Privacy policy

1. Controller

Sven Braun
Sven Braun Executive SearchGermany

Phone: +49 156 78 32 58 68
Email: info@svenbraun.de

I have not appointed a data protection officer because the legal requirements for doing so (Art. 37 GDPR, Section 38 German Federal Data Protection Act, BDSG) are not met. If you have any questions about data protection, please contact me directly.

2. Key points at a glance

• Google Analytics is only loaded if you have consented in the cookie notice. I do not use social media plugins.
• Fonts are loaded from my own server. No connection to Google or other font providers is made when you visit the website.
• If you write to me via the contact form, by email or by phone, I process your information only to deal with your enquiry. Form submissions are not stored on the website.
• Links to LinkedIn are plain links. No data is transferred until you click a link.

3. Hosting and server log files

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The servers are located in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO.

When you visit the website, information transmitted by your browser is processed automatically (server log files):

• IP address of the requesting device
• date and time of access
• page or file requested and amount of data transferred
• website from which the access was made (referrer)
• browser and operating system used

This data is required to deliver the website and to ensure its security and stability, for example to fend off attacks. The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in the secure and error-free operation of the website. The log files are deleted automatically after the hosting provider’s short retention period, unless they are needed to investigate a specific security incident.

The connection to this website is encrypted using TLS. You can recognise this by the padlock symbol and “https://” in your browser’s address bar.

4. Cookies and storage on your device

Without your consent, this website only stores information in your browser that is strictly necessary for its operation. The legal basis for storage is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the legal basis for the subsequent processing is Art. 6(1)(f) GDPR.

• Cookie settings (Complianz): the “cmplz_…” cookies store your choice in the cookie notice so that it does not reappear on every page. Storage period: up to 365 days.
• Language setting (Polylang): the “pll_language” cookie stores whether you use the website in German or English. Storage period: up to one year.

I only use cookies for statistics and marketing with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). See section 8 for details. You can delete or block cookies in your browser at any time. The website remains usable; you may need to choose the language and cookie settings again.

5. Contact by form, email or phone

If you contact me via the contact form, by email or by phone, I process your information (for example your name, company, contact details and the content of your message) to deal with your enquiry.

Contact form: the form is provided with the WordPress plugin Contact Form 7. Name, email address and message are required; all other information is voluntary. Your entries are sent to me by email and are not stored in the website’s database. To protect against automated spam, the form contains a field that is invisible to humans (honeypot); no data is transferred to third parties and no cookies are set.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR. My legitimate interest lies in responding to your enquiry.

For email I use a professional email service with which a data processing agreement is in place. I delete your data once your enquiry has been dealt with, unless statutory retention obligations apply. I retain business correspondence in accordance with German commercial and tax law (generally six years, Section 257 German Commercial Code, Section 147 German Fiscal Code).

Booking an appointment via Microsoft Bookings: the link “Book an appointment online” takes you to Microsoft Bookings, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. I use the details you enter there (name, email address, phone number, preferred time and your message) only to arrange and hold the appointment. The legal basis is Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for enquiries not related to a contract. Microsoft processes the data as a processor within Microsoft 365 (Art. 28 GDPR). A transfer to the USA cannot be ruled out; Microsoft is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

6. Data processing in search mandates

As an executive search consultant, I search for executives on behalf of companies. In doing so, I process personal data of candidates and of contacts at clients. The following information also serves as information pursuant to Art. 14 GDPR for persons whose data I have not collected from them directly.

Candidates

• Purpose: identifying and directly approaching suitable executives for a specific search mandate, holding interviews, assessing suitability and, with your consent, presenting you to the client.
• Data: name, career history, current position and employer, business contact details, qualifications and information you share with me in conversation or in documents.
• Sources: publicly accessible, professionally oriented sources, in particular professional networks such as LinkedIn, company websites and publications, as well as recommendations from my professional network. I do not use private social networks for research.
• Legal basis: Art. 6(1)(f) GDPR for research and the first approach. My legitimate interest and that of my client lie in filling the position; your interest lies in learning about career opportunities. Once you express interest, I process your data to prepare a possible employment relationship (Art. 6(1)(b) GDPR). I only pass on your documents and my assessment to a client with your consent (Art. 6(1)(a) GDPR).
• Information: I inform you about the processing at the latest when I first contact you, and in any case within one month of collecting your data.
• Recipients: the respective client, only with your consent; otherwise exclusively service providers who support me as processors (for example for email and contact management). Where a service provider processes data in the USA, the transfer is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) or on EU standard contractual clauses (Art. 46 GDPR).
• Storage period: I delete your data no later than six months after the search mandate has been completed, unless you have consented to longer storage, for example to be contacted again about suitable positions in the future. You can withdraw such consent at any time.
• Objection: you can object to the processing at any time, including informally by email. I will then no longer contact you and will delete your data unless a retention obligation applies.

Submitting documents via the upload form

I provide candidates with a form for sending me their CV. The page is not publicly linked; I only send the link on a targeted basis.

• Purpose: Assessing your suitability for suitable leadership positions, contacting you and, only with your prior consent in each individual case, presenting you to a client.
• Data: Name, email address, optionally phone number, position reference and message, as well as your CV (PDF or Word) and the information it contains. Please do not include special categories of personal data (such as information on health, religion or political opinions).
• Legal basis: Your consent (Art. 6(1)(a) GDPR), which you give by ticking the box in the form; where you voluntarily provide special categories of data, additionally Art. 9(2)(a) GDPR. If you express interest in a specific position, I also process your data to prepare a possible employment relationship (Art. 6(1)(b) GDPR).
• Technical process: Transmission is encrypted (TLS). Your details and your CV are delivered to me by email; you receive a confirmation of receipt at the address you provided. The file is stored on the web server only temporarily for sending and is then deleted automatically; it is not stored in the website database. For sending and storing email I use Microsoft 365 (Microsoft Ireland Operations Ltd.), and for hosting the website STRATO (STRATO GmbH, Berlin), each on the basis of a data processing agreement. For transfers to the USA, the information under “Recipients” above applies.
• Recipients: I only pass your documents on to a company with your prior consent in each individual case.
• Storage period: I delete your data as soon as you withdraw your consent, but no later than six months after completion of the search mandate for which you submitted your documents. Without reference to a specific mandate, I delete your documents no later than six months after receipt, unless you have consented to longer storage.
• Withdrawal: You can withdraw your consent at any time with effect for the future, informally by email to info@svenbraun.de. The lawfulness of processing carried out before the withdrawal remains unaffected. Providing your data is voluntary; without consent, I cannot accept your documents via the form.

Clients and prospective clients

I process data of contacts at clients and prospective clients (name, position, company, contact details, correspondence) to initiate and perform mandates (Art. 6(1)(b) GDPR) and to maintain the business relationship (Art. 6(1)(f) GDPR). The data is deleted when it is no longer required for these purposes and no statutory retention obligations apply.

7. Protection of the login area

To protect the login area of this website against attacks, the security plugin “Limit Login Attempts Reloaded” stores the IP address and time of failed login attempts. The data is stored on my server and is not transferred to third parties. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in the security of the website. This processing does not take place for visitors who do not log in.

8. Google Analytics (only with consent)

If you consent to the “Statistics” category in the cookie notice, I use Google Analytics 4 of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without your consent, the service is not loaded.

• Google Analytics 4 (statistics): records how the website is used, such as pages viewed, time spent, approximate region, device and browser. Google Analytics 4 does not store IP addresses. The purpose is to improve the website and its content. Analytics data is deleted after 14 months.

The cookie notice shows in detail which cookies are set and how long they are stored. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future by changing your choice in the cookie settings (“Manage consent” button).

Google may also transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). A data processing agreement (Art. 28 GDPR) is in place for Google Analytics. Further information: policies.google.com/privacy.

9. Links to LinkedIn

This website links to my profile on LinkedIn. These are plain links, not embedded content or plugins. No data is transferred to LinkedIn until you click a link. LinkedIn is responsible for processing on its platform:

• LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

10. Your rights

Under the GDPR you have the following rights:

• access to the data I hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object under Art. 21 GDPR: where I process your data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation. I will then no longer process your data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

An informal message to info@svenbraun.de is sufficient to exercise your rights.

Right to lodge a complaint: you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de

11. Further information

• Transfers to third countries: a transfer to the USA is only possible with Google Analytics as described in section 8 and only takes place with your consent. For transfers in the course of search mandates, see section 6.
• Automated decisions: no solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
• Obligation to provide data: you are under no statutory or contractual obligation to provide me with data. Without your contact details, however, I cannot respond to your enquiry.

12. Changes

I will update this privacy policy if the website, my data processing or the legal situation changes. The version published here applies.