Hidden Job Market

This English translation is provided for convenience; the German version is legally binding.

No data protection officer has been appointed, as the statutory requirements for doing so are not met. Your requests are handled by the management.

1. Use of this website

1.1 Provision of the website and server logs

When you visit our website, data that is technically necessary to display the page to you is transmitted automatically: IP address, date and time of access, page requested, volume of data transferred, browser type and operating system, and the previously visited page. This processing serves the secure and stable operation of the website. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the functionality and security of our website. Our website is hosted by Vercel Inc., based in the United States, and delivered via its server network. Vercel processes the data mentioned on our behalf on the basis of a data processing agreement; for the transfer to the United States, see section 7.1. We serve fonts and images ourselves, without using external font services.

1.2 Cookies and consent management

We use cookies and similar technologies. Strictly necessary cookies are required for the website to function; the legal basis is Art. 6(1)(f) GDPR in conjunction with Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). All other cookies, in particular for audience measurement, are only used with your consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. We obtain your consent through our own consent dialogue. There you can choose between the categories “Functional” (embedded content such as the map), “Statistics” and “Marketing”. We store your choice and its timestamp exclusively locally in your browser so that we can take it into account on your next visit; after twelve months we ask again. This information is not transmitted to us or to third parties. You can change or withdraw your consent at any time with effect for the future via the cookie settings.

We use Google’s consent mode (Consent Mode). Google Tag Manager is loaded when the website is accessed, whereby your IP address and the page requested are transmitted to Google. As long as you have not given your consent, the Google services on our website do not set any cookies for audience measurement or advertising, and no cookie-based measurement takes place.

1.3 Audience measurement

We use Google Tag Manager and Google Analytics 4 to understand how our website is used and to improve our content. In the process, usage data such as pages visited, time spent on the site, approximate location and information about the device used are processed. Cookie-based measurement and the attribution of usage data take place only after you have given your consent. The legal basis is Art. 6(1)(a) GDPR; for loading the Tag Manager itself, Art. 6(1)(f) GDPR (legitimate interest in the technical provision of consent management). The provider is Google Ireland Limited; a transfer to the United States cannot be ruled out. Further details can be found in section 7.1. In addition, Google Search Console provides us with aggregated reports on the search terms through which our pages are found. These reports do not allow any conclusions to be drawn about individual persons.

1.4 Contacting us

If you contact us via the contact form, by email or by telephone, we process your details in order to handle your enquiry. Mandatory fields are marked as such. Via the contact form we receive your email address and, if provided, your company, name, telephone number and message, as well as the page from which you sent the form. The details are not stored on the website but are forwarded directly as an email to our mailbox via a server function of our hosting provider Vercel; for sending and storage we use Microsoft 365, a service of Microsoft Ireland Operations Limited. To protect against automated submissions, we check technical characteristics when the form is submitted, such as a field invisible to humans and the time between opening and submitting the form; no additional data is stored for this purpose and no third-party services are involved. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to the initiation or performance of a contract, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in responding to enquiries.

1.5 Appointment booking

To arrange meetings, we offer online appointment booking via Calendly. If you use it, we process your name, your email address, the selected appointment and any additional information you provide voluntarily. The legal basis is Art. 6(1)(b) GDPR for appointments related to a contract, otherwise Art. 6(1)(a) GDPR on the basis of the consent you give by using the booking service. The provider is Calendly LLC, based in the United States.

1.6 Map service

On our home page you can view the location of our offices on a Google Maps map. The map is only loaded once you have consented to the “Functional” category or, in an individual case, clicked on “Show map”. In the process, your IP address and information about your browser in particular are transmitted to Google. The legal basis is Art. 6(1)(a) GDPR. The provider is Google Ireland Limited; a transfer to the United States cannot be ruled out. Further details can be found in section 7.1.

1.7 Links to external services

Our website contains links to external services, including professional networks, review platforms, map services and messaging services. These are plain links; data is only transmitted to the respective provider once you click on the link. From that point on, the privacy policy of the respective provider applies. Our career portal and our protected client portal can be reached via separate addresses. The information in this policy applies to both.

2. Newsletter

If you subscribe to our newsletter, we process your email address and, if provided, your name. Registration takes place using the double opt-in procedure: you first receive an email with a confirmation link, and you are only subscribed once you have clicked it. We store the time of registration and confirmation as proof. We also analyse whether and when a message was opened and which links were clicked in order to tailor our content to our readers’ interests. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 174 TKG 2021. You can withdraw your consent at any time free of charge; each issue contains an unsubscribe link for this purpose. The withdrawal does not affect the lawfulness of processing carried out before it. We use Mailchimp, a service of Intuit Inc., based in the United States, which processes the data on our behalf, to send the newsletter. When you subscribe via our website, your email address is transmitted directly to Mailchimp via a server function of our hosting provider Vercel and stored there together with a note of the registration source. For the transfer to the United States, see section 7.1.

3. Candidates: applying to us

This section applies if you apply to us for an advertised position or submit an unsolicited application. If we approached you without you having applied, section 4 applies.

3.1 Purposes and legal bases

We process your data in order to review your application, conduct the selection procedure for a specific search mandate and propose you to our clients. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest and that of our clients lie in conducting the recruitment procedure; your application is based on your interest in a career move. For the disclosure of your documents to a specific client and for inclusion in our talent pool, we obtain your separate consent pursuant to Art. 6(1)(a) GDPR. Where processing is necessary to comply with legal obligations or for the establishment, exercise or defence of legal claims, we rely on Art. 6(1)(c) and (f) GDPR.

3.2 What data we process

• Master and contact data: name, address, email address, telephone number
• Application documents: CV, references and certificates, supporting documents, cover letter, photograph if you include one
• Information on education, career history, qualifications and language skills
• Information on availability, notice period, mobility and salary expectations
• Notes and assessments from our conversations with you, and the status of the procedure
• Your consents and when they were given

Please do not send us any information on special categories of personal data within the meaning of Art. 9 GDPR, such as health, religion or trade union membership. We do not ask for such information and do not need it.

3.3 Source of the data

We process the data you provide to us. In addition, we may take into account publicly available professional information, for example from professional networks. We only obtain references after prior agreement with you.

3.4 Disclosure to clients

We only present your profile to a client after we have informed you about the company and the position and obtained your consent. Your profile is made available via a protected client portal to which only the designated contact persons of the respective client have access. The client is an independent controller for the further processing of your data in its selection procedure.

3.5 Necessity of the information

Providing your data is voluntary. However, without the information necessary for the assessment, we cannot process your application or propose you.

4. Candidates: approached by us

This section applies if we approached you in the course of a search without you having applied to us. It contains the information required under Art. 14 GDPR.

4.1 Why we contact you

On behalf of companies, we search for specialists and executives for specific positions. Positions of this kind are generally not filled through job advertisements, because the right people do not actively apply. We therefore identify and contact them directly.

4.2 Where your data comes from

We did not collect your data from you. It comes from the following sources:

• Publicly accessible professional networks, in particular LinkedIn
• Publicly accessible sources such as company websites, specialist articles, talks, trade media and commercial register publications
• Suggestions and recommendations from our professional network
• Our consultants’ own research

4.3 What data we process

We process exclusively professional data: your name, your current role and employer, your career history and education, your areas of expertise and your business contact details. In addition, we record our assessment of whether your profile fits a specific position, and the status of our contact with you.

4.4 Legal basis

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest and that of our clients lie in filling vacant positions; at the same time, we pursue the interest of presenting you with a career opportunity you would otherwise not hear about. We have balanced your interests against these. The following weigh in your favour: we process exclusively professional and predominantly publicly available data, we approach you individually and in relation to a specific position, we inform you about the processing when we first contact you, and you can object at any time.

4.5 What happens to your data if you are not interested

If you tell us that you are not interested, we stop the processing and delete your data on completion of the search mandate. At your request, we will add you to a suppression list so that we do not contact you again in future searches; for this purpose we store only the information strictly necessary. Inclusion in our talent pool beyond the current mandate only takes place with your explicit consent.

4.6 Disclosure to clients

We only give your name to a client after we have informed you about the company and the position and obtained your consent. Without your consent, no client will learn that we have spoken to you. Your right to object: you can object to the processing of your data at any time without suffering any disadvantage. A short message to datenschutz@fortalent.at is sufficient. We will then stop the processing without delay. Further details can be found in section 10.

5. Supplementary assessment

In individual procedures, we additionally use recognised psychometric instruments to better assess professional and personal fit. This only takes place after prior agreement and on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR. Your answers and the resulting evaluation are processed. To conduct the assessment, we use the testing system of a specialised provider that processes the data on our behalf. We discuss the evaluation with you; it is only passed on to the client with your separate consent. A test result never decides on its own whether you are considered in the procedure. Consent is voluntary and can be withdrawn at any time.

6. Clients and business contacts

For contact persons at our clients, as well as prospective clients and business contacts, we process name, role, business contact details, company affiliation and notes on the course of our cooperation. The legal basis is Art. 6(1)(b) GDPR for the initiation and performance of the contract and Art. 6(1)(f) GDPR for maintaining the business relationship. For invoicing, the retention obligations under tax law additionally apply pursuant to Art. 6(1)(c) GDPR.

7. Recipients, service providers and transfers to third countries

Within our company, only those persons who need your data for the purposes stated have access to it. In addition, we use carefully selected service providers who process data exclusively on our instructions and on the basis of data processing agreements pursuant to Art. 28 GDPR. These fall into the following categories:

• Applicant management: provider of an applicant tracking system based in the European Union
• Client portal: database and hosting provider, processing in the European Union, company headquarters partly in the United States
• Website: hosting including form delivery, audience measurement and map service, European Union and United States
• Communication and storage: provider of email, calendar and file storage, European Union and United States
• Newsletter: newsletter delivery provider based in the United States
• AI-assisted administration: provider of an AI service based in the United States
• Assessment: provider of a testing system based in the European Union
• Accounting: accounting software and tax advisory services based in the European Union

Data is only transferred to clients after your consent, as described in sections 3 and 4. The respective client is an independent controller for its subsequent processing. Beyond this, we disclose data where we are legally obliged to do so or where this is necessary for the establishment, exercise or defence of legal claims.

7.1 Transfers to third countries

Some of the service providers mentioned are based in the United States or use sub-processors there. In these cases, we base the transfer either on an adequacy decision of the European Commission, provided the provider is certified under the relevant framework, or on the standard contractual clauses adopted by the European Commission together with supplementary safeguards. On request, we will be happy to inform you of the specific basis for each transfer.

8. Retention period

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods. Specifically:

• Data from research prior to making contact: deletion on completion of the respective search mandate
• Application and candidate data in the selection procedure: deletion six months after completion of the procedure, unless you have consented to longer storage
• Data in the talent pool: in accordance with your consent; we actively ask you whether you wish to continue
• Data provided in the client portal: complete deletion one month after completion of the search mandate
• Reports and records relating to the mandate: five years from completion of the mandate for the establishment and defence of legal claims
• Newsletter data: until you withdraw your consent; we retain proof of registration beyond that for evidentiary purposes
• Enquiries via form, email or telephone: until they have been fully dealt with, unless a longer retention obligation applies
• Invoices and accounting records: seven years pursuant to Section 132 of the Austrian Federal Fiscal Code (Bundesabgabenordnung, BAO)

Where statutory retention obligations apply, we restrict processing instead of deleting the data; the data is then no longer used for the original purposes.

9. Use of artificial intelligence and automated decision-making

We use AI-supported tools to analyse documents, summarise profiles and prepare reports for our clients. In the process, your professional data, including the content of your CV, may be transmitted to the provider of the service, which processes it exclusively on our behalf. The use of your data to train the underlying models is contractually excluded. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in handling mandates carefully and promptly.

Where we explicitly do not use AI: the personal assessment of a candidate is prepared exclusively by the responsible consultant in person. It is based on the interview conducted and on the consultant’s own professional judgement, not on a machine-generated evaluation. AI tools support us in preparing information; they do not replace judgement. You can find out how we approach artificial intelligence in general at www.fortalent.at/en/about#ai.

Important: a decision on whether you are considered in a procedure is never based solely on automated processing. Every assessment and every recommendation is the personal responsibility of a consultant. No automated individual decision-making within the meaning of Art. 22 GDPR, including profiling with legal effect, takes place.

10. Your rights

You have the following rights. To exercise them, please contact datenschutz@fortalent.at. We will respond to your request free of charge within one month; in the case of particularly extensive requests, we may extend this period by two months and will inform you accordingly.

• Right of access pursuant to Art. 15 GDPR: you can obtain information as to whether and which data we process about you, as well as a copy of this data
• Right to rectification pursuant to Art. 16 GDPR: we correct inaccurate data and complete incomplete data
• Right to erasure pursuant to Art. 17 GDPR: you can request the erasure of your data unless a retention obligation prevents this
• Right to restriction of processing pursuant to Art. 18 GDPR: you can request that we restrict processing, for example while we verify the accuracy of the data
• Right to data portability pursuant to Art. 20 GDPR: you receive the data you have provided in a commonly used, machine-readable format
• Right to object pursuant to Art. 21 GDPR: you can object, on grounds relating to your particular situation, to processing based on a legitimate interest
• Withdrawal of consent pursuant to Art. 7 GDPR: you can withdraw consent you have given at any time with effect for the future

10.1 Note on the right to object

If you object to the processing, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If you object to being approached by us in the course of a search, we will stop the processing without further review.

10.2 Right to lodge a complaint

If you believe that we are not processing your data lawfully, you can lodge a complaint with a supervisory authority. The competent authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna. We would appreciate it if you contacted us first so that we can resolve your concern directly.

11. Changes to this policy

We update this policy when our services, the systems we use or the legal framework change. The version published on this page applies in each case.

Version as of: 30 September 2026.