Privacy Policy - Montalbetti Partners

1. Who we are

Montalbetti Partners GmbH is a retained executive search company in the financial and professional services sectors.

This policy applies to you if you are one of our clients, suppliers, candidates, applicants for a job with Montalbetti Partners, or a referee in respect of a candidate.

We protect your privacy and your private information. We collect, process, and use your personal data following the content of this Privacy Notice and the applicable European and German data protection regulations.

This Privacy Notice governs the extent to which we collect, process, and use personal information about you. We, therefore, ask you to read the following instructions carefully.

2. Controller’s name and contact details

The controller pursuant to Art. 4 (7) of the EU General Data Protection Regulation (GDPR) is:

Montalbetti Partners GmbH
Hochstraße 31
60313 Frankfurt
Telefon: +49 69 219 389838
E-Mail: hello@montalbetti.com

3. Collection and storage of personal data, categories and purpose of processing

What personal data do we collect about you?

We collect the necessary information to provide our executive search and leadership advisory services.

Candidates/Applicants: Personal Data, includes CV’s, identification documents, educational records, work history, employment, and references. We may also collect sensitive personal data. We only collect sensitive personal data, and process this data, if you have given explicit consent.

Clients & Suppliers: Personal Data, Contact Data, Financial Data and Services Data when we correspond with our clients about our services.

Where do we collect personal data?

The following are the various sources we may collect personal data about you:

Directly from you. This is information you provide while searching for a new opportunity and during the different recruitment stages.
From an agent/third party acting on your behalf. e.g. external researchers, Interim Management companies, and data providers such as Loxo Source, Contact Out etc.
Through publicly available sources such as LinkedIn, Xing, Viadeo, and RocketReach.
Company Websites

How and why do we use personal data?

We use candidates‘ data to match their skills, experience, and education with potential employers. We initially collect basic information on candidates such as contact details, job roles and experience when we conduct our talent mapping exercises to help our clients understand the current market and to find potential candidates for our clients. If a candidate is longlisted and goes through to the next stages, we will collect more information at the interview (or equivalent) stage and onwards in that manner.

Furthermore, we may use your Personal Information to provide you with our newsletter, email notifications and other communications by email.

What legal basis do we have for using this information?

For candidates, interim managers, referees and clients, our processing is necessary for our legitimate interests. We need the information to assess suitability for potential roles, find potential candidates and contact clients and referees, develop our services and grow our business.

The legal basis for the collection of the relevant data is our legitimate interest pursuant to Art. 6 (1) lit. f) GDPR.

The data will be provided voluntarily. The more information will be provided, the better the evaluation of aptitude with job positions of clients and the subsequent placement of candidates. To evaluate a candidate’s professional profile, it may also be required to collect further information about the candidate through assessments (Hogan and MSA Profil). Then this may involve processing more detailed personal data, including sensitive data. In that case, we always ask for consent before undertaking such processing.

For clients, we may also rely on our processing being necessary to perform our services.

How long do we keep personal data?

If no interaction takes place within a period of five years, the stored personal data will be deleted after the expiry of this period.

This storage is based on the legitimate interest in a long-term collaboration that goes beyond a specific assignment, a specific placement, or a specific evaluation.

4. Share of data

Who do we share personal data with?

Initially, the data will be processed within the Montalbetti Partners only. We use third-party providers to help us administer certain activities and services. We use Microsoft, SharePoint, OneDrive and Loxo.co to store data.

However, depending on how and where the Services need to be performed, candidate’s personal data may be shared with clients, selected external partners who are processing assessments, and other providers such as travel agencies etc.

To conduct mapping or research exercises on behalf of our clients to enable them to understand the market, we may share some basic information about the potential candidates, such as first name, last name, current employer and current position, and some basic information about education and work history. The information disclosed will be limited to what is necessary for this purpose.

A transfer of personal data (candidate’s CV and contact details) to clients occurs only if a candidate is suitable for a position with a client or matches the client’s job specifications, and we have the candidate’s consent. In this case, clients will receive a confidential report on the candidate. The confidential report provides all the client’s relevant information about the candidate to assess whether the candidate is suitable for a position.

Passing on data to clients is compulsory for successful placements. The legal basis for the transfer is our legitimate interest (Art. 6 (1) lit. f) GDPR).

It is expressly stated that it may be possible that database servers of clients to whom candidate information is being sent are in third countries outside the European Economic Area (EEA), where the EU Commission has confirmed no adequate level of data protection.

5. Your rights

You have the following rights towards us with regard to your personal data:

Right to information,
Right to correction or deletion,
Right to restriction of processing,
Right to refusal of processing,
Right to data portability.

You also have the right to lodge a complaint about our processing of your personal data with a data protection authority.

6. Withdrawal of consent or objection to the processing of your data

If you have given your consent to the processing of your data, you can revoke it at any time. Such a revocation affects the permissibility of the processing of your personal data after you have given it to us.

Insofar as we base the processing of your personal data on the balancing of interests, you can object to the processing. This is the case if, in particular, the processing is not necessary for the fulfilment of a contract with you, which is described by us in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will examine the situation and will either discontinue or adapt the data processing or show you our compelling reasons worthy of protection on the basis of which we will continue the processing.

7. Collection of personal data when you visit our website

If you use the website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (legal basis is Art. 6 (1) lit. f) GDPR):

IP address
Date and time of the enquiry
Time zone difference from Greenwich Mean Time (GMT)
Content of the request (specific page)
Access status / HTTP status code
Quantity of data transferred in each case
The website from which the request comes
Browser
Operating system and its interface
Language and version of the browser software.

In addition to the aforementioned data, technically necessary and, optionally, technically unnecessary cookies are stored on your computer if you give your consent. Cookies are small text files that are stored on your hard drive assigned to the browser you are using and through which certain information flows to the body that sets the cookie (in this case us). They are used to make the website more user-friendly and effective overall.

If cookies are set on our website that require your consent, we will inform you about this separately within this privacy policy. If you have given your consent to this, you can revoke it at any time via the cookie banner on our website.

Google Analytics

If you have given your consent, Google Analytics 4, a web analytics service provided by Google LLC, is used on this website. The controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

Google Analytics 4 uses cookies that enable us to analyse your use of our website. The information collected by the cookies about your use of this website is usually transferred to a Google server in the USA and stored there.

In Google Analytics 4, the anonymisation of IP addresses is activated by default. Due to IP anonymisation, your IP address will be truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

Your user behaviour is recorded during your visit to the website. In addition to the personal data mentioned under section 7 of this declaration, the following data is recorded:

First visit to the website
Start of the session
Websites visited
Your “click path”, interaction with the website
Scrolls (whenever a user scrolls to the end of the page (90%))
Clicks on external links
Internal search queries
Interaction with videos
file downloads
Ads viewed / clicked on

On behalf of the operator of this website, Google will use this information to analyse your use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyse the performance of our website.

Recipients of the data are/may be

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor pursuant to Art. 28 GDPR)
Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

For the USA, the European Commission adopted its adequacy decision on 10 July 2023. Google LLC is certified under the Data Privacy Framework. Since Google servers are distributed worldwide and a transfer to third countries (for example to Singapore) cannot be completely ruled out, we have also concluded the standard contractual clauses with the provider.

The data sent by us and linked to cookies is automatically deleted after 2 months. The maximum lifespan of Google Analytics cookies is 2 years. Data whose retention period has been reached is automatically deleted once a month.

The legal basis for this data processing is your consent in accordance with Art. 6 (1) lit. a) GDPR, which you can revoke at any time.

You can find more information on the terms of use of Google Analytics and data protection at Google here.

Data security

We take all appropriate technical and organizational security measures to protect your data from manipulation, loss, destruction, or unauthorized access by third parties. Our systems are secured against unauthorized access. Your personal data is encrypted with us. We use the coding system SSL (Secure Socket Layer).

We expressly point out that despite all the technical precautions, the Internet does not permit absolute data security. We are not li

8. Links

We use links to content on websites of other websites operators.

We have no influence on the data collected there or the data processing procedures, nor do we know the full extent of the data collection, the purpose of the processing or the retention periods.

We also have no information about the deletion of the data collected by the linked provider. In this respect, we are not responsible under data protection law for the data processing on the linked website.

Further information on the purpose and scope of data collection and processing by the website operator can be found in the privacy policies of the respective websites. There you will also find further information on your rights in this regard and the setting options for protecting your privacy.

9. Other functions and offers on our website

In addition to the purely informational use of our website, we offer various services that you can use if you are interested. To do so, you must generally provide additional personal data that we use to provide the respective service and for which the aforementioned data processing principles apply.

In some cases, we use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are regularly monitored.

If our service providers or partners are based in a country outside the European Union (EU) or the European Economic Area (EEA), we will inform you of the consequences of this circumstance at the appropriate point in this privacy policy.

10. Categories of recipients of personal data

To process our business transactions, we use external domestic and foreign service providers (e.g. for IT, logistics, telecommunications, sales and marketing) who may also gain knowledge of your personal data. We have concluded order processing contracts with these providers in accordance with Art. 28 GDPR, which ensure that data processing is carried out in a permissible manner.

If your personal data is passed on by us to our subsidiaries or is passed on to us by our subsidiaries (e.g. for advertising purposes), this is also done on the basis of existing order processing relationships.

11. Conditions for the transfer of personal data to third countries

For the exceptional cases in which personal data is transferred to countries outside the European Economic Area (EEA), i.e. to third countries, this is done under the conditions of Art. 44 et seq. GDPR. We will inform you about the respective details of the transfer at the relevant points below.

The European Commission certifies that some third countries have a level of data protection comparable to the EEA standard by means of so-called adequacy decisions. However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of legal provisions. If this is the case, we ensure that data protection is adequately guaranteed. This is possible via binding corporate rules, standard contractual clauses of the European Commission for the protection of personal data pursuant to Art. 46 (1, 2) lit. c) GDPR, certificates or recognised codes of conduct

12. Updating the Privacy Policy

Due to further development of our company or revised legal or regulatory requirements it may be necessary to change this Privacy Policy from time to time.