Privacy Policy

Last updated: September 2026

This is a translation for convenience. In the event of any discrepancy, the German version ("Datenschutzerklärung") shall prevail.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Phone: +49 40 999995 88
Email: mail@synergize-search.com
Web: www.synergize-search.com

Represented by the Managing Director: Roman Klinke
Commercial register: Local Court (Amtsgericht) of Hamburg, HRB 124538

For any data protection matter, or to exercise your rights, please contact us using the details above.

Data Protection Officer

We have not appointed a data protection officer, as the statutory thresholds under Art. 37 GDPR and Sec. 38 BDSG (German Federal Data Protection Act) do not apply to us. Please direct any data protection enquiries to the contact details above.

2. Overview

Synergize Search is an executive search and recruitment consultancy specialising in the AV and UC industry. The core of our work is to identify, approach and support suitable specialists and executives on behalf of client companies. This necessarily involves processing candidates' personal data — frequently data we have not obtained from the candidates themselves but from publicly accessible sources.

This policy explains what data we process, for what purposes and on what legal basis. It applies equally to:

• visitors to our website,
• candidates we approach or who contact us,
• contact persons at client companies, business partners and suppliers.

We process personal data exclusively in accordance with the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

3. Data processing when visiting our website

3.1 Server log files

When you access our website, your browser automatically transmits information to our hosting provider's server, where it is temporarily stored in log files:

• IP address of the requesting device
• Date and time of access
• Name and URL of the file retrieved
• Referring website (referrer URL)
• Browser and operating system used
• Volume of data transferred and confirmation of successful retrieval

Purpose: ensuring a stable connection, convenient use of the website, evaluation of system security and stability, and administration.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the purposes described above, in particular the security and functionality of our website.

Retention: Cloudflare stores end-user activity logs, where generated for the relevant service, for up to seven days by default. Where Workers Logs are enabled for our website, the retention period is up to three days. We do not retain our own server log files or combine this data with other data sources.

3.2 Hosting and technical delivery

We use Cloudflare Workers, operated by the following external service provider, to technically provide and protect our website:

Cloudflare processes the data generated during your visit to the extent necessary to deliver and secure the website. Cloudflare acts as a processor for us under Art. 28 GDPR; the applicable processing terms are governed by Cloudflare's Data Processing Addendum. Because processing outside the European Economic Area cannot be ruled out, the safeguards described in section 4.5 apply.

3.3 Cookies and similar technologies

Our website does not use cookies for analytics, tracking or marketing purposes. Where strictly necessary technical cookies are used for the operation of the website, this is based on Sec. 25(2) no. 2 TDDDG; any subsequent processing is based on Art. 6(1)(f) GDPR.

We do not use web analytics services, social media plugins, mapping services or embedded advertising networks.

3.4 Encryption

For security reasons, our website uses TLS encryption. You can recognise an encrypted connection by the "https://" prefix in your browser's address bar and by the padlock symbol.

3.5 Contact form and spam protection

If you use our contact form, we process the name, email address, telephone number (if provided) and message that you submit. We use this information solely to receive and deal with your enquiry.

To protect the form from automated and abusive submissions, we use Cloudflare Turnstile. According to Cloudflare, Turnstile processes technical signals such as IP address, TLS fingerprint, user-agent header, site key and associated origin to distinguish human visitors from bots. These signals are used to protect the form and are not used by us for advertising, profiling or web analytics.

We use Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, to deliver the form message to our mailbox. Resend receives the form fields and the message content solely for transactional email delivery. We have not enabled email-open or link-click tracking for these messages.

Legal basis: Art. 6(1)(b) GDPR where an enquiry concerns the conclusion or performance of a contract; otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in answering enquiries and protecting the form against abuse.

Recipients and transfers: Cloudflare processes Turnstile signals in connection with form security; Resend processes form data to deliver the message. Further information on transfers outside the EEA is set out in section 4.5.

Retention: We retain submitted information only for as long as necessary to deal with the enquiry and any resulting business relationship, subject to statutory retention obligations.

3.6 Contacting us by email or telephone

If you contact us by email or telephone, we process the information you provide (name, contact details, content of your enquiry) in order to handle your request.

Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract; otherwise Art. 6(1)(f) GDPR based on our legitimate interest in responding to enquiries.

Retention: we delete the data once your request has been dealt with conclusively, unless statutory retention obligations apply. If your enquiry leads to a candidate or client relationship, the periods set out in sections 4 and 5 apply.

Please note that unencrypted email may be vulnerable. For confidential information we will gladly provide a secure transmission channel on request.

4. Processing of candidate data

This section is the heart of our data processing. It applies to everyone we identify, approach, assess or include in our candidate pool in the course of a search mandate.

4.1 Categories of data processed

Depending on the stage of the process, we process:

• Identification and contact data: name, business and where applicable private contact details, address
• Professional data: current and previous employers, position, function, area of responsibility, reporting line, industry experience, career history
• Qualification data: education, degrees, certifications, language skills, technical competencies
• Application documents: CV, references, certificates, covering letters, work samples
• Process data: motivation to change roles, availability, salary expectations and structure, geographic preferences, interview notes, our assessment of fit for a specific mandate, status in the selection process
• Communication data: correspondence, call notes, appointments

We do not collect or request special categories of personal data under Art. 9 GDPR (e.g. health data, disability status, trade union membership, religious or philosophical beliefs). If you disclose such information to us on your own initiative, we process it only where necessary for the relevant process and only with your explicit consent (Art. 9(2)(a) GDPR), which you may withdraw at any time with effect for the future. Otherwise, we delete such information.

4.2 Source of the data (Art. 14(2)(f) GDPR)

Where we have not obtained your data directly from you, it originates from the following sources:

• publicly accessible professional networks, in particular LinkedIn and XING
• company websites, annual reports, press releases and trade media
• speaker and attendee listings from industry events and trade fairs
• generally accessible internet sources and search engines
• recommendations from our professional network and referrals from third parties
• information provided by client companies in the course of a search mandate

We collect data from a professional context only. We do not evaluate private social media.

We will tell you the source of your data at the latest when we first contact you, and in any event within one month of collection (Art. 14(3) GDPR).

4.3 Purposes and legal bases

On the legitimate interest in the initial approach: our interest is to identify and approach qualified specialists and executives on behalf of client companies. We have carried out a balancing of interests and deliberately limit ourselves to professional data from sources that are evidently intended for professional self-presentation. We safeguard your interests in particular by informing you promptly about the processing, granting you a right to object at any time, and deleting your data immediately if you object or are not interested.

Important: we never pass your data to a client company without your explicit consent. In particular, we will not approach your current employer or disclose your identity to third parties without your agreement. Discretion is not merely a service commitment for us — it is a data protection obligation.

4.4 Recipients

Your data may be received by:

• Client companies, only with your prior consent and limited to the relevant mandate. From the point of transfer, the client company is an independent controller within the meaning of Art. 4(7) GDPR; its own privacy notice governs the processing there. There is no processor relationship between us and the client company.
• IT service providers acting as processors under Art. 28 GDPR, in particular Cloudflare, Inc. (website delivery and Turnstile form protection through Cloudflare Workers), Plus Five Five, Inc. d/b/a Resend (transactional delivery of contact-form messages), and Microsoft Ireland Operations Limited (Microsoft 365 for email, calendar and document processing).
• Tax and legal advisers, where necessary to comply with statutory obligations or to assert our rights.
• Public authorities and courts, where we are legally obliged to disclose.

Our candidate CRM is an application we have developed and operate ourselves. Third parties access the data stored there only within the processor relationships described above.

We do not transfer your data to third parties for advertising, marketing or sales purposes.

4.5 Transfers to third countries

We process your data primarily within the European Union / European Economic Area.

When using Cloudflare Workers, Cloudflare Turnstile, Resend and Microsoft 365, processing or access from a third country, in particular the United States, cannot be ruled out in individual cases. Resend states that its primary processing operations take place in the United States and provides for the EU Standard Contractual Clauses in its Data Processing Addendum; it also states its participation in the EU-U.S. Data Privacy Framework. For the other providers, transfers take place on the basis of the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework and, where appropriate, on the Standard Contractual Clauses under Art. 46(2)(c) GDPR together with supplementary technical and organisational safeguards.

Where a client company is established outside the EU/EEA, we will inform you of this separately before transferring your data and will obtain your consent.

4.6 Retention periods

• Candidate data in an active mandate: until the search is concluded.
• After conclusion or rejection: deletion within six months, unless you have consented to inclusion in our candidate pool. This period reflects the time limits for asserting claims under Sec. 15(4) AGG (German General Equal Treatment Act) and Sec. 61b ArbGG.
• Candidate pool: where consent has been given, stored for 24 months. Before expiry we will ask whether you wish to extend your consent; if we receive no response, we delete your data.
• Contractual and accounting records: in accordance with commercial and tax retention periods of eight or ten years respectively (Sec. 257 HGB, Sec. 147 AO). During this period processing is restricted to fulfilling those obligations.
• On objection or withdrawal of consent: immediate deletion, unless statutory retention obligations apply.

4.7 No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Your suitability and every decision on the further course of a selection process is assessed exclusively by people.

Where we use AI-supported tools — for example for research, structuring text or pre-sorting search results — these serve solely to assist our work. They make no selection, assessment or rejection decisions, and their output is always reviewed by a person.

4.8 Obligation to provide data

You are under no obligation to provide us with personal data. However, without the information required for a mandate, we cannot consider you in a selection process.

5. Processing of client and business partner data

From contact persons at client companies, suppliers and other business partners we process name, function, business contact details, correspondence and the information required to carry out the mandate.

Legal basis: Art. 6(1)(b) GDPR for initiating and performing the contractual relationship, Art. 6(1)(c) GDPR for compliance with legal obligations, and Art. 6(1)(f) GDPR for maintaining the business relationship.

Retention: for the duration of the business relationship, thereafter in accordance with statutory retention periods (see section 4.6).

6. Your rights as a data subject

You have the following rights in relation to your personal data:

• Access (Art. 15 GDPR) — to whether and which data we process about you, including purposes, recipients, retention periods and origin
• Rectification (Art. 16 GDPR) — of inaccurate or incomplete data
• Erasure (Art. 17 GDPR) — unless statutory retention obligations apply
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) — receipt of your data in a structured, commonly used and machine-readable format
• Withdrawal of consent (Art. 7(3) GDPR) — at any time with effect for the future; the lawfulness of processing carried out before withdrawal remains unaffected

An informal message to mail@synergize-search.com is sufficient to exercise your rights.

Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR.

This applies in particular to the inclusion of your data in our research and to the initial approach in the context of a search mandate. If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

An informal objection to mail@synergize-search.com is sufficient. On request we will add you to an internal suppression list so that we do not contact you again in future.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

The authority responsible for us is:

7. Data security

We take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access. These include transport encryption, encryption of stored data, a role-based authorisation concept applying the need-to-know principle, multi-factor authentication, regular backups and a confidentiality undertaking from all staff. Our measures are continuously adapted to the state of the art.

8. Changes to this privacy policy

We will update this policy if the legal position, our services or the nature of our processing changes. The current version published on this website applies.