MICHAEL THIESS Management Consultants
Managing Director: Michael Thiess
Link to legal: http://www.michaelthiess.com/contact/legal/?lang=en
Types of processed data
- inventory data (e.g. names, addresses).
- contact data (e.g. email, telephone numbers).
- content data (e.g. text input, logos).
- usage data (e.g. visited websites, interests in content, access times).
- meta/communication data (e.g. device information, IP addresses).
- application data, also within the framework of Executive Search (profession, work experience, family status, certificates).
Groups of affected persons
Visitors and users of the online offering (followingly we refer to the affected persons as “users”).
Purpose of the processing
- provision of the online offering, its functions and contents
- answering of contact requests and communication with users
- security measures
- audience reach measurement
„Personal data“ is all information referring to an identified or identifiable natural person (followingly referred to as “affected person”). A natural person is considered identifiable, when it can be directly or indirectly identified, in particular by means of assignment to an identifier, such as a name to an identification number, to location data, to an online identifier (e.g. cookie) or to one or more special attributes which can be expression of the physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person.
“Processing” refers to any process, whether or not carried out with the aid of automated procedures, in connection with personal data. The term extends over a wide range and covers virtually every handling of data.
“Responsible person” means the natural or legal person, public authority, public institution or anybody that decides, alone or in consensus with others on the purposes and means of processing personal data.
“External processors“ are natural or legal persons, authorities, state bodies or different entities, which process personal data in behalf of persons responsible.
Underlying legal basis
We take appropriate technical and organizational measures in accordance with Art. 32 GDPR, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different likelihood and severity of the risk to the rights and personal freedoms of natural persons to ensure a level of protection appropriate to the risk.
Measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as their access, input, disclosure, security of availability and separation. We have also set up procedures to ensure the compliance with affected people’s rights, data deletion and reaction to data vulnerability. Furthermore, we already consider the protection of personal data in the development, or selection of hardware, software and procedures, according to the principle of data protection through technology design and privacy-friendly default settings (Art. 25 GDPR).
Cooperation with data processing companies and third–parties
If in the context of our data processing, we disclose data to other persons and companies external processors or third-parties), transmit them to them or otherwise grant them access to the data, this will only happen on the basis of a legal license (e.g. if a transmission of the data to third-parties, as to payment service providers, referring to Art. 6.1 lit. b of the GDPR, is required to fulfill the contract), if you have agreed, if we have the legal obligation to do so or based on our legitimate interests (e.g. the use of agents, webhosts, etc.).
If we commission third-parties to process data on the basis of a so-called “data processing contract”, this is done on the basis of Art. 28 of the GDPR.
Transmission to third countries
If we process data in a third country (this means outside the European Union (EU) or the European Economic Area (EEA)) or in the context of the use of third-party services, disclosure or transmission of data to third-parties, this will only be done if it is to fulfill our (pre)-contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only in the presence of the special conditions of Art. 44 et seq. GDPR. This means that the processing happens e.g. on the basis of specific guarantees, such as the officially recognized level of data protection on EU-equal level (e.g. for the United States through the “Privacy Shield”) or compliance with officially recognized special contractual obligations (so-called “standard contractual clauses”).
Legal rights of affected persons
You have the right to demand a confirmation as to whether the data in question is being processed, for inquiry about this data as well as for further information and a copy of the data in accordance with Art. 15 GDPR.
You have according to Art. 16 GDPR the right to demand the completion of the data concerning you or the correction of incorrect data concerning you.
In accordance with Art. 17 GDPR, you have the right to demand that the relevant data will be deleted immediately or, alternatively, to require a restriction of the processing of data in accordance with Art. 18 GDPR.
You have the right to receive data concerning you that you have provided to us in accordance with Art. 20 GDPR and to request their transmission to other responsible persons.
According to Art. 77 GDPR you have the right to lodge a complaint with the responsible supervisory authority.
Right of revocation
You have got the legal right to revoke any given consents according to Art. 7.3 GDPR for the future.
Right of objection
You can object to the future processing of your data in accordance with Art. 21 GDPR at any time. The objection may, in particular, be made against processing for direct marketing purposes.
Cookies and right of objection in direct marketing
“Cookies” are small files that are stored on users’ computers. Different information can be stored in the cookies. A cookie is primarily used to store the information about a user (or the device on which the cookie is stored) during or after his visit to an online offering. Cookies that are deleted after the user leaves an online service and closes the browser are called temporary cookies, or “session cookies” or “transient cookies”. In such a cookie, e.g. the contents of a shopping cart in an online shop or a login status can be saved. The term “permanent” or “persistent” refers to cookies that remain stored even after the browser has been closed. Thus, e.g. the login status could be saved if users visit it after several days. Likewise, in such a cookie the interests of the users can be stored, which are used for range measurement or marketing purposes.
A “third-party cookie” refers to cookies that are offered by providers other than the person who manages the online offering (if the cookies only belong to the responsible person they are called “first-party cookies”).
If users do not want cookies to be stored on their device, they will be asked to disable the option in their browser’s system settings. Saved cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this online offering.
Provision of contractual services
We process the data of our contractual partners and interested parties as well as other contracting authorities, customers, clients or contractual partners (uniformly referred to as “contractual partners”) in accordance with Art. 6.1 lit. b GDPR in order to provide you with our contractual or pre-contractual services. The data processed, the nature, scope and purpose and necessity of its processing are determined by the underlying contractual relationship.
The processed data includes the master data of our contractual partners (e.g. names and addresses), contact data (e.g. email addresses and telephone numbers) as well as contract data (e.g. services used, contract contents, contractual communication, names of contact persons) and payment data (e.g. bank details, payment history). In principle, we do not process special categories of personal data, unless they are part of a commissioned or contractual processing.
We process data which are necessary for the establishment and fulfillment of the contractual services and point out the necessity of providing the information, if this is not evident for the contractual partners. Disclosure to external persons or companies will only be made if required by contract. When processing the data provided to us within the framework of a contract, we act in accordance with the instructions of the client as well as the legal requirements.
As part of the use of our online services, we store the IP address and the time of each user action. The storage is based on our legitimate interests, as well as the user’s protection against misuse and other unauthorized use. A disclosure of this data to third-parties is inherently not done unless it is necessary for the pursuit of our claims or there is a legal obligation in accordance with. Art. 6.1 lit. c GDPR.
The deletion of the data takes place after the expiration of legal warranty and comparable obligations, the necessity of the storage of the data is checked every three years; in the case of legal archiving obligations, the deletion takes place after its expiration. Information stays saved in the customer’s account until the account is deleted.
Administration, financial accounting, office organization, contact organization
We process data in the context of administrative tasks as well as the organization of our operations, financial accounting and compliance with statutory obligations, such as archiving. In doing so, we process the same data that we process in the course of performing our contractual services. The processing principles are Art. 6.1 lit. c GDPR, Art. 6.1 lit. f and Art. 28 of the GDPR. The processing affects customers, prospects, business partners and website visitors. The purpose and our interest in processing lies in the administration, financial accounting, office organization, archiving of data, i.e. tasks that serve to maintain our business activities, perform our tasks and provide our services. The deletion of data in terms of contractual services and contractual communications information refers to information given in these processing activities.
We disclose or transmit data to the financial administration, consultants, such as for example, accountants or auditors, and other fee and payment service providers.
Furthermore, we store information based on our business interests regarding suppliers, promoters and other business partners, e.g. for the sake of later contact. We store this mainly company-related data basically permanent.
We process the applicant data only for the purpose and in the context of the application process in accordance with the legal requirements. The processing of the applicant data takes place in order to fulfill our (pre-)contractual obligations in the context of the application process within the meaning of Art. 6.1 lit. b GDPR Art. 6.1 lit. f GDPR if the data processing e.g. is required for us in the context of legal proceedings (in Germany, § 26 BDSG applies additionally).
The application process requires applicants to provide us with the applicant data. The necessary applicant data are derived from the job descriptions and basically include the personal details, postal and contact addresses and the documents that belong to the application, such as cover letter, CV and certificates. In addition, applicants can voluntarily provide us with additional information.
Insofar as special categories of personal data within the meaning of Art. 9.1 GDPR are voluntarily communicated within the framework of the application procedure, their processing is additionally carried out in accordance with Art. 9.2 lit. b GDPR (e.g., health information such as disability or ethnic origin). Insofar as special categories of personal data within the meaning of Art. 9.1 GDPR are requested from applicants in the context of the application procedure, their processing is additionally carried out in accordance with Art. 9. 2 lit. a GDPR (for example health data, if necessary for the respective profession).
Applicants can send us their applications via email. However, please note that emails are generally not sent in encrypted form and that applicants themselves must provide encryption. Therefore, we cannot take any responsibility for the transmission of the application between sending and the reception on our server and therefore recommend using postal shipping. Instead of applying via email, applicants still have the opportunity to send us the application via post.
The data provided by the applicants may be further processed by us in the event of a successful application for employment purposes. Otherwise, if the application for a job offer is not successful, the applicants’ data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which the applicants are able to request at any time.
The deletion is done after the expiration of a period of six months, when a legitimate cancellation of the candidate is present, so that we can answer any follow-up questions to the application and meet our obligations under the Equal Treatment Act. Invoices for any reimbursement of travel expenses are archived in accordance with the tax regulations.
Disclaimer Executive Search
When contacting us (for example via e-mail, telephone or via social media), the information provided by the user for processing the contact request and processing it in accordance with Art. 6.1 lit. b GDPR is processed. User information can be stored in a Customer Relationship Management System (“CRM System”) or comparable request organization.
We delete the requests if they are no longer required. We check the necessity every two years; furthermore, the legal archiving obligations apply.
Hosting and E-Mail transmission
The hosting services we use are for the purpose of providing the following services: infrastructure and platform services, computing capacity, storage and database services, e-mail transmission security services, and technical maintenance services we use to operate this online service.
In doing so, we or our hosting provider process stock data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors of this online offering on the basis of our legitimate interests in an efficient and secure provision of this online service in accordance with Art. 6.1 lit. f GDPR in connection with Art. 28 GDPR (conclusion of the data processing contract).
Collection of access data and log files
We or our hosting provider collects data on the basis of our legitimate interests within the meaning of Art. 6.1 lit. f GDPR on every access to the server on which this service is located on (so-called server log files). The access data include the name of the retrieved web page, file, date and time of the call, amount of data transferred, message about successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.
Logfile information is stored for security reasons (for example, to investigate abusive or fraudulent activities) for a maximum of 7 days and then deleted. Data which further retention is required for evidential purposes shall be exempted from the cancellation until final clarification of the incident.
Deletion of data
According to legal requirements in Germany, the storage takes place in particular for 6 years in compliance with § 257.1 HGB (trading books, inventories, opening balance sheets, annual accounts, trade letters, accounting documents, etc.) and for 10 years pursuant to § 147.1 AO (books, records, management reports, accounting records, trade and business letters, documents relevant to taxation, etc.).
Online presences in social media
We maintain an online presence on social networks and platforms in order to communicate with customers, prospects and users active there and to inform them about our services. When calling up the respective networks and platforms, the terms and conditions and data processing guidelines of the respective operators apply.
Please note that data from users can be processed outside the European Union. This may result in risks for the users because e.g. enforcement of user rights could be made more difficult. With respect to US providers certified under the Privacy Shield, we point out that they are committed to respecting EU privacy standards.
Furthermore, the data of the users are usually processed for market research and advertising purposes. Thus, e.g. user profiles are created from the user behavior and the resulting interests of the users. The usage profiles can in turn be used to e.g. place advertisements inside and outside the platforms that are allegedly in line with users’ interests. For these purposes, cookies are usually stored on the computers of the users, in which the user behavior and the interests are stored.
Furthermore, in the usage profiles, data can also be stored independently of the devices used by the users (in particular if the users are members of the respective platforms and logged in).
The processing of the personal data of users is based on our legitimate interests in an effective information of users and communication with users in accordance with. Art. 6.1 lit. f GDPR. If the users are asked by the respective providers for a consent to the data processing (that is, they agree to an agreement, for example, by ticking a checkbox or confirmation button), the legal basis of the processing is Art. 6.1 lit. a and Art. 7 GDPR.
For a detailed description of the respective processing and the possibilities of contradiction (opt-out), we refer to the following linked information of the providers.
Also in the case of requests for information and the assertion of user rights, we point out that these can be claimed most effectively from the providers. Only the providers have access to the data of the users and can directly take appropriate measures and provide information.
Integration of third–party services and content
Within our online offering, we rely on our legitimate interests (i.e. interest in the analysis, optimization and economic operation of our online offering within the meaning of Art. 6.1 lit. f GDPR) to use third party content and service offerings to embed e.g. videos or fonts (followingly referred to as “contents”).
This always presupposes that the third-party providers of this content perceive the IP address of the users since they could not send the content to their browser without the IP address. The IP address is therefore required for the presentation of this content. We strive to use only those content whose respective providers use the IP address only to deliver the content. Third parties may also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website.
The pseudonymous information may also be stored in cookies on the user’s device and may include, but is not limited to technical information about the browser and operating system, referring web pages, visit time, and other information regarding the use of our online offering and can also be connected with information from different sources.
Status: June 2018
This post is also available in: German