Privacy Policy

1. Controller

Controller within the meaning of the GDPR:
Goran Golik – Sales.Bayern
Amalienstraße 71, RGB 2, 80799 Munich, Germany
Email: gg@sales.bayern

2. General information on data processing

Personal data are processed exclusively in accordance with the applicable legal provisions, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German General Equal Treatment Act (AGG).

Processing takes place only to the extent necessary to provide this website, handle contact enquiries and conduct sales-related recruitment and placement processes.

3. Hosting and server log files

This website is provided via a webspace package from united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany. The webspace service uses technical infrastructure services required to deliver and securely operate the website.

When this website is accessed, technically necessary information is processed, in particular the IP address, date and time of access, browser type and version, operating system, referrer URL, and pages and files accessed.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure, stable and error-free provision of this website. Where service providers process personal data on my behalf, this is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

4. Contact forms on this website

This website provides separate contact forms for companies and for candidates. When a form is submitted, the data entered are transmitted in encrypted form via HTTPS to the Sales.Bayern web server and processed on the server so that the enquiry can be forwarded by email to gg@sales.bayern. No external form service provider is used.

For the company form, the data processed may include in particular name, company, email address, telephone number, position to be filled and the content of the message. For the candidate form, the data processed may include in particular name, email address, telephone number, LinkedIn profile, current position, message and — if voluntarily uploaded — a CV.

CVs may be submitted voluntarily as PDF or DOCX files up to 5 MB. The uploaded file is technically used only to process and transmit the enquiry. The form function does not permanently store the uploaded file in the website's web directory. After successful transmission, the message, including any attachment, is stored in the email system used.

To protect against automated misuse (e.g. spam enquiries by bots), the IP address is briefly stored on the server in pseudonymised form (as a hash value), together with a timestamp, each time a form is submitted. This information is used to prevent multiple enquiries being sent from the same IP address within a short period of time. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in protecting the website and email inbox from misuse. This information is not linked to the other form data and is not used for other purposes.

The legal basis is Art. 6(1)(b) GDPR where the enquiry serves to initiate a contractual or employment relationship, and Art. 6(1)(f) GDPR for other business enquiries. For candidate enquiries, the information in Section 7 also applies.

5. Email communication and Microsoft 365

I use Microsoft 365 for business email communication. If you contact me by email or via a form, the information you provide is processed to handle your enquiry and for further communication. This may include, in particular, sender and recipient addresses, communication content, attachments, timestamps and technically necessary connection data.

The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft 365 is subject to the privacy and security terms of the Microsoft Products and Services Data Protection Addendum. Where Microsoft processes personal data on my behalf, this takes place on the basis of the corresponding data processing terms pursuant to Art. 28 GDPR.

Processing of data outside the European Union or the European Economic Area cannot be ruled out in every case. Where required, Microsoft relies on appropriate safeguards for such transfers, in particular the Standard Contractual Clauses adopted by the European Commission.

The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.

6. Business contacts and direct acquisition

In the course of initiating business relationships, I process personal data of contacts at potential and existing business customers. This may include, in particular, name, professional position, company, business contact details and publicly available professional information.

The processing is carried out for targeted outreach and the initiation of business relationships on the basis of Art. 6(1)(f) GDPR. My legitimate interest lies in acquiring and supporting business customers and marketing my services.

The data may originate in particular from publicly available professional sources, company websites, professional networks or existing business contacts.

Personal data are stored only for as long as necessary for the stated purposes or as required by statutory retention obligations.

You may object at any time to the processing of personal data for direct marketing purposes. Following such an objection, the personal data will no longer be used for direct marketing.

7. Applicant and candidate data

In the context of sales-related recruitment and placement processes, I process candidates' personal data solely for the purpose of identification, approach, assessment and the conduct of mandate-related recruitment and placement processes.

The data processed may include in particular: contact details, career history and qualifications, information on current and previous employment, salary and target compensation information, interview and conversation notes, information on motivation to change roles and availability, publicly available professional information (e.g. from professional networks such as LinkedIn or XING), and other information voluntarily provided during a recruitment process.

Processing takes place exclusively in connection with specific recruitment mandates and only to the extent necessary to conduct the respective process. The principles of data minimisation and purpose limitation apply.

The legal basis for processing is Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR and Section 26 BDSG. Applicants are treated as employees within the meaning of Section 26(7) BDSG. The legitimate interest lies in conducting professional recruitment processes, assessing professional fit and supporting companies in sales-related hiring decisions.

Applicant and candidate data are made available only to persons directly involved in the relevant recruitment process. No further disclosure takes place without an appropriate legal basis or explicit consent. Where candidate profiles are forwarded to commissioning companies as part of a mandate, this takes place solely in the context of that mandate and only with the knowledge of the person concerned.

If candidates upload a CV via the form on this website, they do so voluntarily. The CV is processed solely to handle the relevant enquiry and — where a specific recruitment process arises — for the recruitment purposes described in this section. It will not be forwarded to a company without prior consultation with the person concerned.

Retention period: After completion of a recruitment process, candidate and applicant data are generally deleted no later than six months thereafter, unless further storage is required for the establishment, exercise or defence of legal claims or another legal basis applies.

A longer retention period may apply in particular on the basis of consent or statutory retention obligations.

8. Direct approach and professional networks

When searching for suitable candidates, publicly available professional information may be processed, in particular from professional networks such as LinkedIn or XING and other publicly available professional sources. Processing takes place exclusively in a professional context and only in connection with sales-related recruitment processes. Information from private social networks (e.g. Facebook, Instagram) is not processed in a professional context.

Candidates contacted by direct approach receive the required information on data processing pursuant to Art. 14 GDPR no later than at the time of first contact. The data originate in particular from publicly available professional sources such as LinkedIn or XING.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in conducting professional direct approaches and mandate-related recruitment processes.

9. Use of external software and AI-assisted systems

In providing my services, external software solutions and digital services may be used, in particular for communication, document creation, appointment organisation and the structured processing of mandate-related information. These may include digital tools for document creation, appointment organisation and structured assistance systems. The information in Section 5 additionally applies to Microsoft 365.

For the structured evaluation and summarisation of professional documents — in particular CVs and profile information — and for assessment against requirement profiles, I may use AI-assisted systems, in particular services from OpenAI (ChatGPT) and Anthropic (Claude). Their use serves solely to support work organisation in specific recruitment processes. No automated decision is made regarding a person's suitability or rejection; professional assessment and decision-making remain with me.

Sales.Bayern is operated as a sole proprietorship. I alone have access to applicant and candidate data. Personal data are transmitted to AI systems only to the extent necessary and for the relevant purpose. Where possible and appropriate, information is reduced, anonymised or pseudonymised beforehand. Candidate documents continue not to be shared with commissioning companies without prior consultation with the person concerned.

Personal data are processed only to the extent necessary. Where available and required, external service providers are used on the basis of appropriate data processing agreements pursuant to Art. 28 GDPR or appropriate safeguards for any third-country transfers. The legal basis is Art. 6(1)(f) GDPR and — where applicable — Section 26 BDSG. The legitimate interest lies in efficient, careful and professionally sound assessment within mandate-related recruitment processes.

10. LinkedIn

This website contains an external link to my LinkedIn profile. Merely visiting this website does not automatically transmit data to LinkedIn. A connection to LinkedIn is established only when the link is actively clicked.

Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
Further information: linkedin.com/legal/privacy-policy

11. Locally hosted fonts

This website uses locally hosted fonts (no external requests to Google Fonts). As a result, no data are transmitted to Google when the page loads.

12. Confidentiality in the recruitment process

Confidentiality is an essential part of the way I work. Information from conversations, interviews and recruitment processes is processed exclusively in the relevant mandate-related context. Personal information is disclosed only where this is necessary for the relevant recruitment process or where corresponding consent has been given.

13. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. This can be recognised, among other things, by “https://” in the address bar.

14. Retention period

Personal data are stored only for as long as necessary to fulfil the respective purposes or as required by statutory retention obligations. Once the purpose of processing no longer applies and no statutory retention obligations prevent deletion, the data are deleted.

15. Rights of data subjects

Within the framework of the applicable legal provisions, you have in particular the following rights: right of access (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to data portability (Art. 20 GDPR) and right to object (Art. 21 GDPR).

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, please contact: gg@sales.bayern.

In addition, you have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority in Bavaria is:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach
lda.bayern.de

16. Objection to direct marketing

The use of contact details published in fulfilment of legal notice requirements for sending unsolicited advertising is hereby objected to.

Irrespective of this, data subjects may object at any time to the processing of their personal data for direct marketing purposes (see Section 6 and the right to object under Art. 21 GDPR). Please contact gg@sales.bayern.

17. Changes to this Privacy Policy

This Privacy Policy may be amended where necessary due to technical or legal developments.

Last updated: September 2026