Our services for:
Data protection
As of: 26 October 2026
1. CONTROLLER AND CONTACT
The controller responsible for processing your personal data within the meaning of the General Data Protection Regulation (GDPR) is Primazon GmbH, a personnel consultancy based in Munich.
• Primazon GmbH, Kunigundenstraße 36, 80805 Munich, Germany
• Managing director: Heiko Hoess
• Commercial register: Amtsgericht München (Local Court of Munich), HRB 251113
• Email: datenschutz@primazon.space
• Phone: +49 89 4520 3564
• Website: primazon.space
• Contact for data protection: Heiko Hoess, reachable at datenschutz@primazon.space
2. OVERVIEW: PROCESSING ACTIVITIES, PURPOSES AND LEGAL BASES
We only process personal data if there is a legal basis under Art. 6 GDPR. The following overview shows all processing activities at a glance; sections 3 to 12 explain them in detail.
• Visiting the website: IP address, time, browser, page accessed. Purpose: providing and securing the website. Legal basis: Art. 6(1)(f) GDPR.
• Cookies and tracking that are not strictly necessary: identifiers, usage data. Purpose: audience measurement (Google Analytics), convenience functions. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.
• Map (Google Maps): IP address, page accessed. Purpose: showing our location. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.
• Contact requests: name, contact details, message. Purpose: answering your request. Legal basis: Art. 6(1)(b) or (f) GDPR.
• Applicants and candidates: contact details, CV, references, interview notes. Purpose: advice, placement, presentation to clients. Legal basis: Art. 6(1)(b) GDPR; disclosure and talent pool: Art. 6(1)(a) GDPR.
• Direct outreach via LinkedIn and LinkedIn Recruiter Lite: name, position, employer, profile content. Purpose: first contact with potential candidates. Legal basis: Art. 6(1)(f) GDPR.
• Clients and contact persons: name, role, contact details, contract data. Purpose: performing contracts, invoicing, client care. Legal basis: Art. 6(1)(b), (c) and (f) GDPR.
• Google Workspace: appointments, documents, meeting data, and emails (Gmail) where used. Purpose: communication and organisation. Legal basis: Art. 6(1)(b) and (f) GDPR.
• Email hosting with Strato: emails, attachments, sender and recipient addresses, connection data. Purpose: sending, receiving and storing email correspondence. Legal basis: Art. 6(1)(b) and (f) GDPR.
• Appointment booking with Calendly: name, email address, chosen appointment, time zone, voluntary details. Purpose: scheduling calls. Legal basis: Art. 6(1)(b) GDPR.
• Call transcription with Fathom: recording, transcript, summary, name and email of participants. Purpose: documenting calls. Legal basis: Art. 6(1)(a) GDPR.
• AI assistance with Claude: anonymised content that we enter. Purpose: texts, summaries, structuring. Legal basis: Art. 6(1)(b) and (f) GDPR.
• Statutory retention: invoices and business records. Purpose: commercial and tax law. Legal basis: Art. 6(1)(c) GDPR.
Obligation to provide data: Providing your data is voluntary. Without the details required for advice, placement or scheduling, for example name, contact details and CV, we cannot offer you our services. When you visit the website, the technically necessary data (section 3) is required so that the page can be displayed; we only set all other cookies with your consent.
3. VISITING THE WEBSITE PRIMAZON.SPACE
When you visit our website, technically necessary data is processed so that the page can be displayed and operated securely.
Hosting: Our website is run with the Wix website builder (Wix.com Ltd., Israel, and Wix.com Inc., USA). Wix acts as our processor; a data processing agreement is in place. An adequacy decision of the EU Commission applies to Israel; for transfers to the USA see section 14.
Server log files: When you visit the site, your IP address, date and time, the page accessed, browser type and operating system are recorded automatically. This serves delivery, error analysis and defence against attacks (Art. 6(1)(f) GDPR).
Cookies and similar technologies: We set technically necessary cookies without consent (Section 25(2) TDDDG). We only load all other cookies, for example for statistics or the embedded map, after your consent via the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time with effect for the future via the cookie settings. For audience measurement we use the statistics included in Wix and Google Analytics (see section 8). We do not use any other third-party tracking or advertising services.
4. CONTACTING US
If you contact us by email, phone or via a form, we process your details in order to answer your request.
This includes your name, contact details and the content of your message. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR. We delete the data once the request has been dealt with and no retention obligation applies (see section 15).
5. APPLICANTS AND CANDIDATES
We process the data of candidates in order to advise them, find suitable positions and present them to clients.
Data: Name, contact details, CV, references, qualifications, salary expectations, availability and our notes from conversations. Please do not send us particularly sensitive information (Art. 9 GDPR) such as health, religion or trade union membership unless it is required for the placement.
Source of the data: The data comes from you (for example via our careers page, which we run with Wix), from your public profile, for example on LinkedIn (see section 7), or from referrals.
Disclosure to clients: We only present your profile to a company once you have agreed (Art. 6(1)(a) GDPR). You can withdraw your consent at any time.
Talent pool: With your consent we add you to our talent pool in order to contact you about suitable future positions. Without your consent we delete your data after the process has ended (see section 15).
Applicant management system: We manage applications and candidate profiles in an applicant management system that we developed ourselves. It is operated locally on our own systems in Munich; no data is transferred to external service providers or to third countries in this context.
No automated decision-making: People always decide on your suitability. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place.
6. CLIENTS AND CONTACT PERSONS AT CLIENT COMPANIES
For companies that engage us, we process the data of contact persons in order to perform and invoice the contract.
This includes name, role, business contact details, contract and billing data. The legal bases are Art. 6(1)(b) GDPR (contract), (c) (legal obligations, for example under tax law) and (f) (client care and initiating further assignments). If companies pass on data of employees to us, they do so under their own responsibility.
7. LINKEDIN
We use LinkedIn to find and approach potential candidates and to present our company. For users in the EU, LinkedIn Ireland Unlimited Company, Dublin, is the operator; LinkedIn is itself responsible for its own data processing. You can find its privacy notice on LinkedIn.
Direct outreach (sourcing): We look at publicly visible profiles, check whether the qualifications fit a position, and write to suitable people via LinkedIn. For this we process name, current position, employer, qualifications and other profile content. The legal basis is our legitimate interest in recruiting skilled professionals for our clients (Art. 6(1)(f) GDPR). We only make contact for professional purposes, through the LinkedIn messaging function.
LinkedIn Recruiter: For candidate search we use LinkedIn Recruiter Lite, a paid LinkedIn product. With it we search for profiles, create notes and lists about candidates and send messages (InMail). LinkedIn processes the notes and lists we create there on our behalf under the LinkedIn contract terms for Recruiter. Suggestions and rankings from Recruiter are only an aid: we review every suggestion ourselves, and an algorithm never alone decides on suitability (Art. 22 GDPR). The legal basis is Art. 6(1)(f) GDPR.
Information under Art. 14 GDPR: Because we do not collect the data from you directly, we inform you with our first message at the latest, and in any case within one month, about this privacy policy and the source of the data (your LinkedIn profile).
Company page: We run the LinkedIn page https://www.linkedin.com/company/primazon-gmbh/. We are jointly responsible with LinkedIn for the statistics of this page (Art. 26 GDPR). LinkedIn provides us with anonymised reports; LinkedIn bears the main responsibility for processing visitor data.
Your right to object: You can object to our processing of your profile data at any time (section 16); we will then stop contacting you and delete your data unless compelling reasons prevent this.
8. GOOGLE
We use Google Workspace for calendar, video conferencing and document storage and, where used, Gmail as an email client; the mailboxes of the domain are hosted by Strato (see section 9). The provider is Google Ireland Limited, Dublin, with its parent company Google LLC, USA.
Gmail, Calendar, Meet, Drive: Our correspondence with candidates, clients and prospects, appointment scheduling, video calls and document storage run through these services. Content, metadata and contact details are processed. The legal bases are Art. 6(1)(b) GDPR (contract, pre-contractual measures) and Art. 6(1)(f) GDPR (efficient organisation).
Data processing: Google processes the data as our processor on the basis of a data processing agreement (Cloud Data Processing Addendum). For transfers to the USA see section 14.
Video calls: We only record Google Meet calls with your prior consent.
Google Analytics: We use Google Analytics on our website for audience measurement. We only load it after your consent in the cookie banner (category analytics; Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google Analytics evaluates how visitors use the site, for example pages viewed, time spent, approximate location and device type, and uses cookies and identifiers for this. Google processes the data as our processor on the basis of Google's data processing terms; for transfers to the USA see section 14. In Google Analytics, event data is deleted after 2 months and user-level data (identifiers) after 14 months without new activity. You can withdraw your consent at any time via the cookie settings.
Google Maps: Our website embeds a map from Google Maps at the bottom that shows our location. We only load the map after your consent in the cookie banner; until then you see a placeholder. Only then does your browser connect to Google, which transmits, among other things, your IP address to Google (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); for transfers to the USA see section 14. You can withdraw your consent at any time via the cookie settings. We do not use other Google services such as Google Fonts or reCAPTCHA.
9. STRATO (EMAIL HOSTING)
Our email mailboxes under the domain primazon.space are operated for us by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.
When you write to us or we write to you, Strato processes and stores on its servers the email content, attachments (for example CVs), sender and recipient addresses and connection data. The legal basis is Art. 6(1)(b) GDPR where requests and contracts are concerned, otherwise Art. 6(1)(f) GDPR (reliable and secure communication).
Strato processes the data as our processor on the basis of a data processing agreement. Hosting takes place on servers in Berlin and Karlsruhe, i.e. in Germany, so no transfer to third countries takes place. Sending and retrieval are encrypted (TLS); if the other side does not support encryption, emails can be read in transit. Please therefore do not send us particularly sensitive information by unencrypted email.
10. APPOINTMENT BOOKING WITH CALENDLY
We use Calendly, a service of Calendly LLC, USA, for scheduling calls.
When you choose an appointment via our booking link, we process your name, your email address, the chosen appointment, your time zone and any details you voluntarily provide in the form. Calendly checks availability against our Google Calendar and sends confirmations and reminders. The legal basis is Art. 6(1)(b) GDPR (scheduling to initiate or perform a contract), otherwise Art. 6(1)(f) GDPR.
Calendly processes the data as our processor on the basis of a data processing agreement; for transfers to the USA see section 14. We only link to Calendly and do not embed it into our website: when you click the booking link you leave our website, and Calendly's privacy notice applies to processing at Calendly.
11. CALL TRANSCRIPTION WITH FATHOM
For video calls we use Fathom, a tool from Fathom Video, Inc., USA, that transcribes and summarises calls.
If you take part in a call that we record with Fathom, we process the recording, the transcript, an automatically generated summary and the names, email addresses and voice contributions of the participants. At the start of every call we obtain the consent of all participants (Art. 6(1)(a) GDPR) and only record if everyone agrees; otherwise we end or do not start the recording. We use the transcripts to document the content of calls and to handle candidate profiles and assignments carefully.
Fathom processes the data as our processor on the basis of a data processing agreement; for transfers to the USA see section 14. Recordings, transcripts and summaries are deleted automatically after 6 months. The automatic summary is only an aid: we never decide about candidates solely on the basis of it (Art. 22 GDPR).
12. USE OF AI ASSISTANCE (CLAUDE)
We use the AI assistant Claude from Anthropic PBC (USA, in the EU via Anthropic Ireland, Limited) to support our work; people always review and decide.
Purpose: We have Claude draft and revise texts (job ads, cover letters, messages), summarise documents and structure information, for example a candidate profile for presentation to a client.
Data: We do not enter personal data of candidates or clients into Claude. We remove or replace names, contact details and other information that could identify a person beforehand. We do not enter special categories of data under Art. 9 GDPR.
Legal basis: Where personal data does occasionally find its way into a text, for example the name of a contact person, the legal basis is Art. 6(1)(f) GDPR (efficient, quality-assured work).
Provider and training: We use Claude with a Pro account. Anthropic processes the inputs of this account under its own terms of use and privacy notice. We have switched off the model improvement setting, so inputs are not used to train the models. Because we do not enter identifiable data, no processing on our behalf takes place in this respect. For transfers to the USA see section 14.
No automated selection: We do not use Claude to select, rate or reject candidates automatically. We review the AI's results for content before we use them. There is no decision based solely on automated processing within the meaning of Art. 22 GDPR.
13. RECIPIENTS AND PROCESSORS
Your data is only received by parties that need it for the purposes stated.
• Wix (website hosting), Google (Workspace, Analytics), Strato (email hosting), Calendly (appointment booking) and Fathom (call transcription) as processors
• Anthropic (AI assistance, anonymised inputs only)
• Clients to whom we present your profile, only with your consent
• LinkedIn as an independent controller for the platform and as a processor for our notes and lists in Recruiter Lite
• Tax advisers, IT service providers and other service providers who are contractually bound to confidentiality and data protection
• Authorities and courts, where we are legally obliged to do so
We do not pass data on to third parties for advertising purposes.
14. TRANSFERS TO THIRD COUNTRIES
Some of our service providers process data in the USA or in Israel, so we base these transfers on appropriate safeguards under Chapter V GDPR.
• USA: Where the recipient (for example Google LLC, Wix.com Inc., Calendly LLC, Fathom Video, Inc., Anthropic PBC) is certified under the EU-US Data Privacy Framework, the EU Commission's adequacy decision of 10 July 2023 applies. Otherwise we use the EU Standard Contractual Clauses and examine additional safeguards.
• Israel: An adequacy decision of the EU Commission exists.
• LinkedIn: The operator for EU users is based in Ireland; LinkedIn is itself responsible for intra-group transfers; for Recruiter, the safeguards from the contract with LinkedIn apply.
You can obtain a copy of the safeguards on request using the contact details in section 1.
15. RETENTION AND DELETION
As a rule we automatically delete personal data after 6 months and data in the talent pool after 24 months; deviating periods, for example for Google Analytics, and longer statutory retention obligations take precedence.
• Server log files: only as long as necessary for the operation and security of the website; Wix determines the exact period
• Contact requests: automatically 6 months after the request has been dealt with, unless a business relationship arises
• Applicants and candidates without talent pool: automatically 6 months after the process has ended
• Talent pool: automatically 24 months after being added, earlier if you withdraw consent
• Contract and billing data: commercial letters 6 years, accounting records 8 years, in each case from the end of the calendar year
• Documents in Google Drive and mailboxes at Strato: automatically after 6 months, unless a retention obligation applies
• Inputs to Claude: according to the provider's settings; we do not keep candidate files there
• Appointment bookings (Calendly): automatically 6 months after the appointment, unless a business relationship arises
• Notes and lists in LinkedIn Recruiter Lite: automatically 6 months after the process has ended, 24 months in the talent pool
• Recordings and transcripts (Fathom): automatically 6 months after the call
• Data in Google Analytics: event data 2 months, user-level data 14 months without new activity
If you withdraw consent or object, we delete the data concerned without undue delay, unless a legal obligation prevents this.
16. YOUR RIGHTS
You have the following rights against us, which you can exercise at any time using the contact details in section 1.
• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR); the lawfulness of the processing carried out until then remains unaffected
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons. We will then no longer process the data unless we demonstrate compelling legitimate grounds.
17. RIGHT TO LODGE A COMPLAINT
You can lodge a complaint with a data protection supervisory authority if you believe that we are processing your data unlawfully.
The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de. You can also contact the authority at your place of residence or work.
18. DATA SECURITY
We protect your data through technical and organisational measures under Art. 32 GDPR.
• Encrypted transmission (TLS) on the website and for email, as far as the other side supports it
• Access to candidate and client data only for authorised persons
• Data processing agreements with all service providers that process data on our behalf
• Regular review of permissions and deletion of data that is no longer needed
• Employees are bound to confidentiality
19. UPDATES AND CHANGES
We adapt this privacy policy when our services, the tools we use or the legal situation change. You can find the current version at primazon.space.