In the following, we provide information about the collection of personal data when using
- our website https://www.tagliabuepartners.com/
- our profiles in social media
Personal data is any data that can be related to a specific natural person, such as their name or IPaddress.
1.1 Contact details
The controller within the meaning of Art. 4 para. 7 EU General Data Protection Regulation (GDPR) is MTP Executive Search GmbH, Gessnerallee 28, Zurich, Switzerland, email: info@mtpartners.ch. We are legally represented by Mirko Tagliabue and by our Data Protection Officer Martin Bastius, who can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin,www.heydata.eu, E-Mail: datenschutz@heydata.eu.
1.2 Scope of data processing, processing purposes and legal bases
We detail the scope of data processing, processing purposes and legal bases below. In principle, the following come into consideration as the legal basis for data processing:
- Art. 6 para. 1 s. 1 lit. a GDPR serves as our legal basis for processing operations for which we obtain consent.
- Art. 6 para. 1 s. 1 lit. b GDPR is the legal basis insofar as the processing of personal data is necessary for the performance of a contract, e.g. if a site visitor purchases a product from us or we perform a service for them. This legal basis also applies to processing that is necessary for pre-contractual measures, such as in the case of inquiries about our products or services.
- Art. 6 para. 1 s. 1 lit. c GDPR applies if we fulfill a legal obligation by processing personal data, asmay be the case, for example, in tax law.
- Art. 6 para. 1 s. 1 lit. If GDPR serves as the legal basis, we can rely on legitimate interests to process personal data, e.g. for cookies that are necessary for the technical operation of our website.
1.3 Data processing outside the EEA
Insofar as we transfer data to service providers or other third parties outside the EEA, the security of the data during the transfer is guaranteed by adequacy decisions of the EU Commission, insofar as they exist (e.g. for Great Britain, Canada and Israel) (Art. 45 para. 3 GDPR).In the case of data transfer to service providers in the USA, the legal basis for the data transfer is anadequacy decision of the EU Commission if the service provider has also certified itself under the EU USData Privacy Framework.In other cases (e.g. if no adequacy decision exists), the legal basis for the data transfer are usually, i.e.unless we indicate otherwise, standard contractual clauses. These are a set of rules adopted by the EU Commission and are part of the contract with the respective third party. According to Art. 46 para. 2 lit.b GDPR, they ensure the security of the data transfer. Many of the providers have given contractualguarantees that go beyond the standard contractual clauses to protect the data. These include, for example, guarantees regarding the encryption of data or regarding an obligation on the part of the third party to notify data subjects if law enforcement agencies wish to access the respective data.
1.4 Storage duration
Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as they are no longer required for their intended purpose and no legal obligations to retain data conflict with the deletion. If the data are not deleted because they are required for other and legally permissible purposes, their processing is restricted, i.e. the data are blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.
1.5 Rights of data subjects
Data subjects have the following rights against us with regard to their personal data:
- Right of access,
- Right to correction or deletion,
- Right to limit processing,
- Right to object to the processing ,
- Right to data transferability,
- Right to revoke a given consent at any time .
Data subjects also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of their personal data. In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) is responsible for this. The contact details are as follows: Federal Data Protection and Information Commissioner (FDPIC) Feldeggweg 1 CH - 3003 BernSwitzerlandThe contact details of the cantonal data protection authorities (which may also be responsible in certaincases) and the FDPIC can be found, for example, on the FDPIC website or on the website of the German Federal Commissioner for Data Protection and Freedom of Information athttps://www.bfdi.bund.de/ SharedDocs/ Adressen/ DE/ Europaeische Datenschutzbeauftragte/ Schweiz.html.
1.6 Obligation to provide data
Within the scope of the business or other relationship, customers, prospective customers, or third parties need to provide us with personal data that is necessary for the establishment, execution, and termination of a business or other relationship or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude the contract or to provide a service or will no longer be able to perform an existing contract or other relationship. Mandatory data are marked as such.
1.7 No automatic decision making in individual cases
As a matter of principle, we do not use a fully automated decision-making process in accordance witharticle 22 GDPR to establish and implement the business or other relationship. Should we use these procedures in individual cases, we will inform of this separately if this is required by law.
1.8 Making contact
When contacting us, e.g. by e-mail or telephone, the data provided to us (e.g. names and e-mail addresses) will be stored by us in order to answer questions. The legal basis for the processing is our legitimate interest (Art. 6 para. 1 s. 1 lit. f GDPR) to answer inquiries directed to us. We delete the data accruing in this context after the storage is no longer necessary or restrict the processing if there are legal retention obligations.
2.1 Notice for website visitors
Our website uses technologies such as cookies or similar storage technologies to store information on the end device of users or to access information already stored there (e.g. IP addresses or device identifiers). The specific types of information concerned are described in more detail in the sections below.
The storage of information and access to it are carried out on the basis of the following legal grounds: Service necessity:
- Where storage or access is technically necessary in order to provide a serviceexpressly requested by the user (e.g. to use a chat function or to ensure the security and stability of the website), the processing is based on Article 5(3) sentence 2 of the ePrivacy Directive inconjunction with Article 6(1)(f) GDPR (legitimate interest) or – depending on national implementation – based on the corresponding provisions of the applicable Member State.
- Consent-required activities: In all other cases, storage and access will only take place if the user has given prior and explicit consent. The legal basis for this is Article 5(3), sentence 1 of the ePrivacy Directive in conjunction with Article 6(1)(a) GDPR, sentence 1 of the ePrivacy Subsequent processing of personal data is carried out solely on the basis of the provisions of the GDPR and, where applicable, additional national data protection laws.
2.2 Informative use of our website
During the informative use of the website, i.e. when site visitors do not separately transmit information to us, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This is our legitimate interest, so that the legal basis is Art. 6 para. 1s. 1 lit. f GDPR.
These data are:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transferred in each case
- Website from which the request comes
- Browser
- Operating system and its interface
- Language and version of the browser software.
This data is also stored in log files. They are deleted when their storage is no longer necessary, at thelatest after 14 days.
2.3 Web hosting and provision of the website
Our website is hosted by Webflow. The provider is Webflow, Inc., 398 11th St., Floor 2, San Francisco, CA94103, USA. In doing so, the provider processes the personal data transmitted via the website, e.g.content, usage, meta/communication data or contact data in the USA. Further information can be found in the provider's privacy policy at https://webflow.com/legal/eu-privacy-policy.
It is our legitimate interest to provide a website, so the legal basis of the described data processing is Art. 6 para. 1 s. 1 lit. f GDPR.
The legal basis of the transfer to a country outside the EEA are adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.
2.4 Third parties
2.4.1 Google Analytics
We use Google Analytics for analytics. The provider is Google LLC, 1600 Amphitheatre ParkwayMountain View, CA 94043, USA. The provider processes usage data (e.g. web pages visited, interest incontent, access times), meta/communication data (e.g. device information, IP addresses) in the USA inthe USA.The legal basis for the processing is Art. 6 para. 1 s. 1 lit. a GDPR . The processing is based on consent.Data subjects may revoke their consent at any time by contacting us, for example, using the contactdetails provided in our privacy policy. The revocation does not affect the lawfulness of the processinguntil the revocation.The transfer of personal data to a country outside the EEA takes place on the legal basis adequacydecision. The security of the data transferred to the third country (i.e. a country outside the EEA) isguaranteed because the EU Commission has decided as part of an adequacy decision in accordancewith Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.The data will be deleted when the purpose for which it was collected no longer applies and there is noobligation to retain it. Further information is available in the provider's privacy policy athttps://business.safety.google/privacy/.
2.4.2 heyData
We have integrated a data protection seal on our website. The provider is heyData GmbH,Schützenstraße 5, 10117 Berlin, Germany. The provider processes meta/communication data (e.g. IPaddresses) in the EU.The legal basis of the processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest in providingwebsite visitors with confirmation of our data privacy compliance. At the same time, the provider has alegitimate interest in ensuring that only customers with existing contracts use its seals, which is why amere image copy of the certificate is not a viable alternative as confirmation.As the data is masked after collection, there is no possibility to identify website visitors. Furtherinformation is available in the privacy policy of the provider at https://heydata.eu/en/privacy-policy .
For data subjects who apply to us or whom we contact in connection with search mandates, the following provisions pursuant to Articles 13 and 14 of the GDPR apply in addition. In particular, we process master data and contact information such as first and last names as well as professional contact details. Additionally, we process data regarding professional history, specifically resume information, educational credentials, employment references, and details regarding qualifications and previous positions. We collect this data either directly from the data subjects or from publicly accessible sources, such as professional social networks (e.g., LinkedIn), for research and identification purposes. Furthermore, candidate-specific data such as salary history, salary expectations, notice periods, and availability, as well as performance and evaluation data from interviews and assessments, are processed.If data subjects have provided separate consent pursuant to Art. 6(1)(a) GDPR, this also includes recordings as well as AI-supported transcripts and analyses of video interviews by the provider Metaview.
Data processing serves to identify suitable candidates, conduct the application process, and initiate anemployment relationship. The legal basis for the described data processing is Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (our legitimate interest in filling open positions for our clients). If you are added to our talent pool, your data is stored based on our legitimate interest in providing long-term career counselling pursuant to Art. 6(1)(f) GDPR.
Within our company, only authorised persons have access to this data. We use the communicationservice Slack for internal coordination. We employ an internal team at our location in India to support our research activities. Access is provided exclusively via encrypted cloud systems without local storage on-site. The legal basis for the data transfer is the Standard Contractual Clauses pursuant to Art. 46(2)(c)GDPR, as no adequacy decision exists for India. We also use the cloud-based ATS/CRM system Ezekia to manage our client accounts and candidate profiles. The providers of our software solutions (Ezekia, Metaview, Slack, Google Workspace) act as processors on our behalf in accordance with Article 28 of the GDPR.
Unless expressly stated otherwise, the data will be deleted as soon as it is no longer necessary toachieve the purpose for which it was collected. Since our business model is based on long-term careersupport, we store data in our talent pool for as long as is appropriate for facilitating future careeropportunities, unless the data subject requests early deletion. In the event of a rejection for a specific assignment, we store the data for a period of up to 6 months to defend against any legal claims, provided that the individual has not been included in the talent pool.
We are represented in social media networks in order to present our organization and our services there. The operators of these networks regularly process their users' data for advertising purposes. Among other things, they create user profiles from their online behaviour, which are used, for example,to show advertising on the pages of the networks and elsewhere on the Internet that corresponds to the interests of the users. To this end, the operators of the networks store information on user behaviour in cookies on the users' computers. Furthermore, it cannot be ruled out that the operators merge this information with other data. Users can obtain further information and instructions on how to object to processing by the site operators in the data protection declarations of the respective operators listed below. It is also possible that the operators or their servers are located in non-EU countries, so that they process data there. This may result in risks for users, e.g. because it is more difficult to enforce theirrights or because government agencies access the data.If users of the networks contact us via our profiles, we process the data provided to us in order to respond to the inquiries. This is our legitimate interest, so that the legal basis is Art. 6 para. 1 s. 1 lit. f GDPR.
4.1 LinkedIn
We maintain a profile on LinkedIn. The operator is LinkedIn Ireland Unlimited Company, Wilton Place,Dublin 2, Ireland. The privacy policy is available here: https://https://www.linkedin.com /legal/privacy-policy?_l=de_DE. One way to object to data processing is via the settings for advertisements:https://www.linkedin.com /psettings /guest-controls /retargeting-opt-out.
We reserve the right to change this privacy policy with effect for the future. A current version is always available here.
If you have any questions or comments regarding this privacy policy, please feel free to contact us usingthe contact information provided above.