Privacy Notice

1. Controller

2. Applicable Data Protection Laws

We process personal data in accordance with the data-protection laws applicable to the relevant processing activity. Depending on the circumstances, this may include the data-protection laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and, where its territorial scope applies, Regulation (EU) 2016/679 (GDPR) and supplementary national laws.

References to GDPR legal bases in this notice apply only where the GDPR applies to the relevant processing activity.

3. Hosting and Technical Delivery

This website is delivered using Vercel infrastructure. When the website is accessed, technically necessary data may be processed, including IP address, date and time of access, requested resource, browser and device information, referrer information, and technical log and security data.

Processing serves website delivery, security, stability, error analysis and protection against abusive or malicious access. Where the GDPR applies, processing is in particular based on Article 6(1)(f) GDPR, our legitimate interest being the secure and reliable operation of the website.

Use of international hosting and infrastructure services may involve processing outside the European Economic Area. Where applicable law requires specific safeguards for such transfers, the legally required transfer mechanisms are used.

4. Contact

If you contact us by email, telephone or through the contact functionality on this website, we process the information you provide to handle and respond to your enquiry and for related follow-up communications.

Where the GDPR applies, processing may be based on Article 6(1)(b) GDPR for pre-contractual measures or Article 6(1)(f) GDPR for legitimate business communications.

The current website contact form does not send the entered information directly to a proprietary form server; it opens the email application configured on your device with a prepared message.

5. Candidate, Applicant and Recruitment Data

In connection with recruitment consulting, executive search, direct search, interim, freelance and related recruitment services, we may process candidate and applicant data including names, contact details, CV and employment history, education, qualifications, language skills, compensation information, availability, notice periods, interview notes, preferences, references and other information relevant to a recruitment process.

We process such data to identify, approach, assess and introduce suitable candidates, manage recruitment and placement processes, communicate with candidates and clients, and document our recruitment activities.

Where the GDPR applies, processing may be based depending on the circumstances on Article 6(1)(b), Article 6(1)(f) or, where required, consent. Our legitimate interests include the professional provision of recruitment and placement services and maintenance of a professionally relevant candidate network.

6. Sources of Data in Direct Search

For executive search and direct search, professional information may also be obtained from publicly available or professionally provided sources, including professional networks, company websites, public profiles, professional directories, referrals, business partners or information supplied by candidates themselves.

Where the GDPR applies and personal data is not obtained directly from the individual, we provide the information required by applicable law unless a statutory exception applies.

7. Clients and Other Recipients

Candidate data may be disclosed to prospective employers, clients and persons involved in their recruitment decision where this serves a specific or apparent recruitment purpose. Selected IT, hosting, communications, cloud, legal, tax or other service providers may also receive data to the extent necessary to provide their respective services.

Disclosures are made only for legitimate business purposes and subject to applicable data-protection and confidentiality requirements.

8. International Data Transfers

Kossmehl Consult FZ LLC is established in Ras Al Khaimah, United Arab Emirates, and operates internationally. Personal data may therefore be processed or transferred across borders, including between the UAE, the European Union or European Economic Area, and other countries in which candidates, clients or service providers are located.

Where applicable law imposes additional requirements on international transfers, we use the required legal mechanisms. Where the GDPR applies, these may include adequacy decisions, appropriate safeguards under Article 46 GDPR including applicable Standard Contractual Clauses, or legally available derogations.

9. Retention

We generally retain personal data only for as long as necessary for the relevant purpose or for applicable legal retention, evidence or documentation obligations.

Data may also be retained where necessary for the establishment, exercise or defence of legal claims. For candidate and recruitment data, the applicable retention period depends in particular on whether a process remains active, whether further professional contact can reasonably be expected and which legal requirements apply.

10. Cookies, Tracking and External Content

Based on the website's current technical configuration, we do not use our own analytics or marketing cookies and do not embed external fonts, maps or marketing tracking services. Technically necessary activities of the hosting provider remain unaffected.

If analytics, marketing or other external services are introduced in the future, this notice will be updated and consent will be obtained before activation where legally required.

11. Data Subject Rights

To the extent provided by applicable data-protection laws, individuals may have rights including access, rectification, erasure, restriction of processing, objection and, where applicable, data portability.

Where processing is based on consent, consent may generally be withdrawn for the future without affecting the lawfulness of processing before withdrawal.

Where the GDPR applies, individuals also have the right to lodge a complaint with a competent supervisory authority.

Requests may be sent to info@kossmehl-consulting.de.

12. Requirement to Provide Data

Providing personal data is generally voluntary. Certain information may, however, be required for us to answer an enquiry, conduct a recruitment process or provide contractual or pre-contractual services. If required information is not provided, the relevant service may not be possible or may be limited.

13. Automated Decision-Making

We generally do not make decisions based solely on automated processing that produce legal or similarly significant effects using personal data processed through this website or our recruitment activities, unless otherwise expressly communicated in a specific case.

14. Data Security

We use appropriate technical and organisational measures designed to protect personal data against loss, misuse, unauthorised access, unauthorised disclosure or other unlawful processing, taking account of the nature of the data, purpose of processing and relevant risks.

15. Updates

We may update this Privacy Notice when our processing activities, service providers, technical functions or legal requirements change. The version published on this website is the current version.