Privacy policy

This English version is provided for convenience. Only the German version is legally binding.

1. Controller and contact

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Lippstadt office: Fleischhauerstraße 6, 59555 Lippstadt, phone +49 2941 28 64-0.

For all questions concerning data protection and the exercise of your rights, you can contact us using the contact details given above. Please mark your message with the keyword “Data protection”.

This privacy policy applies to the website www.kon-part.de and to the activities of KON-PART GmbH as an executive search firm, in particular to the processing of data relating to our clients, candidates and business partners. The KON.TALENT brand is governed by the privacy policy published on its own website.

2. Key points at a glance

• Our website does not set any cookies for advertising or analytics purposes and does not embed any third-party content that transfers data to those third parties when a page is accessed. Fonts, images, maps and videos are stored on our own server.
• To improve our services, we measure the reach of our website using Matomo – without cookies, with truncated IP addresses and on our own web space. You can object to this measurement at any time.
• As an executive search firm, we process data relating to candidates, including candidates who have not applied to us themselves but have been approached by us. Section 11 explains what data this is, where it comes from and what happens to it.
• We use artificial intelligence tools in our work, including for the processing of application documents. Decisions about people are always made by people. Section 12 describes this use in detail.
• We pass on documents and information about candidates to clients only with the candidates’ consent.
• You have comprehensive rights, including the rights of access, erasure and objection (Section 16).

3. Provision of the website and hosting

Hosting

Our website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur. IONOS processes the data generated when the website is accessed on our behalf in data centres in Germany or the European Union. A data processing agreement pursuant to Art. 28 GDPR has been concluded with IONOS.

Server log files

Each time our website is accessed, the web server automatically records information transmitted by your browser:

• IP address of the requesting device,
• date and time of access,
• page or file accessed and amount of data transferred,
• status code (e.g. successful retrieval, page not found),
• previously visited page (referrer), if transmitted by your browser,
• browser type and version, and operating system.

This processing serves the secure and stable provision of the website, the analysis of errors and the defence against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a secure and functional website. The log files are deleted or anonymised after 14 days at the latest, unless they are required for longer in an individual case to investigate a security incident.

Encryption

The connection to our website is encrypted using TLS. You can recognise this by “https://” in the address bar of your browser.

4. Cookies and access to your terminal equipment

Our website does not use cookies or comparable technologies that store information on, or read information from, your terminal equipment and are not strictly necessary. A cookie banner is therefore not provided. If you object to audience measurement (Section 5), this objection is stored in your browser. This is necessary, within the meaning of Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), so that your wish can be respected permanently.

Should we use services in future that require consent, we will obtain such consent in advance and amend this privacy policy accordingly.

5. Audience measurement with Matomo

In order to understand how our website is used and to improve it, we use the open-source software Matomo. Matomo runs on our own web space at IONOS; the data is not transferred to the manufacturer of Matomo or to any other third parties.

We have configured Matomo in line with the principle of data minimisation:

• No cookies are set and no information is stored on your terminal equipment.
• Your IP address is truncated by two bytes before any storage (e.g. 192.168.xxx.xxx). It is therefore not possible to identify you.
• Visits are not attributed to a person across several days or devices. Data is not combined with other data.
• The “Do Not Track” or “Global Privacy Control” setting of your browser is respected.

The data recorded includes in particular: pages accessed and time spent on them, referrer, approximate region (derived from the truncated IP address), browser, operating system, device type and screen resolution, as well as clicks on links to contact, appointment booking or job advertisements. The data is evaluated exclusively in aggregated form.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in designing and improving our website in line with users’ needs. The raw data is deleted after 13 months.

Objection: You can object to this data collection at any time. To do so, please use the following setting; your objection will be stored in your browser.

6. Contacting us

Contact form

If you write to us using the contact form, we process the data you provide (name, company, email address, optionally phone number, and your message) in order to respond to your enquiry. The form is transmitted to us as an email via our web server at IONOS. Mandatory fields are marked; without them we cannot process your enquiry.

Email and phone

If you contact us by email or phone, we process your details and the content of your message in order to deal with your request. Our email mailboxes are operated by IONOS and our phone system by an IT service provider.

Legal basis and storage period

If your enquiry relates to a contract or to steps prior to entering into a contract, the legal basis is Art. 6(1)(b) GDPR; otherwise it is Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). We delete your enquiry once it has been dealt with conclusively and no statutory retention obligations apply. We retain business correspondence for up to six or ten years in accordance with the provisions of commercial and tax law. If your enquiry results in an application or an assignment, Sections 10 and 11 apply.

7. Appointment booking via Calendly

For online appointment booking, we refer you to the Calendly service provided by Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA. Calendly is not embedded in our website. Only when you click on “Book an appointment online” does the Calendly page open in a new window, and only then is data transferred to Calendly.

When you make a booking, Calendly processes the data you enter (name, email address, selected appointment and, where applicable, phone number and comments) on our behalf. We use this data to plan and hold the appointment. The legal basis is Art. 6(1)(b) GDPR insofar as the appointment serves to initiate an assignment or an application, and otherwise Art. 6(1)(f) GDPR (legitimate interest in simple appointment scheduling). Calendly is responsible for the setting of cookies on the Calendly pages.

A data processing agreement has been concluded with Calendly. Calendly is certified under the EU-U.S. Data Privacy Framework; in addition, the standard contractual clauses of the European Commission have been agreed. Further information: calendly.com/privacy. If you prefer not to use Calendly, you are welcome to arrange an appointment by phone or email.

8. Content, fonts, maps and links

• Fonts: The fonts used on our website are stored locally on our server. No connection is established to servers operated by Google or other providers.
• Maps: The location maps of our offices are stored as image files on our server (map data © OpenStreetMap contributors). Only when you click on “Open in Google Maps” are you redirected to Google; from that point on, the privacy policy of Google Ireland Limited applies.
• Videos and images: Videos and images, including the preview images of our LinkedIn posts, are stored on our server. No data is transferred to LinkedIn or other platforms when the page is accessed.
• Links: Our website contains links to other services, for example to LinkedIn, XING, the BDU, Calendly or our applicant tracking system. Data is transferred to these providers only when you click on a link. The respective providers are responsible for their own data processing.

9. Our presence on professional networks

We maintain company pages on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) and XING (New Work SE, Am Strandkai 1, 20457 Hamburg). When you visit these pages, interact with us there or send us messages, we process the data you make available to us there in order to communicate with you and to operate our presence (Art. 6(1)(f) GDPR).

We are joint controllers with LinkedIn (Art. 26 GDPR) for the statistics provided by LinkedIn on the use of our company page. LinkedIn has undertaken to assume the primary obligations, in particular informing users and handling data subject requests. Details can be found in LinkedIn’s Privacy Policy and in the “Page Insights Joint Controller Addendum”. You can also exercise your rights against us.

10. Clients, prospective clients and business partners

We process the contact and communication data of contact persons at clients, prospective clients, cooperation partners and service providers (e.g. name, position, company, contact details, notes of conversations, quotation and contract documents, invoicing data). The purposes are the initiation and performance of assignments, invoicing, the maintenance of the business relationship and providing information about our services.

The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual steps), Art. 6(1)(c) GDPR (statutory retention obligations) and Art. 6(1)(f) GDPR (legitimate interest in maintaining business contacts). We store the data in our customer relationship management system and our accounting software, which are operated on our behalf by service providers in the European Union. Section 12 applies accordingly insofar as we prepare documents from assignments, such as position descriptions or notes of conversations, with the support of artificial intelligence.

Promotional communication by email takes place only within the limits permitted by law. You can object to it at any time.

11. Candidates and applicants

Our task is to find suitable individuals for our clients and to open up suitable career prospects for people. For this purpose, we process personal data relating to candidates. This section provides you with information pursuant to Art. 13 and Art. 14 GDPR, regardless of whether you have applied to us or have been approached by us.

11.1 Who this section concerns

• persons who apply for a position we are handling or submit a speculative application to us, for example via our applicant tracking system, by email or in a personal meeting;
• persons whom we approach in a targeted and confidential manner in the course of a search (direct search);
• persons who have been recommended to us or whom we know from our professional network;
• persons whose data is stored in our candidate pool;
• referees named to us by candidates.

11.2 What data we process

• Master data and contact details: name, address, phone numbers, email addresses, date of birth, profile addresses on professional networks;
• Career history and qualifications: CV, education and training, degrees, academic and employment references, certificates, language skills, professional positions, functions, areas of responsibility, achievements, publications;
• Information on your professional situation and preferences: current and desired remuneration, notice period, availability, motivation for changing jobs, mobility, preferred locations;
• Findings from the selection process: notes and records of conversations and interviews, assessments from our candidate audit, results of psychometric assessment procedures, information provided by referees, our evaluations and reports;
• Communication data: content and metadata of our correspondence, meeting appointments;
• Image and audio data: application photographs, if you provide them to us, and recordings of conversations, only with your consent (Section 11.8).

We do not request special categories of personal data (Art. 9 GDPR), such as information on health, a severe disability or religious affiliation. If your documents contain such information, we process it only insofar as this is necessary for the process or you wish us to do so, for example if you inform us of a severe disability so that it can be taken into account in the process (Art. 9(2)(a), (b) and (f) GDPR). Otherwise, we exclude such information from further processing wherever possible.

11.3 Where the data comes from

We obtain the data primarily from you. In the course of direct search, we also collect data from publicly accessible professional sources, in particular from profiles on professional networks such as LinkedIn and XING, from company websites, specialist publications, press releases, commercial registers and industry directories, and from trade fair and event documentation. Further sources are recommendations from our network, referees you name to us and our own candidate pool. We research only information relating to your professional activities; your private life is not the subject of our research.

If we approach you without you having contacted us first, we inform you about the data processing at the latest at the time of our first contact with you, and in any event within one month, and refer you to this privacy policy (Art. 14 GDPR).

11.4 Purposes of processing

• identification, approach and selection of suitable candidates for our clients’ positions;
• assessment of your suitability and fit, including interviews, candidate audit, psychometric assessment and references;
• preparation of candidate profiles and reports for our clients, after you have given your consent;
• communication and scheduling with you and our clients;
• support during contract negotiations and during the first months after you have changed jobs;
• inclusion in our candidate pool so that we can present suitable positions to you in future;
• quality assurance, documentation and evidence of our services, and the defence and assertion of legal claims;
• verification of the authenticity of submitted documents to protect our clients and honest candidates.

11.5 Legal bases

• Art. 6(1)(b) GDPR, insofar as you apply to us or are involved in a selection process with us (steps taken at your request prior to entering into a contract);
• Art. 6(1)(f) GDPR for direct search, the research of publicly accessible professional information, quality assurance, the verification of the authenticity of documents and the defence of legal claims. Our legitimate interest lies in carrying out our activities as an executive search firm; our clients’ interest lies in filling their positions. We safeguard your interests by processing only professional information, informing you at an early stage and passing on your data only with your consent. You can object to the processing at any time (Section 16);
• Art. 6(1)(a) GDPR (consent) for the disclosure of your documents to clients, inclusion in our candidate pool beyond the usual period, the recording of conversations, psychometric assessment procedures and the obtaining of references;
• Art. 6(1)(c) GDPR, insofar as legal obligations exist, such as retention obligations;
• Art. 9(2)(a), (b) and (f) GDPR for special categories of personal data (Section 11.2).

You can withdraw any consent you have given at any time with effect for the future. The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.

11.6 Disclosure to clients

We pass on your data to a client only if you have given your prior consent, in each case for the specific position. We often present candidates initially in anonymised form. The client then processes the data received under its own responsibility for its selection process. We treat your salary expectations, your current position and your intention to change jobs as confidential. Your current employer will learn nothing from us.

11.7 Applicant tracking system

We manage candidate data in the applicant tracking system Coveto, provided by Coveto ATS GmbH, Alois-Thums-Straße 11, 63667 Nidda. Applications submitted via our online forms are received directly into this system. Coveto processes the data on our behalf. A data processing agreement has been concluded with Coveto.

11.8 Interviews, recording and transcription

We conduct interviews in person, by phone or by video conference. We take notes of the conversations. We record conversations only if you have given your express prior consent. In this case, we may convert the recording into text, summarise it and evaluate it for our assessment and reports with the support of artificial intelligence (Section 12). We delete the audio recording as soon as the evaluation has been completed, and at the latest after three months. Without your consent, we do not make any recordings; you will suffer no disadvantage as a result.

11.9 Authenticity of documents, references and assessment

To protect our clients and all honest candidates, we check submitted documents for plausibility and signs of subsequent alteration, including with the help of our own software. If any irregularities arise, we clarify them with you before drawing any conclusions.

We obtain references only with your consent and only from persons whom you name to us or to whom you have agreed. We carry out psychometric assessment procedures only with your consent; we inform you separately in advance about the respective procedure and any providers involved. We discuss the results with you.

11.10 Storage period and candidate pool

• After the conclusion of a selection process in which you were involved, we store your data for up to six months in order to answer queries and to be able to defend against legal claims (Art. 6(1)(f) GDPR).
• With your consent, we include you in our candidate pool so that we can present suitable positions to you in future. We then store the data until you withdraw your consent, but for no longer than three years after the last contact. Before this period expires, we ask you whether you wish to remain in the pool.
• If we have contacted you in the course of direct search and you have not responded or have not expressed any interest, we limit storage to the information necessary to ensure that we do not approach you again against your wishes. At your request, we delete all data.
• If you are hired through us, we retain the documents required for invoicing and as evidence of our services in accordance with the statutory periods, generally six to ten years.

12. Use of artificial intelligence

Artificial intelligence (AI) is an integral part of our work. It helps us to research more thoroughly, evaluate documents more carefully and respond more quickly. Decisions about people are always made by people. This section explains how we use AI and how we protect your data in doing so.

12.1 Areas of use

We use AI-supported systems in particular for the following tasks:

• Research and identification: analysis of markets, companies and organisational structures, and identification of potentially suitable candidates from publicly accessible professional sources and our candidate pool, including semantic search;
• Evaluation of documents: extracting, structuring, summarising and translating CVs, references, cover letters and other application documents, including optical character recognition (OCR);
• Matching against requirements: comparison of qualifications and experience with the requirements profile of a position as a basis for assessment by our consultants;
• Interview preparation and follow-up: preparation of interview guides, transcription and summarising of conversations (only with consent, Section 11.8), structuring of conversation notes;
• Reports and documents: drafts of candidate profiles, reports, short profiles and career summaries, which our consultants review, revise and take responsibility for;
• Verification of documents: detection of inconsistencies and signs of subsequent alteration (Section 11.9);
• Communication: drafting, translation and linguistic revision of correspondence;
• Organisation: scheduling, follow-ups, evaluation and quality assurance of our processes.

12.2 Which systems we use

We use AI language models and AI-supported software from established technology providers, AI functions in our specialist software and our own applications built on these services. We use only services that

• act as processors pursuant to Art. 28 GDPR in accordance with our instructions,
• have contractually undertaken not to use your data to train their models, and
• store your data only for as long as is necessary to provide the service and to prevent misuse.

The providers are based in the European Union or in the USA. For transfers to the USA, see Section 14. We will provide you with a current list of the AI services we use on request.

12.3 Principles

• People decide. AI results serve as a basis for our work. Whether we approach you, present a position to you or recommend you to a client is decided by a consultant after their own review. No decision based solely on automated processing within the meaning of Art. 22 GDPR which produces legal effects concerning you or similarly significantly affects you takes place.
• Review of results. AI can make mistakes. We check results for accuracy before using them and correct any errors.
• Data minimisation. We provide AI services only with the data required for the respective task. Where the task permits, we remove names and contact details beforehand or replace them with identifiers.
• No discrimination. Characteristics protected under the AGG (German General Equal Treatment Act), such as gender, age, origin, religion or disability, are not criteria in our assessment, including in AI-supported evaluations.
• No profiling beyond professional life. We do not use AI to evaluate information from your private life and do not create personality profiles from publicly accessible sources.
• Transparency. On request, we will inform you whether and for which tasks your data has been processed using AI.

12.4 Legal bases

Processing with AI support is carried out on the same legal bases as the respective processing without AI (Sections 10 and 11), in particular Art. 6(1)(b) GDPR in the context of a selection process and Art. 6(1)(f) GDPR. Our legitimate interest lies in thorough, prompt and high-quality executive search. For recordings of conversations and for special categories of personal data, Art. 6(1)(a) GDPR and Art. 9(2) GDPR apply respectively.

12.5 Your objection

You can object to the AI-supported processing of your data at any time. We will then process your documents without AI support, insofar as this is possible with reasonable effort; you will suffer no disadvantage in the selection process as a result.

13. Recipients and processors

Within KON-PART, only those persons who need your data to perform their tasks have access to it, in particular the responsible consultant and our research team. The partners of KON-PART are self-employed and work with KON-PART GmbH as independent associates; they are bound to confidentiality and to compliance with data protection law.

In addition, we use carefully selected service providers that process data on our behalf and in accordance with our instructions (Art. 28 GDPR):

• hosting, email and web space (IONOS SE);
• applicant tracking system (Coveto ATS GmbH);
• customer relationship management, accounting and office software, including cloud storage;
• telephony and video conferencing;
• AI services (Section 12);
• appointment booking (Calendly LLC);
• IT service providers for operation, maintenance and data backup.

Further recipients are, with your consent, our clients (Section 11.6) and, where necessary, tax advisers, lawyers and public authorities in the context of statutory obligations. In the case of assignments that we carry out jointly with cooperation partners, we inform you of their involvement before passing on data to them. We do not sell data.

14. Transfers to third countries

Some of our service providers, in particular providers of AI services and of appointment booking, are based in the USA or access data from there. Data is transferred only if an adequate level of data protection is ensured:

• on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, provided the recipient is certified under it (Art. 45 GDPR), or
• on the basis of the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR), supplemented where necessary by supplementary measures.

We will provide you with a copy of the respective safeguards on request. Clients based outside the European Union receive your data only with your consent.

15. Storage period

We store personal data only for as long as is necessary for the respective purpose, as you have consented to, or as required by statutory retention periods. The specific periods are stated in the respective sections. We retain documents relevant under commercial and tax law for six or ten years respectively, in accordance with § 257 HGB (German Commercial Code) and § 147 AO (German Fiscal Code). After the periods have expired, the data is deleted or anonymised.

16. Your rights

Under the GDPR, you have the following rights:

• the right of access to the data we process (Art. 15),
• the right to rectification of inaccurate data (Art. 16),
• the right to erasure (Art. 17),
• the right to restriction of processing (Art. 18),
• the right to data portability (Art. 20),
• the right to withdraw consent given, with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): If we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds which override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can object to direct approaches by us and to inclusion in our candidate pool at any time without giving reasons.

To exercise your rights, a message to kontakt@kon-part.de or to our postal address is sufficient.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your place of residence, your place of work or the place of the alleged infringement. The supervisory authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

18. Data security

We protect your data by means of technical and organisational measures that reflect the state of the art, including encrypted transmission, access restrictions based on the need-to-know principle, regular encrypted data backups and the obligation of all persons involved to maintain confidentiality. We continuously review and improve our measures.

There is no obligation to provide us with personal data. Without the necessary information, however, we cannot include you in a selection process or process your enquiry.

19. Changes to this privacy policy

We amend this privacy policy when our data processing or the legal situation changes. The version published on this website at the relevant time applies.

As of October 2026