GDPR commitment

Talent & Co. ("we", "our", "us"), represented by Peggy Theodorou as an independent consultant, is committed to processing personal data lawfully, fairly, and transparently. We respect your privacy and handle your personal data in compliance with the EU General Data Protection Regulation (GDPR) and applicable Greek law.

This GDPR Commitment explains how we collect, use, and protect your personal data, the legal bases we rely on, and your rights. Your data may be shared with relevant third parties to provide our services, for business management, and to comply with legal obligations.

We process personal data only when a valid legal basis applies:

• Consent: e.g., when you share your CV or authorize us to present you to a client.
• Contractual necessity: to provide recruitment and consulting services.
• Legitimate interests: for business communications, record-keeping, service improvement, and recruitment purposes, balanced against your rights.
• Legal obligations: where processing is required by law.

We may collect the following types of personal data:

• Contact details: name, email, phone number.
• Professional information: CV, employment history, education, skills.
• Preferences: work location, availability, compensation.

We do not collect sensitive personal data (such as race, religion, political opinions, union membership, health data, biometric data, sexual orientation, or unrelated financial details) unless legally required.

We may share your data with:

• Other Talent & Co. entities, partners, and service providers.
• Clients, within the scope of recruitment or consulting services.
• Third-party providers of HR, IT, or marketing services.
• Public authorities, law enforcement, courts, and regulatory bodies when required by law.

Your personal data may be transferred internationally. Any such transfers comply with applicable law and include appropriate safeguards, including standard contractual clauses or transfers to countries recognized by the EU as providing adequate protection.

• Candidate data is retained for up to 24 months, unless consent is renewed.
• Client and partner data is retained for the duration of the business relationship or as required by law.
• After this period, data is securely deleted.

We implement technical and organizational measures to protect your data from loss, misuse, unauthorized access, alteration, or disclosure, including:

• Encryption, password protection, and restricted access.
• Secure deletion of outdated records.
• Regular review of security measures.

In case of a personal data breach, we will notify affected individuals promptly and report to the Hellenic Data Protection Authority within 72 hours, if required.

Under GDPR, you have the right to:

1. Be informed about the processing of your data.
2. Access your personal data.
3. Rectify inaccurate or incomplete data.
4. Request erasure ("Right to be Forgotten"), subject to exceptions.
5. Restrict processing in specific circumstances.
6. Receive your data in a structured, machine-readable format (data portability).
7. Object to processing based on legitimate interests, direct marketing, research, or statistics.
8. Withdraw consent at any time.
9. Object to automated decision-making, including profiling, where applicable.

You can exercise your rights by contacting us at: team@talent-and-co.com. We may require verification of identity to protect your personal data.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority: www.dpa.gr, Kifisias 1-3, 115 23 Athens, Greece, +30 210 6475600, contact@dpa.gr.

For questions about this GDPR Commitment or to exercise your rights: