Legal

Privacy policy

Last updated: August 2026

At NAKAMA EUROPE LTD. (hereinafter “we” or “us”), we attach great importance to the protection of your personal data. This privacy policy informs you, in accordance with the General Data Protection Regulation (GDPR), about how we collect, process and protect personal data on our website www.nakamaeurope.com.

Throughout this privacy policy, we refer to our services for individuals and companies as “services”, to the individuals we currently or potentially place as “candidates”, and to those who engage us to find suitable candidates or provide other services as “clients”.

1. Data Controller

The controller within the meaning of the GDPR is:

NAKAMA EUROPE LTD.

71 Lower Baggot Street

Dublin D02 P593, Ireland

Email: office(at)nakamaeurope.com

Website: www.nakamaeurope.com

We have assessed whether we are required to appoint a data protection officer under Art. 37(1) GDPR and concluded that we are not, given our processing activities. The assessment is documented internally. For all questions on data protection and for exercising your rights, we have designated a permanent point of contact:

Data protection coordination: Claudia Wulf

Email: office(at)nakamaeurope.com

2. Overview of Data Processing

We only process personal data to the extent necessary for the provision of a functional website, our content and services. Processing is based on the following legal grounds:

  • Consent (Art. 6(1)(a) GDPR) – e.g. when subscribing to our newsletter or when AI-assisted tools are used in conversations.
  • Performance of a contract (Art. 6(1)(b) GDPR) – e.g. when providing our services.
  • Legitimate interest (Art. 6(1)(f) GDPR) – e.g. for the operation and security of the website and candidate placement.
  • Legal obligation (Art. 6(1)(c) GDPR) – e.g. statutory retention obligations.

3. Data Security

For security reasons and to protect the transmission of personal data, our website uses SSL/TLS encryption. You can recognise an encrypted connection by the address bar of your browser changing from “http://” to “https://” and by the padlock symbol in your browser bar.

In addition, we take the following measures pursuant to Art. 32 GDPR:

  • A data-light website: no cookies, no tracking, no analytics services and no embedded third-party content. No data is transmitted to third parties when you visit our pages.
  • Processing within the EU or the EEA. The only exception is appointment booking, for which Standard Contractual Clauses apply, see Section 17.
  • Tightly restricted access to the candidate database: only our data protection coordination has full access. Clients receive limited guest access to individual profiles only, and only after you have consented to being presented to that client.
  • Data processing agreements pursuant to Art. 28 GDPR are in place with all service providers listed in Section 16.
  • Defined retention periods, see Section 18.

4. Hosting

Our website is hosted on servers of:

Hetzner Online GmbH

Industriestr. 25, 91710 Gunzenhausen, Germany (server location: Germany)

Hetzner processes access data (server log files) on our behalf, which are automatically collected with each page request. Processing is based on Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of the website) and on the basis of a data processing agreement pursuant to Art. 28 GDPR.

5. Server Log Files

Each time our website is accessed, the following data is automatically collected and stored in server log files:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the file retrieved
  • Volume of data transferred
  • Access status (HTTP status code)
  • Browser type and version, operating system
  • Referrer URL (previously visited page)

This data is used exclusively to ensure the smooth operation of the website and to improve our services. This data is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR.

Log file data is deleted after a maximum of 30 days, unless further retention is required for evidentiary purposes.

6. Cookies

Our website does not currently use any cookies, including no analytics or marketing cookies. A cookie banner is therefore not required. Should we use services in future that require consent-based cookies, we will provide information here and obtain your consent in advance.

7. Social Media Links (LinkedIn, Instagram)

Our website contains links to our profiles on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). These are plain links, not embedded plugins; no data is transmitted to these providers when you visit our website. Only when you click such a link is a connection established between your browser and the servers of the respective network. The provider thereby receives the information that you have come from our website with your IP address. If you are logged in there, the visit can be associated with your user account.

Further information: LinkedIn Privacy Policy | Instagram (Meta) Privacy Policy

8. Email Contact

You have the option of contacting us by email. In this case, the personal data you provide (e.g. name, email address, content of the enquiry) will be stored and processed by us to handle your request.

Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to a contractual relationship (pre-contractual measures), otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). We do not obtain consent for this, because you provide the data in order to have your own enquiry dealt with.

The data will be deleted as soon as it is no longer required for the purpose for which it was collected and no statutory retention obligations apply. If you contact us as a candidate, please also refer to our information in Section 12.

9. Appointment Booking (TidyCal)

To arrange conversations we use the appointment booking service TidyCal provided by Sumo Group Inc. (d/b/a TidyCal), 1305 E. 6th St #3, Austin, TX 78702, USA. The booking takes place on TidyCal’s pages (tidycal.com). We process the data you provide when booking: name, email address, the selected appointment, your enquiry (the service you select), your notes on your situation and the topics you wish to discuss, optionally your LinkedIn profile, and your decision as to whether the conversation may be transcribed (details on transcription in Section 12.6). Booking is also possible without consenting to transcription.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request). A data processing agreement pursuant to Art. 28 GDPR has been concluded with the provider. As processing takes place in the USA, the transfer relies on the EU Standard Contractual Clauses that form part of that agreement (Art. 46(2)(c) GDPR). See Section 17 for details.

Further information: TidyCal Privacy Policy

10. Newsletter and Marketing (Brevo)

To send our newsletter and other marketing communication we use Brevo, a service provided by Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. When you subscribe to our newsletter, we process your email address and, where provided, your name. Subscription uses the double opt-in procedure: you receive a confirmation email and are only added to the distribution list after you have confirmed.

Dispatch takes place via Brevo’s servers; a data processing agreement pursuant to Art. 28 GDPR has been concluded with the provider. Brevo can analyse whether newsletters are opened and which links are clicked; we use this analysis to improve our content.

Legal basis: Art. 6(1)(a) GDPR (consent). You can unsubscribe from the newsletter at any time via the unsubscribe link at the end of every email or by email to office(at)nakamaeurope.com. The lawfulness of processing carried out prior to withdrawal remains unaffected.

Further information: Brevo Privacy Policy

11. Google Workspace and Google Drive

We use Google Workspace for Business, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a central platform for our business communication and internal organisation. This includes in particular sending and receiving business emails (Gmail), managing calendars, and storing and collaborating on documents in Google Drive.

In the context of email communication and document storage, the following data is processed: name and email address of sender and recipient, content of the message or document, date and time, and any attached files. Candidate and client documents (e.g. CVs, notes, reports) may also be stored in Google Drive. This data is processed on Google servers within the EU/EEA (subject to Google Workspace configuration settings).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures), Art. 6(1)(f) GDPR (legitimate interest in efficient business communication and internal organisation) and Art. 28 GDPR (data processing). A data processing agreement (DPA) has been concluded with Google in compliance with GDPR requirements.

The same retention periods apply as for the underlying data: candidate documents are deleted at the latest three years after the last contact, client documents at the latest 24 months after the last contact, in each case subject to statutory retention obligations. We review what is held in Google Drive annually.

Further information: Google Privacy Policy | Google Workspace DPA

12. Data Processing When Using Our Services as a Candidate

If you wish to use our services as a candidate, we need to process certain information about you. As a general rule, we only collect data that is necessary for the provision of our services.

You can send us your CV, references or other presentations (e.g. design portfolio) by email or submit them through our application form. The form is not operated on our website but by our applicant management system Hellotalent (Cegid SAS, France); the button on our contact page leads there. Your details and documents therefore go directly into the database described in Section 12.5. As a candidate, you warrant to NAKAMA EUROPE LTD. that all information provided is truthful and complete.

12.1 Categories of Personal Data

Personal data we process about you as a candidate includes:

  • Name, address, date of birth, marital status, email and/or other contact details
  • Professional career history (including information about placements through us), personal qualifications and skills
  • Information on specific professional expertise and previous employers
  • Salary expectations
  • Nationality, visas, work permits or other identity-related information
  • Contact details of references
  • Information about hobbies, interests and leisure activities, insofar as you provide it yourself; we do not ask for it

12.2 Sources of Data

We obtain this data from the following sources:

  • Directly from you (e.g. by submitting your CV, personal contact or creating a user profile)
  • Publicly accessible professional networks (LinkedIn, XING, Behance)
  • Publicly accessible online job boards
  • References
  • Your own professional website (if applicable)
  • Clients or other candidates

Where we have not collected your data from you directly, we will inform you of the source: at the latest within one month of collection, or with our first contact if that occurs earlier (Art. 14(3) GDPR).

12.3 Use of Your Personal Data

We assess and evaluate your suitability for potential positions and may present you to the respective clients. For this purpose, your personal data is transmitted electronically to the client.

Legal basis: If you sent us your documents yourself or submitted them through our application form, Art. 6(1)(b) GDPR is the governing basis (carrying out the placement you requested). If we approached you as a result of our own research, we rely on Art. 6(1)(f) GDPR (legitimate interest in candidate placement); you may object to this processing under Art. 21 GDPR. For presenting you to a specific client, we additionally obtain your consent under Art. 6(1)(a) GDPR.

12.4 Consent and Withdrawal

The processing of the personal data you have voluntarily provided is carried out within the scope of the consent you have given. By submitting data and content to NAKAMA EUROPE LTD. as a candidate, you expressly warrant that we are authorised to use this data for the purpose of presenting it to our clients and that such use does not infringe any third-party rights.

You may withdraw your consent at any time, discontinue using our services and request the deletion of your data. The lawfulness of processing carried out prior to withdrawal remains unaffected.

For the purpose of candidate placement, your personal data may also originate from third-party sources (e.g. LinkedIn). We will delete this data as soon as we no longer have a legitimate interest in its use or you have informed us that you do not wish to use our services. We may retain your personal data in a reduced form to avoid unwanted repeated contact.

12.5 Candidate Database (Hellotalent)

We store our candidates’ data in our database “Hellotalent” provided by Cegid (formerly Talentsoft), Cegid SAS, 52 Quai Paul Sédallian, 69279 Lyon Cedex 09, France (server location: France). We process the categories of data listed in Section 12.1, in particular your application documents, your career history and the course of our collaboration. You will receive online access to your profile from us. Through this access, you can independently request the deletion of your stored data. For updates to your profile, please contact us by email at office(at)nakamaeurope.com.

Legal basis: Art. 6(1)(b) GDPR where you provided your data to us yourself, otherwise Art. 6(1)(f) GDPR (legitimate interest in candidate placement). The choice follows the same distinction as in Section 12.3.

12.6 AI-Assisted Interview and Data Processing

As part of our services, we use AI-powered tools to transcribe and document conversations with candidates and to summarise text.

No evaluation, rating, scoring or ranking of candidates by AI takes place at NAKAMA. Experience, motivation and fit are assessed, and every selection decision is made, exclusively by our consultants.

a) Transcription (Google Cloud Speech-to-Text)

For the transcription of interviews, in particular where video or audio recordings are made, we use Google Cloud Speech-to-Text provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The audio track is transmitted to Google servers for conversion into text. Processing takes place within the EU/EEA. Google does not use the transmitted data for its own purposes or to improve its models. Recordings are only made with your prior consent.

b) Interview Analysis (Hedy AI)

For the structured documentation of conversations, we use the Hedy AI platform (provider: Hedy Technologies Ltd.). Transcription takes place locally on the device (on-device). Only text excerpts are transmitted to servers for AI-assisted analysis. The server location is within the EU. Audio data is not permanently stored. Hedy AI does not use your data for training AI models.

Further information: Hedy AI Privacy Policy | Hedy AI Trust Centre

c) AI Language Model (Langdock)

To summarise and prepare text, for example interview notes, we use the enterprise AI platform Langdock provided by Langdock GmbH, Berlin, Germany. Langdock provides access to various AI language models, with all data processing taking place exclusively in EU data centres (100% EU data sovereignty). Langdock is ISO 27001 certified and SOC 2 Type II audited. User data is not used for training AI models.

Further information: langdock.com

Legal basis for 12.6 a) to c): Art. 6(1)(a) GDPR (consent). We only record a conversation and only have it transcribed or analysed if you have agreed beforehand; you may withdraw your agreement at any time with future effect. Without your agreement, no AI-assisted processing of your conversation takes place. Where data processing is carried out on our behalf, data processing agreements pursuant to Art. 28 GDPR have been concluded.

13. Data Processing When Using Our Services as a Client

In order to provide or prepare the contractual services for you as a client, we process personal data of persons employed in your company, such as contact information, name and position, as well as preferences for filling positions and opinions on the candidates we propose.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in the contractual performance of our services).

We also store personal data of your internal contacts after the end of the contract or if no contract has been concluded, for the purpose of re-establishing contact. We delete this data at the latest 24 months after the last contact, or earlier as soon as you inform us that you do not wish to use our services in the future. Statutory retention obligations, for example under tax law, remain unaffected.

14. Special Categories of Personal Data

Data within the meaning of Art. 9(1) GDPR (e.g. health data, religious beliefs, political opinions) is not required for our services. Please do not send us such data unsolicited. Should such data become relevant in individual cases, we will obtain your explicit consent pursuant to Art. 9(2)(a) GDPR.

15. Use of AI Systems (EU AI Act)

We use AI-powered tools and inform you about this transparently, whether or not we are legally required to do so.

  • Purpose of use: transcription and documentation of conversations, and summarising and preparing text.
  • Systems used: Google Cloud Speech-to-Text (transcription), Hedy AI (documentation of conversations), Langdock (summarising text). Details in Section 12.6.
  • Human assessment: experience, motivation and fit are assessed exclusively by our consultants. AI does not produce evaluations, scores or rankings of candidates at NAKAMA.
  • Transparency: candidates are informed before or at the start of a conversation that AI-powered tools are used for transcription and documentation, and give their consent beforehand.
  • Data protection: all AI service providers used process data exclusively within the EU/EEA. User data is not used for training AI models.
  • Information on request: you may ask at any time which AI-powered tools were used in connection with your data, and for what purpose.

Classification: Regulation (EU) 2024/1689 (EU AI Act) classifies AI systems in the employment context as high-risk where they are intended to analyse and filter applications or to evaluate candidates (Annex III, No. 4). These use cases do not apply to us. We use AI exclusively for transcription, documentation and text preparation, not for evaluating, selecting or filtering candidates.

Should we use AI systems in future that fall under Annex III, No. 4, we will state this here in advance and meet the obligations attached to it.

16. Disclosure of Data to Third Parties

We use your personal data exclusively for our own services as described above. Exceptions are made for our service partners who are required for the technical provision of our services. The scope of data transfer is limited to the legally permissible minimum and data protection requirements are observed.

The following service partners are involved in our operations:

  • Hetzner Online GmbH (hosting) - Industriestr. 25, 91710 Gunzenhausen, Germany (server location: Germany)
  • Cegid SAS (Hellotalent candidate database, formerly Talentsoft) - 52 Quai Paul Sédallian, 69279 Lyon Cedex 09, France (server location: France)
  • Google Ireland Limited (Google Workspace incl. Gmail and Google Drive, Google Cloud Speech-to-Text) - Gordon House, Barrow Street, Dublin 4, Ireland
  • Brevo GmbH (newsletter and marketing) - Köpenicker Straße 126, 10179 Berlin, Germany
  • Sumo Group Inc. (appointment booking TidyCal) - 1305 E. 6th St #3, Austin, TX 78702, USA
  • Hedy Technologies Ltd. (interview analysis, Hedy AI) - server location: EU
  • Langdock GmbH (AI language model platform) - Berlin, Germany (server location: EU)

17. Data Transfers to Third Countries

All service providers listed in Section 16 except one process your data within the EU or the EEA. A transfer to a third country only takes place for appointment booking:

Sumo Group Inc. (TidyCal), 1305 E. 6th St #3, Austin, TX 78702, USA. The transfer relies on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, which form part of the data processing agreement concluded with the provider.

For clarity: there is no general adequacy decision for the United States. The European Commission’s decision on the EU-U.S. Data Privacy Framework applies only to organisations that have self-certified under it and appear on the official list. We therefore do not base the transfer to Sumo Group Inc. on that decision, but on the Standard Contractual Clauses.

You may request a copy of the safeguards we have agreed (Art. 46(1) GDPR): office(at)nakamaeurope.com.

18. Retention Period and Deletion

We only store your personal data for as long as is necessary for the respective processing purposes or as required by statutory retention periods. In detail:

  • Server log files: maximum 30 days
  • Email enquiries: until the enquiry is resolved, plus statutory retention periods
  • Candidate data: until withdrawal, at most 3 years after the last contact
  • Client data (corporate clients): for the duration of the contract, plus statutory retention periods (up to 10 years)
  • Contact details of contacts without a running contract: at most 24 months after the last contact
  • Documents held in Google Drive: according to the periods for the underlying data, with an annual review
  • Transcripts and AI-assisted analyses of conversations: together with the candidate data, and without delay if consent is withdrawn

You may request the deletion of your data at any time (informal email to office(at)nakamaeurope.com). We will delete your data without delay, provided no statutory retention obligations apply.

19. Is Providing Your Data Required?

You are under no statutory or contractual obligation to provide us with personal data. Providing it is voluntary. Without certain details, however, we cannot provide our services, or can provide them only to a limited extent:

  • As a candidate: without your career history and contact details we cannot assess your suitability or present you to a client. Inclusion in our candidate database is then not possible.
  • When booking an appointment: without a name and email address we cannot confirm the appointment or speak to you. The details about your enquiry are optional; they only help us prepare.
  • As a client: without the contact details of your contacts we cannot carry out the engagement.

Consent to the recording and AI-assisted analysis of a conversation (Section 12.6) is never a precondition. You can hold and book a conversation without giving that consent, and you will not be disadvantaged as a result.

A statutory obligation to provide data exists only insofar as tax or commercial law requires it in the context of a business relationship.

20. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

  • Access (Art. 15 GDPR): You may request information about the personal data we process about you.
  • Rectification (Art. 16 GDPR): You may request the correction of inaccurate data or the completion of incomplete data.
  • Erasure (Art. 17 GDPR): You may request the deletion of your data, provided no statutory retention obligations apply.
  • Restriction (Art. 18 GDPR): You may request the restriction of processing of your data.
  • Data portability (Art. 20 GDPR): You may receive your data in a structured, commonly used and machine-readable format.
  • Objection (Art. 21 GDPR): You may object at any time to the processing of your data based on Art. 6(1)(f) GDPR.
  • Withdrawal of consent (Art. 7(3) GDPR): You may withdraw any consent given at any time with future effect, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise your rights, please contact: office(at)nakamaeurope.com

21. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of a legitimate interest under Art. 6(1)(f) GDPR (Art. 21(1) GDPR).

In our case this concerns above all the processing of candidate data obtained through our own research (Section 12.3) and the contact details of client contacts that we retain in order to approach them again (Section 13).

If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

Where your data is processed for direct marketing, you may object at any time and without giving reasons. We will then no longer use your data for that purpose (Art. 21(2) and (3) GDPR).

An informal message to office(at)nakamaeurope.com is sufficient for your objection. It is not subject to any particular form and is free of charge.

22. Automated Decision-Making / Profiling

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The AI-powered tools we use (see Sections 12.6 and 15) transcribe, document and summarise text; they do not evaluate candidates and do not prepare decisions. All decisions in the placement process are made by our qualified consultants.

23. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR (Art. 77 GDPR).

The supervisory authority responsible for us is:

Data Protection Commission (DPC)

21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland

Phone: +353 (0)761 104 800

Website: www.dataprotection.ie

Alternatively, you may also contact the supervisory authority of your place of residence or employment.

24. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in the legal situation or modifications to our services or data processing activities. The current version is always available on this page.

Last updated: August 2026