Legal

Privacy Policy

Version: 26 September 2026

At NAKAMA EUROPE LTD. (hereinafter “we” or “us”), we attach great importance to the protection of your personal data. This privacy policy informs you, in accordance with the General Data Protection Regulation (GDPR), about how we collect, process and protect personal data on our website www.nakamaeurope.com and in connection with our services.

Throughout this privacy policy, we refer to our services for individuals and companies as “services”, to the individuals we currently or potentially place as “candidates”, and to those who engage us to find suitable candidates or provide other services as “clients”.

1. Data Controller

The controller within the meaning of the GDPR is:

NAKAMA EUROPE LTD.

71 Lower Baggot Street

Dublin D02 P593, Ireland

Email: office@nakamaeurope.com

Website: www.nakamaeurope.com

Based on our current assessment, we are not required to appoint a data protection officer under Art. 37(1) GDPR. For all questions on data protection and for exercising your rights, we have designated a permanent point of contact:

Data protection coordination: Claudia Wulf

Email: office@nakamaeurope.com

2. Overview of Data Processing

We only process personal data to the extent necessary for the provision of a functional website, our content and services. Processing is based in particular on the following legal grounds:

  • Consent (Art. 6(1)(a) GDPR), for example when subscribing to our newsletter or when consent-based AI-assisted tools are used in conversations.
  • Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), for example when providing or preparing our services.
  • Legitimate interest (Art. 6(1)(f) GDPR), for example for operating and securing the website and for candidate placement.
  • Legal obligation (Art. 6(1)(c) GDPR), for example statutory tax or commercial retention obligations.

3. Data Security

For security reasons and to protect the transmission of personal data, our website uses SSL/TLS encryption. You can recognise an encrypted connection by the address bar of your browser changing from “http://” to “https://” and by the padlock symbol being displayed.

We take appropriate technical and organisational measures pursuant to Art. 32 GDPR. These include data minimisation, restricted access to personal data, appropriate access controls and defined deletion periods. Based on its current status, our website uses no cookies, tracking or embedded third-party content. Separate services, such as appointment booking, are governed by the information provided in the relevant sections of this privacy policy.

Access to the candidate database is tightly restricted. Full access is limited to authorised persons. Clients receive limited access to individual profiles only and only where presentation to the relevant client takes place under the applicable requirements. Where legally required, data processing agreements pursuant to Art. 28 GDPR are in place with service providers used.

4. Hosting

Our website is hosted on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, with the server location in Germany. Hetzner processes access data and server log files on our behalf, which are automatically collected when pages are accessed. Processing is based on Art. 6(1)(f) GDPR and, where required, on a data processing agreement pursuant to Art. 28 GDPR.

5. Server Log Files

Each time our website is accessed, the following data is automatically collected and stored in server log files:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the file retrieved
  • Volume of data transferred
  • Access status (HTTP status code)
  • Browser type and version and operating system
  • Referrer URL (previously visited page)

This data is used exclusively to ensure the smooth operation of the website and to improve our services. It is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR.

Log file data is deleted after a maximum of 30 days, unless further retention is required for evidentiary purposes or by law.

6. Cookies

Our website does not currently use any cookies, including analytics or marketing cookies. A cookie banner is therefore not required on the current status. If we use services in future that require consent-based cookies, we will provide information here and obtain your consent in advance.

6.1 Audience Measurement (Umami)

For audience measurement, we use the open-source software Umami, which we operate ourselves on our server in Germany. Umami records the pages visited, the approximate origin of the visit (country and referring website), browser type and device category. No cookies are set and no information is stored on or read from your device. Your IP address is not stored. Repeat visits are aggregated only by means of a daily-changing, non-reversible check value; no personal profile is created.

The data remains on our server and is not shared with third parties. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly measurement of website use without identifying individuals).

7. Social Media Links (LinkedIn, Instagram)

Our website contains plain links to our profiles on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). These are not embedded plugins. No data is transmitted to these providers when you visit our website. Only when you click such a link is a connection established between your browser and the servers of the relevant network. The provider thereby receives the information that you have come from our website with your IP address. If you are logged in there, the visit can be associated with your user account.

Further information is available in the LinkedIn and Instagram (Meta) privacy policies on the respective websites.

8. Email Contact

You have the option of contacting us by email. In this case, the personal data you provide, such as your name, email address and the content of your enquiry, will be stored and processed by us to handle your request.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contractual relationship or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). We do not obtain consent for this because you provide the data in order to have your own enquiry dealt with.

The data will be deleted as soon as it is no longer required for the purpose for which it was collected and no statutory retention obligations apply. If you contact us as a candidate, please also refer to Section 12.

9. Appointment Booking via INTENT (Executives)

Executives currently arrange conversations through the appointment booking service TidyCal (Section 9.1); we transfer the booking details into our own system INTENT. In future, executives will book directly through our booking portal INTENT at intent.nakamaeurope.com. INTENT is operated on our server in Germany; appointments are kept in our Google Calendar. We process the data you provide when booking: name, email address, the selected appointment, the service you select, your notes on your situation and the points you wish to clarify, your LinkedIn profile and your decision as to whether the conversation may be transcribed. Booking is also possible without consenting to transcription.

When booking through INTENT, you may also upload your CV. This is optional. It helps us understand your starting point before the conversation and is not a precondition for booking. The file is assigned to your enquiry and is accessible only to us. Please note Section 14 on special categories of personal data.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). Based on the intended operation, processing through our INTENT portal does not involve a transfer to third countries. For retention periods, see Section 18.

9.1 Appointment Booking via TidyCal (Companies and, for the time being, Executives)

To arrange conversations with companies and, until booking moves to INTENT, with executives, we use the appointment booking service TidyCal provided by Sumo Group Inc. (d/b/a TidyCal), 1305 E. 6th St #3, Austin, TX 78702, USA. The booking takes place on TidyCal’s pages. We process the data you provide when booking: name, email address, the selected appointment, your enquiry, your notes on your situation and the topics you wish to discuss, your LinkedIn profile and your decision as to whether the conversation may be transcribed. Booking is also possible without consenting to transcription.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). Where legally required, the provider is engaged on the basis of a data processing agreement pursuant to Art. 28 GDPR. For processing involving the USA, the transfer relies, where the clauses are in fact part of the agreement, on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. See Section 17 for details.

Further information is available in TidyCal’s privacy policy on the provider’s website.

10. Newsletter and Marketing (Brevo)

To send our newsletter and other marketing communications, we use Brevo, a service provided by Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. When you subscribe to our newsletter, we process your email address and, where provided, your name. Subscription uses the double opt-in procedure: you receive a confirmation email and are only added to the distribution list after you have confirmed.

Dispatch takes place via Brevo’s servers. Where legally required, the provider is engaged on the basis of a data processing agreement pursuant to Art. 28 GDPR. Brevo may analyse whether newsletters are opened and which links are clicked; we use this analysis to improve our content.

The legal basis is Art. 6(1)(a) GDPR (consent). You can unsubscribe at any time via the unsubscribe link at the end of every email or by emailing office@nakamaeurope.com. The lawfulness of processing carried out prior to withdrawal remains unaffected.

11. Google Workspace and Google Drive

We use Google Workspace for Business, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a central platform for our business communication and internal organisation. This includes business email (Gmail), calendars and the storage and collaborative editing of documents in Google Drive.

The data processed includes in particular the name and email address of the sender and recipient, the content of the message or document, date and time and any attached files. Candidate and client documents, such as CVs, notes and reports, may also be stored in Google Drive. This data is processed on Google servers within the EU/EEA, subject to the relevant Google Workspace configuration.

Depending on the processing, the legal basis is Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR and, where legally required, Art. 28 GDPR. Where a data processing agreement is required, a corresponding Data Processing Agreement has been concluded with Google.

The same retention periods generally apply as for the underlying data. Candidate documents are deleted at the latest three years after the last contact and client documents at the latest 24 months after the last contact, in each case subject to statutory retention obligations. We review what is held in Google Drive annually.

12. Data Processing When Using Our Services as a Candidate

If you wish to use our services as a candidate, we need to process certain information about you. As a general rule, we only collect data that is necessary for the provision of our services.

You can submit your CV through our application form. The form is operated by our applicant management system Hellotalent, provided by Cegid SAS, France; the button on our contact page leads there. Your details and documents therefore go directly into the database described in Section 12.5. As a candidate, you warrant to NAKAMA EUROPE LTD. that all information provided is truthful and complete.

We do not accept CVs or other personal documents sent by email. Documents received this way are not processed and are deleted.

12.1 Categories of Personal Data

Personal data we process about you as a candidate includes in particular:

  • Name, address, date of birth, marital status, email address and other contact details
  • Professional career history, personal qualifications and skills, and information about placements through us
  • Information on specific professional expertise and previous employers
  • Salary expectations
  • Nationality, visas, work permits or other identity-related information
  • Contact details of references
  • Information about hobbies, interests and leisure activities, insofar as you provide it yourself; we do not ask for it

12.2 Sources of Data

We obtain this data from the following sources:

  • Directly from you, for example by submitting your CV, personal contact or creating a user profile
  • Publicly accessible professional networks, for example LinkedIn, XING and Behance
  • Publicly accessible online job boards
  • References
  • Your own professional website, if applicable
  • Clients or other candidates

Where we have not collected your data from you directly, we will inform you of the source at the latest within one month of collection, or with our first contact if that occurs earlier (Art. 14(3) GDPR).

12.3 Use of Your Personal Data

We assess and evaluate your suitability for potential positions and may present you to the respective clients. For this purpose, your personal data is transmitted electronically to the relevant client where this is necessary for the specific presentation and the required consent has been obtained.

If you sent us your documents yourself or submitted them through our application form, Art. 6(1)(b) GDPR is the governing basis. If we approached you as a result of our own research, we rely on Art. 6(1)(f) GDPR; you may object under Art. 21 GDPR. For presenting you to a specific client, we additionally obtain your consent under Art. 6(1)(a) GDPR where required.

12.4 Consent and Withdrawal

The personal data you voluntarily provide is processed under the applicable legal basis and, where required, your consent. By submitting data and content to NAKAMA EUROPE LTD. as a candidate, you warrant that we are authorised to use the data for the stated purposes and that such use does not infringe any third-party rights.

You may withdraw your consent at any time with future effect, discontinue using our services and request deletion of your data. The lawfulness of processing carried out prior to withdrawal remains unaffected.

For candidate placement, your personal data may also originate from third-party sources, such as LinkedIn. We will delete this data as soon as we no longer have a legitimate interest in its use or you have informed us that you do not wish to use our services. We may retain data in reduced form to avoid unwanted repeated contact.

12.5 Candidate Database (Hellotalent)

We store our candidates’ data in our database Hellotalent provided by Cegid (formerly Talentsoft), Cegid SAS, 52 Quai Paul Sédallian, 69279 Lyon Cedex 09, France, with the server location in France. We process in particular the categories of data listed in Section 12.1, application documents, your career history and the course of our collaboration. You will receive online access to your profile. Through this access, you can independently request deletion of your stored data. For profile updates, please email office@nakamaeurope.com.

The legal basis is Art. 6(1)(b) GDPR where you provided your data to us yourself, otherwise Art. 6(1)(f) GDPR. Where legally required, the provider is engaged on the basis of a data processing agreement pursuant to Art. 28 GDPR.

12.6 AI-Assisted Interview and Data Processing

As part of our services, we use AI-powered tools to transcribe and document conversations with candidates and to summarise and prepare text. NAKAMA does not use AI to evaluate, score, rank, select or filter candidates. Experience, motivation and fit are assessed, and selection decisions are made, exclusively by our human consultants.

a) Transcription (Google Cloud Speech-to-Text)

For the transcription of interviews, we use Google Cloud Speech-to-Text provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The audio track is transmitted to Google servers for conversion into text. Under the configuration intended for this service, processing takes place within the EU/EEA. According to the underlying service terms, Google does not use the transmitted data for its own purposes or to improve its models. Recordings are made only with your prior consent.

b) Interview Analysis (Hedy AI)

For transcription and the structured documentation of conversations, we use the Hedy application provided by Hedy AI LLC (USA). Under our configuration, speech recognition runs locally on our consultant’s device; the audio recording does not leave the device and is not stored permanently. The full transcript is synchronised to our account with the provider and analysed there with AI support to produce conversation notes and a summary. Storage and AI analysis are intended to take place in the European Union under the configured data region. However, because the provider is established in the USA and individual technical services, such as request routing, may be operated there, contact with a third country cannot be excluded.

According to provider information or the underlying contractual safeguards, sub-processors may be used and may be contractually required to process within the EU and EEA, not to retain content beyond the relevant request and not to train their models on this data. According to the provider, the current list of sub-processors is published in its Trust Centre. These statements are subject to the applicable provider documentation and agreements. We delete the transcript after the summary has been produced; the provider does not delete automatically. Recordings are made only with your prior consent.

c) AI Language Model (Langdock)

To summarise and prepare text, such as interview notes, we use the enterprise AI platform Langdock provided by Langdock GmbH, Berlin, Germany. According to the provider, data processing takes place exclusively in EU data centres and user data is not used to train AI models. Where legally required, the provider is engaged on the basis of a data processing agreement pursuant to Art. 28 GDPR.

The legal basis for processing under this section is Art. 6(1)(a) GDPR (consent). We only record a conversation and only have it transcribed or analysed if you have agreed beforehand. You may withdraw your consent at any time with future effect. Without your consent, no AI-assisted processing of your conversation takes place.

12.7 INTENT Client Portal

Once you have engaged us, we set up a protected area for you in our INTENT client portal at intent.nakamaeurope.com. The portal runs on our own server in Germany. You log in with your email address, a password you choose and a one-time code that we send you by email.

Within the portal we process your enquiry information, your answers in the career briefing, documents you upload such as your CV, references and test results, your entries in the modules and in the exchange with the AI coach, the resulting logbook, your appointments and summaries of our conversations that we have released. Technical and organisational measures, in particular database separation, access controls and permissions, ensure that you can see only your own area.

For the AI coach we use the Langdock platform described in Section 12.6(c), with processing in the EU. According to the provider, your data is not used to train AI models. The legal basis for performance of the contract is Art. 6(1)(b) GDPR. Voluntary use of the AI coach additionally requires your consent under Art. 6(1)(a) GDPR; if special categories of personal data are processed, Art. 9(2)(a) GDPR also applies where required.

You may withdraw your consent at any time with future effect. The AI coach can then no longer be used, and we delete the history of your conversations with it immediately. The entries in your logbook remain as your work results. The remaining contractual services generally remain available to the extent that they do not depend on this function. You can delete uploaded documents yourself at any time. Statutory retention obligations remain unaffected. For retention periods, see Section 18.

12.8 AI-Assisted CV Check

At intent.nakamaeurope.com/de/cv-check and intent.nakamaeurope.com/en/cv-check, we offer an AI-assisted CV check. You indicate your career level and the purpose for which you wish to use your CV and upload your CV as a PDF, DOCX or TXT file (maximum 5 MB). The CV is processed solely for this one-time technical content analysis and deleted once the analysis is complete; it is not stored permanently.

The assessment is carried out via the Langdock platform described in Section 12.6(c), with processing in the EU. According to the provider, the data is not used to train AI models. The CV check shows how an AI-assisted recruiting system may recognise and classify content. It is not an assessment of your personal suitability and is not used for an automated decision, selection, filtering or ranking.

If you would like to receive the full assessment as a PDF by email, you may provide your email address for this separate purpose. Further information or marketing messages about our services require separate voluntary consent unless another valid legal basis applies. Requesting the result does not constitute consent to advertising. You may withdraw consent to receiving the result with future effect. You can unsubscribe from marketing messages using the unsubscribe link or by emailing office@nakamaeurope.com; you may object to marketing use at any time.

The legal basis for the CV check is your consent under Art. 6(1)(a) GDPR, given expressly before upload and withdrawable at any time with future effect. Please do not upload special categories of personal data within the meaning of Art. 9(1) GDPR. If such data is nevertheless transmitted, it will, where possible, be excluded from the analysis or deleted. Further processing will take place only where it is actually required and explicit consent under Art. 9(2)(a) GDPR has been validly obtained.

13. Data Processing When Using Our Services as a Client

In order to provide or prepare the contractual services for you as a client, we process personal data of persons employed in your company, in particular contact information, name and position, preferences for filling positions and opinions on the candidates we propose.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in the contractual performance of our services).

We also store personal data of your internal contacts after the end of the contract or if no contract has been concluded, for the purpose of re-establishing contact. We delete this data at the latest 24 months after the last contact, or earlier when you inform us that you do not wish to use our services in the future. Statutory retention obligations remain unaffected.

14. Special Categories of Personal Data

Data within the meaning of Art. 9(1) GDPR, such as health data, religious beliefs or political opinions, is generally not required for our services. Please do not send us such data unsolicited. If such data is genuinely relevant in an individual case, we will obtain explicit consent pursuant to Art. 9(2)(a) GDPR. The additional notice in Section 12.8 applies to the CV check.

15. Use of AI Systems (EU AI Act)

We use AI-powered tools and inform you about this transparently, whether or not we are legally required to do so.

  • Purpose of use: transcription and documentation of conversations and summarising and preparing text.
  • Systems used: Google Cloud Speech-to-Text for consent-based transcription, Hedy AI for documenting conversations and Langdock for summarising and preparing text.
  • Human assessment: experience, motivation and fit are assessed exclusively by our consultants. NAKAMA does not use AI to evaluate, rank, select or filter candidates.
  • Transparency: candidates are informed before or at the start of a conversation that AI-powered tools are used for transcription and documentation and give their consent beforehand.
  • Data protection: processing is governed by the information and configuration of the relevant services. According to the providers, user data is not used to train AI models.
  • Information on request: you may ask at any time which AI-powered tools were used in connection with your data and for what purpose.

Regulation (EU) 2024/1689 (EU AI Act) may trigger different requirements depending on the actual product configuration and use. As described in this privacy policy, the applications are limited to transcription, documentation, summarisation and technical content analysis. They are not used to assess personal suitability or to select, filter or rank candidates. If the actual use changes or a system falls within a differently classified legal use case, the processes and this privacy policy will be reviewed and amended accordingly.

16. Disclosure of Data to Third Parties and Service Providers

We use your personal data exclusively for our own services described above. Exceptions are made for service providers required for the technical provision of individual services. The scope of data transfer is limited to the legally permissible minimum and data protection requirements are observed. The relevant roles and agreements are determined according to the specific processing; where legally required, the provider is engaged on the basis of a data processing agreement pursuant to Art. 28 GDPR.

The following service providers may in particular be involved:

  • Hetzner Online GmbH (hosting), Industriestr. 25, 91710 Gunzenhausen, Germany, server location Germany
  • Cegid SAS (Hellotalent candidate database, formerly Talentsoft), 52 Quai Paul Sédallian, 69279 Lyon Cedex 09, France, server location France
  • Google Ireland Limited (Google Workspace including Gmail and Google Drive and Google Cloud Speech-to-Text), Gordon House, Barrow Street, Dublin 4, Ireland
  • Brevo GmbH (newsletter and marketing), Köpenicker Straße 126, 10179 Berlin, Germany
  • Sumo Group Inc. (TidyCal appointment booking), 1305 E. 6th St #3, Austin, TX 78702, USA
  • Hedy AI LLC (interview analysis and Hedy AI), USA
  • Langdock GmbH (AI language model platform), Berlin, Germany, according to the provider with processing in the EU

We provide clients with at most a written summary of a conversation about a candidate, where disclosure is necessary for the specific placement and the relevant consent has been obtained. We do not pass on recordings or full transcripts to clients.

17. Data Transfers to Third Countries

The service providers named in Section 16 process data within the EU or EEA under the intended configurations, where this is in fact applicable to the relevant service. Sumo Group Inc. (TidyCal) has a connection with the USA because it is established there. Hedy AI LLC also has a possible third-country connection because of the provider’s establishment and individual technical services, such as request routing. Setting the data region to the European Union does not automatically exclude every third-country access or technical connection.

For Sumo Group Inc., the transfer relies, where the clauses are in fact part of the agreement, on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

For Hedy, storage and AI analysis are intended to be set to the European Union data region. Where a transfer or access to a third country takes place, we rely, where it is in fact part of the agreement, on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. According to provider information, a Transfer Impact Assessment is made available. The specific transfer chain, including any routing, support or other access, must be assessed on the basis of the applicable provider documentation and agreements.

There is no general adequacy decision for the United States. The European Commission’s decision on the EU-U.S. Data Privacy Framework applies only to organisations that have self-certified under it and appear on the official list. We therefore do not rely on that decision as a blanket basis for transfers to Sumo Group Inc., but on the relevant safeguards actually agreed.

You may request a copy of the agreed safeguards by emailing office@nakamaeurope.com.

18. Retention Period and Deletion

We only store your personal data for as long as is necessary for the respective processing purposes or as required by statutory retention periods. The following periods generally apply:

  • Server log files: maximum 30 days.
  • Email enquiries: until the enquiry is resolved, plus statutory retention periods.
  • Enquiries via INTENT without an engagement: 12 months after the enquiry is closed, including your details, uploaded documents, notes and messages.
  • Engagements arising from INTENT: for the duration of the contract, plus statutory retention periods; uploaded documents follow this period.
  • Records of consent and withdrawal: 3 years after the enquiry is closed.
  • Candidate data: until withdrawal, at most 3 years after the last contact.
  • Client data of corporate clients: for the duration of the contract, plus statutory retention periods, up to 10 years.
  • Contact details of contacts without a running contract: at most 24 months after the last contact.
  • Documents held in Google Drive: according to the periods for the underlying data, with an annual review of the holdings.
  • Transcripts in the Hedy application: deleted by NAKAMA after the summary has been produced; the provider does not delete automatically. Derived summaries and analyses are retained with the candidate data and deleted immediately upon withdrawal of consent, unless statutory obligations prevent this.
  • Data in the INTENT client portal: for the duration of the contract; afterwards we keep the content for 12 months so that you can export it and build on it if you work with us again, and then delete it, unless statutory retention obligations prevent this; documents you delete are removed unless statutory obligations prevent this.
  • CV check: the uploaded CV is not stored permanently and is deleted once the one-time analysis is complete. The email address and assessment created are retained until withdrawal, at most 12 months after the last contact, unless statutory obligations require otherwise.

You may request deletion of your data at any time by sending an informal email to office@nakamaeurope.com. We will delete your data without delay unless statutory retention obligations or another lawful reason for continued storage applies.

19. Is Providing Your Data Required?

You are under no statutory or contractual obligation to provide us with personal data. Providing it is voluntary. Without certain details, however, we cannot provide our services, or can provide them only to a limited extent:

  • As a candidate: without your career history and contact details we cannot assess your suitability or present you to a client. Inclusion in our candidate database is then not possible.
  • When booking via INTENT: without a name and email address we cannot confirm the appointment. The selected service, your notes on your situation and your LinkedIn profile are mandatory where the booking form requires them; without them we cannot prepare the conversation or assess whether our service suits you. The CV is optional.
  • When booking via TidyCal: without a name and email address we cannot confirm the appointment or speak to you. Details about your enquiry are optional and help us prepare.
  • As a client: without the contact details of your contacts we cannot carry out the engagement.

Consent to the recording and AI-assisted analysis of a conversation is never a precondition. You can hold and book a conversation without giving that consent, and you will not be disadvantaged as a result.

A statutory obligation to provide data exists only insofar as tax or commercial law requires it in the context of a business relationship.

20. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

  • Access (Art. 15 GDPR): You may request information about the personal data we process about you.
  • Rectification (Art. 16 GDPR): You may request the correction of inaccurate data or the completion of incomplete data.
  • Erasure (Art. 17 GDPR): You may request deletion of your data, provided no statutory retention obligations apply.
  • Restriction (Art. 18 GDPR): You may request restriction of processing of your data.
  • Data portability (Art. 20 GDPR): You may receive your data in a structured, commonly used and machine-readable format.
  • Objection (Art. 21 GDPR): You may object at any time to processing of your data based on Art. 6(1)(f) GDPR.
  • Withdrawal of consent (Art. 7(3) GDPR): You may withdraw any consent given at any time with future effect, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, please contact Claudia Wulf at office@nakamaeurope.com.

21. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of a legitimate interest under Art. 6(1)(f) GDPR (Art. 21(1) GDPR).

In our case this concerns above all the processing of candidate data obtained through our own research and the contact details of client contacts that we retain in order to approach them again.

If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

Where your data is processed for direct marketing, you may object at any time and without giving reasons. We will then no longer use your data for that purpose (Art. 21(2) and (3) GDPR). An informal message to office@nakamaeurope.com is sufficient for your objection.

22. Automated Decision-Making / Profiling

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The AI-powered tools we use transcribe, document, analyse technical content and summarise text; they do not evaluate candidates or prepare decisions about their suitability, selection or placement. All decisions in the placement process are made by our qualified consultants. This assessment applies to the described use and will be reviewed if the product configuration or purpose changes.

23. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR (Art. 77 GDPR).

The supervisory authority responsible for us is:

Data Protection Commission (DPC)

21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland

Phone: +353 (0)761 104 800

Website: www.dataprotection.ie

Alternatively, you may also contact the supervisory authority of your place of residence or employment.

24. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in the legal situation or modifications to our services or data processing activities. The current version is available on this page.

Last updated: 26 September 2026