Privacy Policy

Learn how we collect, use, protect, and share personal data across our website, recruitment services, and candidate processes.

Privacy Policy (English Translation)

This Privacy Policy is an English translation of the German Datenschutzerklärung. In the event of discrepancies or differences in interpretation, the German version shall prevail.

1. Controller

The controller responsible for processing personal data in connection with this website and our services is:

Ethos Human Recruitment GmbH
Fritz-Werner-Straße 54 G
12107 Berlin
Germany

Represented by its Managing Director, Dirk Ohlmeier
Telephone: +49 30 49207071
Email: do@just-better.eu

Further information can be found in our Legal Notice.

2. General information

We process personal data exclusively in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Personal data means any information relating to an identified or identifiable natural person. This includes names, contact details, professional information, CVs, application documents, communication content and technical usage data.

3. Legal bases

We process personal data on the following legal bases in particular:

  • Article 6(1)(a) GDPR, where you have given consent;
  • Article 6(1)(b) GDPR, where processing is necessary to perform a contract or take steps before entering one;
  • Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation;
  • Article 6(1)(f) GDPR, where processing is necessary for legitimate interests that are not overridden by your interests or fundamental rights.

You may withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing before withdrawal.

4. Website access and hosting

Our website is provided using the Landing Rabbit website and hosting service. When you access it, technically necessary data may be processed, including your IP address, access date and time, accessed page or file, referrer URL, browser type and version, operating system and device information, and HTTP status code.

This is necessary to deliver a secure, reliable and technically functional website, identify errors and prevent misuse. The legal basis is Article 6(1)(f) GDPR. Technical log data is deleted when no longer required, unless a security review or legal obligation requires longer retention. Landing Rabbit processes operational website data on our behalf.

5. Contact forms and file submissions

You may contact us through our website and submit files, especially CVs and other professional documents. We may process your name, email address, telephone number, company and position, message content, uploaded documents, and submission time and technical information.

The information is technically received through Landing Rabbit and forwarded to our database hosted within the European Economic Area (EEA). Landing Rabbit is not intended to retain submitted information permanently beyond technical transmission.

Enquiries concerning a contract, potential collaboration, application or recruitment service are processed under Article 6(1)(b) GDPR. General business enquiries are processed under Article 6(1)(f) GDPR, based on our legitimate interest in handling and documenting business communications. We use separate consent only for processing not necessary to handle your enquiry, such as additional marketing communications.

Please do not submit special-category data, including health information, religion, trade-union membership or sexual orientation, unless strictly necessary for the relevant matter.

6. Appointment booking with meetergo

We use meetergo to schedule appointments: meetergo GmbH, Hauptstraße 44, 40789 Monheim am Rhein, Germany. When you use a meetergo booking page, it may process your name, email address, telephone number, company, requested appointment, time zone, messages, voluntary information and technical connection data.

Processing is necessary to arrange and conduct your requested appointment under Article 6(1)(b) GDPR. General business meetings may additionally be processed under Article 6(1)(f) GDPR. meetergo may connect with our Google Calendar and generate a video-conference link, and processes data on our behalf.

If you follow a meetergo link, you leave our website. If its booking page is embedded on our website, the service loads only after consent where optional cookies, external resources or similar technologies are used. Further information is available in the meetergo Privacy Policy.

7. Google Calendar and Google Meet

We use Google Calendar to manage appointments and Google Meet for video conferences. The EEA provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We may process names and email addresses, appointment and calendar information, meeting invitations, communication data, IP addresses, device information, and audio and video data during conferences. Processing is necessary for appointments and pre-contractual or contractual communications under Article 6(1)(b) GDPR; other business meetings are processed under Article 6(1)(f) GDPR.

We do not record conferences unless we inform you in advance and obtain any required consent. Google may process data outside the EEA; where required, transfers rely on an adequacy decision, EU-US Data Privacy Framework certification, Standard Contractual Clauses or other appropriate safeguards.

8. Microsoft Teams

We may alternatively use Microsoft Teams for video conferences. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Data processed may include your name and email address, meeting information, chat messages, IP address, device information, and audio and video data. Processing is based on Article 6(1)(b) GDPR for pre-contractual or contractual purposes and Article 6(1)(f) GDPR for other business meetings.

Conferences are not recorded without prior notification and any required consent. Transfers outside the EEA are subject to Microsoft safeguards, including applicable adequacy decisions and Standard Contractual Clauses.

9. Cookies and consent management

We use CookieYes to obtain, manage and document consent for optional cookies, tracking services and external content. CookieYes may process your consent status, selected categories, selection time, technical browser and device information, a pseudonymous identifier, and evidence of consent where applicable.

Saving your choice is technically necessary to remember it during later visits. The legal bases are Article 6(1)(c) and Article 6(1)(f) GDPR and Section 25(2) TDDDG. Optional technologies are activated only with your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can change or withdraw your choice at any time in Cookie Settings in the website footer.

10. Google Tag Manager and Google Analytics

We use Google Tag Manager to manage website tags and, subject to your consent, Google Analytics to analyse website use. Analytics may process IP address, device and browser information, visited pages, visit source, interactions and events, approximate geographical information, and pseudonymous online identifiers.

Processing takes place exclusively with consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. CookieYes communicates your choice to Google, and Google tags may not place analytics or marketing cookies before consent. We use a suitably configured Consent Mode implementation.

The recipient is Google Ireland Limited. Processing by affiliated companies or service providers outside the EEA is subject to Google’s safeguards. You may withdraw consent at any time through Cookie Settings.

11. LinkedIn Insight Tag and YouTube

Subject to your consent, we use the LinkedIn Insight Tag, provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, to measure visits, campaign results and conversions. It may process IP address, device and browser information, accessed pages, access time, referrer data and LinkedIn identifiers. The legal basis is consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. LinkedIn’s own privacy information applies where it processes data for its own purposes. You may withdraw consent through Cookie Settings.

We also embed YouTube videos, provided by Google Ireland Limited. When a video loads, IP address, device and browser information, the accessed page, usage and interaction data, and information from an existing Google or YouTube account may be processed. YouTube content loads only after consent to the relevant category or deliberate activation of the video. The legal basis is Article 6(1)(a) GDPR with Section 25(1) TDDDG. Where technically possible, we use privacy-enhanced mode; this does not completely prevent transmission when a video is played.

12. Executive search and candidate data

As part of our executive-search, recruitment-consulting and placement services, we process candidate data. This may include names and contact details; current and former employers; positions and responsibilities; publicly available professional information; CVs, qualifications and experience; salary expectations, availability, location and mobility; interview notes, assessments, professional interests, correspondence, appointment information and, where lawful and agreed, references.

We obtain data directly from candidates, public professional sources, LinkedIn, Xing and comparable networks, legally usable recruitment and CV databases, our candidate database, recommendations, clients and professional contacts. If we did not collect your data directly, we provide Article 14 GDPR information generally no later than our first contact, within the statutory period or before first disclosure.

We use data to assess experience and interests, discuss opportunities, assess suitability for assignments, create anonymised profiles, coordinate meetings, conduct possible placements and maintain our professional network. Processing for a specific recruitment process generally relies on Article 6(1)(b) GDPR. Identifying and initially contacting suitable executives generally relies on Article 6(1)(f) GDPR, based on our and our clients’ legitimate interests in filling specialist and executive roles. You may object to Article 6(1)(f) processing for reasons relating to your particular situation.

13. AI-assisted CV structuring

For internal support, our own application accesses Mistral AI models through an API. The provider is Mistral AI SAS, 15 rue des Halles, 75001 Paris, France. CV content, including names, contact details, qualifications and experience, may be transferred to and technically processed through the Mistral API.

The AI is used solely to summarise and structure CVs. It does not decide candidate suitability, selection, rejection or placement. Responsible individuals make all assessments and decisions; no decision with legal or similarly significant effects is made solely by automated means under Article 22 GDPR.

We have opted out of use of API inputs and outputs for model training, disabled training use and activated Zero Data Retention. Inputs and outputs are not retained beyond immediate technical processing, except for mandatory legal or security-related exceptions. Candidate data is not published or submitted through feedback or model-training functions.

Mistral AI acts as our processor under an Article 28 GDPR data-processing agreement. The legal basis is generally Article 6(1)(b) or Article 6(1)(f) GDPR, depending on the recruitment process. We minimise data and remove or pseudonymise direct identifiers where possible. Transfers by subprocessors outside the EEA use adequacy decisions, Standard Contractual Clauses or other safeguards under Articles 44 et seq. GDPR.

14. Candidate database and retention

Candidate and contact data is held in our own database hosted within the EEA. Access is restricted to authorised individuals. Our technical and organisational measures include role-based permissions, secure authentication, encryption, backups, security-event logging and regular access reviews. The hosting provider acts on our behalf under Article 28 GDPR.

We retain data only as long as needed for the relevant purpose. Candidate profiles are generally retained for up to 36 months after the last relevant professional contact. Relevant contact can include a profile update, interview, application, approval, assignment or substantive communication about professional opportunities, and restarts the 36-month period.

When no continuing contact or documented reason for retention exists, data is deleted or we ask for confirmation to retain it. Objections and consent withdrawals are considered regardless of this period. We may keep minimal suppression-list data after an objection to prevent accidental future contact, based on Article 6(1)(f) GDPR. Data for specific placements may be retained longer for legal claims or statutory commercial and tax obligations. General enquiry data is deleted after resolution unless further grounds apply.

15. Client disclosures and recipients

Clients initially receive anonymised candidate profiles. We disclose a candidate’s name, contact details, complete CV or other direct identifiers only after the candidate expressly approves disclosure for that specific process. The legal basis is Article 6(1)(a) GDPR. Approval can be withdrawn for the future but cannot reverse a lawful prior disclosure. We inform you of the specific client before requesting approval. After disclosure, the client generally processes the information independently as controller.

Depending on the process, recipients may include website, hosting, database and IT providers; consent-management, communication, email, calendar, video-conference and appointment-booking providers; analytics and marketing providers following consent; Mistral AI; approved clients; legal, tax and other advisers; and public authorities or courts where legally required. Processors are contractually bound under Article 28 GDPR.

16. International transfers and data security

Some providers may process personal data outside the EU or EEA. Transfers occur only where Articles 44 et seq. GDPR requirements are met, including through an adequacy decision, valid EU-US Data Privacy Framework certification, European Commission Standard Contractual Clauses and additional technical and organisational safeguards. Despite these measures, protection in some countries, particularly the United States, may differ from European standards. Optional website services involving third-country transfers activate only after consent.

We implement appropriate technical and organisational measures to protect data against loss, manipulation, unauthorised access and unlawful disclosure. Measures are regularly reviewed and adjusted according to the state of the art, implementation costs, processing context and risks to individuals.

17. Required data and your rights

Providing personal data is generally voluntary. However, certain information is needed to answer an enquiry, arrange an appointment or carry out a recruitment process. Without it, we may be unable to provide the requested service, or may provide it only to a limited extent.

Subject to legal requirements, you have rights to access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20), objection (Article 21), withdrawal of consent and complaint to a supervisory authority. To exercise your rights, contact do@just-better.eu. We may request suitable proof of identity to protect your information.

Where data is processed for direct marketing, you may object at any time. Following objection, we will no longer use your data for direct marketing.

18. Complaints and policy updates

You have the right to lodge a complaint with a data protection supervisory authority. The authority generally responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information. Current contact details are available at www.datenschutz-berlin.de. You may also contact the authority responsible for your habitual residence, place of work or the place of the alleged infringement.

We may update this Privacy Policy if our website, internal processes, service providers or legal requirements change.

Last updated: September 2026