In the following, we provide information about the collection of personal data when using
- our website https://www.tagliabuepartners.com/
- our profiles in social media
Personal data is any data that can be related to a specific natural person, such as their name or IPaddress.
1.1 Contact details
The controller within the meaning of Art. 4 para. 7 EU General Data Protection Regulation (GDPR) is MTP Executive Search GmbH, Gessnerallee 28, Zurich, Switzerland, email: info@mtpartners.ch. We are legally represented by Mirko Tagliabue and by our Data Protection Officer Martin Bastius, who can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin,www.heydata.eu, E-Mail: datenschutz@heydata.eu.
1.2 Scope of data processing, processing purposes and legal bases
We detail the scope of data processing, processing purposes and legal bases below. In principle, the following come into consideration as the legal basis for data processing:
- Art. 6 para. 1 s. 1 lit. a GDPR serves as our legal basis for processing operations for which we obtain consent.
- Art. 6 para. 1 s. 1 lit. b GDPR is the legal basis insofar as the processing of personal data is necessary for the performance of a contract, e.g. if a site visitor purchases a product from us or we perform a service for them. This legal basis also applies to processing that is necessary for pre-contractual measures, such as in the case of inquiries about our products or services.
- Art. 6 para. 1 s. 1 lit. c GDPR applies if we fulfill a legal obligation by processing personal data, asmay be the case, for example, in tax law.
- Art. 6 para. 1 s. 1 lit. If GDPR serves as the legal basis, we can rely on legitimate interests to process personal data, e.g. for cookies that are necessary for the technical operation of our website.
1.3 Data processing outside the EEA
Insofar as we transfer data to service providers or other third parties outside the EEA, the security of the data during the transfer is guaranteed by adequacy decisions of the EU Commission, insofar as they exist (e.g. for Great Britain, Canada and Israel) (Art. 45 para. 3 GDPR).In the case of data transfer to service providers in the USA, the legal basis for the data transfer is anadequacy decision of the EU Commission if the service provider has also certified itself under the EU USData Privacy Framework.In other cases (e.g. if no adequacy decision exists), the legal basis for the data transfer are usually, i.e.unless we indicate otherwise, standard contractual clauses. These are a set of rules adopted by the EU Commission and are part of the contract with the respective third party. According to Art. 46 para. 2 lit.b GDPR, they ensure the security of the data transfer. Many of the providers have given contractualguarantees that go beyond the standard contractual clauses to protect the data. These include, for example, guarantees regarding the encryption of data or regarding an obligation on the part of the third party to notify data subjects if law enforcement agencies wish to access the respective data.
1.4 Storage duration
Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as they are no longer required for their intended purpose and no legal obligations to retain data conflict with the deletion. If the data are not deleted because they are required for other and legally permissible purposes, their processing is restricted, i.e. the data are blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.
1.5 Rights of data subjects
Data subjects have the following rights against us with regard to their personal data:
- Right of access,
- Right to correction or deletion,
- Right to limit processing,
- Right to object to the processing ,
- Right to data transferability,
- Right to revoke a given consent at any time .
Data subjects also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of their personal data. In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) is responsible for this. The contact details are as follows: Federal Data Protection and Information Commissioner (FDPIC) Feldeggweg 1 CH - 3003 BernSwitzerlandThe contact details of the cantonal data protection authorities (which may also be responsible in certaincases) and the FDPIC can be found, for example, on the FDPIC website or on the website of the German Federal Commissioner for Data Protection and Freedom of Information athttps://www.bfdi.bund.de/ SharedDocs/ Adressen/ DE/ Europaeische Datenschutzbeauftragte/ Schweiz.html.
1.6 Obligation to provide data
Within the scope of the business or other relationship, customers, prospective customers, or third parties need to provide us with personal data that is necessary for the establishment, execution, and termination of a business or other relationship or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude the contract or to provide a service or will no longer be able to perform an existing contract or other relationship. Mandatory data are marked as such.
1.7 No automatic decision making in individual cases
As a matter of principle, we do not use a fully automated decision-making process in accordance witharticle 22 GDPR to establish and implement the business or other relationship. Should we use these procedures in individual cases, we will inform of this separately if this is required by law.
1.8 Making contact
When contacting us, e.g. by e-mail or telephone, the data provided to us (e.g. names and e-mail addresses) will be stored by us in order to answer questions. The legal basis for the processing is our legitimate interest (Art. 6 para. 1 s. 1 lit. f GDPR) to answer inquiries directed to us. We delete the data accruing in this context after the storage is no longer necessary or restrict the processing if there are legal retention obligations.
2.1 Notice for website visitors
Our website uses technologies such as cookies or similar storage technologies to store information on the end device of users or to access information already stored there (e.g. IP addresses or device identifiers). The specific types of information concerned are described in more detail in the sections below.
The storage of information and access to it are carried out on the basis of the following legal grounds: Service necessity:
- Where storage or access is technically necessary in order to provide a serviceexpressly requested by the user (e.g. to use a chat function or to ensure the security and stability of the website), the processing is based on Article 5(3) sentence 2 of the ePrivacy Directive inconjunction with Article 6(1)(f) GDPR (legitimate interest) or – depending on national implementation – based on the corresponding provisions of the applicable Member State.
- Consent-required activities: In all other cases, storage and access will only take place if the user has given prior and explicit consent. The legal basis for this is Article 5(3), sentence 1 of the ePrivacy Directive in conjunction with Article 6(1)(a) GDPR, sentence 1 of the ePrivacy Subsequent processing of personal data is carried out solely on the basis of the provisions of the GDPR and, where applicable, additional national data protection laws.
2.2 Informative use of our website
During the informative use of the website, i.e. when site visitors do not separately transmit information to us, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This is our legitimate interest, so that the legal basis is Art. 6 para. 1s. 1 lit. f GDPR.
These data are:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transferred in each case
- Website from which the request comes
- Browser
- Operating system and its interface
- Language and version of the browser software.
This data is also stored in log files. They are deleted when their storage is no longer necessary, at thelatest after 14 days.
2.3 Web hosting and provision of the website
Our website is hosted by Webflow. The provider is Webflow, Inc., 398 11th St., Floor 2, San Francisco, CA94103, USA. In doing so, the provider processes the personal data transmitted via the website, e.g.content, usage, meta/communication data or contact data in the USA. Further information can be found in the provider's privacy policy at https://webflow.com/legal/eu-privacy-policy.
It is our legitimate interest to provide a website, so the legal basis of the described data processing is Art. 6 para. 1 s. 1 lit. f GDPR.
The legal basis of the transfer to a country outside the EEA are adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.
2.4 Third parties
2.4.1 Google Analytics
We use Google Analytics for analytics. The provider is Google LLC, 1600 Amphitheatre ParkwayMountain View, CA 94043, USA. The provider processes usage data (e.g. web pages visited, interest incontent, access times), meta/communication data (e.g. device information, IP addresses) in the USA inthe USA.The legal basis for the processing is Art. 6 para. 1 s. 1 lit. a GDPR . The processing is based on consent.Data subjects may revoke their consent at any time by contacting us, for example, using the contactdetails provided in our privacy policy. The revocation does not affect the lawfulness of the processinguntil the revocation.The transfer of personal data to a country outside the EEA takes place on the legal basis adequacydecision. The security of the data transferred to the third country (i.e. a country outside the EEA) isguaranteed because the EU Commission has decided as part of an adequacy decision in accordancewith Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.The data will be deleted when the purpose for which it was collected no longer applies and there is noobligation to retain it. Further information is available in the provider's privacy policy athttps://business.safety.google/privacy/.
2.4.2 heyData
We have integrated a data protection seal on our website. The provider is heyData GmbH,Schützenstraße 5, 10117 Berlin, Germany. The provider processes meta/communication data (e.g. IPaddresses) in the EU.The legal basis of the processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest in providingwebsite visitors with confirmation of our data privacy compliance. At the same time, the provider has alegitimate interest in ensuring that only customers with existing contracts use its seals, which is why amere image copy of the certificate is not a viable alternative as confirmation.As the data is masked after collection, there is no possibility to identify website visitors. Furtherinformation is available in the privacy policy of the provider at https://heydata.eu/en/privacy-policy .
Für betroffene Personen, die sich bei uns bewerben oder die wir im Zusammenhang mit Suchaufträgen kontaktieren, gelten zusätzlich die folgenden Bestimmungen gemäß Artikel 13 und 14 der DSGVO. Insbesondere verarbeiten wir Stammdaten und Kontaktinformationen wie Vor- und Nachnamen sowie berufliche Kontaktdaten. Darüber hinaus verarbeiten wir Daten zum beruflichen Werdegang, insbesondere Informationen aus Lebensläufen, Bildungsabschlüsse, Arbeitszeugnisse sowie Angaben zu Qualifikationen und früheren Positionen. Wir erheben diese Daten entweder direkt von den betroffenen Personen oder aus öffentlich zugänglichen Quellen, wie z. B. beruflichen sozialen Netzwerken (z. B. LinkedIn), zu Recherche- und Identifizierungszwecken. Darüber hinaus werden kandidatenspezifische Daten wie Gehaltshistorie, Gehaltsvorstellungen, Kündigungsfristen und Verfügbarkeit sowie Leistungs- und Bewertungsdaten aus Vorstellungsgesprächen und Assessments verarbeitet. Sofern die betroffenen Personen eine gesonderte Einwilligung gemäß Art. 6 Abs. 1 lit. a DSGVO erteilt haben, umfasst dies auch Aufzeichnungen sowie KI-gestützte Transkripte und Analysen von Video-Vorstellungsgesprächen durch den Anbieter Metaview.
Die Datenverarbeitung dient der Identifizierung geeigneter Kandidaten, der Durchführung des Bewerbungsverfahrens und der Aufnahme eines Arbeitsverhältnisses. Rechtsgrundlage für die beschriebene Datenverarbeitung ist Art. 6 Abs. 1 lit. b DSGVO (vorvertragliche Maßnahmen) und Art. 6 Abs. 1 lit. f DSGVO (unser berechtigtes Interesse an der Besetzung offener Stellen für unsere Kunden). Wenn Sie in unseren Talentpool aufgenommen werden, werden Ihre Daten auf Grundlage unseres berechtigten Interesses an der langfristigen Karriereberatung gemäß Art. 6 Abs. 1 lit. f DSGVO gespeichert.
Innerhalb unseres Unternehmens haben nur befugte Personen Zugriff auf diese Daten. Für die interne Koordination nutzen wir den Kommunikationsdienst Slack. Zur Unterstützung unserer Rechercheaktivitäten beschäftigen wir ein internes Team an unserem Standort in Indien. Der Zugriff erfolgt ausschließlich über verschlüsselte Cloud-Systeme ohne lokale Speicherung vor Ort. Rechtsgrundlage für die Datenübermittlung sind die Standardvertragsklauseln gemäß Art. 46 Abs. 2 Buchstabe c DSGVO, da für Indien keine Angemessenheitsentscheidung vorliegt. Wir nutzen zudem das cloudbasierte ATS/CRM-System Ezekia zur Verwaltung unserer Kundenkonten und Kandidatenprofile. Die Anbieter unserer Softwarelösungen (Ezekia, Metaview, Slack, Google Workspace) agieren gemäß Artikel 28 DSGVO als Auftragsverarbeiter in unserem Auftrag.
Sofern nicht ausdrücklich anders angegeben, werden die Daten gelöscht, sobald sie zur Erreichung des Zwecks, für den sie erhoben wurden, nicht mehr erforderlich sind. Da unser Geschäftsmodell auf einer langfristigen Karrierebegleitung basiert, speichern wir Daten in unserem Talentpool so lange, wie es zur Ermöglichung zukünftiger Karrieremöglichkeiten angemessen ist, es sei denn, die betroffene Person verlangt eine vorzeitige Löschung. Im Falle einer Ablehnung für einen bestimmten Auftrag speichern wir die Daten für einen Zeitraum von bis zu 6 Monaten zur Abwehr etwaiger Rechtsansprüche, sofern die Person nicht in den Talentpool aufgenommen wurde.
Wir sind in sozialen Netzwerken vertreten, um dort unsere Organisation und unsere Dienstleistungen vorzustellen. Die Betreiber dieser Netzwerke verarbeiten regelmäßig die Daten ihrer Nutzer zu Werbezwecken. Unter anderem erstellen sie anhand des Online-Verhaltens Nutzerprofile, die beispielsweise dazu dienen, auf den Seiten der Netzwerke und an anderer Stelle im Internet Werbung anzuzeigen, die den Interessen der Nutzer entspricht. Zu diesem Zweck speichern die Betreiber der Netzwerke Informationen zum Nutzerverhalten in Cookies auf den Computern der Nutzer. Darüber hinaus kann nicht ausgeschlossen werden, dass die Betreiber diese Informationen mit anderen Daten zusammenführen. Weitere Informationen sowie Hinweise dazu, wie der Verarbeitung durch die Betreiber der Seiten widersprochen werden kann, finden Nutzer in den unten aufgeführten Datenschutzerklärungen der jeweiligen Betreiber. Es ist zudem möglich, dass sich die Betreiber oder deren Server in Nicht-EU-Ländern befinden, sodass sie Daten dort verarbeiten. Dies kann zu Risiken für die Nutzer führen, z. B. weil die Durchsetzung ihrer Rechte erschwert wird oder weil staatliche Stellen auf die Daten zugreifen. Wenn Nutzer der Netzwerke über unsere Profile Kontakt mit uns aufnehmen, verarbeiten wir die uns übermittelten Daten, um die Anfragen zu beantworten. Dies ist unser berechtigtes Interesse, sodass die Rechtsgrundlage Art. 6 Abs. 1 S. 1 lit. f DSGVO ist.
4.1 LinkedIn
Wirunterhalten ein Profil auf LinkedIn. Betreiber ist die LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Irland. Die Datenschutzerklärung finden Sie hier: https://https://www.linkedin.com/legal/privacy-policy?_l=de_DE. Eine Möglichkeit, der Datenverarbeitung zu widersprechen, besteht über die Einstellungen für Werbung: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
Wir behalten uns das Recht vor, diese Datenschutzerklärung mit Wirkung für die Zukunft zu ändern. Die aktuelle Fassung ist jederzeit hier abrufbar.
Sollten Sie Fragen oder Anmerkungen zu dieser Datenschutzerklärung haben, können Sie sich gerne über die oben angegebenen Kontaktdaten an uns wenden.