This information applies to candidates whom we approach in the course of recruitment consulting and placement or who apply to us. If we search for candidates on behalf of a company for its own positions (recruitment process outsourcing), that company is the controller and we process your data as its processor. In this case, we inform you on behalf of that company when we first contact you.
The controller is the company through whose brand we contact you:
alphacoders GmbH, Am Sandtorkai 48, 20457 Hamburg, Germany, e-mail: datenschutz@ctg-consulting.com
The companies of the CareerTeam Group use a shared recruiting platform and are joint controllers for processing in recruiting (Art. 26 GDPR, see section XI): CTG Consulting GmbH (with the brands Scalable Talent and Findus Finds), CareerTeam GmbH (with the brand Benomik), PALTRON GmbH, Numeris Consulting GmbH, Sinceritas GmbH, alphacoders GmbH and Foxio Consulting GmbH, each at Am Sandtorkai 48, 20457 Hamburg, Germany, and CareerTeam Schweiz GmbH, Weinplatz 10, 8001 Zurich, Switzerland.
Data protection officer for all companies named above:
ARTANA Digital GmbH, Prof. Dr. Christian Rauda, Alstertwiete 3, 20099 Hamburg, Germany, phone +49 40 537 981 260, e-mail: data.security.officer@alphacoders.de, www.artana.law
We process your data in order to match suitable candidates – individually or as a team – with companies that want to fill a position.
• Direct approach without a prior application, including the monitoring of career changes (section IV): Art. 6(1)(f) GDPR. Our legitimate interest is to approach candidates individually and at a suitable time, offer them suitable positions and fill our clients' vacancies.
• Application and ongoing placement process: Art. 6(1)(b) GDPR (pre-contractual steps and performance of the placement relationship).
• Inclusion in the group's candidate database beyond the specific process and special categories of personal data you provide voluntarily (e.g. information on a severe disability): your consent, Art. 6(1)(a) and Art. 9(2)(a) GDPR. You can withdraw your consent at any time with effect for the future.
• Recording and transcription of video interviews: only with your consent, Art. 6(1)(a) GDPR (see section VII).
• Contact via WhatsApp: only with your express consent, Art. 6(1)(a) GDPR (see section VI).
• Usage analysis and feature management in our candidate portal: only with your consent, Section 25(1) TDDDG, Art. 6(1)(a) GDPR (see section VII).
Name; profile link (e.g. LinkedIn, XING); profile photo from your public professional profiles; current and previous positions and employers; career history; skills, qualifications and languages; location; business contact details and – if you provide them – private contact details; salary ranges estimated by the provider Coresignal; information on career changes (e.g. a change of employer); search terms (skill tags) through which we found you; status and history of our contacts (e.g. contacted, response, interest, interview); the content of our messages with you (LinkedIn, XING, e-mail, WhatsApp); notes from conversations and – with your consent – recordings and transcripts of video interviews; documents you send us (e.g. CV, references); the assessment of fit we produce (section V); your consents and objections.
Where we do not collect the data from you directly, it comes from the following sources:
• publicly accessible professional profiles on career networks, in particular LinkedIn and XING, including profile photos, and other publicly accessible professional platforms and websites (e.g. GitHub, Stack Overflow, personal websites);
• search results and message histories from XING TalentManager that our recruiters transfer via a browser extension of our recruiting platform;
• XING profiles that we retrieve via the service provider Bright Data (Bright Data Ltd., Israel);
• licensed profile data compiled from publicly accessible professional profiles by the provider Coresignal (Coresignal UAB, Vilnius, Lithuania), including profile photos and salary estimates derived from them. Coresignal also informs us about career changes (e.g. a change of employer) of persons in our candidate database;
• for physicians (Sinceritas brand): commercially acquired directories of hospitals and clinics containing business contact details.
We inform you about this processing no later than at our first contact with you. You may object to the monitoring of career changes at any time.
We use AI language models to evaluate and summarise CVs and profiles, compare profile data with the requirements of a position, summarise interview transcripts and search our candidate database. For this we use Google Vertex AI (Gemini models) exclusively in EU regions. When comparing a profile with a position, the system produces an assessment of fit (score and reasoning). This constitutes profiling within the meaning of Art. 4(4) GDPR.
Our recruiters can also use the AI assistant Claude (Anthropic) with company accounts via a protected interface of our platform, for example to summarise candidate profiles. Anthropic processes the data as a processor and stores it in the USA (see section IX).
No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place: whether you are contacted or presented to a client is always decided by a recruiter. The models are not trained with your data. The legal basis is Art. 6(1)(f) GDPR or, if you have applied, Art. 6(1)(b) GDPR. You may object to this processing at any time and request an explanation of the assessment.
• LinkedIn: messages via our recruiters' accounts. The technical connection is provided by Unipile (Unipile SAS, France), which processes the login credentials of the recruiter accounts and incoming and outgoing messages for this purpose.
• XING: messages via XING TalentManager.
• E-mail: a brief, job-related first contact, Art. 6(1)(f) GDPR. We send e-mails on behalf of the respective brand via the Mailjet service (processing in the EU). Every e-mail contains a notice of your right to object and an unsubscribe option.
• Telephone: a brief, job-related first contact, Art. 6(1)(f) GDPR.
• WhatsApp: only after your express prior consent (Art. 6(1)(a) GDPR), which we log. The technical connection is provided by Unipile. The provider of WhatsApp is Meta Platforms Ireland Ltd., Dublin, Ireland. Data may be transferred to the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. You can withdraw your consent at any time, e.g. by replying "STOP".
You can object to being contacted at any time – informally by e-mail to datenschutz@ctg-consulting.com, by replying to our message or via the unsubscribe link in our messages and in the candidate portal.
When we contact you, you receive a personal link to our candidate portal; we send login links by e-mail via the Mailgun service (EU region). In the portal you can view information on the position, upload documents, book appointments (via Google Workspace appointment scheduling) and send us messages. We log your consents and objections as evidence (Art. 7(1) GDPR). The legal basis is Art. 6(1)(b) GDPR and, for voluntary information, your consent (Art. 6(1)(a) GDPR).
Only if you consent in the portal do we analyse its use with Amplitude and manage features with Reflag. Both services receive only pseudonymous identifiers, no names; the data is processed in the EU. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw in the portal at any time.
We conduct video interviews via Google Meet. Only if you consent orally at the beginning of the conversation do we record it and have it transcribed in order to document and summarise its content; we document your consent. We delete the recording once the transcript has been created, at the latest after 30 days; we store the transcript together with the other process data (section X).
• Internal: only the staff of the responsible company who handle the respective position. Within the shared platform, data is separated by brand.
• Clients: potential employers only receive your data after you have agreed to it being passed on.
• Service providers (processors under Art. 28 GDPR):
– Google Cloud EMEA Ltd., Dublin, Ireland – operation of our recruiting platform (region Belgium, europe-west1), AI service Vertex AI (EU regions), Google Maps Platform (location data only, to calculate distances), Google Workspace (e-mail, calendar and appointment scheduling, documents, video conferencing with Google Meet including recording and transcription);
– Elasticsearch B.V., Amsterdam, Netherlands (Elastic Cloud) – search function of the recruiting platform, region Belgium;
– Mailjet SAS, Paris, France (Sinch Mailjet) – sending e-mails, processing in the EU;
– Mailgun Technologies, Inc., USA (Sinch Mailgun) – sending login links and receiving e-mail replies, EU region;
– Unipile SAS, France – connection of LinkedIn and WhatsApp;
– Bright Data Ltd., Israel – retrieval of XING profiles;
– Anthropic, PBC, San Francisco, USA – AI assistant Claude with company accounts, storage in the USA;
– Amplitude, Inc., USA – usage analysis in our portals (only with consent), EU data centre;
– Functional Software, Inc. (Sentry), USA – error analysis of our applications, processing in the EU;
– Bucket ApS (Reflag), Copenhagen, Denmark – feature management in our portals (only with consent, pseudonymous identifiers), processing in the EU;
– Supabase, Inc., USA – database of internal recruiting tools, hosted in Frankfurt am Main;
– Vercel Inc., USA – hosting of internal recruiting tools, region Frankfurt am Main;
– Hetzner Online GmbH, Gunzenhausen, Germany – servers for our workflow automation, located in Germany;
– Pipedrive OÜ, Tallinn, Estonia – customer relationship management;
– Sinceritas brand only: eRecruiter GmbH – applicant management system.
Our recruiting platform and our service providers generally store and process your data in the EU. Transfers outside the EU/EEA only take place where there is an adequacy decision of the European Commission (e.g. for Israel, Switzerland or US companies certified under the EU-U.S. Data Privacy Framework) or where appropriate safeguards exist, in particular EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). This concerns:
• the AI assistant Claude (Anthropic, PBC, USA): storage in the USA on the basis of EU Standard Contractual Clauses;
• the retrieval of XING profiles via Bright Data in Israel (adequacy decision);
• WhatsApp (Meta, EU-U.S. Data Privacy Framework);
• support and maintenance access by the US companies of individual service providers (Google, Mailgun, Amplitude, Sentry, Supabase, Vercel) to data stored in the EU (EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses).
If we present you to a client outside the EU, we will inform you of the recipient and the country beforehand.
We delete your data once the collaboration in the recruiting process ended more than six months ago, no consent to further storage exists and there is no legitimate interest in storage. Such a legitimate interest exists
• for data you have published on career networks (e.g. name, profile link, position, employer), the search terms through which we found you and the status of our contacts, for as long as your profile is publicly accessible;
• for data we need to prove a placement to our clients, until the three-year limitation period expires.
If you have consented to the processing of special categories of personal data and withdraw this consent, we delete this data without undue delay unless a legal obligation prevents this. We delete recordings of video interviews as described in section VII; we delete transcripts, profile photos and salary estimates together with the other profile data.
• The companies named in section I jointly determine the purposes and means of processing in recruiting and client acquisition and use a shared recruiting platform.
• Each company provides the information required under Art. 13 and 14 GDPR and ensures the lawfulness of its processing.
• You can exercise your rights against any of the companies involved; the companies forward your request to one another.
• Personal data breaches are notified by the company in whose sphere the breach occurred, or by CTG Consulting GmbH if this is unclear.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent (Art. 7(3)). You can lodge a complaint with a data protection supervisory authority, in particular the Hamburg Commissioner for Data Protection and Freedom of Information.
Right to object (Art. 21 GDPR): Where we process your data on the basis of Art. 6(1)(f) GDPR – in particular for direct approaches, the monitoring of career changes and AI-assisted processing – you may object to this processing at any time. We will then no longer process your data for these purposes.
Further details can be found in the privacy policy of the respective company: CTG Consulting GmbH – www.ctg-consulting.com/datenschutz; CareerTeam GmbH – www.careerteam.de/datenschutz; CareerTeam Schweiz GmbH – www.careerteam.ch/datenschutz; PALTRON GmbH – www.paltron.com/privacy-policy; Numeris Consulting GmbH – www.numeris-consulting.de/datenschutz; Sinceritas GmbH – www.sinceritas.com/datenschutz; alphacoders GmbH – www.alphacoders.de/datenschutz; Foxio Consulting GmbH – www.foxio.com/datenschutz.
As of October 2026
