Privacy Policy

The protection of your personal data is of great importance to us. We would therefore like to provide you with full details here regarding the processing and storage of your data when you visit our website and within our organisations.

In order to use all the features and services on our website, we need to collect your personal data. This data is processed and stored in accordance with the legal guidelines and requirements of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and, where applicable, other data protection laws.

Data controller

furthermatch GmbH
Breite Straße 22
40213 Düsseldorf

Contact: hello@furthermatch.com

Further information can be found in the legal notice.

DATA PROTECTION OFFICER

Data Protection Officer: Mag.a iur. Elisa Drescher

Email:office@scaleline-ltd.com (Please mention furthermatch GmbH when contacting us)

COLLECTION AND PROCESSING OF PERSONAL DATA ON THIS WEBSITE

Please note: To protect your data as comprehensively as possible against unauthorised access, we implement technical and organisational measures and use an encryption method on our website. Your data is transmitted via the internet from your computer to ours and vice versa using TLS encryption. TLS stands for 'Transport Layer Security' and is an encryption protocol for data transmission over the internet. You can usually recognise 'TLS' by the fact that the padlock icon in your browser's status bar is closed and the address begins with https://.

  1. COLLECTION OF ACCESS AND LOG DATA

This website automatically collects and stores server log file information that your browser transmits to us.

This includes:

  • The user's IP address
  • Date and time of access
  • Type of request
  • Customer information such as type and version
  • The user's operating system (device, device OS version),
  • Referrer information (i.e. the source of the access)

The legal basis for this data processing is our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Our legitimate interest lies in being able to identify indications of unlawful use of our website. This data is stored separately from any personal data you may have provided and therefore does not allow any conclusions to be drawn about a specific individual. Your personal data will not, as a matter of principle, be disclosed to third parties. We have entered into a data processing agreement in accordance with Article 28 of the GDPR with the provider of this website, IONOS SE, based in Montabaur (Germany). This provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us, and stores this information for a maximum of 7 days. We only store the server log files in the event of attacks on our server infrastructure or other legal infringements. This extended storage period is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR and serves solely to preserve evidence.

  1. ENQUIRIES VIA THE CONTACT FORM, EMAIL AND TELEPHONE

We naturally treat any personal information you provide to us on a voluntary basis as confidential. We use the personal data you provide exclusively to process and respond to your enquiry. The legal basis for data processing is our legitimate interest under Article 6(1)(f) of the GDPR. This stems from our interest in responding to enquiries from our customers, business partners and prospective clients, and in promoting and maintaining customer satisfaction. A further legal basis for natural persons is the initiation or performance of a contract in accordance with Article 6(1)(b) of the GDPR.

All personal data that you provide to us with your enquiry will be deleted or anonymised by us no later than two years after we have provided you with our final response, provided that no contract is concluded. The two-year retention period is based on the fact that, in isolated cases, you may contact us again regarding the same matter after receiving a response and refer to the previous correspondence. In our experience, we have found that no further enquiries follow our replies after two years.

  1. DOCUMENT UPLOAD

Your personal data will be processed solely for the purpose of providing specialist recruitment consultancy in the field of law and compliance. This includes, in particular, reviewing your documents with a view to identifying suitable career opportunities with potential employers from our network, as well as contacting you to present relevant vacancies. Furthermore, your data will be used – irrespective of specific job vacancies – to advise you as part of personalised career coaching or, upon request, to prepare you specifically for upcoming job interviews (interview coaching). The processing is therefore intended to support your professional development and career reorientation.

The processing of your personal data is based on your voluntary consent in accordance with Article 6(1)(a) of the GDPR. Insofar as you provide information in your application documents that falls within the special categories of personal data within the meaning of Article 9(1) of the GDPR (e.g. information relating to health or severe disability), the processing of this sensitive information is also carried out on the basis of your explicit consent in accordance with Article 9(2)(a) of the GDPR.

For the purposes described, we process the personal data that you provide to us as part of your application or consultation. This includes, in particular, your contact details (such as your name, email address and telephone number), information about your professional background, qualifications and interests (e.g. from your CV and cover letter), as well as any additional information you voluntarily provide to us during telephone calls or in emails. Furthermore, depending on the content of your documents, this may also include special categories of personal data, such as references to your state of health or details of a severe disability.

The information from the upload is temporarily stored by our web host. For support purposes, our web agency and data processor, 21vision GmbH, based in Dortmund, Germany, may access the data. To carry out and manage our brokerage processes, we use the specialist provider Starhunter GmbH, based in Munich, Germany, with whom we have concluded a data processing agreement in accordance with Article 28 of the GDPR. Starhunter processes your personal data exclusively on our instructions and in compliance with appropriate technical and organisational measures to protect your data.

Your personal data will be stored for a maximum period of two years. This period begins from the date of your last active contact with us, for example by submitting documents or through correspondence. Once this period has expired, your data will be deleted, provided that you have not given your consent again or that statutory retention obligations prevent this.

The processing of your data is on a voluntary basis. You may withdraw your consent at any time, with future effect, without giving reasons. Withdrawal may be made informally, for example by email tohello@furthermatch.com . The lawfulness of the processing carried out up to the point of withdrawal remains unaffected. In the event of withdrawal, your data will be deleted immediately, provided there is no other legal basis for its further processing.

  1. BOOKING APPOINTMENTS VIA ONLINE CALENDARS

To simplify the booking of appointments, we use the software 'Calendly' and 'Microsoft Bookings'. To process the booking, we collect your name and email address. After booking, you will receive an appointment confirmation by email, including the access link to the online meeting, as well as a reminder message prior to the appointment to help prevent you from missing it. You can cancel the booked appointment or reschedule it to another date at any time. The legal basis for data processing when booking via Calendly or Microsoft Bookings, as well as for the confirmation and reminder emails sent in this context, is your consent in accordance with Article 6(1)(a) of the GDPR. Booked appointments are deleted after 6 months.

Calendly is provided by Calendly LLC, which is based in the USA; a data processing agreement has been concluded with them in accordance with Article 28 of the GDPR. Beyond this, we do not pass on your data to third parties. Data transfers to Calendly LLC are subject to the Adequacy Decision for the USA, as Calendly LLC holds valid certification under the Data Privacy Framework. The certification can be viewed here: https://www.dataprivacyframework.gov/list

We obtain 'Microsoft Bookings' from our data processor, Microsoft Ireland Limited, based in Ireland, with whom we have concluded a data processing agreement in accordance with Article 28 of the GDPR. Furthermore, we do not pass on your data to third parties.

Booked appointments are stored for the duration of the contract negotiation process. The retention periods for enquiries submitted via contact forms apply mutatis mutandis. Please also refer to our privacy notice for business partners and customers.

  1. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies to facilitate and improve the use of our website. Cookies are small text files that may be stored on your computer or smartphone (end device) via your browser when you visit a website. Cookies can also provide us with information about how you use our website, enabling us to continuously improve its design.

Among other things, cookies are used to uniquely identify what our customers find interesting and useful on our website. In Germany, the storage of information on your device and access to information already stored there are governed by Section 25 of the Telecommunications and Digital Services Data Protection Act (TDDDG). This provision applies regardless of whether the information in question relates to an identified or unidentifiable individual.

We use technically necessary cookies and similar technologies without requiring your consent. Access is permitted in this respect under Section 25(2)(2) of the TDDDG, as it is strictly necessary for us to provide the service you have expressly requested (for example, to display our website correctly or to enable you to use the functions you have requested). We base the processing of personal data arising in this context on our legitimate interests and the interests of third parties pursuant to Article 6(1)(f) of the GDPR or, where applicable, on Article 6(1)(b) of the GDPR.

Any use of cookies and similar technologies that is not technically necessary is only permitted with your prior, explicit and active consent. The legal basis for accessing your device in this respect is Section 25(1) of the TDDDG; we base the subsequent processing of your personal data on your consent in accordance with Article 6(1)(a) of the GDPR. Using our 'Cookie Consent Tool', you can choose which categories of cookies you wish to consent to when visiting our website. You can also withdraw or amend your consent at any time with future effect.

You can also delete cookies that have already been stored at any time via your web browser's settings. You can also adjust your web browser's settings so that no cookies are stored. In that case, however, not all functions of our website may be available.

We use only technically necessary cookies for the following purposes:

Name Retention period Purpose
furthermatch_session Session or short-term (expires on the same day; Laravel default 120 mins) Session cookie of the framework (Laravel). Maintains the user session and assigns requests to the correct session. HttpOnly and Secure set.
XSRF-TOKEN Session CSRF protection (Cross-Site Request Forgery). Prevents form actions from being triggered by third-party sites on behalf of the user. 'Secure' set.

DATA PROCESSING BY BUSINESS PARTNERS AND CUSTOMERS

  1. Fulfilment of contractual obligations (Article 6(1)(b) of the GDPR)

The purposes of data processing arise from the implementation of pre-contractual measures and the fulfilment of obligations arising from the concluded contract.

  1. Execution of our contracts with customers

To process our contracts with you, we process master data such as your first name and surname, your billing address, and your billing and payment details. We use your email address to communicate with you.

  1. To fulfil legal obligations (Article 6(1)(c) of the GDPR)

The purposes of data processing arise in each individual case from statutory requirements. These legal obligations include, for example, the fulfilment of retention and identification obligations – such as those arising from tax audit and reporting requirements – and data processing in response to enquiries from public authorities. In this context, data may also be transferred to our appointed tax adviser.

  1. To pursue our legitimate interests (Article 6(1)(f) of the GDPR)

We process the contact details of contact persons at customers, prospective customers, suppliers and other business partners for the purpose of communicating by email, telephone and post. The legal basis for data processing is the legitimate interest pursuant to Article 6(1)(f) of the GDPR. This legitimate interest arises from the need to conduct or establish business relationships with customers, prospective customers, suppliers and other business partners, as well as to maintain personal contact with contact persons.

We do not, as a matter of principle, pass on data to third parties.

Personal data is stored for the purpose of conducting business relationships for as long as there is a legitimate interest in doing so. It may be necessary, where appropriate, to process the personal data you have provided beyond the actual fulfilment of the contract with business partners. The legitimate interests in this context include, in particular, the selection of suitable business partners, compliance with regulatory requirements, the assertion of legal claims, the defence against liability claims, the prevention of criminal offences and the settlement of claims arising from the business relationship.

  1. Who receives the personal data you have provided?

Within the framework of contractual relationships, we may also engage data processors or service providers who may have access to your personal data. Compliance with data protection regulations is ensured by contract.

  1. Retention period

Personal data will be retained for as long as is necessary to fulfil the purposes set out above.

Specifically, we use the following data processors:

  • Microsoft Ireland Operations LTD for the use of Microsoft 365
  • Digital Dimension IT GmbH for IT support
  • 21vision GmbH for website maintenance
  1. Data processing for the purpose of documenting compliance with the GDPR

Where your data is processed on the basis of consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, we process your data exclusively for the specified purpose and in accordance with separate information provided, in order to be able to demonstrate, within the framework of our accountability obligation under Article 5(2) of the GDPR, that you have consented to the data processing in question.

Where you exercise your data subject rights under the GDPR vis-à-vis us, we also process and store your data in order to be able to demonstrate, as part of our accountability obligation under Article 5(2) of the GDPR, that we have complied with the GDPR when handling your enquiry.

Where you exercise your rights under the GDPR against us, your data may be transferred to our external data protection consultancy (SCALELINE Datenschutz).

OPERATION OF SOCIAL MEDIA PRESENCES

We maintain the following social media accounts:

LinkedIn: https://www.linkedin.com/company/furthermatch/

https://www.linkedin.com/in/christiane-jakobus/

Xing: https://www.xing.com/profile/Christiane_Jakobus

Data processing by us:

  1. Maintaining the above-mentioned social media pages and placing adverts

Personal data entered on social media pages, such as comments, videos, images, 'likes', public posts, etc., is published by the respective social media platform. We reserve the right to delete content should this be necessary. Where appropriate, we may share content on our page and contact you via the social media platform, for example via the messaging services offered. In addition, we regularly place advertisements ("Ads") via our social media pages. The legal basis for this data processing is the legitimate interest under Article 6(1)(f) of the GDPR, which serves our public relations and communication objectives.

  1. Page Insights

Social media platforms provide anonymised statistics and insights which help us gain an understanding of the types of actions people take on our site (known as 'Page Insights'). These Page Insights are generated on the basis of certain information about people who have visited our site.

The legal basis for this data processing is our legitimate interest under Article 6(1)(f) of the GDPR, which is based on our need to obtain information about the actions taken and the visitors to our pages.

This processing of personal data is carried out by the social media platform and by us as so-called joint controllers under Article 26 of the GDPR. In the case of joint controllership, a separate agreement must be concluded.

LinkedIn: https://legal.linkedin.com/pages-joint-controller-addendum

XING: https://www.xing.com/terms/onlyfy-one

If you wish to object to a specific data processing activity over which we have control (e.g. the deletion of comments), please contact us using the contact details provided above.

Please note: The provision of your data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide your personal data. If you do not provide your data, you will not be able to communicate with us via our social media pages, interact with us or take part in the prize draw. To get in touch, please use the email address provided above.

Data processing by the social media platform operator:

In addition to us, there is also the operator of the social media platforms themselves. From a data protection perspective, the operator is also regarded as a further data controller carrying out its own data processing. This means that the operator is also a separate data controller under the GDPR. However, we have only limited influence over the data processing carried out by the operator. Where we are able to exert influence (e.g. through configuration settings), we work within the limits of our capabilities to ensure that the operator of the social media platform handles data in accordance with data protection regulations. In many cases, however, we are unable to influence the data processing carried out by the operator of the social media platform, nor do we know exactly what data they process. The respective operator provides information on the processing of personal data in their own privacy policy:

LinkedIn: https://de.linkedin.com/legal/privacy-policy

XING: https://privacy.xing.com/en/privacy-policy

When using the platform, your personal data is generally also processed by the respective platform operator on servers in third countries, in particular in the USA. Certain third countries have been granted an 'adequacy decision' by the European Commission. This means that the legal framework for the protection of privacy in these countries is comparable to that in the EU or the EEA. Further information on the current countries with an adequacy decision can be found here. Certifications under the adequacy decision for the USA, the Data Privacy Framework, exist for Meta Platforms Inc (Facebook, Instagram), LinkedIn and Google (YouTube). In all other cases, we enter into so-called standard contractual clauses with the platform operators regarding the transfer of personal data to third countries.

Please note: The operator of the social media platform uses web tracking methods. This web tracking may take place regardless of whether you are logged in or registered with the social media platform**. As already explained, we unfortunately have little influence over the web tracking methods used by the social media platform.** For example, we cannot disable it. Please be aware that it cannot be ruled out that the social media platform provider may use your profile and behavioural data, for example to analyse your habits, personal relationships and preferences, etc. We have no influence over the processing of your data by the social media platform provider.

COMMUNICATION VIA THE MICROSOFT TEAMS VIDEO CONFERENCING SYSTEM

We use the 'Microsoft Teams' tool to conduct telephone conferences, online meetings and video conferences. You will receive access to the agreed appointments via a link sent by email. By clicking on the link, you can join the video meeting. Before joining, you can decide for yourself whether or not to activate your video. You are muted by default and must manually unmute your microphone if you wish to do so. If you switch on your camera and/or microphone, the data from your microphone and video camera will be processed during the meeting.

If you are taking part in an online meeting as an external participant, you will receive an access link by email from the meeting host. When registering for the online meeting, you will then need to provide your name and, where applicable, your email address.

Depending on the nature and scope of the specific use, the following additional data may also be processed:

  • Personal details (e.g. first name and surname, email address, profile picture)
  • Meeting metadata (e.g. date, time and duration of the communication, name of the meeting, participants' IP addresses)
  • Device/hardware data (e.g. IP addresses, MAC addresses, client version)
  • Text, audio and video data (e.g. chat histories, video, audio and presentation recordings)
  • Connection data (e.g. telephone numbers, country names, start and end times, IP addresses)

Furthermore, personal data relating to you may be processed. This depends specifically on your usage, such as your use of the chat function and the whiteboard.

We would like to draw your attention specifically to the fact that any information you provide during the meeting will be processed at least for the duration of the meeting.

Legal basis

The legal basis for data processing for direct contractual partners is Article 6(1)(b) of the GDPR; for business partners or contact persons at external organisations, it is the legitimate interest under Article 6(1)(f) of the GDPR. The legitimate interest lies in the organisation of virtual communication and the web conference.

Microsoft Teams is a service provided by Microsoft Corporation. For further information on the processing of your data when using 'Teams', please see: https://privacy.microsoft.com/de-de/privacystatement and https://news.microsoft.com/de-de/datenschutz-und-sicherheit-in-microsoft-teams-nutzer. We cannot rule out the possibility that data may also be routed via internet servers located outside the EU or the EEA. The Adequacy Decision for the USA applies to data transfers to Microsoft in the USA. You can view Microsoft's certification here.

The service provider, Microsoft, will necessarily become aware of the aforementioned data, insofar as this is contractually regulated under our data processing agreement in accordance with Article 28 of the GDPR. There are no other recipients.

You are generally under no obligation to communicate with us via Microsoft Teams. Alternatively, meetings may also take place by telephone.

We generally delete personal data once there is no longer any need for further storage.

INFORMATION ON DATA PROCESSING IN CONNECTION WITH VIDEO CONFERENCES VIA ZOOM

We use the Zoom tool, provided by Zoom Video Communications Inc., to conduct telephone conferences, online meetings and video conferences. You will receive access to the agreed appointments via a link sent by email. By clicking on the link, you can join my video room. Before joining, you can decide for yourself whether to enable your video feed. You are muted by default and must manually unmute your microphone if you wish to do so. If you switch on your camera and/or microphone, this data will be processed during the meeting.

Depending on the nature and extent of your specific use, the following additional data may also be processed:

  • Personal details (e.g. first name and surname, email address, profile picture)
  • Meeting metadata (e.g. date, time and duration of the communication, name of the meeting, participant's IP address)
  • Device/hardware data (e.g. IP addresses, MAC addresses, client version)
  • Text, audio and video data (e.g. chat histories, video, audio and presentation recordings)
  • Connection data (e.g. telephone numbers, country names, start and end times, IP addresses)

Furthermore, personal data relating to you may be processed. This depends specifically on your usage, such as your use of the chat function or the whiteboard. We expressly draw your attention to the fact that any information you provide during the meeting will be processed at least for the duration of the meeting.

Legal basis

The legal basis for data processing for direct contractual partners is Article 6(1)(b) of the GDPR; for business partners or contact persons at external organisations, it is the legitimate interest under Article 6(1)(f) of the GDPR. The legitimate interest lies in the organisation of virtual communication.

Recipients

The provider, Zoom, will necessarily become aware of the aforementioned data, insofar as this is contractually regulated under our data processing agreement in accordance with Article 28 of the GDPR. There are no other recipients.

We cannot rule out the possibility that data may also be routed via internet servers located outside the EU or the EEA. Zoom Voice Communications, Inc. holds a valid certification under the Data Privacy Act, which constitutes an adequacy decision for the USA.

You are not obliged to communicate with us via Zoom. Alternatively, you may communicate by email or telephone.

We generally delete personal data once there is no longer any need for further storage.

RIGHTS OF DATA SUBJECTS

YOU HAVE THE RIGHT, PURSUANT TO ARTICLE 15(1) OF THE GDPR, TO RECEIVE, UPON REQUEST AND FREE OF CHARGE, INFORMATION REGARDING THE PERSONAL DATA STORED ABOUT YOU. FURTHERMORE, SUBJECT TO THE LEGAL REQUIREMENTS BEING MET, YOU HAVE THE RIGHT TO RECTIFICATION (ARTICLE 16 OF THE GDPR), ERASURE (ARTICLE 17 OF THE GDPR) AND RESTRICTION OF PROCESSING (ART. 18 GDPR) OF YOUR PERSONAL DATA. IF YOU HAVE YOURSELF PROVIDED THE DATA BEING PROCESSED, YOU HAVE A RIGHT TO DATA PORTABILITY IN ACCORDANCE WITH ART. 20 GDPR.

WHERE THE DATA PROCESSING IS BASED ON ARTICLE 6(1)(e) OR (f) OF THE GDPR, YOU HAVE THE RIGHT TO OBJECT UNDER ARTICLE 21 OF THE GDPR. IF YOU OBJECT TO DATA PROCESSING, SUCH PROCESSING WILL CEASE IN FUTURE, UNLESS THE CONTROLLER CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR CONTINUING THE PROCESSING WHICH OVERRIDE THE DATA SUBJECT'S INTEREST IN OBJECTING.

IF THE DATA PROCESSING IS BASED ON CONSENT PURSUANT TO ARTICLE 6(1)(a), ARTICLE 9(2)(a) OR ARTICLE 49(1)(a) of the GDPR, YOU MAY WITHDRAW YOUR CONSENT AT ANY TIME WITH EFFECT FOR THE FUTURE, WITHOUT THIS AFFECTING THE LAWFULNESS OF THE PROCESSING CARRIED OUT TO DATE.

FURTHERMORE, YOU HAVE THE RIGHT TO LODGE A COMPLAINT WITH A DATA PROTECTION SUPERVISORY AUTHORITY. IN PARTICULAR, YOU MAY LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY IN THE EU MEMBER STATE WHERE YOU RESIDE, WHERE YOU WORK OR WHERE THE ALLEGED INFRINGEMENT TOOK PLACE.

Contact details for the relevant data protection authority:

State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia
Kavalleriestr. 2–4, 40213 Düsseldorf
Telephone: 0211/38424-0
Fax: 0211/38424-999
Email: poststelle@ldi.nrw.de

NO AUTOMATED DECISION-MAKING.

We do not carry out any automated decision-making or profiling.

PROVISION

Unless otherwise stated in the previous sections, the provision of personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. Failure to provide your personal data may mean, for example, that we are unable to respond to your enquiries.

This privacy notice has been drawn up in collaboration with the consultancy firm SCALELINE Datenschutz. The texts are subject to copyright.

Last Updated: September 2026