Privacy Policy

Who is responsible for processing?

Responsible under the General Data Protection Regulation (GDPR) is teamCon GmbH (brand voccess), Landstraße 82, 4020 Linz, Austria. You can reach us via email at office@voccess.com or by phone at +43 732 27451881.

Company registration number FN 414513 d, company court Landesgericht Linz, VAT number ATU68637111 (see also legal notice). A data protection officer is currently not appointed – for all data protection concerns, a message to the above address is sufficient.

Which data do we process, and for what purpose?

The following overview shows all areas where personal data are collected by us. Details are provided in the respective sections below.

What rights do you have?

You can exercise these rights at any time without formalities—an email to the above address is sufficient, no justification needed. We will respond within one month.

• Access (Art. 15): What data we have stored about you. In your candidate account, you can download a complete export as a file under settings at any time.
• Correction (Art. 16): Correct inaccurate data—directly possible in the account.
• Deletion (Art. 17): In the account, you can completely delete your profile along with uploaded documents.
• Restriction of processing (Art. 18) and data portability (Art. 20).
• Objection (Art. 21) against processing based on legitimate interests.
• Withdrawal of given consents (Art. 7 para. 3) effective for the future—such as through cookie settings or notification switches in the account.

Hosting, database, and server logs

The website is operated by Vercel Inc. (USA); our database, user management, and file storage are managed by Supabase Inc. (USA) in a data center in London (Region eu-west-2, United Kingdom). Both providers are processors under a contract pursuant to Art. 28 GDPR. For information on transfers to third countries, see the section below.

When you access the website, technically necessary log data is generated: IP address, time, accessed address, data volume transferred, browser, and operating system. We need this data to deliver the site and detect attacks. We do not combine it with other data.

Uploaded documents (resume, certificates, profile picture) are stored in non-public storage areas. They are not accessible via a guessable address: To display them, the application generates a link that expires after two minutes.

Cookies and your consent

We set technically necessary cookies without consent—this includes especially the session cookie that keeps you logged in after signing in. Without this cookie, the candidate account does not function.

All other cookies and similar techniques are set only after you have actively agreed in the consent banner. This complies with § 165 para. 3 of the Telecommunications Act 2021 and Art. 6 para. 1 letter a GDPR. The default setting is rejection, and the button to decline is just as visible as the button to agree.

You can change or withdraw your decision at any time via the cookie settings. Until you consent, the services listed below send no data; we use Consent Mode v2 for this, where all consent types are set to rejected by default.

Web analytics and marketing

We aim to understand which content is read and which paths lead to an application. For this, we currently use Google Analytics 4 and Microsoft Clarity, and for queries from companies, additionally HubSpot – exclusively with your consent. If you refuse, you can fully use the website.

Google Analytics 4 only loads after you have agreed to the statistics or Google Analytics in the consent banner. It then sets the cookies _ga and _ga_* (each with a storage duration of two years) to differentiate between repeat visits and sessions. In addition to page views, we use it to track specific steps on the website: submitted contact inquiries (with the chosen issue category), clicks on our email address or phone number, opened appointment bookings, registrations, steps, and completion of profile onboarding, completed assessments, started and submitted applications (with the job number), saved jobs, created job alerts, and uploaded resumes. The content of your details, names, email addresses, or phone numbers are not transmitted. Full IP addresses are not stored by Google Analytics 4. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR, § 165 para. 3 TKG 2021); you can revoke it at any time via “Cookie Preferences” at the end of each page.

Microsoft Clarity also loads only after your consent to statistics or Microsoft Clarity. It sets the cookies _clck (one year) and _clsk (one day), which assign page views to a visit, and transmits to Clarity that the data must not be used for advertising purposes. Legal basis and revocation as with Google Analytics 4.

Without consent and without cookies, we measure reach with Matomo: accessed pages, duration of visits, source of access, and rough information about device and browser. Matomo does not set cookies, assigns no user ID, does not record sessions, and shortens the IP address before storing it; if “Do Not Track” is activated in your browser, no measurement takes place. The data remains on a separate Matomo server (matomo.seocon.at) operated by our agency seoCon as a processor for us and is not shared with third parties. The legal basis is our legitimate interest in data-sparing statistics (Art. 6 para. 1 lit. f GDPR); you can object at any time by email or activate “Do Not Track.”

HubSpot only loads after your consent to marketing or HubSpot. It sets the cookies __hstc and hubspotutk (each six months), __hssc (30 minutes), and __hssrc (session), which recognize visits and associate them with a later inquiry. If you then submit our contact form, your details from it (name, company, position, email address, phone number, issue, and message) are additionally transferred to our customer management at HubSpot. Other forms – such as registration, candidate profile, or application – are not sent to HubSpot. Legal basis and revocation as with Google Analytics 4.

The following services are in preparation and not currently integrated. They would also only load after your consent; before any of them come into use, we will update the table above.

Google, Microsoft, and HubSpot partially process data in the USA, as do some of the services in preparation. HubSpot stores our account data in the EU data center. More details are in the section on third-country transfers. With Google (and in the future Meta), it also cannot be ruled out that collected data may be merged with an existing account with these providers if you are logged in there.

Contact form and appointment booking

If you send us the contact form, we store your details in our database and notify our team via email. The only mandatory fields are issue, company, name, and email address; all other fields are optional and help to better categorize your concern. If you have consented to HubSpot in the consent banner, we also transfer the inquiry to our customer management at HubSpot (see Web Analytics and Marketing).

To protect against automated submissions, we check if a field invisible to humans was filled and how long it took to fill out. This check doesn't evaluate any behavior and doesn't set a cookie.

Additionally, we protect the contact form, registration, and the forms "Forgot password" and "Resend confirmation email" with Cloudflare Turnstile (Cloudflare, Inc., USA). Turnstile only loads with one of these forms and checks, based on the technical characteristics of your browser and IP address, whether a human is submitting the form; usually without you needing to do anything, occasionally with a checkbox to click. Turnstile does not set cookies on voccess.com. The legal basis is our legitimate interest in protecting forms from spam and abuse (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework.

To schedule an appointment, we link to an external calendar on the "Initial Consultation" page. Data is transferred to the provider only when you open it; if you book an appointment, their privacy policy also applies.

Applicant account

For an account, we require an email address and a password. Alternatively, you can sign in with LinkedIn or Google. We will transfer only the first name, last name, and email address to your candidate profile.

You decide what to disclose in your profile: contact details, desired regions and work models, targeted roles, work experience, education, skills, and languages, as well as salary expectations. The progress bar is a guideline, not a requirement – only the name and email address fields are mandatory.

We log when you agreed to the privacy policy and its version. This proof is required by Art. 7 para. 1 GDPR.

During registration, we store the way you came to us: campaign IDs from the link (UTM parameters), the referring website, and the first page you accessed. These details are only kept by your browser for the session duration (no cookie); they are stored upon registration. Together with your voluntary response to “How did you hear about voccess?” we use them to understand which channels bring us candidates (legitimate interest, Art. 6 para. 1 lit. f GDPR).

When you set up a job alert in the job search, we save your search filters and email you new suitable positions. You can pause or delete any alert in your account; deleting ends the notifications.

You can delete your account at any time in the settings. This will remove your profile, applications, recommendations, and all uploaded files. Exceptions are data we are legally required to retain and application documents already submitted to a company – the company itself is responsible there.

Applications and sharing with companies

A mere created profile is not visible to any company. If you apply for a specific position, your application along with your profile and resume first goes to voccess: They are seen by the recruiters managing the position—for executive search mandates, also the responsible partner working under the voccess brand. Each person only sees applications for the positions they are responsible for.

Your documents will be passed on by the responsible recruiter as part of your application to the company filling the position—only for this specific position. The companies are obligated to confidentiality. Your salary expectation is shared only if you consent to it during the application.

Regarding your application, recruiters record notes and interview results to assess which position suits you (legitimate interest, Art. 6 para. 1 lit. f GDPR).

Before submitting, we show you step-by-step which information is included. Responses you give there are added to your profile, making future applications shorter.

We maintain a log of your application status updates and their timing. For ongoing applications, you will receive a confirmation email, an invitation to our assessments a few days later, and at most one reminder as long as they remain open. If we do not select you for a position, we will inform you a few days after the assessments and keep you in consideration for future suitable positions. You can disable these notifications in the settings; you can view your status at any time in your account.

Assessments and Deep Match

In the account, you can complete three assessments: values and work culture, motivation (such as salary expectations, presence days, travel readiness, travel time), and professional competencies in your role family. From your answers and a job's requirements profile, we calculate how well both match. The legal basis is the initiation of recruitment at your request (Art. 6 para. 1 lit. b GDPR); the assessments are voluntary and can be paused anytime.

The results are seen by voccess recruiters. Each result is individually reviewed by a recruiter and their decision is recorded with reasons. Only a released result appears in the company's client area to which the position belongs—without names and contact details, as “Candidate 1, 2, …”. voccess establishes the contact. You will receive feedback on your strengths, but no point scores.

We track how long you take for a question and where you pause an assessment to improve the questionnaires. Evaluations are done only in aggregate and without names.

Use of artificial intelligence

We use AI to simplify creating your profile and suggesting suitable job positions. This only uses data you have provided.

1. 01

   Resume analysis – only upon your request

   If you initiate analysis in your account or upload your resume or LinkedIn profile as a PDF during onboarding with your consent, we send the content to OpenAI to structure work experience, education, and skills. The provider does not use data transmitted via this interface to train its models. You see the result in your account first, confirming section by section; in onboarding, we pre-fill your profile, allowing you to review and change any entry in subsequent steps. Already captured information is never overwritten in either case.

2. 02

   Résumé extract for our recruiting team

   If you have uploaded a résumé, the recruiters managing your application can also have it read by AI (OpenAI, as above) to clearly see work experience, education, skills, and languages – for example, if your profile is not yet complete. The result is only available in our internal management: It will not be added to your profile, shared with companies, or used for evaluation or ranking. We store it as long as the résumé or your account exists, so the résumé does not have to be submitted multiple times.

3. 03

   Voice recordings – only upon your request

   If you choose the audio interview during onboarding or use 'Speak' on a profile field, we send each voice recording with your consent to OpenAI for transcription. We do not store the recordings. During the audio interview, you can see and correct the recognized text; only when you accept the answers do we evaluate them like a resume and pre-fill your profile—already captured information is never overwritten. When using 'Speak' on a field, AI incorporates the spoken input into that field; the result remains in the form until you review and save it yourself.

4. 04

   Skill suggestions

   During onboarding and in your profile, we suggest skills that match your profile. For this, we send your desired areas, experience level, job titles and descriptions from past positions, degrees and fields of study, and already selected skills to OpenAI—excluding names, contact information, employers, or schools. The suggestions are not saved; only what you select is added to your profile.

5. 05

   Job recommendations – suggestions, not decisions

   For recommendations, we calculate a mathematical representation of the text from your profile and job ads and compare both. This includes transparent rules regarding skills, role, location, and salary. The result is a ranking with an explanation that we display to you.

The number of analysis runs is limited per person per day. We log each run with a timestamp and result status to identify errors; the content of your résumé is not included in the technical logs. We store the structured result of a run so that you can review it, and the recruiting team can see it.

Email dispatch

We send our emails via Google Workspace (Google Ireland Limited). This includes notifications of contact inquiries, confirmation of applications, reminders for ongoing applications, and – if you activate them – alerts about suitable positions.

We do not send advertising newsletters without registration. Each type of notification can be individually turned off in the account.

To whom do we pass data?

We do not sell data. Recipients are our recruiters and partners, processors working for us and contractually bound under Art. 28 GDPR, as well as companies you apply to. Processors only access data to the extent necessary for their service.

If we are legally obliged or need to defend legal claims, authorities, courts, or our legal representation may receive data.

Google (Google Analytics 4), Microsoft (Clarity), and HubSpot are added once you have consented in the consent banner (see Web Analytics and Marketing).

Transfer to third countries

Our database is located in a data center in the United Kingdom. The European Commission has determined that the United Kingdom provides an adequate level of data protection (adequacy decision pursuant to Art. 45 GDPR); additional safeguards are not required for this.

Some of the mentioned providers process data in the USA. Where this is the case, we base the transfer on the European Commission's adequacy decision regarding the EU-U.S. Data Privacy Framework or – where this does not apply – on the standard contractual clauses under Art. 46 para. 2 lit. c GDPR along with supplementary protective measures.

An equivalent level of data protection cannot always be guaranteed; particularly, access by U.S. authorities cannot be entirely excluded. Consent-required services also imply your consent to this transfer under Art. 49 para. 1 lit. a GDPR.

How long do we store your data?

We delete personal data as soon as the purpose is no longer applicable and no legal retention requirements conflict with this. The following terms apply.

How do we protect your data?

• All transmission is encrypted with TLS.
• In the database, each table with personal references follows an access rule: You only see your data, recruiters and partners only the applications for the positions they manage. These rules are automatically cross-checked.
• Uploaded files are stored in non-public storage areas and are only accessible via short-lived, signed links.
• We store passwords only as hashes; we cannot view them.
• Error logs contain no personal content, only technical identifiers.

Changes to this statement

We update this statement when our processing changes – for example, when a service is added. Each version carries an identification number. If a change affects the scope of consent, we will request it again.