Legal
Privacy Policy
How we handle your data — in plain language, because recruitment runs on trust.
1. Who we are (Controller)
[Legal entity name, e.g. Alma Energy Search GmbH]
[Registered address]
[Company registration number]
Email: hello@almaenergysearch.com
We are the data controller for personal data processed through this website and our recruitment services. [If you appoint a Data Protection Officer, name them here — usually not mandatory for a small agency, but check your national rules.]
2. What data we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Name, email, phone, CV, work history, salary expectations (candidates) | Matching you with roles; presenting you to clients with your consent per role | (1)(b) steps prior to a contract; (1)(a) consent for sharing with a specific client |
| Name, company, role details (client contacts) | Running searches you commission; invoicing | (1)(b) contract performance |
| Form submissions via our contact form | Responding to your inquiry | (1)(b) / (1)(f) legitimate interest in answering you |
| Technical logs (IP, browser) held by our hosting provider | Security, keeping the site running | (1)(f) legitimate interest |
We never share your CV with any client without asking you first, for that specific role. This is both our legal obligation and our business model — a candidate who trusts us tells us the truth, and truthful candidates are what our clients pay for.
3. Where your data lives (Processors)
- Website hosting: [GitHub Pages / Netlify / your host] — serves the site, holds standard access logs.
- Contact form & CV uploads: [Formspree Inc. / your form provider] — receives your submission and forwards it to our mailbox.
- Email: [Google Workspace / Microsoft 365 / provider].
- Candidate database: [where you actually store CVs — a drive, an ATS…].
Some of these providers process data outside the EU/EEA. Where that happens, transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses. [Verify this for each provider you actually use and adjust.]
4. How long we keep it
- Candidate data: [e.g. 24 months] after our last meaningful contact, unless you ask us to delete it sooner or renew your consent. We contact you before extending.
- Unsuccessful application data: deleted [e.g. 6 months] after the search closes, unless you agree to stay in our pool.
- Client and invoice data: statutory retention periods (typically 6–10 years, per national tax law).
5. Your rights
Under the GDPR you can, at any time:
- Access the data we hold on you (Art. 15)
- Correct it (Art. 16)
- Delete it — "right to be forgotten" (Art. 17)
- Restrict or object to processing (Art. 18, 21)
- Take it with you — data portability (Art. 20)
- Withdraw consent at any time, without affecting prior processing (Art. 7(3))
One email to hello@almaenergysearch.com does it — no forms, no hoops. We respond within one month. You also have the right to complain to your supervisory authority: [name + link of your national DPA, e.g. the BayLDA for Bavaria, the ICO for the UK].
6. Cookies & tracking
This website sets no cookies and runs no analytics or tracking. Fonts are loaded from Google Fonts, which involves a request to Google's servers transmitting your IP address. [To remove even this, self-host the fonts — a 15-minute task; then this section becomes simply "no third-party requests at all." Recommended for DE/AT markets where courts have ruled against remote Google Fonts.]
7. Changes
We'll update this policy as our tools change and note the date below. Material changes affecting how we handle candidate data will be communicated to registered candidates directly.
Last updated: [date]