Privacy Policy

1. Introduction

Below we provide information about the processing of personal data in connection with

the use of our website q-talent.eu
our recruiting services (active sourcing, applicant management, candidate placement)
the use of our profiles on social media and sourcing platforms
the business relationship with our clients and business partners

Personal data is any data that can be related to a specific natural person, e.g. name, email address, or IP address.

1.1. Controller and contact details

The controller within the meaning of Art. 4(7) of the EU General Data Protection Regulation (GDPR) is:

Sonja Gamsjäger – Q-TALENT
Obgrün 21
8264 Großwilfersdorf
Austria
Email: sonja.gamsjaeger@q-talent.eu

For all data protection inquiries, you can reach us at: datenschutz@q-talent.eu

We have not appointed a data protection officer, as we are not obliged to do so under Art. 37 GDPR.

1.2. Scope of data processing, purposes, and legal bases

The scope of the data processing, the purposes, and the legal bases are set out in detail further below. In principle, the following legal bases may apply to data processing:

Art. 6(1) sentence 1 lit. a GDPR serves as the legal basis for processing operations for which we obtain consent.
Art. 6(1) sentence 1 lit. b GDPR is the legal basis where the processing of personal data is necessary for the performance of a contract, e.g. when a candidate or client enters into a placement process or a business relationship with us. This legal basis also applies to pre-contractual measures, for example in the case of inquiries about our services.
Art. 6(1) sentence 1 lit. c GDPR applies where we fulfill a legal obligation through the processing of personal data, as may be the case, for example, under tax law.
Art. 6(1) sentence 1 lit. f GDPR serves as the legal basis where we can rely on legitimate interests for the processing of personal data, e.g. for our active sourcing or for cookies that are necessary for the technical operation of our website.

1.3. Data processing outside the EEA

Insofar as we transfer data to service providers or other third parties outside the European Economic Area (EEA), adequacy decisions of the EU Commission pursuant to Art. 45(3) GDPR guarantee the security of the data during the transfer, where such decisions exist.

For data transfers to service providers in the USA, the transfer is based on the EU-US Data Privacy Framework (adequacy decision of the EU Commission dated 10 July 2023), provided the respective service provider is certified under this framework. The US service providers we use (Google, Anthropic, SmartSuite, Calendly, as well as the Manatal hosting at AWS) are, to the best of our knowledge, DPF-certified.

In other cases (e.g. where no adequacy decision exists), the legal basis for the data transfer is the Standard Contractual Clauses (SCCs) pursuant to Art. 46(2) lit. c GDPR. These are a set of rules adopted by the EU Commission and become part of the contracts with the respective service providers.

1.4. Storage period

Unless expressly stated otherwise within this privacy policy, the data stored by us is deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent deletion. Insofar as the data is not deleted because it is required for other and legally permissible purposes, its processing is restricted, i.e. the data is blocked and not processed for other purposes. This applies, for example, to data that we must retain for commercial or tax law reasons.

We state specific retention periods in the respective sections on the individual processing activities.

1.5. Rights of data subjects

Data subjects have the following rights vis-à-vis us with regard to the personal data concerning them:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to object to processing (Art. 21 GDPR), in particular for processing based on legitimate interests
Right to data portability (Art. 20 GDPR)
Right to withdraw a consent given at any time (Art. 7(3) GDPR), whereby the lawfulness of the processing carried out up to the withdrawal remains unaffected

Data subjects also have the right to lodge a complaint with a data protection supervisory authority about the processing of their personal data. For Austria, this is the Austrian Data Protection Authority (www.dsb.gv.at).

1.6. Obligation to provide data

Within the scope of a business relationship or other relationship, clients, candidates, interested parties, or third parties must provide us only with the personal data that is necessary for the establishment, performance, and termination of the business relationship, or that we are legally obliged to collect. Without this data, we will generally have to decline the conclusion of a contract or the provision of a service, or will no longer be able to perform an existing contract.

Mandatory information is marked as such.

1.7. No automated decision-making in individual cases

For the establishment and performance of a business relationship or other relationship, we generally do not use fully automated decision-making pursuant to Art. 22 GDPR. AI tools that we use in profile creation and decision preparation serve exclusively as support; the final decision is always made by a human. Should we use fully automated procedures in individual cases, we will provide separate information about this, where this is legally required.

1.8. Contacting us

When you contact us, e.g. by email, telephone, or via LinkedIn, Xing, or WhatsApp, the data you provide to us (e.g. name, email address, telephone number, content of the inquiry) is stored by us in order to answer questions and to initiate or continue our business relationship.

The legal basis for the processing is our legitimate interest (Art. 6(1) sentence 1 lit. f GDPR) in answering inquiries addressed to us, or, in the case of pre-contractual measures, Art. 6(1) sentence 1 lit. b GDPR. We delete the data arising in this context once its storage is no longer necessary, or we restrict the processing if statutory retention obligations exist.

2. Data processing on our website

2.1. Cookie notice and consent management

Our website stores information on the terminal equipment of website visitors (e.g. cookies) or accesses information already stored on the terminal equipment (e.g. IP addresses). The specific information involved is set out in the following sections.

This storage and access take place on the basis of:

technical necessity, insofar as this storage or access is strictly necessary for us to provide the service of our website expressly requested by the website visitor (e.g. to ensure the IT security of our website), or
the consent of website visitors via our consent management tool.

To manage consents, we use the Complianz tool. The provider is Complianz B.V., Kalmarweg 14-5, 9723 JG Groningen, Netherlands. Complianz stores the consents given locally in the user’s browser. No data transfer to third parties takes place. The legal basis for using Complianz is Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest lies in the proper documentation and management of our website visitors‘ consents.

Non-essential cookies and tracking technologies load exclusively after active consent of the website visitors.

2.2. Informational use of the website

For the informational use of the website, i.e. when visitors do not separately provide us with information, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This constitutes our legitimate interest, so that the legal basis is Art. 6(1) sentence 1 lit. f GDPR.

This data is:

IP address
date and time of the request
time zone difference to Greenwich Mean Time (GMT)
content of the request (specific page)
access status / HTTP status code
amount of data transferred in each case
website from which the request comes
browser
operating system and its interface
language and version of the browser software

This data is also stored in log files. It is deleted when its storage is no longer necessary, at the latest after 14 days.

2.3. Web hosting and provision of the website

Our website is hosted by World4You Internet Services GmbH, Hafenstraße 35, 4020 Linz, Austria. The provider processes the personal data transmitted via the website (e.g. content, usage, meta/communication data, or contact data) in the EU. A data processing agreement pursuant to Art. 28 GDPR exists with World4You.

Further information can be found in the provider’s privacy policy at https://www.world4you.com/unternehmen/datenschutzerklaerung.

It is our legitimate interest to provide a website, so that the legal basis for the data processing described is Art. 6(1) sentence 1 lit. f GDPR.

2.4. Booking of appointments

Website visitors can book appointments with us on our website. We use two different tools for this, depending on the type of appointment:

Calendly for initial meetings with potential clients: The provider is Calendly LLC, 271 17th St NW, Suite 1000, Atlanta, GA 30363, USA. Calendly processes data in the USA. Calendly is certified under the EU-US Data Privacy Framework; the data transfer to the USA is based on the adequacy decision of the EU Commission. A data processing agreement pursuant to Art. 28 GDPR exists with Calendly. Further information: https://calendly.com/legal/privacy-notice
Google Bookings for general appointments, in particular initial meetings with candidates as well as informal conversations and introductory meetings: The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be processed in the USA. Google is certified under the EU-US Data Privacy Framework. A data processing agreement pursuant to Art. 28 GDPR exists with Google. Further information: https://policies.google.com/privacy

When booking an appointment, in addition to the data you enter (name, email address, telephone number, any free-text information, consent to transcription), we also process meta and communication data (e.g. IP address, timestamp).

We have a legitimate interest in offering interested parties and candidates a user-friendly way to arrange appointments. The legal basis for the data processing is Art. 6(1) sentence 1 lit. f GDPR as well as, in the case of pre-contractual measures, Art. 6(1) sentence 1 lit. b GDPR.

2.5. Technically necessary cookies

Our website uses cookies. Cookies are small text files that are stored in the web browser on a site visitor’s device. Insofar as these cookies are necessary for the operation of our website or its functions (hereinafter „technically necessary cookies“), the legal basis for the associated data processing is Art. 6(1) sentence 1 lit. f GDPR. We have a legitimate interest in providing clients and other site visitors with a functional website.

Specifically, we use technically necessary cookies for the following purposes:

cookies that retain language settings
cookies that store the status of the cookie consent (Complianz)

2.6. Web analysis, tracking, and marketing tools

We use the following tools exclusively on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR. They do not become active before you have consented via our cookie banner. You can withdraw your consent at any time via the cookie settings.

2.6.1. Google Tag Manager

We use the Google Tag Manager to manage the tracking tools used on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google Tag Manager itself does not collect any personal data. It serves exclusively to manage and deliver other tags. Data processing only takes place via the tools delivered through the Tag Manager, which are listed individually below.

Data may be processed in the USA. Google is certified under the EU-US Data Privacy Framework. A data processing agreement pursuant to Art. 28 GDPR exists with Google.

Further information: https://policies.google.com/privacy

2.6.2. Google Analytics

We use Google Analytics to analyze the usage behavior of our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). The provider processes usage data (e.g. visited web pages, interest in content, access times) and meta/communication data (e.g. device information, IP addresses) in the USA.

The transfer of personal data to the USA is based on the adequacy decision of the EU Commission. Google is certified under the EU-US Data Privacy Framework. A data processing agreement pursuant to Art. 28 GDPR exists with Google.

The data is deleted when the purpose of its collection no longer applies and no retention obligation prevents this. Further information: https://policies.google.com/privacy

2.6.3. Google Search Console

We use the Google Search Console to analyze the performance of our website in Google search. The provider is Google Ireland Limited. The Search Console collects aggregated data on search queries, click-through rates, and visibility. Direct processing of personal data of website visitors does not generally take place.

Further information: https://policies.google.com/privacy

2.6.4. LinkedIn Insight Tag

We use the LinkedIn Insight Tag to analyze conversions and for targeted advertising. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (parent company: LinkedIn Corporation, USA).

The LinkedIn Insight Tag collects data about your visit to our website (e.g. URL, referrer URL, device information, IP address, timestamp) and sends it to LinkedIn. This data is used for advertising purposes and to measure the success of our marketing activities on LinkedIn.

Data may be processed in the USA. LinkedIn is certified under the EU-US Data Privacy Framework. A corresponding agreement on joint controllership pursuant to Art. 26 GDPR exists with LinkedIn for the collection and transfer of the data for advertising purposes.

You can also object to the processing of your data by LinkedIn directly with LinkedIn: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Further information: https://www.linkedin.com/legal/privacy-policy

2.6.5. Meta Pixel (Facebook Pixel)

We use the Meta Pixel to measure the effectiveness of our marketing activities on Meta platforms (Facebook, Instagram) and to deliver targeted advertising. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (parent company: Meta Platforms Inc., USA).

The Meta Pixel collects data about your visit to our website (e.g. visited pages, actions performed, device information, IP address) and sends it to Meta.

Data may be processed in the USA. Meta is certified under the EU-US Data Privacy Framework. A corresponding agreement on joint controllership pursuant to Art. 26 GDPR exists with Meta for the collection and transfer of the data for advertising purposes.

Further information: https://www.facebook.com/privacy/policy

3. Recruiting and placement activity

3.1. Overview

Within the scope of our recruiting activity, we process personal data of candidates in various phases:

identification of potential candidates via publicly available profiles (active sourcing)
inclusion in our applicant management system after initial contact and expression of interest
conducting preliminary conversations and creating internal profiles
placement with our clients

In this section we explain how we handle personal data in each of these phases.

A supplementary, candidate-friendly short version of this information can be found at q-talent.eu/privacy-information-for-talents.

3.2. Active sourcing: identification of potential candidates

We search specifically for suitable candidates on behalf of our clients. To do this, we use publicly available profiles on the following platforms:

LinkedIn
Xing
talent.cloud (karriere.at)
Talentwunder
other publicly available professional profiles and CV databases

Process:

When we think a person might be a good fit for an open position, we first contact them directly on the relevant platform. We ask whether they are interested in a detailed job description.

Only once the person signals interest do we store their data in our applicant management system. Until that point, no stored data about the person exists with us. At the latest with our first follow-up message, the person receives a reference to this privacy policy as well as to q-talent.eu/privacy-information-for-talents.

Categories of data collected:

From the person’s public profile, we collect the following data, insofar as it is contained in the respective profile:

first and last name
professional location (city, country)
current employer and current position
professional background
education
competencies and skills
publicly listed contact details (email address and/or telephone number, insofar as made public by the person themselves)
profile picture
link to the original profile

Purpose of the processing:

Identification of suitable candidates for open positions of our clients, documentation of our sourcing activities to avoid multiple approaches, and preparation of a possible initial contact.

Legal basis:

Art. 6(1) sentence 1 lit. f GDPR (legitimate interest). Our legitimate interest is to identify qualified candidates for our clients and to offer potential candidates suitable career opportunities.

We have carried out a documented balancing of interests and have come to the conclusion that the legitimate interests of the data subjects do not prevail, because exclusively professionally relevant data, published by the persons themselves on professional platforms, is processed, and because the use of the data corresponds to the customary purpose of these platforms (professional networking and career development).

Storage period:

Data of potential candidates with whom no active contact is established, or where no activity has taken place for more than 6 months, is deleted. This deletion takes place within the scope of our monthly cleanup routine. In the case of active contact, further storage is governed by Section 3.3.

Right to object:

You have the right to object to the processing of your data pursuant to Art. 21 GDPR at any time. In the event of an objection, we delete your data without delay, provided no compelling legitimate grounds prevent this. An objection can be made informally by email to datenschutz@q-talent.eu.

3.3. Active candidates

When you respond to our approach or actively contact us (for example by sending a CV, booking an appointment, or applying via our career page), the active phase of the placement begins.

Categories of data collected:

In addition to the data categories listed under 3.2, we process everything you communicate or provide to us:

CV, cover letter, references, further documents
salary expectations, availability, motivation to change jobs
the content of our communication by email, LinkedIn, Xing, WhatsApp, or telephone
the content of our preliminary conversations, insofar as you have consented to transcription
our professional assessment and notes on the placement history

Purpose of the processing:

assessment of your suitability for open positions of our clients
preparation of your introduction to the client
creation of internal profiles with our professional assessment
accompanying you through the placement process (preparation for conversations, negotiation support)
communication and documentation of the course of the placement

Internal Q-TALENT profile:

Based on your CV and our preliminary conversation, we create a two-page internal profile, which we transmit to the respective client together with your CV. Alongside a summary of your qualifications, this profile contains our professional assessment and recommendation regarding your suitability for the specific position. This internal profile is part of our working basis and is not presented to you for prior review.

Legal basis:

Art. 6(1) sentence 1 lit. b GDPR (pre-contractual measure or performance of contract), Art. 6(1) sentence 1 lit. a GDPR (consent, in particular for transcription and talent pool storage), as well as Art. 6(1) sentence 1 lit. f GDPR (legitimate interest in efficient placement).

Should you provide special categories of personal data pursuant to Art. 9 GDPR in your CV or cover letter (for example information on health or religious affiliation), the processing takes place on the basis of your consent pursuant to Art. 9(2) lit. a GDPR. We ask you to provide such information in application documents only if it is actually relevant to the position sought.

Storage period:

6 months after the last activity, if no active placement process is (any longer) underway
24 months in the talent pool, if you have given us your explicit consent for this
longer storage in the case of ongoing placement processes or statutory retention obligations (for example tax law, commission settlement with clients)

3.4. Transfer to clients

When we want to propose you for a specific open position, we speak with you beforehand and obtain your consent. Only then do we transmit your documents to the respective client.

During the transfer, we process the following data:

your CV
the internal Q-TALENT profile created by us
where applicable, further documents provided by you

Transfer route:

via the career portal of the respective client (in this case you receive a confirmation of receipt directly from the client)
by email to the contact person at the client

Legal relationship with the client:

Upon transfer of your data to a client, the client becomes an independent controller within the meaning of Art. 4(7) GDPR. Q-TALENT and the client are not joint controllers within the meaning of Art. 26 GDPR. The client processes your data according to its own privacy policy and within the scope of its own application process.

We do not pass on your data:

to other recruiters
to marketing service providers
to any other third parties without a specific placement context

Legal basis:

Art. 6(1) sentence 1 lit. b GDPR (performance of contract) and Art. 6(1) sentence 1 lit. a GDPR (consent to the introduction to the specific client).

3.5. Application form on our career page

On our career page, which is provided via the Manatal platform, you can apply for specific job advertisements or submit your CV. In doing so, we collect the data you voluntarily provide:

first and last name (mandatory field)
email address (mandatory field)
telephone number (mandatory field, required for candidate communication)
CV (mandatory field)
optional documents and messages

You can additionally give your consent to longer storage in the talent pool (24 months).

Legal basis:

Art. 6(1) sentence 1 lit. b GDPR (pre-contractual measure) as well as, for the talent pool storage, Art. 6(1) sentence 1 lit. a GDPR (consent).

3.6. Service providers used in recruiting

To efficiently manage our recruiting activities, we use software from various service providers. We have concluded data processing agreements pursuant to Art. 28 GDPR with these service providers, insofar as they act as processors within the meaning of the GDPR.

Manatal (applicant management system): Manatal Co., Ltd., 26 Chit Lom Alley, Khwaeng Lumphini, Khet Pathum Wan, Bangkok, 10330, Thailand. The data is hosted at AWS (Amazon Web Services) in the USA. The data transfer to the USA is based on the adequacy decision of the EU Commission within the framework of the EU-US Data Privacy Framework. Further information: https://www.manatal.com/de/privacy-policy
Google Workspace (communication, cloud storage, video calls, transcription): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be processed in the USA. Google is certified under the EU-US Data Privacy Framework.
WhatsApp (messaging): WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. When you actively communicate with us via WhatsApp, the data protection provisions of WhatsApp additionally apply: https://www.whatsapp.com/legal/privacy-policy

3.7. Use of Artificial Intelligence (AI)

At various steps of our recruiting process, AI tools support us. Specifically, we use:

Claude (Anthropic, USA) for text processing, profile creation, CV optimization (only with your explicit consent), and analysis of conversation transcripts
Gemini (Google, EU/USA) for similar purposes

Both providers are certified under the EU-US Data Privacy Framework. We use exclusively business plans with a data processing agreement. This means:

your data is not used to train third-party AI models
no fully automated decision-making pursuant to Art. 22 GDPR takes place
the final decision in the placement process is always made by a human

Legal basis:

Art. 6(1) sentence 1 lit. f GDPR (legitimate interest in efficient processing) as well as Art. 6(1) sentence 1 lit. a GDPR (consent, in particular for CV optimization).

3.8. Transcription of conversations

We offer to transcribe our conversations via Google Meet. The transcription takes place exclusively on the basis of your explicit, prior consent. No audio and no video is recorded, only the spoken text is captured in written form.

Purpose: Concentration on the conversation, ensuring that no important information is lost, basis for the creation of your internal Q-TALENT profile.

Legal basis: Art. 6(1) sentence 1 lit. a GDPR (consent).

Storage location: The transcript is stored on our Google Workspace. Access is granted exclusively to employees of Q-TALENT.

Withdrawal: You can withdraw your consent at any time, even during the conversation. In the event of withdrawal, we delete the transcript without delay. Without consent, we will still conduct the conversation with you completely normally, simply without transcription.

4. Data processing on social media and sourcing platforms

We are present on various social networks and on sourcing platforms in order to present our company, our services, and open positions there, as well as to identify candidates.

The operators of these networks regularly process their users‘ data for their own purposes, in particular for advertising purposes. Among other things, they create user profiles from online behavior, which are used, for example, to show advertising on the networks‘ pages and elsewhere on the internet that corresponds to users‘ interests. To this end, the network operators store information on user behavior in cookies on users‘ devices. It cannot be ruled out that the operators combine this information with further data.

It may be that the operators or their servers are located in non-EU states, so that they process data there. This may result in risks for users, e.g. because the enforcement of their rights is made more difficult or because state authorities access the data.

Further information, as well as notes on how users can object to the processing by the site operators, can be found by users in the privacy policies of the respective operators listed below.

When users of the networks get in touch with us via our profiles, we process the data communicated to us in order to answer the inquiries or to begin the placement process. The legal basis is Art. 6(1) sentence 1 lit. f GDPR (legitimate interest) as well as, in the case of pre-contractual measures, Art. 6(1) sentence 1 lit. b GDPR.

4.1. LinkedIn

We maintain profiles on LinkedIn (personal profiles of our employees as well as a company profile of Q-TALENT). The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

Option to object to advertisements: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

4.2. Xing

We maintain profiles on Xing. The operator is New Work SE, Dammtorstraße 29-32, 20354 Hamburg, Germany.

4.3. karriere.at and talent.cloud

We maintain a company profile on karriere.at as well as a recruiter profile on talent.cloud (sourcing platform of karriere.at GmbH). The operator is karriere.at GmbH, Lederergasse 32, 4020 Linz, Austria.

4.4. Talentwunder

We use Talentwunder as a sourcing platform. The operator is Talentwunder GmbH, Berlin, Germany. Talentwunder aggregates data from publicly available sources to support recruiting activities.

5. Data processing within the scope of our business relationship with clients

When you, as a representative of a company, work with us as a client, we process personal data for the initiation of the contract, the performance of the contract, and the maintenance of the business relationship.

Categories of data collected:

name, position, contact details (business email, telephone)
company-related information (company name, address, VAT ID)
the content of our communication
contract-related data (mandates, conditions, commission settlement)

Purpose of the processing:

initiation and execution of placement mandates
maintenance of the business relationship
invoicing and commission settlement
fulfillment of tax and legal obligations

Legal basis:

Art. 6(1) sentence 1 lit. b GDPR (performance of contract), Art. 6(1) sentence 1 lit. c GDPR (legal obligations, in particular tax and commercial law), Art. 6(1) sentence 1 lit. f GDPR (legitimate interest in maintaining the business relationship).

Tools used:

To manage our business contacts, we use SmartSuite (SmartSuite LLC, USA). SmartSuite is certified under the EU-US Data Privacy Framework. A data processing agreement pursuant to Art. 28 GDPR exists with SmartSuite. Further information: https://smartsuite.com/legal/privacy-policy

Storage period:

Data from ongoing business relationships is stored for the duration of the business relationship. After termination, the statutory retention obligations apply (generally 7 years for tax-relevant documents).

6. Changes to this privacy policy

We reserve the right to amend this privacy policy with effect for the future. A current version is available at any time at q-talent.eu/privacy-policy.

In the case of material changes to the data processing, we will actively inform you, provided you are one of our candidates or clients.

7. Questions and comments

For questions, comments, or to exercise your data subject rights, we are available at the following contact details:

Email: datenschutz@q-talent.eu
Postal address: Q-TALENT e.U., Sonja Gamsjäger, Obgrün 21, 8264 Großwilfersdorf, Austria

As of: 03.05.2026