Privacy notice for candidates

The controller within the meaning of the GDPR for processing your candidate data is:

Sandra Lochmann
People · Places · Performance
Bahnhofstraße 28, 82065 Baierbrunn, Deutschland
Phone: +49 176 85697666
Email: info@sandralochmann.com

There is no statutory obligation to appoint a data protection officer. For data protection questions, please contact the controller above directly.

People · Places · Performance is a recruiting consultancy. We search for and fill positions on behalf of our client companies. We are not your future employer and we do not engage in temporary staffing.

For candidates, our service is free of charge. Your profile never leaves our system without your express release — and you always know which company it is going to.

• Master data: name, address, phone number, email address
• Application data: CV, career history, qualifications, references, language skills
• Information on salary expectations, availability, motivation to change and preferred regions
• Publicly visible professional profiles (e.g. LinkedIn, XING, taleva.io)
• Communication content (email, phone, WhatsApp, messages via LinkedIn and JOIN)
• Optional and only with separate consent: photo, criminal record certificate, further sensitive documents

• Directly from you — e.g. via the JOIN application form, by email, in conversation or via a messaging channel
• From publicly accessible professional profiles (LinkedIn, XING, taleva.io) which you have published yourself for professional visibility
• Through referrals from contacts or cooperation partners
• From freelance recruiters engaged by People · Places · Performance under a confidentiality agreement

• Initiation and performance of a placement — Art. 6(1)(b) GDPR (pre-contractual measures)
• Active outreach for specific positions (sourcing) — Art. 6(1)(f) GDPR (legitimate interest in targeted placement)
• Inclusion in our talent pool — Art. 6(1)(a) GDPR (your consent), revocable at any time
• Sharing your profile with a client company — Art. 6(1)(a) GDPR (your position-specific consent)
• Processing of special categories of data (e.g. health or origin) — only with explicit consent under Art. 9(2)(a) GDPR
• Compliance with legal obligations (e.g. tax and commercial retention) — Art. 6(1)(c) GDPR

To find suitable candidates we review publicly visible professional profiles (in particular LinkedIn and taleva.io). When we contact you for the first time in connection with a specific position, we inform you in the first message about the source of your data, the purpose of the outreach and this privacy notice (Art. 14 GDPR).

The legal basis is our legitimate interest in targeted placement (Art. 6(1)(f) GDPR). You can object to further processing at any time informally — a short reply (“please delete”) is enough. We then delete your data without delay, at the latest within 30 days.

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. First messages may be sent with technical support but always relate to a specific professional situation and are reviewed individually.

Your personal data is disclosed exclusively:

• To a specific client company — only after your express release and with the name of the company
• To technical processors on the basis of contracts under Art. 28 GDPR — in particular:
  • JOIN Solutions AG, Zurich (Switzerland) — applicant management, job ads, multiposting
  • taleva.io — research on publicly visible professional profiles
  • Website and hosting provider (Lovable / Cloudflare) — delivery of this website
  • Supabase — database and auth infrastructure, EU region
  • Email and collaboration providers for the communication with you
• To engaged freelance recruiters or project partners, provided they act on behalf of People · Places · Performance and have signed a confidentiality agreement
• To authorities, insofar as we are legally obliged to do so

We place candidates internationally, including in Germany, the EU, Switzerland, Portugal and selected Latin American countries (in particular Mexico, Colombia, Brazil, Argentina and Chile). Data transfers to countries outside the EU / EEA only take place if:

• You have expressly consented (typically together with releasing your profile to a client company in the target country), or
• an adequacy decision by the EU Commission exists, or
• appropriate safeguards under Art. 46 GDPR are in place (in particular EU standard contractual clauses with additional safeguards).

• Active application for a specific position: stored until at most 6 months after conclusion of the selection procedure.
• Sourcing outreach without response: deletion after 6 months at the latest.
• Talent pool (with consent): stored for up to 24 months; we then ask again or delete. You can withdraw consent at any time.
• Objection / deletion request: deletion without delay, at the latest within 30 days.
• Tax and commercial documents: statutory retention periods (typically 6–10 years).

You have the right at any time to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Lodging a complaint with a supervisory authority (Art. 77 GDPR)

Competent supervisory authority:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de

To exercise your rights, an informal email to info@sandralochmann.com is enough.

Additional information — in particular on cookies, use of this website and further processing outside the recruiting context — is available in the general privacy policy.