Website and applicant management · Departer Deutschland GmbH · Last updated: June 2026
Data protection at a glance
This policy explains what happens to your personal data when you visit our website or engage with us as an executive search consultancy. Personal data means any information that can identify you. You will learn which data we collect, for which purposes and on which legal basis we process it, and which rights you have. Part A covers the website, Part B covers applicant management and placement.
------ Part A: Website: responsibility and privacy information ------
1. Controller of the website
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
Departer Deutschland GmbH
Hohe Bleichen 8, 20354 Hamburg, Germany
Represented by the Managing Directors Sabine Higgen and Norman Sterz
E-mail: info@departer.com
2. Data Protection Officer
You can reach our Data Protection Officer at:
Norman Sterz
c/o Departer Deutschland GmbH, Hohe Bleichen 8, 20354 Hamburg
E-mail: datenschutz@departer.com
Interim arrangement; the appointment of an external Data Protection Officer is currently under review.
3. General information, principles and data security
Protecting your personal data is important to us. We process your data exclusively on the basis of statutory provisions (GDPR, the German Federal Data Protection Act (BDSG), the German Telecommunications Digital Services Data Protection Act (TDDDG)). This policy informs you about the nature, scope and purpose of the processing of personal data on our website and about your rights.
Personal data is any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR), such as name, address, e-mail address, telephone number or IP address.
We take technical and organisational measures to protect your data against loss, destruction, manipulation and unauthorised access; data transmission on our website is encrypted (TLS). Please note that data transmission over the internet, for example when communicating by e-mail, can have security gaps. Complete protection of data against access by third parties is not possible.
Note on data transfers to the USA and other third countries: On our website and in our processes we use services from providers that may process data in the USA or other countries outside the EU (for example Google and Mailchimp). These countries may not offer a level of data protection comparable to the EU. Where a provider is certified under the EU-US Data Privacy Framework, we base the transfer on the European Commission's adequacy decision (Art. 45 GDPR); otherwise on Standard Contractual Clauses (Art. 46 GDPR) or your consent. Further details can be found with the respective services and in Part B on international placement.
4. Accessing the website and server log files
When you access our website for information purposes only, our hosting provider, Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (servers in Germany), automatically collects information that your browser transmits (server log files): browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request and the IP address. A data processing agreement (Art. 28 GDPR) is in place with the hosting provider. The domain is registered with IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.
Purpose: ensuring a smooth connection, convenient use, and evaluating system security and stability.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technically error-free presentation and security of our website).
5. Cookies and consent management
Our website uses cookies and comparable technologies (for example information stored in your browser). Technically necessary cookies required for the operation of the website are used on the basis of Art. 6(1)(f) GDPR in conjunction with Section 25(2) TDDDG.
All cookies and services that are not technically necessary (in particular analytics and marketing services) are only used after you have given your consent via our consent management tool Borlabs Cookie (Borlabs GmbH, Hamburg). Borlabs Cookie runs on our own server and stores your consent decision for documentation purposes. The legal basis for this is Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via the cookie banner settings.
Note: Services requiring consent, in particular Google Analytics (section 6), are only activated after your active consent via the cookie banner. A mere notice in the banner or continued browsing is not sufficient under the case law.
6. Web analytics (Google Analytics 4 via Google Site Kit)
Where you have consented, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is integrated via the WordPress plugin Google Site Kit. Google Analytics uses cookies and similar technologies to evaluate the use of our website. This processes usage data such as pages visited, time spent, referrer, approximate location, device and browser data and IP addresses. Google Analytics 4 does not store full IP addresses; the IP address is only used for rough location determination and is not permanently stored or logged.
Purpose: statistical evaluation of website use and improvement of our offering.
Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with Section 25(1) TDDDG. You can withdraw your consent at any time via the Borlabs cookie banner.
Third-country transfer: Google LLC (USA) is certified under the EU-US Data Privacy Framework; any transfer to the USA is based on the European Commission's adequacy decision (Art. 45 GDPR), supplemented by Standard Contractual Clauses (Art. 46 GDPR). A data processing agreement (Art. 28 GDPR) is in place with Google.
Note: Google Search Console is also connected via Google Site Kit. It evaluates anonymised search statistics and does not set cookies to recognise individual website visitors.
Google Tag Manager: To manage and trigger services such as Google Analytics, we use Google Tag Manager (Google Ireland Limited). The Tag Manager itself does not create user profiles but acts as a technical container through which services requiring consent are loaded. These are only triggered after your consent via the Borlabs cookie banner. Any transfer to the USA is based on the EU-US Data Privacy Framework (Art. 45 GDPR). The legal basis for the non-necessary services triggered in this way is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.
7. Google reCAPTCHA
To protect our forms against misuse by automated systems and spam, we use the reCAPTCHA service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This in particular analyses your IP address and user behaviour and transmits it to Google; any transfer to the USA is based on the EU-US Data Privacy Framework (Art. 45 GDPR).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing spam and misuse). Where consent is obtained via the consent tool, processing is based on Art. 6(1)(a) GDPR and Section 25(1) TDDDG; consent can be withdrawn at any time.
Further information: Google Privacy Policy
8. Social media links (LinkedIn, X, Instagram, Facebook)
Our website links to our profiles on social networks, including LinkedIn (provider for the EEA: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). As long as you do not click these links, no data is transmitted to the networks. Only when you activate a link are you redirected to the respective provider's pages, which then receives your IP address and can associate the visit with the account of logged-in users. We have no influence on this processing; the privacy policy of the respective provider applies. According to current information, we do not use a LinkedIn Insight Tag or comparable tracking pixels.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an appealing presence and findability on social networks).
LinkedIn Privacy Policy: linkedin.com/legal/privacy-policy
9. Leadinfo (identification of business visitors)
We use the lead-generation service Leadinfo provided by Leadinfo (Team.blue GmbH, Bunsenstr. 19, 40215 Düsseldorf, Germany). Leadinfo matches the IP address of website visitors against a database in order to identify companies visiting our website and provides us with aggregated company information (such as company name, sector, general contact details) and usage behaviour on the website. Data processing takes place in data centres within the EU; according to the provider, no transfer to third countries occurs. The service is only activated after your consent via the Borlabs cookie banner.
Purpose: sales and outreach to potential business customers (B2B lead generation).
Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent, as the service is activated via the Borlabs cookie banner). You can withdraw your consent at any time with effect for the future. Since IP addresses are processed, we also inform you pursuant to Art. 14 GDPR that this data is not collected directly from you.
Provider's privacy policy: leadinfo.com/de/rechtliches/datenschutz
10. Newsletter and e-mail marketing (Mailchimp)
To send our newsletter and further information on market-relevant topics, we use the Mailchimp service provided by The Rocket Science Group LLC d/b/a Mailchimp, 405 N. Angier Ave NE, Atlanta, GA 30308, USA (a company of Intuit Inc.).
Registration uses the double opt-in procedure: after signing up, you receive an e-mail in which you confirm your registration. On registration we also store your IP address as well as the date and time in order to be able to prove your consent. The newsletter contains a tracking pixel (web beacon) with which we evaluate open and click rates to optimise our offering.
Legal basis: Art. 6(1)(a) GDPR (consent). You can unsubscribe from the newsletter at any time via the unsubscribe link in every e-mail or by message to info@departer.com.
Third-country transfer: Mailchimp (Intuit) is certified under the EU-US Data Privacy Framework; the transfer to the USA is therefore based on the European Commission's adequacy decision (Art. 45 GDPR), supplemented by Standard Contractual Clauses (Art. 46 GDPR). A data processing agreement (Art. 28 GDPR) is in place with the provider.
11. Registration for the HR and Salary Report
On our website you can register to download our salary guide (HR and Salary Report). Mandatory details are first name, last name, company, job title/function and e-mail address; optionally you can state your region and your interest. We also store the IP address as well as date and time of registration for verification purposes.
Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(b) GDPR for providing the requested content. The data is deleted as soon as the purpose ceases to apply, at the latest when you withdraw the registration.
12. Contacting us
If you contact us via the contact form or by e-mail, we process your details in order to handle your request.
Legal basis: Art. 6(1)(b) GDPR where the request is aimed at concluding or performing a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).
13. Use of AI-supported systems
To support our work, in particular the creation and processing of texts, we use AI-supported software. Where personal data is processed in this context, the following principles apply:
Legal basis: depending on the context, Art. 6(1)(b) or (f) GDPR.
------ Part B: Privacy information for applicant management ------
14. Processing in the context of application and placement
As soon as you apply to us, wish to be included in our talent pool, or we approach you as a candidate for a position, we process your personal data. Departer operates as an executive search consultancy and places candidates with interested companies (clients). To manage this data we use the applicant management system (ATS/CRM) Vincere, which is operated in a data centre within the EU; a data processing agreement (Art. 28 GDPR) is in place with the provider.
For the purposes of placement (matching with open positions, transfer to clients), on the basis of Art. 6(1)(b) GDPR and additionally (f) (legal defence), we process the following categories of data:
This data is generally deleted 6 months after conclusion of the process (class A), unless consent to further storage has been given (see section 19).
Special categories of personal data (Art. 9 GDPR): Application documents may contain special categories of data (for example indications of health, disability, religion or ethnic origin). We ask you to provide such information only insofar as it is necessary for the application. Processing only takes place to the extent permitted under Art. 9(2) GDPR, in particular on the basis of your explicit consent (Art. 9(2)(a) GDPR) or to exercise rights under employment law.
Note on employment data: Where the placement leads to an employment or pre-contractual relationship, Section 26 BDSG (data processing for employment relationships) may also apply.
15. Active sourcing and origin of the data
As an executive search consultancy, we also actively approach suitable candidates and contacts of potential clients without prior contact (direct approach, known as active sourcing). In these cases we do not collect your data from you directly but from other sources. We inform you of this pursuant to Art. 14 GDPR.
Data sources: publicly accessible professional networks (for example LinkedIn and Xing), company websites, industry events and directories, as well as recommendations from third parties.
Data categories: typically name, professional contact details, current and former positions, career history and qualifications.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in initiating a possible placement and in establishing business with clients). You may object to this processing at any time under Art. 21 GDPR. Upon first contact you receive the information required under Art. 14 GDPR, at the latest within one month.
16. Reference checks
As part of a placement process we obtain reference information, but exclusively from persons whom you have named to us as referees. In doing so we process the referee's contact details and their statements about you.
Legal basis: with regard to the candidate, Art. 6(1)(b) GDPR and your consent through naming the reference; with regard to the referees, Art. 6(1)(f) GDPR (legitimate interest in a well-founded assessment of suitability). We inform referees pursuant to Art. 14 GDPR about the processing of their data.
17. Disclosure of data and transfers to third countries
We pass your data to interested companies (clients) in order to place you in suitable positions. Disclosure to a specific client takes place after prior consultation with you. Otherwise we do not pass your data to uninvolved third parties. Disclosure to our technical service providers (for example the applicant management system) takes place within the framework of processing on our behalf pursuant to Art. 28 GDPR.
International placement and third-country transfer: Departer also places candidates internationally, in particular via its locations in the United Arab Emirates (Dubai) and Australia (Brisbane). In the context of such mandates, your data may be transferred to companies in third countries outside the EU/EEA for which no adequacy decision of the European Commission exists (this currently applies to both the United Arab Emirates and Australia). In these cases, the transfer only takes place where appropriate safeguards under Art. 46 GDPR are in place (in particular Standard Contractual Clauses adopted by the European Commission) or where one of the derogations of Art. 49 GDPR applies. Where we transfer your data to such a third country in order to place a specific position, we generally base this on your explicit consent after prior information about the existing risks (Art. 49(1)(a) GDPR) or on the necessity for performing pre-contractual measures at your request (Art. 49(1)(b) GDPR).
Where your data has been passed to a third party (client) for the purpose of placement, Departer has no influence on the subsequent storage, use or deletion of the data by that third party; in this respect the third party is an independent controller.
18. Talent pool
You can voluntarily be included in our talent pool so that we can offer you suitable positions in the future as well. Inclusion takes place exclusively on the basis of your explicit consent (Art. 6(1)(a) GDPR). Consent is voluntary and bears no relation to any ongoing application process. You can withdraw your consent at any time with effect for the future; in that case your data is deleted from the pool, unless statutory retention obligations apply.
When joining the pool you can determine the retention period for your data yourself: 2 years, 5 years or 10 years. Before the period you have chosen expires, we will ask you whether you wish to extend it. If you do not respond, your data is deleted after expiry.
19. Retention period and deletion concept
We delete personal data as soon as the purpose of its processing ceases to apply and no statutory retention obligations apply. Our deletion concept is based on the following classes:
20. Your rights as a data subject
You have the following rights regarding your personal data:
Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Hamburg.
To exercise your rights, a message to datenschutz@departer.com is sufficient.
Obligation to provide data: There is no statutory obligation to provide us with your data. For placement in suitable positions, however, providing the data is necessary, as without it no matching of candidate wishes and requirements is possible.
21. Changes to this privacy policy
We adapt this privacy policy as soon as changes to the processing we carry out or to the legal situation make this necessary. The current version published on our website applies in each case.