This notice is provided under Article 14 of the General Data Protection Regulation (GDPR) because TRELMA GmbH received your personal data from a third party, specifically from Akiba 360degrees Afrika Ltd, a recruitment intermediary with which you are engaged, rather than directly from you. Article 14 requires us to give you this notice within a reasonable period of obtaining your data and at the latest within one month, or at the time we first communicate with you if that happens sooner. This notice tells you who we are, what data we hold about you, where it came from, why we are using it, how long we keep it, who we share it with, and what rights you have.
| Controller | TRELMA GmbH |
|---|---|
| Registered address | Oelsnerring 85, 22609 Hamburg, Germany |
| Website | trelma.com |
| Primary contact | info@trelma.com |
| Contact for data protection | The Director of TRELMA GmbH is the contact point for all data protection enquiries. Write to info@trelma.com. TRELMA is established in Germany and is not required to appoint a representative under Article 27 GDPR. TRELMA is not required to appoint a Data Protection Officer under section 38 of the German Federal Data Protection Act. |
| Supervisory authority | Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg, www.datenschutz-hamburg.de |
| Document reference | TRELMA-GDPR-ART14-001 |
| Version | 1.0 |
| Last updated | 29 September 2026 |
We hold the following categories of personal data about you, as provided to us by Akiba 360degrees Afrika Ltd. We hold only data that is relevant and necessary to assess your suitability for a specific role opportunity (data minimisation principle):
We do not hold special category data about you (such as health information, racial or ethnic origin, political opinions, or biometric data) unless you have explicitly consented to this and we have separately agreed with Akiba 360 to receive it with appropriate safeguards in place. For certain roles with specific occupational requirements (such as field, subsea, or offshore work), we may request limited fitness-to-work information, for example, confirmation of adequate visual acuity, hearing capacity, or physical strength relevant to the role. Where this applies, we will tell you clearly what we are requesting, why it is required for that specific role, and the legal basis on which we process it. We will never request health information beyond what is strictly necessary for the specific role, and any such data will be processed only with your explicit consent under Article 9(2)(a) GDPR, which you are free to refuse, and under a separately documented assessment. If you believe we hold data about you beyond these categories, please contact us using the details in Section 1.
We received your personal data from Akiba 360degrees Afrika Ltd (Kampala, Uganda), a specialist recruitment intermediary operating in the East African market with which you are or have been engaged as a candidate seeking employment opportunities. Akiba 360 shared your profile with us because your professional background may make you a suitable candidate for a role opportunity that one of our employer clients has asked us to fill.
TRELMA and Akiba 360 each operate as independent data controllers. This means each organisation is separately responsible for its own use of your personal data. This notice covers TRELMA's processing only. For information about how Akiba 360 uses your data, what data they hold, and your rights in relation to their processing, please contact Akiba 360 directly.
We process your personal data for the following specific purposes. Where our basis is Legitimate Interests, we have conducted a documented Legitimate Interests Assessment (LIA, reference TRELMA-GDPR-LIA-001). You can request a copy of our LIA summary by contacting us at the details in Section 1.
| Purpose | Legal Basis | Our Legitimate Interest |
|---|---|---|
| Assessing your suitability for a specific role opportunity identified by one of TRELMA's employer clients | Legitimate Interests, GDPR Article 6(1)(f) | TRELMA has a legitimate commercial interest in matching qualified candidates to employer client requirements. Candidates engaging with a specialist recruitment intermediary have a reasonable expectation that their professional profile may be shared with potential employers in the relevant sector. |
| Presenting your profile to the specific employer client for whom the role opportunity exists | Legitimate Interests, GDPR Article 6(1)(f) | As above. We will only present your profile to the employer for whom the specific role was identified, and you will be informed before your profile is submitted. |
| Post-placement follow-up to confirm successful placement and support your welfare (placed candidates only; up to 2 years post-placement) | Legitimate Interests, GDPR Article 6(1)(f) | Legitimate interest in ensuring successful, sustainable placements for both candidates and employer clients, and in supporting candidates in a new environment. |
| Maintaining records of our data processing activities as required by GDPR Article 30 | Legal obligation, GDPR Article 6(1)(c) | Not applicable, legal obligation. |
Your data is assessed by TRELMA personnel, not by automated systems, when evaluating your suitability for a role.
We will share your personal data only with the following parties, and only for the specific purposes set out in Section 4:
We will not share your data with any other employer client, or for any purpose other than those set out in Section 4, without your prior explicit written consent. We do not sell your personal data to third parties.
TRELMA is based in Hamburg, Germany (within the European Economic Area). Your data is stored in our Microsoft 365 cloud environment, hosted on EU-based Microsoft infrastructure.
Your data reached us from Akiba 360degrees Afrika Ltd in Uganda. Bringing data into the EEA in this way is not a restricted transfer under GDPR, so no special safeguard is needed for it. Once we hold your data it stays within the EEA. It is assessed by TRELMA personnel in Germany and stored in Microsoft data centres in the EU.
There is one limited flow in the other direction. We tell Akiba 360 the outcome of your assessment, and we let them know if you ask us to delete your data or object to our using it, so that they can act on it as well. Uganda is not covered by an EU adequacy decision, so for that flow we use the European Commission's Standard Contractual Clauses for transfers between two controllers. You can ask us for a copy of those clauses by writing to info@trelma.com. We have also assessed the risk that a Ugandan public authority might seek access to that information, and we review that assessment every year. Your data is protected throughout by our information security management system, which we maintain in accordance with ISO/IEC 27001:2022.
We keep these arrangements under review and will tell you through an updated version of this notice if they change.
| Situation | Retention Period |
|---|---|
| You are assessed but not shortlisted for a role | Deleted within 30 days of the relevant recruitment drive closing |
| You are shortlisted but not placed | Deleted within 30 days of the relevant recruitment drive closing, unless you give us your explicit written consent to keep your profile for future opportunities, in which case we keep it for up to 12 months |
| You are successfully placed in a role | Retained for up to 2 years after placement for post-placement follow-up and welfare purposes, then deleted |
| You exercise your right to erasure | We respond within one month of receiving your valid request and aim to complete deletion within 10 working days, unless a legal obligation requires us to keep specific records |
| You object to processing | We stop processing and delete your data, and confirm this to you within one month, unless we can demonstrate compelling legitimate grounds that override your interests |
| You request that we retain your data beyond the standard period for future opportunities | We may keep your data only where you give us your explicit written consent. That consent lasts 12 months from the date you give it. Before it expires we will contact you to ask whether you want to renew it, and if you do not reply we will delete your data. You can withdraw your consent at any time by writing to info@trelma.com, and withdrawing it does not make our earlier use of your data unlawful. |
A note on keeping your data longer. We are not obliged to keep your data simply because you ask us to. If you ask, we will consider whether there is a valid basis for keeping it, normally your explicit consent, and whether keeping it is still proportionate. If there is no valid basis we will explain why and delete your data on the standard timetable above.
We maintain a deletion log recording when your data is deleted, the reason for deletion, and who authorised it. This log is retained as part of our accountability records under GDPR Article 30.
Under GDPR, you have the following rights in relation to your personal data held by TRELMA. These rights are not absolute and may be subject to exemptions, but we will always explain if we cannot fully comply with a request and why.
| Your Right | What It Means |
|---|---|
| Access (Article 15) | Request a copy of the personal data we hold about you, free of charge. We respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you within the first month if we need to. |
| Rectification (Article 16) | Ask us to correct inaccurate or incomplete data. We act within one month and, where relevant, tell Akiba 360 about the correction. |
| Erasure (Article 17) | Ask us to delete your data where we no longer need it, where you have withdrawn consent, or where you object and we have no overriding legitimate grounds. We respond within one month and aim to act within 10 working days. |
| Restriction (Article 18) | Ask us to limit how we use your data while a concern is being investigated or resolved. |
| Portability (Article 20) | Receive the data you have provided to us in a structured, commonly used, machine-readable format. Note: this right applies to data processed on the basis of consent or contract, and by automated means. As we rely on Legitimate Interests and process data manually, this right may have limited application to your data held by TRELMA. |
| Object (Article 21) | Object to our processing of your data on the basis of Legitimate Interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your rights and interests. You may object at any time, free of charge and without needing to give a reason. Objecting carries no penalty: you remain in consideration for other opportunities and are not disadvantaged in any way. |
| Not to be subject to automated decisions (Article 22) | Not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. As noted in Section 4, TRELMA does not use automated decision-making for candidate assessment. |
| Withdraw consent (Article 7(3)) | Where we rely on your consent, for example if you asked us to keep your profile for future opportunities, you can withdraw that consent at any time by writing to info@trelma.com. Withdrawing consent does not affect the lawfulness of what we did with your data before you withdrew it. |
To exercise any of your rights, contact us at: info@trelma.com. We acknowledge your request promptly and respond within one month, which we may extend by up to two further months for a complex request, telling you within the first month if we need to. We may ask you to verify your identity before processing a request, to protect your data from unauthorised access.
If you believe we have not handled your data correctly, or you are unhappy with our response to a rights request, you have the right to lodge a complaint with the Hamburg DPA:
Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI)
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
www.datenschutz-hamburg.de
If you live or work in another country of the European Union or the European Economic Area, you may also complain to the data protection authority in that country.
We protect your personal data using appropriate technical and organisational security measures under our information security management system, which we maintain in accordance with ISO/IEC 27001:2022. These include multi-factor authentication (MFA) on all systems holding candidate data, access controls with least-privilege principles, encryption of data at rest and in transit, and regular security reviews and audits. Access to your data is limited to personnel with a legitimate reason to process it for the permitted purposes set out in Section 4.
We may update this notice from time to time to reflect changes in law, our practices, or the nature of our processing. Where changes are material, we will notify candidates who are actively in our processing scope. The current version of this notice is always available on our website at trelma.com/candidate-privacy-notice and on request by email to info@trelma.com.
Document Reference: TRELMA-GDPR-ART14-001
