Privacy Policy

Privacy Policy

Last updated: 28 August 2026

Version: 2026-08-28-talent-v2

1. Who is responsible for your data?

Galactus BV, with registered office at Gamsterstraat 13, 2850 Boom, Belgium, company and VAT number BE 1029.767.737, is the controller for the personal data described in this policy. You can contact us at hello@galactus.be.

This policy covers Galactus Lead, Galactus Talent, our website, contact forms, recruitment and executive-search services, candidate management, assessments and related communications. Galactus is the controller for its own candidate database and recruitment work. A recruiting client may act as a separate controller for information it receives and for its own selection decisions. That client's privacy information may then also apply.

2. Which data do we process?

Website visitors, contacts and subscribers

We may process your name, business email address, company, telephone number when supplied, message, communication preferences and technical or cookie data.

Candidates and applicants

We may process your name, email address, required telephone number, LinkedIn URL, location, professional history, education, skills, availability, contract preference, salary or rate expectation including currency and period, CV, short message, consent and acknowledgement choices, job-specific answers, application status, assessments, internal notes, communications, meetings, presentation history, source information, Talentpool choices and audit records.

Clients and business contacts

We may process identity, business contact details, company, role, mandates, agreements and correspondence needed to provide Galactus Lead or Galactus Talent services.

Assessments and GRIP

We may process submitted answers, generated results, contact details and delivery status needed to provide the requested assessment.

We normally obtain data directly from you. We may also receive professional information from public business sources, referrals, reference contacts or clients when this is relevant and lawful. When we did not obtain the data directly from you, we provide the information required by Article 14 GDPR within the applicable period, unless a legal exception applies.

3. Why do we process data and on which legal basis?

  • Requests and services: to answer enquiries and provide a requested service or assessment, based on steps requested before a contract, performance of a contract or our legitimate interest in responding professionally.

  • Recruitment and executive search: to receive and assess applications, contact potential candidates, communicate, plan interviews, manage selection and, when appropriate, present a candidate for a specific role. Depending on the situation, this is based on steps requested by the candidate before a possible contract or the legitimate interests of Galactus and the recruiting client in filling a role, after considering the candidate's rights and interests.

  • Presentation to a recruiting client: we share only information relevant to a specific process. We inform the candidate about the intended client before information is shared, unless that client's identity was already clear from the vacancy and application context. We do not make an application conditional on Talentpool consent and we do not distribute CVs indiscriminately.

  • Reference checks: we contact a reference only when this is relevant, after informing the candidate and obtaining permission where required. Refusing an optional reference check does not automatically end the application.

  • Talentpool: to retain a candidate profile for future roles only after separate, explicit consent. Refusing or withdrawing Talentpool consent does not affect a current application.

  • Newsletter: to send updates only after consent. Every newsletter offers an unsubscribe option.

  • Security, legal claims and compliance: to prevent abuse, secure systems, keep proportionate audit records, establish or defend legal claims and meet legal obligations, based on legitimate interests or legal obligations.

  • Analytics: to understand and improve the website. Non-essential analytics are used only after cookie consent.

4. Special-category and criminal-offence data

We do not ask candidates to include unnecessary information about health, ethnic origin, political views, religion, trade-union membership, genetics, biometrics, sex life, sexual orientation, criminal convictions or offences in a CV or free-text field. Where such information is exceptionally necessary for a specific role, we process it only when an additional lawful condition under Articles 9 or 10 GDPR and applicable Belgian law is documented.

If a candidate supplies such information without being asked, we limit access and use, remove or redact it when it is not necessary, and do not use it to infer suitability.

5. Human decisions and matching support

Filters, sorting and matching signals may help our recruiters review candidates. They support human judgement. Galactus does not make decisions that have legal or similarly significant effects on a candidate solely through automated processing.

6. Who receives your data?

Access within Galactus is limited to people who need the data for their work. Relevant candidate information may be disclosed to the recruiting client named for a specific process. That client may act as a separate controller for its own recruitment decisions and retention.

We use service providers where necessary, including Vercel and Vercel Blob for hosting and files, Neon for databases, Resend and Amazon SES for email delivery, Microsoft 365 for email and calendar, Cloudflare for security, Google Analytics or Vercel Analytics after applicable consent, Sentry for error monitoring, and professional advisers where required. These parties process data under appropriate agreements and instructions.

We may also disclose information where required by law, a competent authority or the establishment, exercise or defence of legal claims.

7. International transfers

Where a provider processes data outside the European Economic Area, we use an adequacy decision, approved Standard Contractual Clauses or another lawful transfer safeguard.

8. How long do we retain data?

  • Applicants who are not hired: until the selection process is complete and no longer than two months after it closes, unless limited longer retention is necessary for a legal obligation or legal claim.

  • Talentpool: no longer than 24 months from explicit consent or its renewal. You can withdraw consent earlier.

  • Placed or hired candidates: relevant information may be moved to the applicable contractual or personnel file and retained under the rules for that relationship.

  • Presentation and process records: normally follow the retention period for the related application. A limited record may be retained longer where necessary to demonstrate compliance or handle a legal claim.

  • Contact requests and business correspondence: normally no longer than 24 months after the last meaningful contact, unless a shorter or longer period is justified.

  • GRIP and assessment submissions: normally no longer than 12 months after completion.

  • Newsletter: until you unsubscribe. We may retain a minimal suppression record so we can respect that choice.

Security logs and backups are retained only as long as operationally necessary and are removed through scheduled deletion cycles.

9. Your rights

Subject to the GDPR conditions, you may request access, including information about the source and recipients of your data, rectification, erasure, restriction or portability. You may object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing.

Send a request to hello@galactus.be. We may ask for information needed to verify your identity. You can also lodge a complaint with the Belgian Data Protection Authority.

10. Security and accountability

We use proportionate technical and organisational measures, including role-based access, protected administration, encryption where appropriate, monitoring, versioned consent or acknowledgement evidence, audit records and controlled deletion. No system is completely risk-free.

11. Cookies

Necessary cookies support the website. Non-essential analytics are activated only after consent. See our Cookie Policy and use the cookie controls to change your choice.

12. Changes and versions

We may update this policy when our services or legal obligations change. The current version and update date are published on this page. We retain prior versions internally so that we can determine which notice applied to an interaction or application. We communicate material changes directly where this is required or appropriate.