Privacy policy

Talent & Co ("we", "our", "us"), represented by Peggy Theodorou, is an independent HR and talent consulting company committed to protecting the privacy and personal data of all individuals we interact with: candidates, clients, partners, and website visitors.

This Privacy Policy explains how we collect, use, store, share, and protect personal data in the course of our activities, in full compliance with the EU General Data Protection Regulation (GDPR – EU 2016/679) and applicable Greek data protection laws.

By interacting with Talent & Co (e.g., submitting your CV, engaging our services, or communicating with us), you acknowledge that your personal data will be processed according to this Policy.

This Policy applies to all personal data processed by Talent & Co in connection with:

• Recruitment and talent acquisition activities.
• Executive search and HR consulting assignments.
• Employer branding and organizational advisory services.
• Communications with candidates, clients, suppliers, and partners.

This Policy does not cover third-party websites or services linked externally.

We collect and process only the data necessary for our legitimate business purposes and legal obligations.

Categories of data we may collect include:

• Identification & Contact Data: full name, email address, phone number, postal address.
• Professional & Employment Data: CV/resume, employment history, education, professional skills, certifications, portfolios, and references.
• Preferences: desired job type, work location, availability, employment preferences (onsite/hybrid/remote).
• Compensation Data: current and expected remuneration, benefits, or compensation expectations.
• Communications Data: email correspondence, meeting notes, or phone discussions relevant to recruitment or consulting.
• Client or Vendor Data: business name, contact person, tax ID, billing details, contract documentation.
• Declarations: military obligations (where applicable), willingness to provide background/criminal record checks if requested by clients

Special categories of personal data (sensitive data) such as racial or ethnic origin, religious beliefs, political opinions, health data, biometric data, or sexual orientation are not collected or processed unless legally required and explicitly consented to.

Talent & Co processes personal data lawfully under one or more of the following bases:

• Consent: when candidates voluntarily submit their CVs, complete our Candidate Declaration Form, provide references, or authorize us to share their profile with a client.
• Contractual necessity: when processing is required to perform our contractual duties with clients, suppliers, or candidates.
• Legitimate interests: for internal administration, communication, record-keeping, service improvement, and fraud prevention (balanced against the individual's rights).
• Legal obligations: to comply with employment, tax, accounting, or regulatory requirements.

If you choose not to provide certain personal data, we may be unable to offer or complete some of our services.

We process personal data strictly for lawful and relevant purposes, including:

• To provide recruitment, HR consulting, and employer branding services.
• To assess candidate suitability and match candidates with roles at client companies.
• To communicate with clients, candidates, and partners regarding services or opportunities.
• To maintain business relationships and internal administrative records.
• To comply with applicable laws and contractual obligations.

Personal data is never used for unsolicited marketing or sold to third parties.

We may share personal data only when necessary and always under appropriate data protection safeguards.

Data may be shared with:

• Client companies: only after obtaining the candidate's explicit consent and solely for agreed recruitment purposes.
• Service providers: such as IT support, software platforms (e.g., applicant tracking systems), administrative assistants, or subcontractors, all bound by confidentiality and GDPR compliance agreements.
• Legal and regulatory authorities: when required by law or in connection with legal claims.

Each client receiving candidate data is contractually bound through our Client Services Agreement to process such data solely for recruitment purposes and in accordance with GDPR.

If personal data needs to be transferred outside the European Union (EU) or European Economic Area (EEA), we ensure adequate protection measures are in place, such as EU Standard Contractual Clauses (SCCs) or transfers to jurisdictions recognized by the European Commission as providing an adequate level of data protection.

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by law.

• Candidates: up to 24 months from the date of last consent or interaction. Prior to expiry, we may contact you to renew your consent; if consent is not renewed, all data (including backups) will be securely deleted.
• Clients & partners: for as long as the business relationship remains active or as legally required.
• General communications: for as long as needed to resolve queries or manage relationships.

After expiry, data is securely deleted.

Talent & Co applies technical and organizational safeguards including:

• Encryption and password protection of digital systems.
• Role-based access control to authorized personnel only.
• Secure data storage and destruction of outdated files.
• Regular reviews of security protocols and retention policies.

We continually evaluate and enhance our data protection measures to ensure confidentiality, integrity, and availability.

In the event of a personal data breach, Talent & Co will:

1. Identify and assess the scope of the incident.
2. Contain and mitigate further unauthorized access.
3. Evaluate potential risks to affected individuals.
4. Notify the Hellenic Data Protection Authority (HDPA) within 72 hours (if required) and affected individuals without undue delay.
5. Remediate vulnerabilities and implement corrective actions.
6. Document all findings, communications, and mitigation steps.

Under GDPR, you have the right to:

• Access your personal data (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16).
• Request erasure ("Right to be Forgotten") (Art. 17).
• Restrict or object to processing (Art. 18–21).
• Request data portability (Art. 20).
• Withdraw your consent at any time (Art. 7).

Requests are handled free of charge within 30 days. If a request is manifestly unfounded or excessive, we may charge a reasonable administrative fee.

• Talent & Co is not liable for any misuse of candidate data by client companies after lawful and consensual disclosure.
• Clients are responsible for verifying candidate eligibility, qualifications, work permits, and compliance with employment law.
• Candidates are responsible for ensuring their CVs and information provided are accurate and truthful.

This Privacy Policy may be updated periodically to reflect legal or operational changes. The most recent version will always be available on our website.

For any questions about the Privacy Policy, concerns, or to exercise your GDPR rights, please contact: