Privacy notice for candidates

This notice explains how Altisima Inc., trading as Altisima Advisory (“we”), processes personal data of professionals whom we identify as potential candidates for engineering roles. It is provided under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), including for personal data we did not obtain from you directly. Eine deutsche Fassung dieser Datenschutzhinweise stellen wir Ihnen auf Anfrage gern zur Verfügung (a German version is available on request).

1. Controller and contact

The controller is Altisima Inc. (US), trading as Altisima Advisory. Contact for all privacy matters: privacy@altisima-advisory.com.

2. What we do and why (purposes and legal basis)

We identify engineers with demonstrated, publicly evidenced technical capabilities and — only after human review — introduce anonymised capability profiles to prospective employers, and may contact you to ask whether you are open to hearing about a specific role. The legal basis is our legitimate interest in specialist recruitment and talent identification, Article 6(1)(f) GDPR. We have carried out and documented a legitimate-interests assessment balancing this interest against your rights; you may request a summary via the contact above.

3. Categories of personal data

• Identification and professional data: name, current and past roles, employers, dates;
• Publicly evidenced technical work: patents and technical publications you are named on, and the technical capabilities they evidence;
• Public professional profile information and its URL;
• Location at country/region level.

We do not collect special categories of data, and we do not collect data about your private life.

4. Where the data comes from (Article 14(2)(f))

Personal data originates from publicly accessible sources, namely:

• public patent registers (for example the European Patent Register);
• publicly available technical publications and conference records;
• publicly available professional networking profiles;
• company websites and other public professional sources;
• licensed business-contact data providers, where used to confirm current professional details.

5. Recipients

Prospective employers see anonymised capability profiles only — no name, no current employer — unless and until you have expressly told us you are interested in a specific role. Service providers (hosting, database, and business-contact data processors) process data on our behalf under Article 28 agreements.

6. International transfers

Some processors are established outside the EU/EEA (for example US-based data providers). Where that is the case, transfers are safeguarded by adequacy decisions (including the EU–US Data Privacy Framework where the provider is certified) and/or Standard Contractual Clauses with supplementary measures.

7. Retention

We retain candidate records only as long as needed for the purposes above and review them periodically. If you object to processing, we erase or restrict your record (keeping, where necessary, a minimal suppression entry so we do not contact you again). You can request erasure at any time.

8. Your rights — especially your right to object

Because we process your data on the basis of legitimate interest, you have the right to object at any time (Article 21 GDPR). If you object, we will stop processing your data for these purposes. Simply reply to any message from us or write to privacy@altisima-advisory.com.

You also have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), and the right to lodge a complaint with a supervisory authority — in Germany, the data-protection authority of your state, or that of our establishment.

9. No solely automated decisions

We make no decisions about you based solely on automated processing within the meaning of Article 22 GDPR. Software assists our team in organising publicly evidenced capabilities; every assessment that reaches a prospective employer has been reviewed and confirmed by a human. Transparency information about our system under the EU AI Act is published at /compliance.

10. Timing of this notice

Where we did not obtain your data from you, this notice is provided at the latest at the time of our first communication with you (Article 14(3) GDPR), which links to this page.