Privacy Policy

There is no statutory obligation to appoint a data protection officer. Therefore, no external data protection officer has been appointed. If you have any questions, please contact the controller directly (see above).

• Initiation and execution of recruitment placements
• Transmission of anonymised profiles to potential employers
• Building and maintaining a candidate pool for future vacancies
• General communication and project coordination
• Analysis and optimisation of the website and services
• Collaboration with external freelancers for project support (e.g. research, communication, data maintenance)

• Art. 6(1)(a) GDPR – consent
• Art. 6(1)(b) GDPR – contract initiation or performance
• Art. 6(1)(f) GDPR – legitimate interest in efficient placement and business operations
• Art. 9(2)(a) GDPR – consent for special categories of personal data

• Master data: name, address, phone number, email address
• Application data: CV, career history, qualifications, language skills
• Information on salary expectations, availability and regions
• Online profiles (LinkedIn, XING, GitHub etc.)
• Communication content (email, phone, WhatsApp, online platforms)
• Optional: photos, references, police clearance certificate (only if required and consented)

• Directly from you (e.g. by email, form, call, online upload)
• Publicly accessible sources such as LinkedIn, XING or taleva.io, provided you have published your profile there for professional visibility
• Recommendations or cooperation partners
• Freelancers or recruiting cooperations within joint projects

For active candidate sourcing, publicly available professional profiles (e.g. on LinkedIn or taleva.io) are evaluated. When making first contact by email or via social networks, you are informed immediately about the collection of your data (Art. 14 GDPR).

The legal basis for this initial contact is usually Art. 6(1)(f) GDPR (legitimate interest in targeted placement). The legitimate interest has been balanced against your interests: your profile is publicly accessible, the message relates to a specific professional opportunity, and you can object to further use of your data at any time.

Every automated initial message contains a reference to this privacy policy and a simple way to object (e.g. reply with “please delete”). After an objection, your data will be deleted without delay (within 30 days at the latest).

Your personal data is disclosed only:

• With your express consent to companies with specific vacancies
• To technical service providers (e.g. email hosting, cloud systems, website provider) with appropriate data processing agreements under Art. 28 GDPR
• To freelancers or project-related partners, provided they act on behalf of Sandra Lochmann and have signed a corresponding confidentiality agreement

Your data is transferred to countries outside the EU or EEA only if:

• you have expressly consented, or
• the country in question has an adequate level of data protection (adequacy decision), or
• suitable safeguards under Art. 46 GDPR exist (e.g. EU standard contractual clauses).

• Application data will be deleted no later than 6 months after the end of the recruitment process, unless consent for longer storage has been given.
• Data from active sourcing without a response will be deleted after 6 months.
• If you consent to inclusion in the candidate pool, data will be stored until you withdraw consent.
• Website tracking data is stored anonymously and deleted automatically in accordance with applicable requirements.
• For data relevant under tax or commercial law, statutory retention periods apply (usually 6–10 years).

You have the right at any time to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdraw consent (Art. 7(3) GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. Email and LinkedIn messages may be sent automatically during initial contact, but always relate to a specific position and include a reference to this privacy policy.

The provision of your personal data is voluntary. However, without certain data (e.g. CV, contact details), successful placement is not possible.

This website uses only technically necessary cookies. External analytics or marketing tools are used only with your express consent. The WhatsApp buttons are simple forwarding links: only when you actively click a button do you leave the website and open WhatsApp or WhatsApp Web.

The WhatsApp buttons on this website link to an external communication service operated by WhatsApp Ireland Ltd. (Meta family of companies). As soon as you click a WhatsApp button, your browser will connect to WhatsApp/Meta servers. In particular, your IP address, device information, the time of access and the pre-filled message may be transmitted to WhatsApp/Meta.

This processing is carried out by WhatsApp/Meta itself, not by Sandra Lochmann. Message content is only disclosed to third parties to the extent necessary for communication. Further data processing within WhatsApp is governed exclusively by the privacy policies of WhatsApp/Meta:

• WhatsApp Privacy Policy: https://www.whatsapp.com/legal/privacy-policy
• Meta Privacy Policy: https://www.meta.com/privacy-policy/

To operate this website and my recruiting processes I use carefully selected service providers who act solely on my documented instructions pursuant to Art. 28 GDPR:

• Website hosting and delivery: Lovable (Lovable Labs Incorporated) on Cloudflare, Inc. infrastructure – processing of server log data (IP address, timestamp, requested resource, user agent) to deliver and secure the site, legal basis Art. 6(1)(f) GDPR.
• Database and backend services: Supabase (Supabase Inc.), EU region – storage of form enquiries and technical counters.
• Email delivery (confirmations and notifications) via the subdomain notify.peopleplacesperformance.com.
• Email mailbox and office communication of the controller.
• Applicant management: JOIN (JOIN Solutions AG, Switzerland) – Switzerland is covered by an EU adequacy decision.
• Sourcing and candidate outreach: taleva.io and LinkedIn Ireland Unlimited Company.
• WhatsApp Ireland Ltd. – only if you actively click a WhatsApp button (see separate section).
• Fonts are self-hosted from my own server; no connection to Google Fonts is made. No map, video or social media embeds transfer data to third parties without your active action.

This website only stores or reads information that is strictly necessary to provide the service you have expressly requested (§ 25(2) no. 2 TDDDG). No analytics, marketing or tracking cookies, no pixels and no social media widgets are used. A consent banner is therefore not required.

Should consent-requiring services be used in the future, they will only load after your prior, express consent, which you may withdraw at any time.

Where providers based or operating infrastructure outside the EU/EEA are used (in particular US providers for hosting and content delivery), the transfer is based on an EU Commission adequacy decision (e.g. EU-US Data Privacy Framework, Switzerland) or on EU standard contractual clauses under Art. 46(2)(c) GDPR together with supplementary technical and organisational measures. A copy of the relevant safeguards can be requested at info@sandralochmann.com.

You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). An informal message to info@sandralochmann.com is sufficient.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 27, 91522 Ansbach, Germany

This website contains no chatbot, no voice assistant and no other AI system you interact with directly. Your voice, emotions or behaviour are not analysed automatically.

Individual images and editorial text elements on this website were created with the support of generative AI tools and subsequently reviewed editorially. Such content is labelled as AI-generated where it depicts realistic-looking persons, places or events (Art. 50 EU AI Act).

No automated decision producing legal effects or similarly significant effects within the meaning of Art. 22 GDPR is made in the candidate selection process. Every assessment, shortlist and recommendation is made by a human being.

AI outputs may be inaccurate, incomplete or outdated. Content on this website does not constitute legal, tax, medical or financial advice.

I only send emails on a specific occasion (confirmations, replies to your enquiry, process and status messages) and — where set up — to recipients who have given prior express consent. No emails are sent to purchased, rented, imported or otherwise acquired address lists. Addresses are collected only where you provide them to me yourself.

• Double opt-in: every sign-up for recurring information emails is verified by a confirmation email. The address only becomes active after you click the confirmation link. Until then nothing is sent.
• Proof of consent (Art. 7(1) GDPR, § 7(2) no. 2 UWG): the time of sign-up, the time of confirmation, the IP address of sign-up and confirmation and the exact wording of the consent text in the language version shown to you are logged. These records serve evidentiary purposes only and are kept until potential claims following a withdrawal have lapsed.
• Unsubscribe: every promotional or recurring email contains an unsubscribe link that takes effect with one click, without login, password or explanation (one-click unsubscribe pursuant to RFC 8058). After unsubscribing, your address is placed on a suppression list so that you receive no further messages. Withdrawal is equally possible by informal email to info@sandralochmann.com.
• Provider identification: every email contains the full provider information required by § 5 DDG (name, postal address, contact details of the controller).
• No open or click tracking: no tracking pixels, no individualised tracking links and no read receipts are used. I measure neither whether you opened an email nor which links you clicked. Should performance measurement be introduced in future, it will only take place after separate, express consent that explicitly names the scope of the measurement.
• Only delivery status, bounces and complaints are logged technically. This data is necessary for proper delivery (Art. 6(1)(f) GDPR) and is not used for profiling.

Direct outreach to companies (B2B): § 7(2) UWG also applies to business communication. I therefore do not send promotional emails to companies without prior express consent. A consent check is built in upstream of sending: for promotional templates the system verifies, before dispatch, that a confirmed and un-withdrawn consent is documented for the recipient address. If it is missing, sending is aborted and logged.

This must be distinguished from individual, position-related candidate outreach within a specific search mandate. That is not advertising within the meaning of § 7 UWG; it is based on Art. 6(1)(f) GDPR with the information required by Art. 14 GDPR provided in the first message and a right to object at any time.

Legal bases: Art. 6(1)(a) GDPR (consent) for recurring information emails and promotional outreach, Art. 6(1)(b) GDPR for occasion-based messages within a contract or enquiry, Art. 6(1)(c) GDPR for the statutory duty of proof.

You can contact me via WhatsApp from this website. The WhatsApp buttons are plain forwarding links: only when you actively click do you leave this website and open WhatsApp.

Purpose: fast contact chosen by you and handling of your enquiry.

Legal bases: your consent through actively using the button (Art. 6(1)(a) GDPR) and Art. 6(1)(b) GDPR where the communication serves to initiate or perform a contract.

Recipient: when you use WhatsApp, data is transferred to WhatsApp Ireland Ltd. / Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. This includes in particular your mobile number, profile information, device and connection data, time of access and the content of your messages. Message content is end-to-end encrypted; metadata is not.

Third-country transfer: Meta also processes data in the USA and other third countries. According to Meta, this transfer is based on the EU Commission adequacy decision for the EU-US Data Privacy Framework and additionally on EU standard contractual clauses under Art. 46(2)(c) GDPR. Even so, a level of protection fully equivalent to EU standards cannot be guaranteed for third countries in every case; access by public authorities in particular cannot be entirely ruled out. By actively using the WhatsApp channel you also consent to this transfer (Art. 49(1)(a) GDPR).

Meta is the independent controller for processing within WhatsApp. The WhatsApp privacy policy applies: https://www.whatsapp.com/legal/privacy-policy

Voluntary use and alternative: using WhatsApp is entirely voluntary and is not a prerequisite for working together. You can always reach me equally well by email at info@sandralochmann.com, by phone or via the contact form on this website. I recommend those channels if you wish to avoid a transfer to Meta.

Retention: WhatsApp conversations are deleted as soon as they are no longer required to handle your request and no statutory retention obligations apply. Please do not send special categories of personal data (e.g. health data) or complete application documents via WhatsApp.

Statistics: clicks on WhatsApp buttons are counted anonymously on my own server (language, page path, time). No cookies are set and no profiles are created.