Privacy Policy

2.1 Categories of Data Processed

The platform operator processes the following categories of personal data:

• Inventory data (e.g. names, addresses, contact details)

• Content data (e.g. qualifications, professional experience, salary expectations)

• Usage data (e.g. pages visited, access times, interactions, video chat metadata)

• Meta/communication data (e.g. IP addresses, device information)

• Contract data (e.g. subject matter of the contract, term, customer category, evidence of contract conclusion)

• Compliance/evidentiary data (e.g. anti-money-laundering evidence for bonus payouts)

2.2 Categories of Data Subjects

• Talents (candidates who create an anonymized profile)

• Companies (employers who view talent profiles and send requests)

• Referral partners (people who participate in the referral program)

• Website visitors

2.3 Purposes of Processing

• Providing the platform and its functions

• Matching talents and companies

• Processing contracts

• Operating the Bonus and Referral Program

• Communication and customer service

• Security and fraud prevention

• Compliance with legal obligations

• Evidence of contract conclusions

• Analysis and optimization of the platform

4.1 Registration

The following data is collected when registering as a talent:

• Email address (for account verification and communication)

• Password (stored encrypted), or alternatively sign-in via Google or LinkedIn login (see § 11)

• First and last name (initially only internal, not publicly visible)

• Phone number (for SMS verification, see § 11)

4.2 Anonymized Profile

The talent profile visible to companies contains exclusively anonymized data:

• Professional qualifications and education

• Professional experience (without naming specific employers)

• Skills and knowledge

• Desired fields of work and regions

• Salary expectations

• Availability and willingness to change jobs

Name, contact details, and identifying information are only transmitted to companies after the talent has expressly granted contact release as part of the placement process.

4.3 Sign-in via Google or LinkedIn

Talents may alternatively register and sign in via "Sign in with Google" or "Sign in with LinkedIn." In doing so, the account ID, email address, and name are transmitted from Google or LinkedIn to the platform operator. Google Ireland Limited and LinkedIn Ireland Unlimited Company respectively act as independent controllers for the sign-in process (see § 11.5).

4.4 Responsibility After Contact Release to Companies

The platform operator is the controller under data protection law for the processing of talent data in the context of providing, displaying, and placing profiles via the platform. As soon as a company accesses a talent's data after contact release and carries out its own processing steps, in particular contacting the talent, storing data in its own systems, or evaluating the talent as part of the hiring process, the company acts as an independent controller within the meaning of Art. 4 No. 7 GDPR. There is no joint controllership with the platform operator (Art. 26 GDPR) in this respect. For questions regarding this further processing, please contact the respective company directly.

4.5 Legal Basis

Processing takes place on the basis of Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(a) GDPR (consent for contact release and OAuth sign-in).

5.1 Registration and Company Profile

The following data is collected when registering as a company:

• Company name and legal form

• Address and contact details

• Contact person (name, position, email, phone)

• Commercial register number (optional)

• VAT ID

5.2 Usage Data

The following is additionally recorded as part of using the platform:

• Interview requests sent

• Successful hires

• Subscription history

Note: payment data is currently not processed, as the platform can currently only be used via the free plan. Once paid plans go live, this statement will be supplemented with the payment service provider then used.

As soon as a company accesses a released talent profile and carries out its own processing steps, it acts as an independent controller in this respect (see § 4.4).

5.3 Legal Basis

Processing takes place on the basis of Art. 6(1)(b) GDPR (performance of a contract).

6.1 Participation in the Bonus and Referral Program

The following data is collected when participating in the bonus/referral program:

• First and last name

• Email address

• Bank details (for paying out premiums)

• Tax information, where required for reporting obligations

• Anti-money-laundering evidence (KYC), where required for the payout of a premium

6.2 Legal Basis

Processing takes place on the basis of Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligation, insofar as KYC evidence is legally required).

7.1 Server Log Files

The following data is automatically collected on every access to the website:

• IP address

• Date and time of access

• Page/file accessed

• Amount of data transferred

• Browser type and version

• Operating system

• Referrer URL (previously visited page)

7.2 Purpose and Legal Basis

Collection takes place to ensure a smooth connection setup, for system security, and for statistical purposes. The legal basis is Art. 6(1)(f) GDPR (legitimate interest).

10.1 What Are Cookies?

Cookies are small text files that are stored on your device and enable recognition.

10.2 Types of Cookies Used

10.3 Currently No Analytics or Marketing Cookies

The platform operator does not currently use any analytics or marketing cookies (e.g. Google Analytics, Google Ads, Meta Pixel, LinkedIn Insight Tag). Should this change, this Privacy Policy will be updated accordingly and the relevant cookies will first be presented for consent via a cookie banner.

10.4 Managing Cookie Settings

You can adjust your cookie settings at any time via our cookie banner or via the "Cookie Settings" link in the website footer.

11.1 Hosting, Database, and File Storage

DigitalOcean, LLC, 101 6th Avenue, New York, NY 10013, USA

Processed: all application data, including account data, talent profiles, uploaded CV files, company data, and chat messages (stored encrypted). Location of processing: EU data center, Frankfurt. Legal basis: DPA pursuant to Art. 28 GDPR. Further information: digitalocean.com/legal/privacy-policy

11.2 Email Delivery

Mailgun (Sinch)

Processed: email address, name, and content of transactional emails (registration confirmation, password reset, notifications regarding settings and invitations). Processing via an EU endpoint. Legal basis: DPA pursuant to Art. 28 GDPR.

11.3 SMS Delivery

Twilio Inc., 101 Spear Street, Suite 500, San Francisco, CA 94105, USA

Processed: phone number and content of SMS messages for phone number verification and security-related notifications (e.g. password changes). Location of processing: USA. Legal basis: DPA pursuant to Art. 28 GDPR in conjunction with EU Standard Contractual Clauses (see § 12).

11.4 AI-Assisted Features in the Developer Portal

Anthropic, PBC, San Francisco, USA

Used exclusively to automatically generate explanations of technical API changes within the internal developer portal. No personal user data is transmitted in this process — only structural interface information. Location of processing: USA. Legal basis: DPA pursuant to Art. 28 GDPR in conjunction with EU Standard Contractual Clauses (see § 12). Data is not used to train AI models.

11.5 Sign-In Services (OAuth)

11.6 Support Chat

Crisp IM SARL, Nantes, France

Processed when using the chat widget: name, email address, and content of the support conversation. Location of processing: EU (France). Legal basis: DPA pursuant to Art. 28 GDPR.

11.7 Monitoring

New Relic, Inc.

Processes technical telemetry data (paths accessed, load times, error logs) for application monitoring and error analysis; in an error context, an internal user ID may be logged, but never profile or message content. Location of processing: EU data center. Legal basis: DPA pursuant to Art. 28 GDPR.