Privacy Policy

1. Controller

Privacy enquiries: datenschutz@personalausland.de
General contact: kontakt@personalausland.de

2. Principles, purposes and legal bases

We process personal data only for specified purposes and only to the extent necessary to operate the website, handle enquiries, manage employer accounts and provide recruitment services.

Depending on the activity, processing is based on the performance of a contract or steps prior to entering into a contract (Article 6(1)(b) GDPR), a legal obligation (Article 6(1)(c) GDPR), legitimate interests in secure and economical operation and in handling business enquiries (Article 6(1)(f) GDPR), or consent where expressly obtained (Article 6(1)(a) GDPR). Processing special categories of personal data also requires a condition under Article 9(2) GDPR to be met.

We retain data only for as long as it is needed for the relevant purpose. It is then deleted or its processing restricted, unless statutory retention or evidence requirements, or the establishment, exercise or defence of legal claims, require further retention. Where no fixed period is stated, the duration depends on these criteria and the specific business relationship.

3. Hosting and server logs

This website currently runs on a server located in Germany within the infrastructure of:

Accessing the website may generate technically necessary log data. This may include the IP address, date and time, requested resource, referrer where transmitted, browser or user agent, and technical status information. Processing serves to deliver the website, maintain stability, analyse errors and prevent abusive access. The legal basis is Article 6(1)(f) GDPR.

No fixed operational deletion period for server logs is currently configured in the application. Log data is retained only as long as necessary for the stated purposes or to meet legal obligations. Specific retention at infrastructure level is reviewed and documented as part of operations.

DigitalOcean, LLC is based in the USA, even though the server used is located in Germany. Any transfer to a third country in connection with operation, support or administration takes place only in accordance with the requirements of Chapter V of the GDPR.

4. Employer accounts

When an employer account is registered and used, we process in particular login and contact details, company information, the assigned company membership, staffing requirements, candidate proposals, and security-related login and session information. The data is used to review registrations, manage accounts, provide the protected employer area and handle recruitment processes.

The legal basis is Article 6(1)(b) GDPR and, for account security, prevention of abuse and reliable assignment to a company, also Article 6(1)(f) GDPR. Registration alone does not grant access to company data. Membership is reviewed and approved internally.

5. Public employer enquiries

When you submit an enquiry using “Tell us your staffing needs”, we process the company, contact and staffing information you enter, along with your message, to review the enquiry, contact you and prepare a possible placement. The legal basis is generally Article 6(1)(b) GDPR and, for general business enquiries, also Article 6(1)(f) GDPR.

6. Candidate registration, profiles and documents

You can submit your candidate details without an account or create a candidate account. When you create an account, we also store the data needed for login and account management, a protected password and the processing status of your account request. An existing candidate profile is not assigned solely because an email address matches. You can manage your own profile in the candidate area only after internal review and explicit linking.

In the approved candidate area, you can update selected personal and professional details and upload application documents. Your uploads and documents expressly shared with you are accessible through protected downloads. Internal documents are not displayed automatically. You can delete documents you uploaded yourself that remain visible to you; other documents continue to be managed internally. Login, password change and password reset functions provide secure access to your account.

During candidate registration, we process the personal and contact details entered, current and preferred locations, professional background, language skills, availability, source of the enquiry and any optional message. Processing serves to review the information, contact you and potentially consider you for suitable recruitment enquiries.

When you apply for a job, we store the link between your candidate profile and the position, your application message, the processing status, and the dates of application and any withdrawal. The recruiting company receives your name, professional profile information and application message. Your email address, phone number, internal source information and documents are not shared automatically. Job postings contain the job and company information provided by the company and become publicly accessible once published.

Further professional information and voluntarily provided documents may be processed during recruitment. Depending on the individual case, these may include a CV, qualification and language certificates, employment references, recognition documents, visa or residence documents, and other application documents. Not every category is mandatory. Please submit only documents needed for the specific recruitment process.

Documents currently remain protected on the application or server infrastructure. They are not published through publicly accessible media paths. Access is provided through internal functions with permission checks or the candidate area assigned to the individual. The legal basis is generally Article 6(1)(b) GDPR; consent or other statutory grounds apply where necessary.

7. Presenting candidates to employers

Candidate information is made available to the relevant employer only within a specific recruitment process and under the platform's access rules. For recruiter-led candidate proposals, identity remains hidden by default. For applications submitted by candidates themselves, the recruiting company receives the candidate's name and the professional profile information described above. Internal source information, internal notes and candidate documents are not shared automatically.

The information shared in an individual case depends on the recruitment stage, the information needed and the approvals granted. The legal basis is generally Article 6(1)(b) GDPR; where necessary, disclosure is based on consent or another applicable legal ground.

8. Email communication

For our domain email and technical message delivery, we use:

Email communication involves processing in particular sender and recipient addresses, timestamps, technical delivery information, the subject and message content. The purpose is to handle your message and communicate reliably. Depending on the content, the legal basis is Article 6(1)(b) or (f) GDPR. Where data is transferred to Switzerland, the data protection requirements for transfers to third countries apply.

9. Cookies and technically necessary storage

The website currently uses only technically necessary mechanisms. In particular, Django may set a CSRF security cookie to protect forms and a session cookie when you sign in or a session is otherwise required. This data is necessary for secure forms, login, account management and expressly requested functions. The legal basis for the associated processing is Article 6(1)(f) GDPR; access to the terminal device is governed by Section 25(2), no. 2 TDDDG.

No analytics or marketing services

When you explicitly switch language, a language cookie stores your choice. It provides your selected language and is not used for analytics or marketing.

We currently do not use analytics or marketing services such as Google Analytics or Meta Pixel on this website. There is therefore currently no consent banner for such services, and PersonalAusland does not set corresponding marketing cookies or initiate tracking requests.

Before any non-essential analytics or marketing services are activated in future, they must remain technically blocked until valid consent has been given. The Privacy Policy will then be updated with the providers, purposes, data and legal bases actually involved. Consent must be changeable or withdrawable at any time.

10. Your data protection rights

Subject to the statutory conditions, you have the right to access your personal data (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and objection to certain processing (Article 21 GDPR). You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing before withdrawal.

Under Article 77 GDPR, you also have the right to lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, place of work or the place of the alleged infringement. To exercise your rights, contact us at datenschutz@personalausland.de.

11. Data security

We take appropriate technical and organisational measures to protect personal data against loss, alteration and unauthorised access, taking the risk into account. These include restricted administration and employer areas, document access with permission checks, and security functions provided by the framework. Absolute protection cannot be guaranteed for data transmission or IT systems.