Privacy Policy (Effective as of June 29, 2025)

1. Controller

2. Data Protection Officer

3. Categories of Data We Process

• Basic information (e.g., name, address)
• Contact details (e.g., email, phone number)
• Content data (e.g., text, images, videos, contracts)
• Usage data (e.g., pages visited, navigation paths, timestamps)
• Technical data (e.g., IP address, device and browser information)
• Application & talent pool data (e.g., CVs, qualifications, motivation letters, photos, preferences, interview notes)

4. Categories of Data Subjects

• Visitors of our website and digital platforms
• Individuals interested in our services
• Clients using our recruiting services
• Candidates and applicants (including talent pool members)
• Employees and other individuals using our services

5. Purpose and Legal Basis of Processing

6. Cookies & Related Technologies

We use session and persistent cookies (up to 24 months), pixel tags, and local storage to enable features, measure traffic, and optimize ads. This is based on your consent (Art. 6(1)(a) GDPR) or our legitimate interests (Art. 6(1)(f) GDPR). You can manage or revoke your consent at any time via the cookie banner or browser settings.

7. Data Processing for Service Delivery

7.1 Recruiting & Consulting

To match candidates with our clients' vacancies, we process client and user data. Reaching out via chatbots or ads is based on our own and our clients' legitimate interests (Art. 6(1)(f) GDPR). When candidates interact and provide data (e.g., via "Learn more" buttons), this is processed for pre-contractual steps (Art. 88 GDPR, § 26 BDSG).

7.2 Talent Pool

We offer a talent pool to recommend candidates for future roles. Candidate profiles are stored for up to 24 months from last activity or until consent is withdrawn. Inclusion in the pool requires prior consent (Art. 6(1)(a) GDPR, § 26(2) BDSG).

• Consent can be revoked at any time, with future effect. Upon withdrawal, data is deleted unless legal retention obligations apply.
• For specific roles, data is only shared with renewed candidate consent.

7.3 Statistical Analysis

We use aggregated data to improve our services. Personal analysis is only conducted with explicit consent.

8. Applications at Inga GmbH

When you apply for internal positions, your application data is processed solely for evaluating employment suitability (Art. 88 GDPR, § 26 BDSG). If no contract is concluded, we delete the data after six months, unless legal or legitimate grounds require longer retention.

9. Comments & User Contributions

Public comments may be stored along with your IP address and username for seven days (Art. 6(1)(f) GDPR), to prevent misuse. Contributions remain visible as long as the content is live and no legitimate removal request has been made.

10. Contacting Us

Data shared through contact forms, email, phone, or social media is processed to respond to your inquiry and manage follow-up communications via our CRM system. Legal basis: Art. 6(1)(b) or (f) GDPR.

11. Data Sharing with Processors & Third Parties

We only share data when you consent, when legally required, if necessary for contract performance, or based on legitimate interests. Data processing agreements are in place with service providers as per Art. 28 GDPR. For transfers to third countries, we ensure appropriate safeguards.

12. Third-Party Services (Selection)

• HubSpot CRM – Request management (Art. 6(1)(f) GDPR, EU-US Data Privacy Framework)
• Google Analytics – Web analytics, only with consent (Art. 6(1)(a) GDPR); IP anonymization, data retention: 14 months
• Facebook Pixel / Custom Audiences – Interest-based ads, only with consent
• Google Fonts – Web font rendering (Art. 6(1)(f) GDPR)

13. Social Media (e.g., Facebook Fanpage)

We share responsibility for Insights data with Facebook Ireland Ltd. (Art. 26 GDPR). Our legitimate interests lie in communication and public presence (Art. 6(1)(f) GDPR). According to Facebook, cookies are deleted or anonymized after 90 days.

14. Technical & Organizational Measures

We implement appropriate security measures under Art. 32 GDPR (e.g., encryption, access control, backups) and regularly review them to ensure data protection.

15. Data Retention & Deletion

Personal data is deleted once it is no longer needed and no legal retention periods (e.g., up to 10 years for commercial or tax documents) or other justified reasons prevent deletion. Talent pool data is erased after 24 months or immediately upon consent withdrawal.

16. Your Data Protection Rights

• Right to object to future processing (Art. 21 GDPR)
• Right to access your data (Art. 15 GDPR)
• Right to correct inaccurate data (Art. 16 GDPR)
• Right to deletion or restriction (Art. 17 & 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect legal or technical developments. The current version is always available on our website.