1. Controller
The controller for data processing on this website is:
Start-One UG (haftungsbeschränkt)Im Mediapark 5
50670 Köln
Germany
Represented by the managing director Michael Weymans.
Telephone +49 221 999 69 382
Email info@startone.io
The controller under the GDPR is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.
2. At a glance
Personal data is any data by which you can be identified. We treat your personal data as confidential and in line with the statutory data protection rules and this notice.
We collect data when you give it to us, for example through the enquiry form, in an email or when booking a call. Further data is recorded automatically by our systems when you open the site, mainly technical details about your browser, operating system and the time of the visit.
Part of that data keeps the site running correctly. Other data we use to analyse how the site is used, once you have consented to it.
Please note that data transmission over the internet can have security gaps. Complete protection against access by third parties is not possible.
3. Hosting
This website is hosted by an external service provider inside the European Union. The personal data collected on this site is stored on that provider's servers. This can include IP addresses, contact enquiries, meta and communication data, site access records and other data generated through a website.
Hosting takes place to fulfil our contract with prospective and existing clients (Article 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Article 6(1)(f) GDPR).
A data processing agreement under Article 28 GDPR is in place with the provider. We will name the provider on request.
4. Server log files
The provider of these pages automatically collects and stores information in server log files, which your browser transmits automatically:
- browser type and version
- operating system used
- referrer URL
- host name of the accessing computer
- time of the server request
- IP address
This data is not combined with other sources. Collection takes place on the basis of Article 6(1)(f) GDPR. The operator has a legitimate interest in the technically correct presentation and the optimisation of the website, and server log files are required for that.
5. Cookies and consent
Our website uses cookies. Cookies are small text files stored on your device. They cause no damage and contain no viruses.
Technically necessary cookies are required for the site to work. They are stored on the basis of Article 6(1)(f) GDPR and Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
All other cookies, in particular for analytics and advertising, are only used with your express consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time with effect for the future by opening the consent settings again.
You can set your browser to inform you about cookies, to allow cookies only in individual cases, to exclude them generally, and to delete them automatically when the browser closes. Disabling cookies may limit the functionality of this website.
The consent cookie
Your choice in the consent banner is stored in a cookie named s1_consent and in your browser local storage. What we store is your selection only, meaning one of the values none, stats, mark or stats,mark. It is kept for 180 days, after which we ask again.
The three categories
Necessary. Always active. Covers the consent cookie itself and technical functions for security and operation. Legal basis: Article 6(1)(f) GDPR, Section 25(2) TDDDG.
Statistics. Audience measurement through Google Analytics 4. Loaded only after your consent. Legal basis: Article 6(1)(a) GDPR, Section 25(1) TDDDG.
Marketing. Measuring and serving ads through Google Ads. Loaded only after your consent. Legal basis: Article 6(1)(a) GDPR, Section 25(1) TDDDG.
Until you consent, every consent signal sent to Google stays on denied. In that state neither analytics nor advertising cookies are set.
Proof of your consent
Article 7(1) GDPR requires us to be able to demonstrate your consent. For each decision made in the banner we therefore store the time, your selection, the language version, the path of the page and a randomly generated identifier that exists only in your browser. Your IP address and your name are not stored. This record sits on our server and is not publicly accessible.
6. Google Tag Manager
We use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is a tool we use to embed and manage tracking and analytics services.
Tag Manager itself does not create user profiles, store cookies or carry out any analysis of its own. It only manages and delivers the services embedded through it. Tag Manager does however record your IP address, which may also be transferred to Google in the United States.
Tag Manager is loaded only after you have consented. The legal basis is therefore Article 6(1)(a) GDPR together with Section 25(1) TDDDG. Consent can be withdrawn at any time with effect for the future.
7. Google Analytics
This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics lets us record and evaluate how visitors use the site. We receive usage data such as page views, time on site, operating system, origin of visitors, approximate location based on the shortened IP address, pages opened and clicks. This data is assigned to a randomly generated identifier, not to your name.
Google Analytics uses technologies that allow a user to be recognised for the purpose of analysing user behaviour, such as cookies or device fingerprinting. IP anonymisation is enabled by default in Google Analytics 4. Your IP address is shortened by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area.
Use takes place exclusively on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn at any time with effect for the future.
A data processing agreement under Article 28 GDPR is in place with Google. A transfer of data to the United States is possible. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission established an adequate level of data protection by decision of 10 July 2023. Google has additionally entered into the standard contractual clauses of the European Commission.
Further information on how Google Analytics handles user data can be found in Google's privacy notice at policies.google.com/privacy. Google provides a browser add-on to disable Google Analytics at tools.google.com/dlpage/gaoptout.
8. Google Ads and conversion tracking
We run advertisements through Google Ads, an advertising programme of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Within Google Ads we use Google conversion tracking. If you click an advertisement placed by Google, a cookie is set for conversion tracking. If you then visit certain pages of our site and the cookie has not expired, Google and we can see that you clicked the advertisement and reached that page. We receive the total number of users who clicked an advertisement. We receive no information that identifies users personally.
Google may also use remarketing. Visitors to our site are then recognised on other websites within the Google advertising network and may see our advertisements there.
Use takes place exclusively on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn at any time with effect for the future.
A transfer of data to the United States is possible, based on the European Commission's adequacy decision on the EU-US Data Privacy Framework and additionally on the standard contractual clauses. Further information: policies.google.com/technologies/ads. You can adjust your advertising settings at myadcenter.google.com.
9. Booking calls through Calendly
To arrange first calls we use Calendly, a service of Calendly LLC, 271 17th St NW, Atlanta, Georgia 30363, United States.
When you book a call you enter your name, email address and possibly further details. This data is stored by Calendly and used to prepare and hold the call. Calendly also records technical data such as IP address and time zone.
The legal basis is Article 6(1)(b) GDPR where the booking serves to initiate a contract, and additionally Article 6(1)(f) GDPR based on our legitimate interest in simple scheduling. Where consent has been requested, processing takes place on the basis of Article 6(1)(a) GDPR.
A data processing agreement is in place with Calendly. The transfer of data to the United States is based on the standard contractual clauses of the European Commission. Further information: calendly.com/privacy.
10. Fonts
This website loads its fonts locally from our own server. No connection is made to servers operated by Google or other font providers, and no data is transferred to third parties.
11. Getting in touch and the enquiry form
If you contact us by email or telephone, your details including the contact data you provide are stored with us so we can handle the enquiry and any follow-up questions.
Through the enquiry form on the home page we collect your name, company, email address, the role to be filled and your message. These details are logged on our server and sent to us by email. You receive a confirmation at the address you gave. The processing serves only to handle your enquiry. The form contains a field invisible to you that filters out automated submissions; no profile is built from it.
Processing takes place on the basis of Article 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary to carry out pre-contractual steps. In all other cases processing is based on our legitimate interest in handling enquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR).
To keep automated submissions out we also use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. The service loads only once you select one of the form fields. Anyone who simply reads the page opens no connection to Cloudflare. Turnstile uses technical characteristics of your browser to check whether the input comes from a person and transmits your IP address to Cloudflare for that purpose. The legal basis is our legitimate interest in a working contact form that is protected against misuse (Article 6(1)(f) GDPR). The transfer to the United States is based on the standard contractual clauses of the European Commission. Further information: cloudflare.com/privacypolicy.
The data stays with us until you ask us to delete it, withdraw your consent, or the purpose for storing it ceases to apply. Mandatory statutory provisions, in particular retention periods under commercial and tax law, remain unaffected.
12. Candidate data
In our work as an executive search firm we process data about specialists and executives we approach or who send us their details. This includes contact data, career history, qualifications and notes from conversations.
The legal basis is Article 6(1)(b) GDPR for pre-contractual steps, Article 6(1)(f) GDPR for our legitimate interest in placement work, and Article 6(1)(a) GDPR where consent has been given. Documents are passed to a client company only with the express consent of the person concerned.
Part of this data comes from publicly accessible sources, in particular professional networks such as LinkedIn and Xing, trade publications and company websites. The legal basis for that processing is our legitimate interest in placement work under Article 6(1)(f) GDPR. We give information about the origin, purpose and extent of the data stored about you on request. Once a first contact turns into a concrete assessment, we inform you about the further processing and obtain your consent for any disclosure.
Data is deleted once the purpose ceases to apply, at the latest after statutory retention periods expire or at your request.
13. Your rights
You have the right at any time:
- to obtain information about the origin, recipients and purpose of your stored personal data (Article 15 GDPR)
- to have inaccurate data corrected (Article 16 GDPR)
- to have your data erased (Article 17 GDPR)
- to have processing restricted (Article 18 GDPR)
- to receive your data in a common, machine-readable format or have it transferred to a third party (Article 20 GDPR)
- to object to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR)
- to withdraw consent at any time with effect for the future (Article 7(3) GDPR)
Write to info@startone.io to exercise these rights.
Where your data is processed for direct marketing, you have the right to object to that processing at any time. After an objection your data will no longer be used for that purpose.
14. Right to lodge a complaint
In the event of breaches of the GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged breach. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf.
15. SSL and TLS encryption
For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can tell an encrypted connection by the browser address bar changing from "http://" to "https://" and by the padlock symbol. With encryption active, the data you send us cannot be read by third parties.
16. Changes to this notice
We update this privacy notice whenever the legal position, our services or our data processing change. The version available on this page applies.
This notice describes our data processing as of August 2026. The German version at startone.io/datenschutz/ is the binding one.