Privacy notice for candidates

The controller within the meaning of the GDPR for processing your candidate data is:

Sandra Lochmann
People · Places · Performance
Bahnhofstraße 28, 82065 Baierbrunn, Deutschland
Phone: +49 176 85697666
Email: info@sandralochmann.com

There is no statutory obligation to appoint a data protection officer. For data protection questions, please contact the controller above directly.

People · Places · Performance is a recruiting consultancy. We search for and fill positions on behalf of our client companies. We are not your future employer and we do not engage in temporary staffing.

For candidates, our service is free of charge. Your profile never leaves our system without your express release — and you always know which company it is going to.

We tell you the planned compensation or salary range of the respective position no later than before the first interview.

• Master data: name, address, phone number, email address
• Application data: CV, career history, qualifications, references, language skills
• Information on salary expectations, availability, motivation to change and preferred regions
• Publicly visible professional profiles (e.g. LinkedIn, XING, taleva.io)
• Communication content (email, phone, WhatsApp, messages via LinkedIn and JOIN)
• Optional and only with separate consent: criminal record certificate, further sensitive documents
• Application photos: we do not request photos and they are not required for the application. If you voluntarily attach one, we process it only within the current procedure and do not pass it on to a client company without your consent.

• Directly from you — e.g. via the JOIN application form, by email, in conversation or via a messaging channel
• From publicly accessible professional profiles (LinkedIn, XING, taleva.io) which you have published yourself for professional visibility
• Through referrals from contacts or cooperation partners
• From freelance recruiters engaged by People · Places · Performance under a confidentiality agreement

• Initiation and performance of a placement — Art. 6(1)(b) GDPR (pre-contractual measures)
• Active outreach for specific positions (sourcing) — Art. 6(1)(f) GDPR (legitimate interest in targeted placement)
• Inclusion in our talent pool — Art. 6(1)(a) GDPR (your consent), revocable at any time
• Sharing your profile with a client company — Art. 6(1)(a) GDPR (your position-specific consent)
• Processing of special categories of data (e.g. health or origin) — only with explicit consent under Art. 9(2)(a) GDPR
• Compliance with legal obligations (e.g. tax and commercial retention) — Art. 6(1)(c) GDPR

To find suitable candidates we review publicly visible professional profiles (in particular LinkedIn and taleva.io). When we contact you for the first time in connection with a specific position, we inform you in the first message about the source of your data, the purpose of the outreach and this privacy notice (Art. 14 GDPR).

The legal basis is our legitimate interest in targeted placement (Art. 6(1)(f) GDPR). You can object to further processing at any time informally — a short reply (“please delete”) is enough. We then delete your data without delay, at the latest within 30 days.

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. First messages may be sent with technical support but always relate to a specific professional situation and are reviewed individually.

Your personal data is disclosed exclusively:

• To a specific client company — only after your express release and with the name of the company
• To technical processors on the basis of contracts under Art. 28 GDPR — in particular:
  • JOIN Solutions AG, Zurich (Switzerland) — applicant management, job ads, multiposting
  • taleva.io — research on publicly visible professional profiles
  • Website and hosting provider (Lovable / Cloudflare) — delivery of this website
  • Supabase — database and auth infrastructure, EU region
  • Email and collaboration providers for the communication with you
• To engaged freelance recruiters or project partners, provided they act on behalf of People · Places · Performance and have signed a confidentiality agreement
• To authorities, insofar as we are legally obliged to do so

We place candidates internationally, including in Germany, the EU, Switzerland, Portugal and selected Latin American countries (in particular Mexico, Colombia, Brazil, Argentina and Chile). Data transfers to countries outside the EU / EEA only take place if:

• You have expressly consented (typically together with releasing your profile to a client company in the target country), or
• an adequacy decision by the EU Commission exists, or
• appropriate safeguards under Art. 46 GDPR are in place (in particular EU standard contractual clauses with additional safeguards).

• Active application for a specific position: stored until at most 6 months after conclusion of the selection procedure.
• Sourcing outreach without response: deletion after 6 months at the latest.
• Talent pool (with consent): stored for up to 24 months; we then ask again or delete. You can withdraw consent at any time.
• Objection / deletion request: deletion without delay, at the latest within 30 days.
• Tax and commercial documents: statutory retention periods (typically 6–10 years).

You have the right at any time to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Lodging a complaint with a supervisory authority (Art. 77 GDPR)

Competent supervisory authority:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de

To exercise your rights, an informal email to info@sandralochmann.com is enough.

The following legal bases and periods apply to the processing of your application data:

• § 26(1) sentence 1 BDSG in conjunction with Art. 88 GDPR: processing for the decision on entering into an employment relationship — the central legal basis for handling your application, even where the employment relationship arises with the client company.
• Art. 6(1)(b) GDPR: pre-contractual measures at your request.
• Art. 6(1)(f) GDPR: legitimate interest in carrying out the search mandate and in approaching suitable profiles.
• Art. 6(1)(a) / Art. 9(2)(a) GDPR: your consent — for inclusion in the talent pool and for the rare case where you voluntarily disclose special categories of personal data (e.g. disability status).
• Deletion after rejection: your application documents are deleted no later than 6 months after the process ends. This period follows the two-month limitation period of § 15(4) AGG (German General Equal Treatment Act) plus a reasonable buffer for service and limitation checks. Longer storage only occurs if you have expressly consented to the talent pool or if AGG proceedings are pending.
• Withdrawal and deletion requests: informally at any time to info@sandralochmann.com. We then delete without undue delay, at the latest within 30 days.

Your data is stored beyond the specific process (talent pool) only if you have previously given express and separate consent. Consent is obtained separately from the application, is voluntary and has no influence on your chances in the ongoing process.

The purpose of the talent pool is to allow us to contact you again for future mandates matching your profile. Retention: up to 24 months; we then ask again or delete. You may withdraw consent at any time with future effect (Art. 7(3) GDPR) — a short message to info@sandralochmann.com is sufficient; the lawfulness of processing before withdrawal remains unaffected.

Your profile is never transferred to a client company without your prior express release. Before every introduction we name the company, the position and the scope of the documents to be transferred. You decide company by company; there is no blanket release 'to all clients'.

Recipients may be companies in Germany, Austria, Switzerland, Italy, Spain and Portugal as well as — in cross-border business — in selected Latin American countries (in particular Brazil, Mexico, Colombia, Argentina, Chile).

Within the EU/EEA (including Italy, Spain, Portugal) the uniform GDPR level of protection applies and no additional safeguards are needed. For recipients in third countries (including Switzerland, the United Kingdom, Latin America) we base the transfer on an EU Commission adequacy decision (e.g. Switzerland, UK, Argentina, Uruguay), otherwise on EU standard contractual clauses under Art. 46(2)(c) GDPR or on your express consent in the individual case under Art. 49(1)(a) GDPR. For countries without an adequacy decision (e.g. Brazil, Mexico, Colombia, Chile) we inform you before release that a level of protection fully comparable to the EU cannot be guaranteed there and that access by public authorities may be possible.

We accept applications exclusively through the application portal on the 'Jobs' page of this website. The portal is operated by JOIN Solutions AG, Zurich (Switzerland), acting as our processor under Art. 28 GDPR; a data processing agreement is in place. An EU Commission adequacy decision exists for Switzerland.

Please do not send application documents by email, WhatsApp or social networks. These channels are not suitable for the confidential transfer of sensitive documents. Unsolicited application documents received by email or messenger are not taken into the process; after a brief reply to you they are deleted, as a rule within 14 days.

Please only submit data that is necessary for the position. Information on health, religion, trade union membership, sexual orientation, ethnic origin or political opinion is not required and should not be provided. A photo, date of birth and marital status are expressly voluntary; omitting them causes no disadvantage.

Additional information — in particular on cookies, use of this website and further processing outside the recruiting context — is available in the general privacy policy.