Privacy Notice for Candidates

[1] Who is responsible

Krusche & Company GmbH
St.-Pauls-Platz 9, 80336 Munich, Germany
[email protected]
Phone: +49 89 41617569 01

Where another K&C group company independently determines how your data is processed, we will identify that company and provide its contact details before the relevant processing begins.

[2] Why we process your data

We process personal data to discuss opportunities, evaluate your experience and suitability, arrange interviews, manage the selection process, verify identity, prevent impersonation or fraud, prepare agreements and set up contractual payments. We also process information to handle data-protection requests and fulfil our legal obligations.

Depending on the circumstances, our legal bases are:

• Article 6(1)(b) GDPR: taking steps at your request before entering into a contract and processing necessary to perform that contract.
• Article 6(1)(f) GDPR: our legitimate interests in identifying suitable professionals, managing an effective selection process, verifying identity and preventing fraud, and establishing, exercising or defending legal claims.
• Article 6(1)(a) GDPR: your consent to optional transcription and AI-assisted preparation of interview notes.
• Article 6(1)(c) GDPR: compliance with legal obligations, including handling data-protection requests and applicable statutory recordkeeping requirements.

For employment applications subject to German law, Section 26(1) BDSG applies where relevant.

Providing information is voluntary. However, without information necessary to assess your suitability, verify your identity or prepare an agreement, we may be unable to continue the process. Optional transcription and AI assistance are not required.

[3] What Data we process and where it comes from

We may process:

• Contact details and professional profiles.
• CVs, qualifications, relevant experience and work samples.
• Availability, proposed rates or compensation expectations.
• Correspondence, interview answers, assessment notes and selection outcomes.
• Interview transcripts and AI-generated summaries, with your consent.
• Relevant contractual documents and records of consent or withdrawal.
• Records of identity checks.
• Bank details necessary to set up payments, collected once you have been selected and we proceed with preparing your agreement.
• Data-protection requests, information necessary to verify the requester’s identity, and records of how we handled the request.

We store your CV and relevant professional information in our recruitment systems to manage the selection process.

We obtain information from you and, where relevant, from recruitment partners, referrals or publicly available professional sources such as LinkedIn. If we obtain your information indirectly, we will identify its source when we first contact you, or earlier where legally required.

Before entering into an engagement, we may ask you to present a passport or other identification document for visual inspection. We do not retain copies, screenshots, document numbers or other document-specific details. We record only that the check took place, its date, the reviewer and the outcome. This inspection is not recorded, transcribed or processed using AI.

We do not request special categories of personal data as part of our standard selection process. Please avoid including information such as health details, religious beliefs or political opinions in your application or interview answers.

[4] Optional transcription and AI assistance

With your prior consent, we may use Microsoft Teams transcription and Microsoft Copilot to summarise and structure your answers during technical discussions. The purpose is to prepare interview notes for our team’s review.

Audio is processed to generate a text transcript. We do not record the call’s audio or video. Transcripts and summaries are processed within our Microsoft 365 environment, with access restricted to authorised persons.

Copilot is used to organise and summarise information. It is not used to score or rank candidates or recommend selection decisions. Our team checks the summary for accuracy and independently assesses your suitability. We do not make selection decisions based solely on automated processing.

You may decline or withdraw consent at any time, including during the call, without affecting your consideration for the engagement. We will then use manual notes without AI assistance.

To withdraw consent after the call, reply to your K&C contact or use the privacy contact above. Withdrawal does not affect the lawfulness of processing carried out before it.

[5] Who may receive your data

Access is limited to people who need the information for the purposes described above. Recipients may include:

• Relevant recruitment staff, technical reviewers, decision-makers and authorised contract or finance administrators within K&C group companies.
• Service providers supporting recruitment, communication, document management and IT operations, including Microsoft 365, Salesforce, emlen and PandaDoc.
• A prospective client where consideration for a specific client project requires it. We will inform you of the client and opportunity before sharing your CV or another identifiable professional profile.
• Professional advisers or public authorities where necessary for legal obligations or legal claims.

Information shared with a prospective client is limited to what is relevant to assessing suitability for the project. Bank details and identity-check records are not included in the candidate profile.

Service providers acting on our behalf are subject to appropriate data-processing and confidentiality obligations.

Where data is transferred or accessed outside the EU or EEA, we use an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with additional safeguards where necessary. You can request information about the safeguards and a copy from our privacy contact.
You also have the right to lodge a complaint with your local data protection authority.

[6] How long we retain your data

We retain recruitment records for the selection process and, where necessary to establish, exercise or defend legal claims, for up to 12 months after it ends. We delete data earlier when it is no longer needed or applicable law requires a shorter period.

Transcripts and intermediate AI-generated summaries are deleted once our team has checked the summary and completed its assessment notes, and no later than the end of the selection process. The checked assessment notes follow the recruitment-record retention period above.

If you withdraw consent, we stop the consent-based processing and delete the related transcripts and AI-generated summaries unless a specific legal obligation or the establishment, exercise or defence of legal claims requires their retention.

Necessary records of consent, withdrawal and data-protection requests are retained only for as long as needed to demonstrate compliance or address related legal claims, taking account of applicable statutory obligations and limitation periods.

If an engagement results, information needed to manage that relationship, including bank details and relevant identity-check records, becomes part of the employment or contractor records and follows the retention rules explained in the applicable privacy notice.

If the engagement does not proceed, bank details collected for payment setup are deleted when no longer needed, unless a specific legal obligation or legal claim requires retention.

Contracts and other legally relevant records may be kept longer where required by applicable statutory retention obligations or necessary for specific legal claims. These exceptions apply only to the relevant records.

[7] Your rights

Subject to the applicable legal conditions, you may request access, correction, deletion, restriction of processing or data portability.

You may object to processing based on legitimate interests on grounds relating to your particular situation. You may withdraw consent at any time.

To exercise your rights, contact us using the details above or reply to your K&C contact. No special form is required. Where necessary, we may ask for limited additional information to verify your identity.

We process your request and our response to fulfil and document our data-protection obligations. We normally respond within one month of receiving your request. If a lawful extension is necessary because of the complexity or number of requests, we will inform you within that month and explain why.

You may also lodge a complaint with a supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement.

[8] Updates

We may update this notice to reflect changes in our processing activities or legal requirements. The current version is available on our website.

Last updated: September 2026