Privacy policy
Information pursuant to Art. 13 GDPR
Version 1.1 · As of 2026-10-26
1. Controller
Enrico Kaldasch for Enrico Kaldasch & Pornvilai Kaldasch GbR, Ackerstraße 19, 04910 Elsterwerda, Deutschland, info@hospitly-international.de.
2. Data protection officer
A data protection officer is not legally required (micro-enterprise) and has not been appointed.
3. Hosting, auth & backend
We operate the website and application on a virtual server provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin (processor under Art. 28 GDPR, server located in Germany); there we process in particular server logs for operational and security purposes (Art. 6(1)(f) GDPR). Database, authentication and file storage run via Supabase (region eu-central-1, Frankfurt/EU), likewise under a data-processing agreement (Art. 28 GDPR). System emails are sent via the SMTP service of STRATO GmbH. Images are served locally from our own server (image source: Pexels).
4. Third-country transfer
The backend is in the EU; there is no planned transfer to third countries. Exception: if you start the international partner search, we transmit data to Careerjet in the United Kingdom, for which an adequacy decision of the European Commission exists (section 7). As the provider (Supabase) belongs to a US parent company, a residual access path to the US cannot be fully excluded; the EU Standard Contractual Clauses serve as a safeguard (Art. 46 GDPR). If you apply to an employer outside the EU (e.g. Gulf states), your application data is transferred there — only after your explicit consent at the application step (Art. 49(1)(a) GDPR).
5. What data & legal bases
Registration/login (Art. 6(1)(b)), profile/usage data (b, optionally a), applications/saved jobs (b), employer listings (b), system emails (b). For paid employer services, additionally tax retention (c).
6. AI-assisted CV parsing
If you upload a CV as a candidate, you can optionally have it parsed automatically to pre-fill your profile. Parsing runs exclusively on our own server using a self-hosted language model — no data is transferred to any external AI or cloud service. The information contained in the document is processed (incl. name, contact details, education, work experience). The legal basis is your consent (Art. 6(1)(a) GDPR); the suggestions are only applied to and stored in your profile once you confirm them. This does not involve any automated decision with legal effect within the meaning of Art. 22 GDPR.
7. Partner job search (external sources)
On the job pages we show job ads from external job portals alongside our own listings; each of these ads carries the name of its source. (1) Adzuna: on the job pages our server automatically loads ads from Adzuna (Adzuna Ltd). The query contains only your search details (keyword, place, radius, country), but not your IP address, not your browser identifier and no other details that could identify you; Adzuna does not receive any personal data about you from us. (2) Careerjet, only after your click: if you click “Start international partner search”, we additionally query the job search of Careerjet. The recipient is Careerjet Ltd, Fairfax House, 461–465 North End Road, London SW6 1NZ, United Kingdom. Careerjet only answers a query if it contains the details of the person who triggered it. Our server therefore transmits to Careerjet: your IP address, your browser identifier (user agent), the start address of our website, and the keyword, place and country of the search. The partner search stays switched on until you reload the page or leave the job search; until then, every further search, every filter change and every move to another results page triggers a new query with these details. Without your click, Careerjet receives no data from us. We transmit the data in order to show you, at your request, additional job offers, including international ones. We also have an economic interest: we take part in the partner programme of Careerjet, which pays partner websites for the visitors they refer. The legal basis is our legitimate interest in these purposes (Art. 6(1)(f) GDPR). The United Kingdom is a third country; the European Commission has found that it ensures an adequate level of data protection (adequacy decision under Art. 45 GDPR, Implementing Decision (EU) 2021/1772, extended until 27 December 2031 by Implementing Decision (EU) 2025/2574). We base the transfer on this decision. Careerjet is responsible for any further processing at Careerjet, including how long the data is kept; details are in the privacy policy of Careerjet (careerjet.com/privacy-policy). Right to object: you may object to this transfer at any time (Art. 21 GDPR), informally to info@hospitly-international.de. The simplest way is not to start the partner search, or to reload the page; then no further data goes to Careerjet. (3) Clicking an ad: if you open a partner ad or a source label, your browser calls up the page of the respective provider. From then on, that provider processes your connection data under its own responsibility and its own privacy policy. (4) Saved jobs: if you save a partner ad, we store its title, company, place, salary information, date, source and link only in the storage of your browser (localStorage). This information does not leave your device. You remove it by tapping the save icon again or by deleting the site data in your browser (§ 25(2) no. 2 TDDDG). (5) Our server: all of these queries run through our server (see section 3). To prevent misuse, it limits the number of queries per IP address and for this purpose keeps the IP address only in working memory, not on a storage medium: in the partner service for at most one minute, in the web server in front of it until newer queries displace the entry, at the latest until that web server restarts. We do not store search results (real-time query).
8. Retention
Account data until account deletion; backups expire on a rolling basis. Invoice/tax data up to 10 years (§ 147 AO, § 257 HGB). Server logs are deleted after 7 days.
9. Your rights & supervisory authority
Access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR); consents can be withdrawn at any time with future effect. Right to lodge a complaint with the competent supervisory authority: the Data Protection Commissioner of Brandenburg (LDA Brandenburg).
10. Cookies & tracking
We do not use tracking, analytics or advertising cookies; only technically necessary session/login cookies (§ 25(2) TDDDG). No automated decision-making within the meaning of Art. 22 GDPR takes place.