Chat on WhatsappPrivacy Notice for Customers and Business Partners of element GmbH
Privacy Notice for Candidates and Job Applicants | Privacy Notice for Website Visitors
Information pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR)
Last updated: 15 September 2026
1. Data Controller
The controller responsible for processing your personal data is:
element GmbH, Bockenheimer Landstrasse 13-15, 60325 Frankfurt am Main, telephone +49 69 15 39 254-0, fax +49 69 15 39 254-49, email: info@element.de
Managing Directors: Laura Reisdorf, Christian Schmitt, Torsten Fischer, Andreas Fischer
2. Data Protection Officer
Our Data Protection Officer can be contacted at: datenschutzbeauftragter@datenschutzexperte.de
Alternatively, you may write to the controller at the address above, marking your correspondence ‘For the attention of the Data Protection Officer’:
PROLIANCE GmbH
Data Protection Officer
Leopoldstr. 21
80802 Munich
3. Personal Data We Process
In the course of our business relationship with you as a client or business partner, we process the following categories of personal data:
- Contact details: surname, first name, company name, position/function, business address, business email address and business telephone number
- Contract data: details of instructions, search assignments, requirement profiles, terms and contract periods
- Communications data: the content of emails, telephone calls, video calls and face-to-face meetings, including notes and summaries of conversations
- Briefing data: job descriptions, requirement profiles and contextual information about vacancies provided by you
- Billing data: billing address, bank details and payment information
4. Sources of Your Personal Data
We generally obtain your personal data:
- Directly from you: through your enquiry, the placing of an order, or communications by email, telephone or in person
- From your company: through contacts designated by you
- From publicly accessible sources: in particular, company websites, professional networks such as LinkedIn and XING, and commercial registers
Where we do not obtain personal data directly from you, we will inform you of its source no later than one month after obtaining it or when we first contact you (Article 14 GDPR).
5. Purposes and Legal Bases of Processing
| Purpose | Legal basis | Explanation |
|---|---|---|
| Entering into and performing the recruitment agreement | Article 6(1)(b) GDPR (performance of a contract) | Processing your personal data in order to handle your instructions, communicate with you, search for candidates and present candidates to you |
| Summarising and preparing briefings and search assignments | Article 6(1)(b) GDPR | To process your instructions efficiently |
| Preparing for client meetings and business development discussions | Article 6(1)(f) GDPR (legitimate interests) | Our legitimate interest lies in the professional preparation and conduct of the business relationship |
| Drafting business development communications | Article 6(1)(f) GDPR (legitimate interests) | Our legitimate interest lies in acquiring new clients and initiating business relationships. We make contact in accordance with statutory requirements (in particular section 7 of the German Unfair Competition Act (UWG)) |
| Summarising notes of conversations | Article 6(1)(b) and/or (f) GDPR | For documentation and efficient further processing as part of the recruitment process |
| Preparing and issuing invoices | Article 6(1)(b) GDPR and Article 6(1)(c) GDPR (legal obligation) | Performance of the contract and compliance with retention obligations under tax and commercial law |
| Establishing, exercising or defending legal claims | Article 6(1)(f) GDPR (legitimate interests) | Retention after the contract has ended in order to protect against potential claims |
6. Principles Governing the Use of AI Systems
As part of our business activities, we use AI-assisted tools to make certain processes more efficient and improve their quality. We wish to be transparent with you about this:
6.1 Use of AI Systems
We use various AI-assisted tools, currently including, in particular, OpenAI’s ChatGPT Pro and Anthropic’s Claude. We may also use other AI-assisted tools; this list is therefore not exhaustive.
Before using an AI system, we assess whether the applicable data protection, contractual and organisational requirements have been met.
In particular, we ensure that:
- personal data is processed on a valid legal basis;
- the necessary data protection and contractual arrangements are in place;
- personal data is processed only to the extent necessary;
- appropriate technical and organisational measures are in place to protect personal data; and
- AI-generated outputs are reviewed by our employees before they are used.
6.2 How Do We Use AI in Connection with Your Personal Data?
In the context of our business relationship with you, we use AI in particular for:
- summarising your briefings and search assignments to enable efficient processing;
- drafting job advertisements based on your requirement profiles;
- preparing for meetings and appointments with you by summarising available information;
- assisting with the documentation and further processing of client enquiries; and
- drafting business development communications, where applicable using anonymised candidate profiles.
6.3 What AI Does Not Do in Our Organisation
- No automated decision-making: decisions about the selection of candidates, the content of proposals or the performance of assignments are made exclusively by individuals.
- No profiling within the meaning of Article 22 GDPR.
- No disclosure of your confidential business information to AI providers for their own purposes.
6.4 Quality Assurance
All AI-generated content is reviewed by our employees for accuracy and appropriateness before it is used in communications with you or with third parties.
7. Recipients of Your Personal Data
| Recipient | Purpose | Legal basis |
|---|---|---|
| AI service providers | AI-assisted text processing on behalf of element GmbH | Article 28 GDPR (processing on behalf of a controller) |
| IT service providers / hosting providers | Technical operation of our systems | Article 28 GDPR (processing on behalf of a controller) |
| Candidates | Your personal contact details will not be disclosed to candidates without your consent. | Article 6(1)(b) GDPR |
| Tax advisers / tax authorities | Compliance with tax obligations | Article 6(1)(c) GDPR |
Where, in an individual case, personal data is transferred to recipients outside the European Union (EU) or the European Economic Area (EEA), this will take place only in compliance with the statutory requirements of the GDPR.
8. Retention Periods
| Situation | Retention period |
|---|---|
| Active business relationship | For the duration of the business relationship |
| After the business relationship has ended | Retention in accordance with obligations under commercial and tax law (6 or 10 years pursuant to the German Commercial Code (HGB) and Fiscal Code (AO)) |
| Business development contacts with no contractual relationship | Deletion as soon as there is no longer a legitimate interest in further storage, at the latest upon objection. |
| Establishing / defending legal claims | Until the applicable statutory limitation periods have expired. |
9. Your Rights
Under the GDPR, you have the following rights:
- Right of access (Article 15 GDPR): you may request access to the personal data we hold about you.
- Right to rectification (Article 16 GDPR): you may request the rectification of inaccurate or incomplete personal data.
- Right to erasure (Article 17 GDPR): you may request the erasure of your personal data, provided that no statutory retention obligations or legitimate interests require its continued retention.
- Right to restriction of processing (Article 18 GDPR): in certain circumstances, you may request that the processing of your personal data be restricted.
- Right to data portability (Article 20 GDPR): you have the right to receive your personal data in a structured, commonly used and machine-readable format.
- Right to object (Article 21 GDPR): where we process your personal data on the basis of legitimate interests, you have the right to object to the processing at any time on grounds relating to your particular situation.
- Right to lodge a complaint with a supervisory authority (Article 77 GDPR): you have the right to lodge a complaint with a data protection supervisory authority, in particular with the supervisory authority responsible for element GmbH:
The Hessian Commissioner for Data Protection and Freedom of Information
Gustav-Stresemann-Ring 1
65189 Wiesbaden
https://datenschutz.hessen.de
10. Requirement to Provide Personal Data
The provision of your personal data is required in part by law (e.g. tax legislation) or is necessary in order to enter into and conduct our business relationship. Without the data required for these purposes, we may be unable to provide our services.
11. Contact
If you have any questions about data protection or wish to exercise your rights, please contact:
element GmbH, Bockenheimer Landstrasse 13-15, 60325 Frankfurt am Main, telephone +49 69 15 39 254-0, fax +49 69 15 39 254-49, email: info@element.de
Alternatively, please contact our Data Protection Officer directly (see section 2).