Legal
Privacy Notice
Version effective as of 1 September 2026.
1. Who we are
Salomons & Partners GmbH (“Salomons & Partners”, “the practice”, “we”, “us”) is an executive search and leadership assessment practice based in Zürich. We are the controller of your personal data as described in this notice.
This notice explains what personal data we collect about you, why, on what legal basis, and how we handle it. It applies when you visit salomonspartners.com, when you contact us through the website, when you submit a CV, when we approach you as part of an executive search mandate, and when you engage us as a client or represent one.
We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP, SR 235.1) and, where it applies, the EU General Data Protection Regulation (GDPR).
2. Data controller
Salomons & Partners GmbH Limmatquai 4, 8001 Zürich, Switzerland CHE-167.753.470
Managing director: Charles Salomons Email: info at salomonspartners.com
For all data protection questions, requests, and complaints, contact us at the email address above.
3. Who this notice applies to
- Visitors to salomonspartners.com
- Clients and their representatives who engage us for search or assessment mandates
- Candidates who apply to us directly or submit a CV through the website
- Candidates we approach as part of a search mandate on behalf of a client
- Referees who provide references on behalf of candidates
- Business contacts, suppliers and service providers in the context of our business operations
4. Data we process, why, and on what basis
4.1 Website visitors
What: IP address, browser and device information, pages viewed, referring URL, date and time of access. A limited, unidentified signal is also sent to Google on every page, whether or not you consent — see section 5. If you have consented to analytics cookies, we collect the fuller measurement data also described in section 5.
Why: To operate the website, ensure its security and stability, to understand in aggregate how the site is used, and — with your consent — to measure that use in detail.
Legal basis: Legitimate interest in operating and securing the site, and in understanding aggregate site usage through the limited signal described in section 5 (FADP Art. 31(2)(a); GDPR Art. 6(1)(f)); consent for analytics cookies and the fuller measurement they enable (GDPR Art. 6(1)(a)).
How we collect it: Directly from you when you visit the site.
Recipients: Our hosting provider (see section 6), Google (Google Analytics — see section 5).
4.2 Client contact form
What: Your name, email address, company, and the content of your message. Optional: any additional information you choose to include.
Why: To respond to your enquiry and, where relevant, to discuss whether we can support a mandate.
Legal basis: Steps taken prior to entering a contract at your request (FADP Art. 31(2)(a); GDPR Art. 6(1)(b)); legitimate interest in responding to enquiries.
How we collect it: Directly from you when you submit the contact form on the website.
Recipients: Web3Forms (form-submission processing service — see section 6), Microsoft (email delivery to our practice inbox).
4.3 Candidates who submit a CV
What: Your name, email address, message, CV file (typically PDF), and any additional information you include. Where relevant to a mandate: your professional background, education, qualifications, career preferences, and any other content in your CV.
Why: To assess whether we can support you in current or future mandates, to hold your CV for consideration in matching future mandates, and to contact you when a relevant mandate arises.
Legal basis: Your consent, given by ticking the consent box on the CV submission form (FADP Art. 31(1); GDPR Art. 6(1)(a)); steps taken prior to entering a contract at your request.
How we collect it: Directly from you when you submit the form on /candidates.
Recipients: Web3Forms (form-submission processing service — see section 6), Microsoft (Microsoft 365 — for storing and reviewing the CV), our clients in the context of specific mandates (only after we have discussed the opportunity with you and you have consented to be introduced).
You may withdraw your consent at any time by contacting us at the address in section 2. We will delete your CV and associated data within 30 days of your request, subject to any legal obligations to retain records.
4.4 Candidates approached during executive search
What: Your name, professional contact details, current and past positions, employer information, publicly available professional information (LinkedIn, company websites, press coverage), and — if a conversation develops — your CV, career preferences, references, and interview notes. In connection with assessment: results of case-based exercises and structured interviews.
Why: To identify and evaluate candidates for a specific mandate we are conducting on behalf of a client, to represent your candidacy to the client (with your knowledge and consent), and to support the client’s selection process.
Legal basis: Our legitimate interest and the legitimate interest of our client in identifying suitable candidates for a specific role (FADP Art. 31(2); GDPR Art. 6(1)(f)); your consent, given when you engage in the process, for further stages.
How we collect it: From publicly available professional sources (including LinkedIn), from you directly during our conversations, and — with your explicit permission — from referees you nominate.
Recipients: Microsoft (Microsoft 365 — for storing our working notes and correspondence), the specific client on whose behalf the mandate is being conducted (only in relation to that mandate and with your knowledge). LinkedIn, in the sense that our search activity uses their platform.
If you would prefer not to be contacted about future mandates, you can tell us and we will note that in our records.
4.5 Clients and business contacts
What: Company name, name and professional contact details of the individuals we work with, contract and mandate details, correspondence, invoicing information.
Why: To provide our services, manage the mandate, communicate with you, and meet our contractual and legal obligations.
Legal basis: Performance of a contract with the client entity (FADP Art. 31(2)(a); GDPR Art. 6(1)(b)); legitimate interest in managing our business; compliance with legal obligations under Swiss commercial and tax law.
How we collect it: Directly from you. We also draw on publicly available professional sources, including LinkedIn, to research and maintain accurate contact information for the individuals we work with.
Recipients: Microsoft (Microsoft 365), our external accountant, our external legal counsel where relevant, and Swiss tax and regulatory authorities where legally required.
4.6 Legal compliance and defence of claims
We process personal data as necessary to comply with legal obligations (Swiss commercial, tax, and data protection law), to establish and defend legal claims, and to respond to lawful requests from Swiss authorities or courts.
Legal basis: Compliance with legal obligations (FADP Art. 31(2)(e); GDPR Art. 6(1)(c)); legitimate interest in the defence of legal claims (GDPR Art. 6(1)(f)).
5. Cookies and analytics
We use cookies on salomonspartners.com. Some are necessary for the site to function; others are used only with your consent.
Necessary cookies: Session cookies required for basic site functionality. These do not require consent.
Analytics cookies: With your consent, we use Google Analytics 4 (Google Ireland Limited, with data processing by Google LLC in the United States) to understand how visitors use the site. IP addresses are anonymised. You can accept or decline analytics cookies through the consent banner shown on your first visit and change your choice at any time via the “Cookie settings” link in the site footer.
Before you decide. The Google Analytics script loads on every page, but until you accept it runs in a restricted mode known as consent mode. In that mode it stores nothing on your device, sets no cookies, and cannot identify you or recognise you between visits. It does send Google a limited signal: the page address, the referring page, approximate location derived from your IP address, and basic browser and device information. Google uses that signal only to produce aggregate, modelled statistics. If you accept analytics cookies, full measurement begins. If you decline, the restricted mode continues for as long as you browse the site.
A separate Cookie Policy lists each cookie, its purpose, and how long it is stored.
6. Data transfers outside Switzerland and the EEA
Some of the service providers we rely on are located outside Switzerland and the European Economic Area. Where personal data is transferred to a country that does not have an adequacy decision from Switzerland or the European Commission, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the Swiss Federal Data Protection and Information Commissioner (FDPIC), together with additional technical and organisational measures.
The main recipients outside Switzerland/EEA are:
| Recipient | Location | Purpose | Safeguard |
|---|---|---|---|
| DreamHost | United States | Website hosting, server logs | SCCs |
| Google (Analytics) | United States | Analytics, only with consent | SCCs; IP anonymisation |
| Web3Forms | United States | Client contact form and CV upload processing | SCCs; file uploads stored for 30 days |
| Microsoft (Microsoft 365) | United States (with EU Data Boundary for eligible data) | Email, document storage, video calls | SCCs; Data Processing Agreement |
| United States | Search platform used in the course of mandates | SCCs |
You can request a copy of the SCCs by contacting us at the address in section 2.
7. Data security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, and disclosure. These include: encrypted connections to the website (TLS), access controls on our systems, use of reputable service providers with their own security certifications, and periodic review of our processing activities.
Because the internet is an open system, we cannot guarantee the security of data transmitted to us over the internet. Please consider this before sending sensitive information through the site or by email.
8. How long we retain your data
We keep personal data only for as long as necessary for the purposes for which it was collected, and in line with legal retention obligations.
| Data | Retention period |
|---|---|
| Server logs | 30 days |
| Client contact-form enquiries | 24 months from the last interaction |
| Unsolicited candidate CVs | 24 months from submission; renewable on your request |
| CV files at the form processor (Web3Forms) | 30 days from submission, after which the file is deleted from Web3Forms’s servers. The CV remains in our systems per the retention period above. |
| Candidates within an active or completed mandate | Duration of the mandate plus 10 years (Swiss commercial law, CO Art. 958f) |
| Client mandate records | 10 years from mandate close (Swiss commercial law) |
| Correspondence and business records | 10 years (Swiss commercial and tax law) |
| Analytics data | 14 months (Google Analytics 4 default; configurable) |
We may retain personal data for longer where required to establish, exercise, or defend legal claims, or where retention is required by law.
9. Automated decisions and profiling
We do not make decisions about you based on automated processing. Every candidate assessment, shortlist recommendation, and client communication is prepared and reviewed by the principal directly.
10. Your rights
Subject to the applicable law, you have the right to:
- Access the personal data we hold about you and receive a copy
- Rectify inaccurate or incomplete data
- Erase your personal data (“right to be forgotten”)
- Restrict or object to our processing
- Data portability — receive certain data in a structured, machine-readable format
- Withdraw consent at any time, where processing is based on your consent (this does not affect the lawfulness of processing before withdrawal)
- Lodge a complaint with the competent data protection authority (see section 11)
To exercise any of these rights, contact us at info at salomonspartners.com. We may ask you to verify your identity before responding. We will respond within one month; complex requests may take longer, in which case we will notify you.
Some rights may be limited where they would infringe the rights of a third party (for example a client’s confidentiality interest in an ongoing mandate), or where we are legally required to retain the data.
11. Questions and complaints
For questions about this notice or how we process your data, contact us first at info at salomonspartners.com. We will do our best to resolve any concerns directly.
If you are not satisfied with our response, you may lodge a complaint with:
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern — edoeb.admin.ch
- EEA: the data protection authority in your country of residence. A list is available on the European Data Protection Board website.
12. Changes to this notice
We may update this notice from time to time. The current version is always available at salomonspartners.com/privacy. Material changes will be announced on the website. The date at the top of this notice reflects when it was last updated.