As of 18 September 2026
1. Controller and contact
The controller is EA European Atlantic GmbH, Neuer Wall 10, 20354 Hamburg, Germany. For privacy matters, contact Daniel Harbeck at mail@european-atlantic.com. Our current assessment does not indicate a statutory requirement to appoint a data protection officer, and none has been appointed.
This notice covers registrations and the placement purposes expressly selected for European Atlantic, HARBECK & PARTNER and HEAVY CAMPAIGNS. European Atlantic serves project experts; HARBECK & PARTNER serves executives seeking permanent positions or interim assignments, as well as speakers, trainers, coaches and lecturers; HEAVY CAMPAIGNS serves creative and digital specialists seeking projects. An enquiry about permanent placement is addressed to EA as an intermediary for potential positions at other companies, not as an application for employment with EA. Our Privacy Policy covers general website visits.
2. Data we process
We process your contact and business details, professional qualifications and experience, availability, working preferences and, where provided, remuneration expectations. This includes your CV and other submitted documents, our correspondence, relevant review notes and project associations. We also process information about verification of your contact address, your statements and requests, and technical data necessary to provide and use the service securely.
The information generally comes from you. Submit only necessary professional information that you are entitled to share. Health data and other particularly sensitive information, or confidential documents belonging to previous clients, do not belong in general registration. Limit information about referees to what is necessary and inform them of the intended disclosure. Naming a referee is not general permission to contact former employers or clients; we agree any such contact with you beforehand.
Your name, email address and an informative profile are required for this registration service. We cannot process registration without them. Other information is voluntary as indicated; missing information may limit assessment of project suitability. There is no statutory obligation to register.
3. Purposes and legal bases
Handling specific cooperation requested by you
Reviewing, discussing and preparing pre-contractual steps with you: Article 6(1)(b) GDPR where those steps are necessary for a contract with you.
General professional communication, administrative allocation and relevant review outside those contractual steps
Article 6(1)(f) GDPR. Our interest is orderly handling of professional enquiries and an appropriate assessment of possible cooperation. This applies particularly to contacts acting for a company.
Inclusion and use in the voluntary pool for future opportunities within the selected areas
Your separate consent under Article 6(1)(a) GDPR. Refusal does not affect processing of your current registration.
Presentation to a customer
Only after your confirmation for the specific project or employment opportunity and intended recipient. Article 6(1)(b) GDPR applies where this is a necessary pre-contractual step requested by you; voluntary disclosure beyond that requires separate consent under Article 6(1)(a) GDPR. The applicable basis is determined and communicated before disclosure.
Security and protection against unauthorised use
Article 6(1)(f) GDPR; our interest is protecting your data and reliable communication channels.
Handling privacy requests and statutory accountability duties
Article 6(1)(c) GDPR together with the applicable data-protection obligations.
Necessary minimal evidence and preventing unintended renewed contact after withdrawal
Article 6(1)(f) GDPR; our interest is demonstrating and reliably respecting your decisions and establishing or defending legal claims.
Acknowledging that you have read this notice is not consent. Pool consent is neither marketing consent nor permission to disclose your profile automatically.
4. Review and professional suitability
We may compare professional profile information with requirements of the selected project or employment opportunities using relevant criteria such as qualifications, experience, availability, working location and remuneration expectations. Rules-based assessments support handling and may influence the order of review. Missing or inaccurate information may affect the assessment; you may have it corrected or supplemented.
A person decides whether to propose a presentation. An assessment alone does not result in a binding offer or rejection. This process does not involve solely automated decisions with legal or similarly significant effects. Registration or pool consent does not authorise sending your documents to external AI services.
5. Recipients and service providers
Within EA, access is limited to people handling the relevant matter. We use processors for hosting, communication and secure electronic transfer, including time-limited encrypted intermediate processing. Our live website is hosted by Host Europe in Germany. Expert documents are retained in Germany; our other regular data stores are located in Germany or the European Union. Providers are engaged according to their privacy role and, where acting as processors, contracted under Article 28 GDPR. The information on possible international processing below also applies.
An identifiable profile or CV is presented to a customer only after your confirmation for the specific opportunity and intended recipient. Such confirmation is neither a project contract nor an employment contract. It does not involve public publication of your profile or use for other placement purposes.
Other recipients may include legal and tax advisers, authorities or courts where necessary for legal obligations or specific legal claims.
Where providers process data outside the EU or EEA, transfers take place only on a lawful basis under Chapter V GDPR. This may be an adequacy decision applicable to the recipient or appropriate safeguards, particularly EU Standard Contractual Clauses with any necessary supplementary measures. Information about the basis used in the particular case and a copy of available safeguards can be obtained through the privacy contact above. Encryption does not replace these requirements.
6. Retention and deletion
Current registration without pool consent
Operational profile data and documents are deleted 90 days after registration review is completed unless a separately justified purpose applies to specific data. An ongoing review continues only as long as necessary to handle the request.
Voluntary expert pool
Twelve calendar months after the last confirmed profile update, consent confirmation or active interaction expressly confirmed with you as demonstrating continued pool participation. Before expiry, we request confirmation; if none is received, we delete after a 30-day grace period. Sending or opening a reminder does not extend the period.
Withdrawal of pool consent
Use for further pool enquiries and presentations based on that consent ends when withdrawal takes effect. Affected operational profile data and documents are deleted within seven days unless an independent lawful retention reason applies to specific data.
Valid request for complete erasure
We arrange deletion without undue delay. The maximum period for documents after final profile deletion is seven days; this is not an additional standard retention period.
Temporary transfer data
Cleared after transfer has completed; where processing has not occurred, scheduled for deletion from active temporary storage no later than seven days after acceptance. This does not promise simultaneous physical deletion of all backup or recovery copies.
Minimal consent and processing evidence
Three years after withdrawal or deletion. This includes the relevant statement or its version record, time, language and source, a reduced identifying reference and withdrawal where applicable. Profiles and CVs are not retained as an evidence archive.
Minimal suppression record
Where necessary, up to three years from withdrawal or deletion to prevent unintended reactivation or renewed contact. No complete profile.
The three-year evidence periods are our purpose-specific retention rule, not a general statutory obligation to retain all data for three years. Use is restricted to the relevant evidence purpose. Independent contractual, accounting or dispute records may have different retention rules; this does not automatically extend retention of your pool profile.
Backup and recovery copies are handled under the applicable limited retention rules and are not used for new project enquiries. Restoration must not reverse an existing withdrawal or deletion decision. The privacy contact can provide information about periods applicable to your data.
7. Your rights and contact options
Subject to the GDPR, you have rights of access, rectification, erasure, restriction and portability. You may withdraw consent at any time with effect for the future; the lawfulness of processing previously based on that consent remains unaffected. You may use our profile management service or the privacy contact. Where necessary, we confirm your identity appropriately.
Objection: Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. We stop processing unless compelling legitimate grounds or legal claims justify continuing. You may object to processing for direct marketing at any time without giving reasons; the expert pool contains no general marketing consent.
You may lodge a complaint with a data-protection supervisory authority, particularly the Hamburg Commissioner for Data Protection and Freedom of Information.
We inform you about action taken on your data-subject requests without undue delay and within one month of receipt. Where necessary because of the complexity or number of requests, this may be extended by up to two further months; we inform you of the extension and reasons within the first month.
8. Brands and purpose limitation
European Atlantic, HARBECK & PARTNER and HEAVY CAMPAIGNS are brands of EA European Atlantic GmbH, Neuer Wall 10, 20354 Hamburg, Germany. They identify areas of expertise within the same company, rather than separate controllers.
- European Atlantic: project and programme management, software and AI development, data engineering and data science, cloud and IT architecture, cybersecurity, quality assurance, business analysis, product management, automation and technical interim management.
- HARBECK & PARTNER: executives and management professionals for permanent employment or interim assignments; also transformation, change management, organisational and people development, speakers, business trainers, coaches and lecturers.
- HEAVY CAMPAIGNS: creative professionals, design and UX/UI, web and commerce development, e-commerce, content and brand communication, SEO/SEA, performance and affiliate marketing, social media, conversion optimisation, CRM and marketing automation.
These areas can overlap. Your enquiry, the specifically communicated purpose and the applicable agreements remain decisive. Brand allocation does not authorise automatic use for other purposes or disclosure to customers. In particular, project pool consent is not consent to permanent employment placement or general advertising.
The opportunity areas selected in each registration form and the accompanying statement determine its scope. This notice does not extend existing consent to another brand or purpose. We provide separate information and obtain new consent where required for new purposes. Withdrawal and erasure may concern one registration or all your registrations; we explain the scope before confirmation. Requesting a profile update does not itself extend a pool retention period.