Legal

Privacy Policy

Version: 5 October 2026

At NAKAMA EUROPE LTD. (hereinafter “we” or “us”), we attach great importance to the protection of your personal data. This privacy policy informs you, in accordance with the General Data Protection Regulation (GDPR), about how we collect, process and protect personal data on our website www.nakamaeurope.com and in connection with our services.

For the purposes of this privacy policy, we distinguish between the following roles:

  • Private clients are individuals who commission or use our advisory, coaching or other services for their own professional situation. They are the contracting parties of the relevant advisory or coaching agreement and do not automatically become candidates by entering into that agreement.
  • Candidates are individuals whose professional data we process in the context of a search or placement service commissioned by a company, in order to present them, where appropriate, to the commissioning company or another potential employer. Candidates are not the commissioning parties of our search or placement services and do not owe us a fee for those services.
  • Corporate clients are companies or other organisations that commission us to search for, select or present suitable candidates. They are the commissioning parties of the search or placement service.
  • Contacts of corporate clients are individuals who communicate with us or participate in carrying out the engagement on behalf of a corporate client.

Depending on how our services are used, one person may have more than one role. Processing in each context is governed exclusively by the specific role and service concerned. The terms “private client”, “candidate” and “corporate client” are not used interchangeably in this privacy policy.

Which sections apply to you?

  • If you commission our advisory, coaching or other services for your own professional situation, you are a private client. Section 12 on the INTENT portal, the general sections and the sections relevant to the service concerned apply to you. The sections on the candidate database, candidate suitability and presentation to corporate clients do not apply to you merely because you commission private advisory or coaching services.
  • If your professional data is processed or you are approached in the context of a search or placement service commissioned by a company, you are a candidate. In that context you are not the commissioning party of the search or placement service.
  • If you communicate with us on behalf of a company, or a company commissions us to search for, select or present candidates, the relevant role is a corporate client or a contact of a corporate client.
  • The general sections, in particular those on the controller, service providers, third-country transfers, retention periods, data-subject rights and changes, apply to all data subjects.

1. Data Controller

The controller within the meaning of the GDPR is: NAKAMA EUROPE LTD., 60 Merrion Square South, Dublin 2, Dublin D02 HE24, Ireland. Email: office@nakamaeurope.com. Website: www.nakamaeurope.com.

Based on our current assessment, we are not required to appoint a data protection officer under Art. 37(1) GDPR. For all questions on data protection and for exercising your rights, we have designated a permanent point of contact: Data protection coordination: Claudia Wulf, email: office@nakamaeurope.com.

2. Overview of Data Processing

We only process personal data to the extent necessary for the provision of a functional website, our content and services. Processing is based in particular on the following legal grounds:

  • Consent (Art. 6(1)(a) GDPR), for example when subscribing to our newsletter or when consent-based AI-assisted tools are used in conversations.
  • Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), for example when providing or preparing our services, including the AI coach in the INTENT portal for private clients.
  • Legitimate interest (Art. 6(1)(f) GDPR), for example for operating and securing the website, candidate placement and communication with contacts of corporate clients.
  • Legal obligation (Art. 6(1)(c) GDPR), for example statutory tax or commercial retention obligations.

3. Data Security

For security reasons and to protect the transmission of personal data, our website uses SSL/TLS encryption. You can recognise an encrypted connection by the address bar of your browser changing from “http://” to “https://” and by the padlock symbol being displayed.

We take appropriate technical and organisational measures pursuant to Art. 32 GDPR. These include data minimisation, restricted access to personal data, appropriate access controls and defined deletion periods. Based on its current status, our website uses no cookies, tracking or embedded third-party content. Separate services, such as appointment booking, are governed by the information provided in the relevant sections of this privacy policy.

Access to the candidate database is tightly restricted. Full access is limited to authorised persons. Corporate clients receive limited access to individual candidate profiles only where presentation to that corporate client for the specific search or placement takes place under the applicable requirements. Private clients do not receive access to the candidate database or candidate profiles merely because they have an advisory or coaching agreement. Where legally required, data processing agreements pursuant to Art. 28 GDPR are in place with service providers used.

4. Hosting

Our website is hosted on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, with the server location in Germany. Hetzner processes access data and server log files on our behalf, which are automatically collected when pages are accessed. Processing is based on Art. 6(1)(f) GDPR and, where required, on a data processing agreement pursuant to Art. 28 GDPR.

5. Server Log Files

Each time our website is accessed, the following data is automatically collected and stored in server log files:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the file retrieved
  • Volume of data transferred
  • Access status (HTTP status code)
  • Browser type and version and operating system
  • Referrer URL (previously visited page)

This data is used exclusively to ensure the smooth operation of the website and to improve our services. It is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR. Log file data is deleted after a maximum of 30 days, unless further retention is required for evidentiary purposes or by law.

6. Cookies

Our website does not currently use any cookies, including analytics or marketing cookies. A cookie banner is therefore not required on the current status. If we use services in future that require consent-based cookies, we will provide information here and obtain your consent in advance.

6.1 Audience Measurement (Umami)

For audience measurement, we use the open-source software Umami, which we operate ourselves on our server in Germany. Umami records the pages visited, the approximate origin of the visit (country and referring website), browser type and device category. No cookies are set and no information is stored on or read from your device. Your IP address is not stored. Repeat visits are aggregated only by means of a daily-changing, non-reversible check value; no personal profile is created. The data remains on our server and is not shared with third parties. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly measurement of website use without identifying individuals).

7. Social Media Links (LinkedIn, Instagram)

Our website contains plain links to our profiles on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). These are not embedded plugins. No data is transmitted to these providers when you visit our website. Only when you click such a link is a connection established between your browser and the servers of the relevant network. The provider thereby receives the information that you have come from our website with your IP address. If you are logged in there, the visit can be associated with your user account. Further information is available in the LinkedIn and Instagram (Meta) privacy policies on the respective websites.

8. Email Contact

You have the option of contacting us by email. The personal data you provide, such as your name, email address and the content of your enquiry, will be stored and processed to handle your request. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contractual relationship or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR. Depending on your role, the further processing is governed by Section 12 for private clients in the advisory or coaching context, Section 13 for candidates, Section 14 for corporate clients or contacts of corporate clients, or Section 12.1 for private clients using the INTENT portal.

9. Appointment Booking via INTENT (Executives and Private Individuals)

Executives and private individuals currently arrange conversations through the appointment booking service TidyCal (Section 9.1); we transfer the booking details into our own system INTENT. In future, executives and private individuals will book directly through our booking portal INTENT at intent.nakamaeurope.com. INTENT is operated on our server in Germany; appointments are kept in our Google Calendar. We process the data you provide when booking: name, email address, the selected appointment, the service you select, your notes on your situation and the points you wish to clarify, your LinkedIn profile and your decision as to whether the conversation may be transcribed. Booking is also possible without consenting to transcription.

Booking a conversation for an executive or private individual in connection with their own advisory or coaching services may be a pre-contractual enquiry by a private client. It is not automatically an application or an entry in the candidate database. You may voluntarily upload your CV through INTENT to help us prepare an advisory or coaching conversation. This does not automatically lead to entry in Hellotalent or processing for placement purposes.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). Based on the intended operation, processing through our INTENT portal does not involve a transfer to third countries. For retention periods, see Section 19.

9.1 Appointment Booking via TidyCal (Corporate Clients and, for the time being, Private Individuals)

To arrange conversations with corporate clients and, until booking moves to INTENT, with private individuals, we use the appointment booking service TidyCal provided by Sumo Group Inc. (d/b/a TidyCal), 1305 E. 6th St #3, Austin, TX 78702, USA. The booking takes place on TidyCal’s pages. We process the data you provide when booking: name, email address, the selected appointment, your enquiry, your notes on your situation and the topics you wish to discuss, your LinkedIn profile and your decision as to whether the conversation may be transcribed. Booking is also possible without consenting to transcription. A booking by a private individual in connection with their own advisory or coaching services is not automatically an application or candidate registration.

The legal basis is Art. 6(1)(b) GDPR. Where legally required, the provider is engaged on the basis of a data processing agreement pursuant to Art. 28 GDPR. For processing involving the USA, the transfer relies on the EU Standard Contractual Clauses agreed with the provider pursuant to Art. 46(2)(c) GDPR. See Section 18 for details. Further information is available in TidyCal’s privacy policy on the provider’s website.

10. Newsletter and Marketing (Brevo)

To send our newsletter and other marketing communications, we use Brevo, a service provided by Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. When you subscribe, we process your email address and, where provided, your name. Subscription uses the double opt-in procedure. Dispatch takes place via Brevo’s servers. Where legally required, the provider is engaged on the basis of a data processing agreement pursuant to Art. 28 GDPR. The legal basis is Art. 6(1)(a) GDPR. You can unsubscribe at any time via the unsubscribe link or by emailing office@nakamaeurope.com. The lawfulness of processing carried out prior to withdrawal remains unaffected.

11. Google Workspace and Google Drive

We use Google Workspace for Business, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a central platform for our business communication and internal organisation. This includes business email, calendars and the storage and collaborative editing of documents in Google Drive. Candidate and corporate-client documents may also be stored in Google Drive. This data is processed on Google servers within the EU/EEA, subject to the relevant Google Workspace configuration. Depending on the processing, the legal basis is Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR and, where legally required, Art. 28 GDPR. The same retention periods generally apply as for the underlying data. Candidate documents are deleted at the latest three years after the last contact and corporate-client documents at the latest 24 months after the last contact, subject to statutory retention obligations. We review what is held in Google Drive annually.

12. Data Processing for Private Clients of Advisory and Coaching Services

We process contact details and the information required to prepare and perform the specific advisory, coaching or other service commissioned. The legal basis is Art. 6(1)(b) GDPR for performance of a contract or pre-contractual measures and, where applicable, Art. 6(1)(f) GDPR for legitimate interests.

Private clients do not automatically become candidates through these services. Their data is not entered into the candidate database, subjected to a suitability assessment for a position or disclosed to corporate clients or potential employers for placement purposes merely because they have an advisory or coaching agreement. A separate candidate service or separate engagement for candidate support or placement remains possible and would require separate information about the applicable role and processing.

For private clients, the AI coach and the INTENT portal serve the performance and support of their own advisory or coaching programme. The AI coach does not replace personal advice. Use of the AI coach is voluntary; refusal or withdrawal of optional consent does not affect the agreed scope of personal advice. Portal content is deleted in accordance with Section 19; documents deleted by a private client are removed unless statutory retention obligations prevent this.

12.1 INTENT Portal for Private Clients

After engagement, we set up a protected area in our INTENT portal at intent.nakamaeurope.com for private clients of advisory and coaching programmes. The portal runs on our own server in Germany. You log in with your email address, a password you choose and a one-time code sent by email.

Within the portal we process enquiry information, answers in the career briefing, documents you upload such as your CV, references and test results, your entries in the modules and your exchange with the AI coach, the resulting logbook, appointments and summaries of conversations released by us. Technical and organisational measures ensure that you can see only your own area.

For the AI coach we use the Langdock platform described in Section 17, with processing in the EU. Langdock processes data solely on our behalf and, according to the provider, does not use it to train AI models. Messages to the AI coach and relevant content from the career briefing and logbook are sent to Langdock; uploaded documents and conversation summaries are not. The AI coach is part of the service offering and contract, but its use is voluntary. The legal basis for the INTENT portal, including the AI coach, is Art. 6(1)(b) GDPR. Before first use or interaction, we explain the AI coach and data handling in the portal.

Please do not share health data or other special categories of personal data under Art. 9(1) GDPR in your exchange with the AI coach. We store your messages and the AI coach’s answers in INTENT so that you can review them and we can prepare sessions. You can delete uploaded documents yourself at any time. Statutory retention obligations remain unaffected. For retention periods, see Section 19.

12.2 Approaching Companies on Behalf of Private Clients

As part of the advisory service, we approach companies and decision-makers on behalf of private clients. The private client approves each company individually before it is approached. Without that approval, no approach takes place.

On request, we first approach a company without naming you. In that case we transfer your career history, area of expertise, a pseudonymised short profile and the text of the approach as agreed with you. Once you have expressly agreed to disclosure to a specific company, we also transfer your name and, if the company asks for it, your curriculum vitae. We do not transfer health data or other special categories of personal data.

A pseudonymised short profile contains no name, no current employer and no clearly identifying details. It nevertheless remains personal data in pseudonymised form. In narrow markets it cannot be ruled out, despite careful pseudonymisation, that individual recipients draw conclusions about you from the experience described. We discuss this risk with you before the approach. You decide when your identity is disclosed.

Where the company approached is located outside the European Union or the European Economic Area, the approved data is transferred to the country concerned. That country may not be covered by an adequacy decision of the European Commission and may not offer a level of protection comparable to European law; rights under the General Data Protection Regulation may be harder to enforce there. Before the approval, we name the target country and point out this risk, and we document your approval. The transfer may be based, in the individual case, on your explicit consent to the specific approach under Art. 49(1)(a) GDPR. Where another appropriate safeguard is relevant and available for the target country or the recipient, in particular an adequacy decision of the European Commission or Standard Contractual Clauses under Art. 46(2)(c) GDPR, we base the transfer on that safeguard. For retention periods, see Section 19.

12.3 Recording, Transcription and AI-Assisted Analysis of Conversations

We record conversations and training sessions with private clients only with separate, prior and freely given consent, and analyse them only on that basis. The legal basis is Art. 6(1)(a) GDPR. For transcription we use Google Cloud Speech-to-Text provided by Google Ireland Limited; for documentation and analysis we use the Hedy application. For the providers, see Section 17; for Hedy's possible third-country element, see Section 18.

You may withdraw your consent at any time with effect for the future. Withholding or withdrawing consent has no effect on the agreed scope of the personal consulting. We delete transcripts once the summary has been produced; Section 19 applies to the summary.

13. Data Processing Where You Are a Candidate in a Search or Placement Service Commissioned by a Company

This section applies exclusively to candidates as defined above. Candidates are not the commissioning parties of the search or placement service. The commissioning party is the relevant company or corporate client that commissions NAKAMA to conduct the search or placement. Candidates do not owe NAKAMA a fee for the search or placement service. This section does not apply merely because a private individual commissions advisory or coaching services for their own professional situation.

If you use our services as a candidate, we process information required for candidate support in a search or placement service commissioned by a corporate client.

13.1 Categories of Personal Data

Personal data we process about candidates includes in particular:

  • Name, address, date of birth, marital status, email address and other contact details
  • Professional career history, personal qualifications and skills, and information about placements through us
  • Information on specific professional expertise and previous employers
  • Salary expectations
  • Nationality, visas, work permits or other identity-related information
  • Contact details of references
  • Information about hobbies, interests and leisure activities, insofar as you provide it yourself; we do not ask for it

13.2 Sources of Data

We obtain this data from the following sources:

  • Directly from you, for example by submitting your CV, personal contact or creating a user profile
  • Publicly accessible professional networks, for example LinkedIn, XING and Behance
  • Publicly accessible online job boards
  • References
  • Your own professional website, if applicable
  • Corporate clients or other candidates

Where we have not collected your data from you directly, we will inform you of the source at the latest within one month of collection, or with our first contact if that occurs earlier (Art. 14(3) GDPR).

13.3 Use of Your Personal Data

We process candidate data in the context of a search or placement service commissioned by a corporate client to assess your suitability for the relevant search and, where appropriate and with your consent, present you to the relevant corporate client or another potential employer. Personal data is transmitted only where necessary for the specific presentation and where the required consent has been obtained.

Where you provided your documents yourself, Art. 6(1)(b) GDPR is the governing basis insofar as processing concerns pre-contractual measures or a candidate service. Where we approached you through our own research, we rely on Art. 6(1)(f) GDPR; you may object under Art. 21 GDPR. For presentation to a specific corporate client or another potential employer, we additionally obtain consent under Art. 6(1)(a) GDPR where required. You are not the commissioning party of the search or placement engagement and do not owe a fee for it.

13.4 Consent and Withdrawal

The personal data you voluntarily provide is processed under the applicable legal basis and, where required, your consent. By submitting data and content to NAKAMA EUROPE LTD. as a candidate, you warrant that we are authorised to use the data for the stated purposes and that such use does not infringe third-party rights.

You may withdraw your consent at any time with future effect, discontinue the candidate service and request deletion of your data. The lawfulness of processing carried out prior to withdrawal remains unaffected. For candidate support and placement, personal data may also originate from third-party sources such as LinkedIn. We delete it when we no longer have a legitimate interest in its use or you tell us you do not wish to use our services. We may retain data in reduced form to avoid unwanted repeated contact.

13.5 Candidate Database (Hellotalent)

We store candidate data in our Hellotalent database provided by Cegid (formerly Talentsoft), Cegid SAS, 52 Quai Paul Sédallian, 69279 Lyon Cedex 09, France, with the server location in France. We process the categories listed in Section 13.1, application documents, career history and the course of our collaboration. You receive online access to your profile and can independently request deletion of stored data. For profile updates, please email office@nakamaeurope.com. The legal basis is Art. 6(1)(b) GDPR where you provided your data yourself, otherwise Art. 6(1)(f) GDPR. Where legally required, the provider is engaged under a data processing agreement pursuant to Art. 28 GDPR.

13.6 AI-Assisted Interview and Data Processing

For candidate services, we use AI-powered tools to transcribe and document conversations with candidates and to summarise and prepare text. Recordings, transcription and AI-assisted analysis of candidate conversations take place only with separate, prior and freely given consent. NAKAMA does not use AI to evaluate, score, rank, select or filter candidates. Experience, motivation and fit are assessed, and selection decisions are made, exclusively by human consultants.

For interview transcription we use Google Cloud Speech-to-Text provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For transcription and structured documentation we use Hedy AI LLC (USA). For summarising and preparing text we use Langdock GmbH, Berlin, Germany. According to provider information, processing takes place in the intended EU data regions; a third-country connection for individual services cannot be excluded. We delete the transcript after the summary has been produced; the provider does not delete automatically. The legal basis for consent-based processing is Art. 6(1)(a) GDPR. Without your consent, no AI-assisted processing of your candidate conversation takes place.

13.7 AI-Assisted CV Check

At intent.nakamaeurope.com/de/cv-check and intent.nakamaeurope.com/en/cv-check, we offer an AI-assisted CV check. You indicate your career level and the purpose for which you wish to use your CV and upload it as a PDF, DOCX or TXT file (maximum 5 MB). The CV is processed solely for this one-time technical content analysis and deleted once the analysis is complete; it is not stored permanently.

The assessment is carried out via Langdock with processing in the EU. According to the provider, the data is not used to train AI models. The CV check shows how an AI-assisted recruiting system may recognise and classify content. It is not an assessment of personal suitability and is not used for automated decision-making, selection, filtering or ranking. If you wish to receive the full assessment as a PDF by email, you may provide your email address for that separate purpose. Further information or marketing messages require separate voluntary consent unless another valid legal basis applies. Requesting the result does not constitute consent to advertising. You may withdraw consent at any time with future effect.

14. Data Processing for Corporate Clients and Their Contacts

This section applies exclusively to corporate clients and their contacts. Corporate clients are the commissioning parties of the search, selection or presentation of candidates. It does not apply to candidates or private clients who commission advisory or coaching services for their own professional situation.

To provide or prepare the search, selection or candidate-presentation service commissioned by a corporate client, we process personal data of contacts of the corporate client and, where relevant, other employees, including contact information, name and position, staffing preferences and opinions on candidates proposed by us.

The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. We also store personal data of contacts of a corporate client after the end of the contract or if no contract has been concluded for the purpose of re-establishing contact. We delete this data at the latest 24 months after the last contact, or earlier when you tell us that you do not wish to use our services in future. Statutory retention obligations remain unaffected.

15. Special Categories of Personal Data

Data within the meaning of Art. 9(1) GDPR, such as health data, religious beliefs or political opinions, is generally not required for our services. Please do not send us such data unsolicited. If genuinely relevant in an individual case, we will obtain explicit consent pursuant to Art. 9(2)(a) GDPR. The additional notices in Sections 12.1 and 13.7 apply to the INTENT AI coach for private clients and to the CV check.

16. Use of AI Systems (EU AI Act)

We use AI-powered tools and inform you about this transparently, whether or not we are legally required to do so.

  • Candidates: transcription and documentation of candidate conversations take place only after separate, prior and freely given consent. NAKAMA does not carry out AI-based suitability assessment, ranking, selection or filtering of candidates.
  • Private clients: the AI coach in the private client’s INTENT portal supports performance of and participation in the advisory or coaching programme. Processing is contract-related and based on Art. 6(1)(b) GDPR. Use is voluntary and personal advice remains unaffected.
  • Corporate clients and contacts of corporate clients: interaction with the INTENT portal takes place only where provided for the specific service commissioned. We explain the AI system and processing before relevant use.
  • Purposes: transcription and documentation of conversations, summarising and preparing text and guidance of private clients through the AI coach in the INTENT portal.
  • Human assessment: our advisers alone assess candidate experience, motivation and fit and make decisions on selection and presentation. No automated decision about professional suitability or selection is made for private clients either.
  • Data protection: processing is governed by the information and configuration of the relevant services. According to the providers, user data is not used to train AI models.
  • Information on request: you may ask at any time which AI-powered tools were used in connection with your data and for what purpose.

Regulation (EU) 2024/1689 (EU AI Act) may trigger different requirements depending on actual product configuration and use. The applications described here are limited to transcription, documentation, summarisation, technical content analysis and guidance of private clients by the AI coach in the INTENT portal. They are not used for automated personal suitability assessment, selection, filtering or ranking of candidates, or for automated assessment or selection of private clients. If actual use changes or a system falls within a differently classified legal use case, the processes and this privacy policy will be reviewed and amended accordingly.

17. Disclosure of Data to Third Parties and Service Providers

We use your personal data exclusively for our own services described above. Exceptions are service providers required for the technical provision of individual services. The scope of data transfer is limited to the legally permissible minimum and data protection requirements are observed. The relevant roles and agreements are determined according to the specific processing; where legally required, the provider is engaged under a data processing agreement pursuant to Art. 28 GDPR.

The following service providers may in particular be involved:

  • Hetzner Online GmbH (hosting), Industriestr. 25, 91710 Gunzenhausen, Germany, server location Germany
  • Cegid SAS (Hellotalent candidate database, formerly Talentsoft), 52 Quai Paul Sédallian, 69279 Lyon Cedex 09, France, server location France
  • Google Ireland Limited (Google Workspace including Gmail and Google Drive and Google Cloud Speech-to-Text), Gordon House, Barrow Street, Dublin 4, Ireland
  • Brevo GmbH (newsletter and marketing), Köpenicker Straße 126, 10179 Berlin, Germany
  • Sumo Group Inc. (TidyCal appointment booking), 1305 E. 6th St #3, Austin, TX 78702, USA
  • Hedy AI LLC (interview analysis and Hedy AI), USA
  • Langdock GmbH (AI language model platform), Berlin, Germany, according to the provider with processing in the EU

We provide corporate clients with at most a written summary of a conversation about a candidate where disclosure is necessary for the specific placement and the relevant consent has been obtained. We do not pass on recordings or full transcripts to corporate clients.

If we present a candidate to a specific company outside the European Union or the European Economic Area, or approach such a company on behalf of a corporate client, transferring the candidate’s personal data to that third country may be necessary. This may typically include name, contact details, professional history, qualifications, professional focus, LinkedIn or profile information, CV details and a summary prepared for the specific presentation; we transfer only data required for the specific approach. The approach and transfer take place only after prior approval of the specific approach by the candidate where required by the processing. The destination country may provide a lower level of protection than the EU. Before the transfer, we provide information about the destination country and intended transfer mechanism where possible and required. Mechanisms may include an adequacy decision of the European Commission, European Commission-approved Standard Contractual Clauses under Art. 46(2)(c) GDPR or another safeguard permitted by Chapter V GDPR. An approach without transferring personal data is possible only where the specific method genuinely permits it; no general promise is made that this will always be possible. A copy of relevant safeguards may be requested at office@nakamaeurope.com. This transfer concerns the candidate role only. It does not concern private clients of advisory or coaching services unless they expressly use a separate candidate service.

18. Data Transfers to Third Countries

The service providers named in Section 17 process data within the European Union or the European Economic Area under the intended configurations. There are two exceptions: Sumo Group Inc. (TidyCal) has a connection with the USA because it is established there. Hedy AI LLC also has a possible third-country connection because of the provider’s establishment and individual technical services, such as request routing. Setting the data region to the European Union does not automatically exclude every third-country access or technical connection.

For Sumo Group Inc., the transfer relies on the EU Standard Contractual Clauses agreed with the provider pursuant to Art. 46(2)(c) GDPR. For Hedy, storage and AI analysis are intended to use the European Union data region. Where a transfer or access to a third country takes place, we rely on the EU Standard Contractual Clauses agreed with the provider pursuant to Art. 46(2)(c) GDPR. The provider's Transfer Impact Assessment is available to us. We provide information on the specific transfer chain, including routing and support access, on request.

There is no general adequacy decision for the United States. The European Commission’s decision on the EU-U.S. Data Privacy Framework applies only to organisations that have self-certified under it and appear on the official list. We therefore do not rely on that decision as a blanket basis for transfers to Sumo Group Inc., but on the EU Standard Contractual Clauses agreed with Sumo Group Inc. You may request a copy of the agreed safeguards by emailing office@nakamaeurope.com.

19. Retention Period and Deletion

We only store your personal data for as long as necessary for the respective processing purposes or as required by statutory retention periods. The following periods generally apply:

  • Server log files: maximum 30 days.
  • Email enquiries: until the enquiry is resolved, plus statutory retention periods.
  • INTENT and advisory or coaching data of private clients: for the duration of the contract; afterwards the content is kept for 12 months so that it can be exported and used if the parties work together again, and then deleted unless statutory retention obligations prevent this.
  • Enquiries via INTENT without an engagement: 12 months after the enquiry is closed, including details, uploaded documents, notes and messages.
  • Engagements arising from INTENT: for the duration of the contract plus statutory retention periods; uploaded documents follow this period.
  • Records of consent and withdrawal: 3 years after the enquiry is closed.
  • Candidate data: until withdrawal, at most 3 years after the last contact.
  • Data of corporate clients and contacts of corporate clients: for the duration of the contract plus statutory retention periods; contact data at most 24 months after the last contact unless statutory retention obligations apply.
  • Documents held in Google Drive: according to the periods for the underlying data, with an annual review of the holdings.
  • Transcripts in Hedy: deleted by NAKAMA after the summary has been produced; the provider does not delete automatically. Derived summaries and analyses are retained with candidate data and deleted immediately upon withdrawal of consent unless statutory obligations prevent this.
  • Data in the INTENT portal, including conversations with the AI coach: for the duration of the contract; afterwards 12 months under the rule above and then deletion unless statutory retention obligations prevent this. Documents deleted by private clients are removed unless statutory obligations prevent this.
  • CV check: the uploaded CV is not stored permanently and is deleted once the one-time analysis is complete. The email address and assessment created are retained until withdrawal, at most 12 months after the last contact, unless statutory obligations require otherwise.

You may request deletion of your data at any time by sending an informal email to office@nakamaeurope.com. We will delete your data without delay unless statutory retention obligations or another lawful reason for continued storage applies.

20. Is Providing Your Data Required?

You are under no statutory or contractual obligation to provide us with personal data. Providing it is voluntary. Without certain details, however, we cannot provide our services, or can provide them only to a limited extent:

  • Private clients: we need contact details and information required for the specific advisory or coaching service. Entry in the candidate database and suitability assessment for a position are not required and do not occur automatically.
  • Candidates: without your career history and contact details we cannot provide candidate support, assess your suitability for the specific search or present you to a corporate client.
  • When booking via INTENT: without a name and email address we cannot confirm the appointment. The selected service, your notes and LinkedIn profile are mandatory where the booking form requires them; the CV is optional and does not automatically lead to candidate registration for private clients.
  • When booking via TidyCal: without a name and email address we cannot confirm the appointment or speak to you. Details about your enquiry are optional and help us prepare.
  • In the INTENT portal for private clients: the AI coach is part of the agreed service, but its use is voluntary. Without your input it cannot guide you through the modules or record results in your logbook.
  • Corporate clients and contacts of corporate clients: without contact details of the relevant contacts we cannot carry out the engagement.

Consent to the recording and AI-assisted analysis of a conversation is never a precondition. You can hold and book a conversation without giving that consent, and you will not be disadvantaged as a result. A statutory obligation to provide data exists only insofar as tax or commercial law requires it in the context of a business relationship.

21. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

  • Access (Art. 15 GDPR): You may request information about the personal data we process about you.
  • Rectification (Art. 16 GDPR): You may request correction of inaccurate data or completion of incomplete data.
  • Erasure (Art. 17 GDPR): You may request deletion of your data, provided no statutory retention obligations apply.
  • Restriction (Art. 18 GDPR): You may request restriction of processing of your data.
  • Data portability (Art. 20 GDPR): You may receive your data in a structured, commonly used and machine-readable format.
  • Objection (Art. 21 GDPR): You may object at any time to processing of your data based on Art. 6(1)(f) GDPR.
  • Withdrawal of consent (Art. 7(3) GDPR): You may withdraw consent at any time with future effect without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, please contact Claudia Wulf at office@nakamaeurope.com.

22. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you that is carried out on the basis of a legitimate interest under Art. 6(1)(f) GDPR (Art. 21(1) GDPR). In our case this concerns above all candidate data obtained through our own research and the contact details of contacts of corporate clients that we retain in order to approach them again.

If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. Where your data is processed for direct marketing, you may object at any time and without giving reasons. We will then no longer use your data for that purpose (Art. 21(2) and (3) GDPR). An informal message to office@nakamaeurope.com is sufficient for your objection.

23. Automated Decision-Making / Profiling

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The AI-powered tools we use transcribe, document, analyse technical content, summarise text and guide private clients through their modules as an AI coach in the INTENT portal. For candidates, they do not make automated suitability or selection decisions and do not rank or filter candidates. For private clients, they do not make automated decisions about professional suitability or selection. All decisions in the candidate and placement process are made by our qualified consultants. This assessment applies to the described use and will be reviewed if the product configuration or purpose changes.

24. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR (Art. 77 GDPR). The supervisory authority responsible for us is: Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Phone: +353 (0)761 104 800. Website: www.dataprotection.ie. Alternatively, you may also contact the supervisory authority of your place of residence or employment.

25. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in the legal situation or modifications to our services or data processing activities. The current version is available on this page.

Last updated: 5 October 2026