Privacy
Last updated: 23 October 2026
This privacy policy explains which personal data I process when you visit this website and in my work as an executive search consultant, for which purposes and on which legal basis.
1. Controller
Jan Nordh, Nordh Executive Search (sole proprietorship) Allacher Straße 217a, 80997 Munich, Germany Phone: +49 89 28700760, Mobile: +49 171 9909550 Email: jan@nordh.de
No data protection officer has been appointed because there is no legal obligation to do so.
2. Hosting and server log files
This website is hosted by Framer B.V., Amsterdam, Netherlands. When you open a page, Framer processes technically necessary data: IP address, date and time, the page requested, referrer URL, browser and operating system. This data is needed to deliver the website and protect it against attacks. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is the secure and stable operation of the website.
Framer processes this data as a processor under Art. 28 GDPR and uses sub-processors, including in the USA. Transfers to the USA are based on the EU-US Data Privacy Framework or on EU Standard Contractual Clauses.
Framer also provides me with cookieless audience measurement (pages viewed, referrer, device type, country). No information is stored on your device and no user profiles are created. The legal basis is Art. 6(1)(f) GDPR.
3. Cookies and consent management
On your first visit, a banner asks whether you allow analytics cookies. Without your consent I do not load any analytics or marketing services. Your choice is saved in your browser’s local storage (framerCookiesConsentMode, framerCookiesDismissed) so the banner does not reappear on every page. Section 25(2) no. 2 TDDDG permits this without consent.
You can change or withdraw your consent at any time with effect for the future via the “Cookie Settings” link at the bottom of every page.
4. Google Tag Manager and Google Analytics 4
Only if you consent to the “Analytics” category in the banner do I load Google Tag Manager and Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before that, no connection to these services is made. If you withdraw consent, the analytics cookies are deleted. Google Analytics shows which pages are viewed, where visitors come from and how long they stay. For this it sets the cookies _ga and _ga_3VF71YD82D with a lifetime of up to two years. Google Analytics does not store IP addresses of users in the EU; it only derives an approximate location (country, region, city).
The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Google may transfer data to the USA on the basis of the EU-US Data Privacy Framework, supplemented by EU Standard Contractual Clauses. A data processing agreement with Google is in place. Analytics data is deleted after 14 months at the latest.
5. Fonts
The fonts on this website are embedded locally. They are stored on Framer’s servers and delivered together with the website (see the hosting section). No connection to Google Fonts or any other external font provider is made when you visit the site.
6. Contact form, email and phone
If you contact me via the contact form, by email or by phone, I process your details (name, email address, topic, message and any further information you choose to give) to answer your request. The form is processed by Framer and forwarded to my email address. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR. I delete requests once they are settled and no retention obligation applies. For email and calendar I use an external service provider as processor.
7. Booking appointments with Calendly
On the scheduling page you can book a call via Calendly, a service of Calendly LLC, USA. The calendar only loads after you click “Load calendar”. From then on, Calendly receives your IP address and technical data and sets its own cookies, among other things to prevent abuse (Cloudflare, Stripe). When you book, Calendly processes your name, email address, the selected time and the details you give about the call.
The legal basis for loading the calendar is your consent given by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); for the booking it is Art. 6(1)(b) GDPR. Transfers to the USA are based on the EU-US Data Privacy Framework or on EU Standard Contractual Clauses. A data processing agreement with Calendly is in place.
8. Video calls
For video calls I use Zoom (Zoom Communications, Inc., USA). Name, email address, audio and video data and technical connection data are processed. The legal basis is Art. 6(1)(b) or (f) GDPR. Transfers to the USA are based on the EU-US Data Privacy Framework or on EU Standard Contractual Clauses.
9. Candidates
As an executive search consultant, I search for sales leaders and specialists on behalf of companies. In doing so I process data of people who contact me and of people I approach myself.
Where the data comes from: from you (CV, conversations, email), from publicly available professional profiles such as LinkedIn and XING, from referrals, and from providers of business contact data, namely Lusha (Lusha Systems Inc., USA) and the enrichment feature of my applicant tracking system Loxo.
Which data: name, business contact details, career history, qualifications, notes from our conversations, and salary expectations and availability where you share them.
Purpose and legal basis: the first approach about a suitable role is based on my legitimate interest and your presumed interest in career opportunities (Art. 6(1)(f) GDPR). Once we discuss a specific role, I process your data to take steps prior to entering into a contract (Art. 6(1)(b) GDPR). I only share your profile with a client company with your prior agreement (Art. 6(1)(a) GDPR).
Talent pool: with your consent I keep your documents in my talent pool for up to two years to consider you for future roles (Art. 6(1)(a) GDPR). Consent is voluntary and can be withdrawn at any time.
Recipients: client companies only with your agreement. As technical service providers I use the applicant tracking system Loxo (Loxo, Inc., USA) and email and video services, each under a data processing agreement. Transfers to the USA are based on the EU-US Data Privacy Framework or on EU Standard Contractual Clauses.
Retention: without an ongoing process I keep your data for no longer than two years after our last contact. You can ask me to delete it at any time.
If I approach you directly, my first message points you to this privacy policy.
10. Clients and business partners
For contacts at clients, prospects and business partners I process business contact details and correspondence to handle requests, carry out and invoice search mandates. The legal basis is Art. 6(1)(b), (c) and (f) GDPR. I keep tax-relevant records for the statutory periods, in particular under Section 147 of the German Fiscal Code (AO).
11. Social networks and external links
I am present on LinkedIn and XING. This website does not embed plugins from these networks; the links only lead to my profiles. The respective provider processes data under its own terms only once you click a link. The same applies to the links to my podcast on Spotify and Apple Podcasts.
12. Your rights
- Access to your stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
- Complaint to a supervisory authority (Art. 77 GDPR); the authority responsible for me is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany
Right to object under Art. 21 GDPR: where I process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to being approached directly at any time without giving reasons. A short message to jan@nordh.de is enough.
13. Further information
You are not obliged to provide personal data; without it, however, I cannot handle your request. There is no automated decision-making, including profiling, under Art. 22 GDPR. The connection to this website is encrypted with TLS.
I update this privacy policy when the processing described here changes.