Privacy.

1. Controller

EPV Managing UG (haftungsbeschränkt) i.G.

public brand: EPV │ GROUP

Rosental 5

80331 München

Germany

Represented by Managing Director Fernando Santoro

General contact: hello@epv-group.com

Privacy enquiries: privacy@epv-group.com

2. Service providers and technical delivery

IONOS – domains and direct email communication

We use IONOS SE, Germany, for domain administration and business email communication. When you contact us by email, we process your contact details, message, any attachments you send and technical delivery data to handle your enquiry. IONOS provides the email infrastructure. Processing by IONOS on our behalf is covered by a data processing agreement. Article 6(1)(b) GDPR applies to enquiries by individuals concerning their own contract or pre-contractual steps they request. For business contacts and other enquiries, we rely on Article 6(1)(f) GDPR and our legitimate interest in handling business communications. Direct emails are separate from automated form and system messages.

For Mail Basic, IONOS’s current public data-processing service description specifies deletion no later than seven days after deletion by the customer or termination of the contract, and deletion of log files no later than 28 days after they are created. This is not an automatic seven-day expiry for messages in an active mailbox. These figures come from the public product appendix; the mapping of the mailboxes actually used and the version incorporated into the account’s contract are being checked separately.

IONOS – data-processing service description (Appendix 1, V3.0, 03/2026): https://www.ionos.de/terms-gtc/fileadmin/pdf/terms-gtc/DE/AVV/Anhang_1_Leistungsbeschreibungen_AVV_IONOS_v.3.0.pdf

IONOS – data processing agreement: https://www.ionos.de/terms-gtc/avv/

IONOS – privacy notice: https://www.ionos.de/terms-gtc/terms-privacy/

Resend – automated system messages

Resend, a service of Plus Five Five, Inc., USA, supports automated system messages for the enquiry and application forms offered. Unsolicited applications are separate from applications for genuinely active mandates. Direct emails through IONOS are separate.

Enquiries are transferred to EPV │ OS through a secured delivery queue (outbox). The internal notification contains the EPV recipient address, enquiry type, requested service, referral source, a system-generated priority recommendation, internal record ID, a protected EPV │ OS link and delivery data; the name, free-text message and attachments are not included in that internal notification. A customer acknowledgement additionally processes the name and requested service, together with the recipient address and enquiry reference.

Own-role applications are shown through protected EPV │ OS access. The internal notification to careers@epv-group.com includes the submitted application details, role, receipt time, internal reference and protected OS link. The CV unambiguously checked CLEAN is attached; replies can be addressed to the supplied applicant email. These details and the CV are transmitted through Resend to the IONOS mailbox. Other Executive Search and unsolicited-application notifications still contain only submission type, reference and protected link. No client forwarding or public document access takes place. Application email copies follow the same purpose-specific retention periods; EPV handles their removal from the mailbox separately from automated website deletion.

For EPV's own employment roles, applicants receive an acknowledgement through Resend and, following a personally made and saved decision, messages about review, an interview appointment or rejection. This processes the applicant's name, email address, role, language and dispatch reference; an interview message also includes the date, time, time zone, format, location or contact method and contact person. Changes to an interview appointment are communicated accordingly. These applicant messages do not include CV attachments, salary information, internal notes or internal reasons. The automatic message does not make a selection decision. The legal basis is section 26(1) BDSG for conducting EPV's own recruitment procedure; the Resend provider and transfer information in this section also applies to these messages.

In this website configuration, Resend is an email service provider, not the website host. Ireland is configured as the sending region for epv-group.com. According to its product-specific privacy information, Resend stores email content, delivery logs, webhook data and account records in the United States. Selecting a sending region does not change the storage location; Resend currently offers no setting for EU storage. The provider describes the EU Standard Contractual Clauses in its data processing agreement as a transfer mechanism. Further information about the safeguards can be requested from privacy@epv-group.com.

For the Free plan currently used, Resend specifies 30 days of retention for email and log data while an account is active. According to the provider, backups are retained for seven days. These are provider statements, not confirmation that all copies at EPV or recipients have been deleted; retention following account termination is a separate matter.

Resend – storage and retention: https://resend.com/security/gdpr

Resend – privacy policy: https://resend.com/legal/privacy-policy

Resend – data processing agreement: https://resend.com/legal/dpa

OpenAI / Cloudflare – hosting and technical delivery

The website is hosted and operated through OpenAI Sites by OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Website and form data as well as technically required connection data may be processed, including IP address, time, requested resource, browser and device information, and security, operational and error logs.

EPV is the controller of personal data collected through this website. OpenAI processes hosted data as a processor under the ChatGPT Sites Terms and the Data Processing Addendum incorporated into those terms. OpenAI may use contractually bound subprocessors, including Cloudflare in particular for technical delivery. Under the Data Processing Addendum, OpenAI remains responsible for its subprocessors.

Fixed data or processing residency has not been established for the existing GROUP website. Newer regional Sites offerings do not automatically migrate existing Sites. Website code, database and file storage, artifacts, metadata and logs may therefore also be processed outside the European Economic Area. Under the OpenAI Data Processing Addendum, transfers rely on an adequacy decision or the EU Standard Contractual Clauses. Information about the safeguards or a copy may be requested from privacy@epv-group.com.

The processing provides a secure, stable and abuse-resistant website. Our legitimate interests are operational security, error analysis and abuse prevention; the legal basis is Article 6(1)(f) GDPR.

Microsoft Azure – security checks of application files

Uploaded application files are checked for malware by the existing EPV scanner in Microsoft Azure, Germany West Central. The scanner processes the file in memory; persistent storage by the scanner is not intended. Only files unambiguously marked CLEAN are released for further handling. This security check is not an assessment of suitability or an automated recruitment decision.

Microsoft processes the scan data as a processor under the existing Azure contractual relationship and its incorporated data-protection terms. The scanner’s regional configuration does not establish EU data residency for the website hosting as a whole. Other providers’ transfer mechanisms and safeguards remain separate. The legal basis for the security check in EPV’s own recruitment procedure is section 26(1) BDSG; for other application routes, the respective basis stated in section 5 applies. Information about the agreed safeguards can be requested from privacy@epv-group.com.

3. Language preference

On epv-group.com, the language choice is passed through the URL parameter “lang=de” or “lang=en”. Without a valid language parameter, the preferred language sent by the browser is used; English is the default for other languages. Neither opening a language URL nor switching languages stores a new preference in cookies or local storage. Legacy “epv-language” entries created solely by this website are specifically removed on the next visit where the browser allows it. Other browser data and security cookies are unaffected.

4. Enquiry form

When an enquiry is submitted, we process the name, company or hotel, business email address, optional telephone number, subject, message and language. An OS fit enquiry additionally covers industry, revenue and FTE bands, clients, locations or units, the organisational issue described, the recurring core workflow, existing systems and sources, an optional executive sponsor and the improvement sought within 90 days. The required checkbox records only that the privacy notice has been read; it is not blanket consent.

The data are processed to respond to the enquiry and to take steps towards a possible contractual or business relationship. Depending on the context, the legal basis is Article 6(1)(b) or (f) GDPR. The legitimate interest is the professional response to business enquiries and documentation of the matter. Without the fields marked as mandatory, the enquiry cannot be processed.

After being stored on this website, enquiries are transferred automatically to EPV │ OS, EPV's access-controlled internal management platform. The supplied data, an internal record identifier and, where applicable, GEN│RAL qualification or OS fit context are transferred. Referral labels such as GEN│RAL or AB│LE are unverified attribution, not authority or proof of priority. A submission identifier, content checksum and bounded delivery attempts support reliable transfer. The public enquiry form is available. Within the same controllership, the transfer supports structured handling, documentation and follow-up; it does not result in automated decision-making or disclosure to third parties.

5. Applications and Executive Search

Own employment roles at EPV │ Managing are separate from Executive Search mandates and unsolicited profiles. For an own-role application, we process name, email, phone, city/country, a PDF or DOCX CV up to 10 MB, earliest start, notice period, preferred weekly hours and desired gross annual salary in EUR for those hours. A short motivation, professional overview and HTTPS profile link are optional. Language, job reference, receipt time and acknowledged notice version OWN_HIRING_APPLICATION_V2 are recorded; existing V1 applications remain unchanged. The legal basis is section 26(1) BDSG for deciding whether to establish employment. The CV is initially isolated in quarantine and checked by the existing EPV malware scanner in Microsoft Azure, Germany West Central. Only files unambiguously marked CLEAN are available through protected access; infected or inconclusively scanned files are not accepted. No separate cover letter, certificates, photos, identity copies, salary history, P&L information or LinkedIn account is needed. Privacy acknowledgement is not talent-pool consent. Review and decisions are personal; there is no automated assessment or forwarding to clients. After closure or rejection, application data and documents are deleted within six months unless a specifically documented retention duty or legal defence requires otherwise. If hired, only data necessary for employment is carried forward separately.

Applications for a client Executive Search position require the role-specific link for a genuinely active Executive Search; the Search ID and position are assigned automatically. The published areas of practice describe EPV’s leadership and assignment contexts. A separately offered unsolicited application form is used only for a personal review of a professional profile for possible future Executive Search mandates. It does not promise placement or a position.

For an unsolicited application, we process name, email, optional phone, city and country, current or last relevant position, leadership responsibility sought, optional availability, an HTTPS professional profile link, a short track record, language, receipt timestamp and the confirmed consent version. This path does not accept document uploads. Review, time-limited consideration and contact rely on separate consent under Article 6(1)(a) GDPR; acknowledgement of the privacy notice is distinct. An unsolicited profile is not accepted without the required information and this consent. Consent may be withdrawn at any time for the future through privacy@epv-group.com; prior lawful processing is unaffected.

Applications for a genuinely active mandate additionally involve the relevant revenue, P&L, team, property, commercial and operations responsibility, results, transformation, stabilisation or growth experience, mandate motivation, start date, notice period, mobility, work authorisation, gross cash target compensation and application source. Applicants may optionally upload one PDF or DOCX file of up to 10 MB; alternatively, they may provide an HTTPS link to a professional profile. The file is first stored in a non-retrievable quarantine area and is checked before release by a malware scanner operated exclusively for EPV in Microsoft Azure, Germany West Central. Only files unambiguously classified as CLEAN are transferred to protected storage and made available solely through the access-controlled Responsibility Desk. Files identified as infected or not conclusively scanned are not made available and are deleted from quarantine.

EPV acts as controller for intake and review. Depending on context, Article 6(1)(b) or (f) GDPR applies to pre-contractual steps for a specific mandate and its documented fair filling. Section 26(1) BDSG applies only where an employment relationship is actually being considered, not generally to self-employed interim mandates.

Disclosure to a client requires prior specific agreement with the person concerned about recipient, purpose and responsibilities. EPV does not operate an indefinite talent pool and does not automatically renew unsolicited-application consent. Article 14 GDPR duties are observed for information not obtained directly. Please do not submit identity documents, photographs or unnecessary information about specially protected characteristics; unavoidable irrelevant information is not evaluated and access is restricted.

6. Retention and deletion

Enquiries are retained for three months after closure for evidence purposes and then deleted unless statutory duties or specifically asserted claims require longer retention.

Unsolicited profiles are considered for possible mandates for no more than six months from receipt and then removed by the daily deletion check, even if no procedure closure has been recorded. There is no automatic renewal. Withdrawal ends consideration; the profile is deleted unless a specifically documented legal duty or legal defence requires restricted further retention. Such records are not used for new mandates.

Applications for a specific active mandate are still deleted no later than six months after the procedure ends or a rejection is received. This limited follow-up supports legal defence, particularly concerning possible AGG claims, under Article 6(1)(f) GDPR. Consideration for another mandate requires a fresh review of the legal basis and transparent information.

The local daily deletion check uses the receipt timestamp for unsolicited profiles and the documented closure timestamp for other applications, and respects documented legal holds. Closure or withdrawal must be recorded in the protected system.

This local deletion check does not automatically cover direct emails at IONOS, copies in EPV │ OS, or providers’ operational and security logs and backups. The three- and six-month periods above are not confirmed retention periods for those other records. Documented provider retention periods for IONOS Mail and Resend are given in section 2. The product-specific retention periods for the website host’s logs and backups are still being clarified.

7. Recipients

Access is limited to Fernando Santoro, subsequently expressly authorised EPV personnel, technical providers required for operation and, following transparent information, the specific client. Service providers are engaged as processors where required.

8. Strictly necessary security cookie; no analytics or marketing cookies

Cloudflare sets the “__cf_bm” cookie when the website is accessed to detect automated or abusive traffic and protect the website. According to Cloudflare, it contains encrypted information used to calculate a proprietary bot score, is generated independently for each site visited, is not associated with a user ID in the EPV application and expires after 30 minutes of continuous inactivity. It is not used for EPV advertising, audience measurement or cross-site tracking.

Access to the terminal equipment is necessary to provide the secure website expressly requested by the visitor and relies on section 25(2)(2) TDDDG. Subsequent processing serves abuse prevention and operational security under Article 6(1)(f) GDPR. Information about Cloudflare as a subprocessor, possible third-country processing and applicable safeguards is provided in section 2. Further technical information: https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/

The current website does not use analytics, advertising or marketing cookies. If this changes, the privacy notice will be updated and consent obtained in advance where required.

Server-side page statistics on epv-group.com and epv-able.de: The epv-able.de server sends only the UTC day, fixed public path and language to the existing GROUP website infrastructure; visitor headers are not forwarded. The separate internal overview does not connect people or visits between websites. Within the existing website hosting, eligible successful HTML page requests only increment a daily counter for a fixed public page path and language. Only website, UTC calendar date, page path, language and count are stored, not IP addresses, visitor identifiers, browser data, referrers, complete URLs or individual request events. No additional information is read from your device, no analytics cookies are set and no analytics scripts are loaded. Requests with DNT/GPC signals, identifiable bots, prefetches, internal pages and signed-in access are excluded. Counters assess aggregate use of our information pages, not recognition, profiling or tracking of individuals. They are kept for 90 calendar days; older counters are removed on the next counted request. Browser-cache use and purely client-side navigation are not fully captured; counts are not unique visitor numbers. The separate technical hosting processing and provider log/backup periods described in section 2 remain unchanged.

9. External links

These central website privacy notices cover the information website epv-able.de. Separate notices are provided for genral.de and the individual product applications. Other external services, such as LinkedIn, are governed by their respective providers’ privacy notices. Following a link loads the destination website.

10. Your rights

Subject to the statutory conditions, data subjects have rights including access, rectification, erasure, restriction of processing, data portability and objection. Consent may be withdrawn at any time with effect for the future.

You also have the right to lodge a complaint with a competent data protection authority.

Lodge a complaint with the Bavarian State Office for Data Protection Supervision (BayLDA): https://www.lda.bayern.de/de/beschwerde.html

11. Separate notice of your right to object (Article 21 GDPR)

Where we process your personal data on the basis of Article 6(1)(f) GDPR, Article 21(1) GDPR allows you to object at any time for reasons relating to your particular situation. This also applies to profiling based on that legal basis.

Following your objection, we will stop processing the data concerned unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.

No particular form is required for your objection; you can, for example, email privacy@epv-group.com.

12. Fair selection and AI systems

EPV assesses applications exclusively against role- and mandate-relevant criteria. Characteristics protected under the German General Equal Treatment Act are neither requested nor used as selection criteria.

EPV currently does not use an AI system to filter, assess, rank or reject applicants. Applicant data are not entered into general-purpose AI or LLM services. There is no emotion recognition, biometric categorisation or solely automated decision-making. Any future supporting use of AI requires a new data-protection and AI Act review, documented purpose, data minimisation, risk management, logging, human oversight and transparent information. The accountable person retains genuine decision authority.

13. Updates

This privacy notice will be updated when functions, service providers or legal requirements change. Last updated: 30 October 2026.

AI assistant on our information websites

The AI assistant is a voluntary information dialogue on EPV's public websites. It is not an employee and explains only approved public EPV content; where useful, it links to existing service and product pages. It does not place orders, make bookings, submit applications or send emails. It cannot access protected product applications, internal Notion content or customer files.

When you send a message, your question, the selected language, a limited conversation history and the approved public knowledge base are transmitted through the website server to OpenAI. No account, identity information or upload is required. Please do not enter personal or confidential information. Pattern-based checks cannot detect or exclude all such content. Links between EPV domains do not carry a conversation.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are to answer questions you voluntarily submit about our public offering in an understandable way and operate the assistant securely. We limit the conversation context, do not build advertising profiles from it and do not automatically transfer it into our contact-management system. All information and direct contact channels remain available without the assistant. Sending a message is not treated as separate consent.

There is no conversation-based retargeting and no automated decision-making with legal or similarly significant effects.

The local conversation is held only in your browser's memory. New, a language or profile change, and reloading the page clear this local state. Merely closing the chat panel does not delete it. We do not operate a dedicated persistent chat database or automatically transfer the conversation into a CRM.

For abuse prevention, the website server processes a pseudonymous hash of the IP address supplied by the hosting platform and counters held in the memory of the relevant runtime instance. These values are not anonymous. The counting window is one minute; expired counters are cleaned up on a subsequent request or disappear when the instance terminates. Exact deletion after one minute is not promised.

The store:false setting disables retrievable response objects, not all retention. OpenAI may retain safety logs for up to 30 days by default, or longer for legal obligations or harm prevention. Technical API-call logs and hosting logs are separate. Optional sharing of API inputs and outputs for model improvement is disabled. No zero-storage, Zero Data Retention or EU-only processing promise is made.

We use the OpenAI API with its incorporated Data Processing Addendum. For EEA customers, OpenAI Ireland Ltd. is the relevant contracting entity; OpenAI processes submitted content as a data processor. We do not use fixed EU/EEA data residency. The DPA provides for Standard Contractual Clauses or an applicable adequacy decision for relevant international transfers. Details of the safeguards are available from privacy@epv-group.com.

The API configuration is Global; processing outside the European Economic Area is possible. The existing hosting section of this notice continues to apply separately.

You may stop using the assistant at any time and contact EPV directly. Where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation under Article 21 GDPR by contacting privacy@epv-group.com. Stopping or resetting the conversation does not automatically delete data already processed by the provider. The other rights and complaint routes in this privacy notice remain applicable.

Replies may be wrong or incomplete. They are non-binding, do not create an engagement and do not replace personal review or an agreement.

VE│RA — personal browser voice test

Supplement dated 23 October 2026. For the protected personal browser test only; no authorisation for public telephone operation or a customer product.

EPV_VOICE_OWNER_PRIVACY_20261023_V1