Privacy Notice

1. General Information

1.1. Data Protection Controller

The controller is Introfy GmbH, Georgsplatz 1, 20099 Hamburg, Germany, info@introfy.app.

1.2. Legal Bases for the Processing of Personal Data

We process a person’s personal data (“data subject”) on the basis of the following legal grounds:

1.2.1. Consent of the Data Subject

Where we obtain the data subject’s consent for specific purposes, Art. 6 para. 1 sentence 1 lit. a GDPR is the legal basis.

1.2.2. Performance of Contractual Obligations

Where processing is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 sentence 1 lit. b GDPR is the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

1.2.3. Legal Requirements and Obligations

Where processing is necessary for compliance with a legal obligation to which we are subject, Art. 6 para. 1 sentence 1 lit. c GDPR is the legal basis.

1.2.4. Safeguarding Legitimate Interests

Where processing is necessary to safeguard our legitimate interest or that of a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, Art. 6 para. 1 sentence 1 lit. f GDPR is the legal basis.

1.3. Retention Period and Deletion of Personal Data

Personal data will be deleted or blocked as soon as there is no longer a legal basis for its processing.

1.4. Recipients of Personal Data

Internally, only those departments process personal data that require it to fulfill their processing purposes. This also applies to the processors, service providers, and vicarious agents we engage. All departments and individuals who work with personal data are bound to data secrecy and have been instructed to handle such data sensitively.

Personal data is only disclosed to third parties where this is in accordance with data protection regulations. In particular, individuals engaged to conduct our business operations (e.g., banks, tax advisors, and providers of EDP and IT services), as well as government agencies and authorities, may receive your personal data where this is necessary to fulfill a legal obligation.

1.5. Data Processing in Third Countries

Some of our services require our processors to process personal data in countries outside the EU/EEA (“third countries”). Where personal data is processed and the country does not provide a level of data protection equivalent to European standards, as confirmed by an adequacy decision adopted by the EU Commission pursuant to Art. 45 para. 3 GDPR, we have concluded EU Standard Contractual Clauses with the processors concerned to establish appropriate safeguards within the meaning of Art. 46 GDPR. A copy of the EU Standard Contractual Clauses can be found at https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:32021D0914&from=DE.

1.6. Data Subject Rights

The data subject has the following rights under the GDPR vis-à-vis us as the controller:

1.6.1. Right of Access

Pursuant to Art. 15 GDPR, the data subject has the right to request access to the personal data processed by us. In particular, the data subject may request the following information:

  • purposes of the processing,

  • categories of data,

  • categories of recipients to whom the personal data have been or will be disclosed, as well as information on whether the personal data are transferred to a third country or an international organisation (in this context, the data subject may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR),

  • intended storage period,

  • existence of a right to rectification, erasure, restriction of processing or objection,

  • existence of a right to lodge a complaint, the source of their data if these were not collected from us,

  • the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved, as well as the significance and intended consequences of such processing for the data subject.

1.6.2. Right to Rectification

Pursuant to Art. 16 GDPR, the data subject has the right to have personal data rectified and/or completed if they are inaccurate or incomplete.

1.6.3. Right to Restriction of Processing

Pursuant to Art. 18 GDPR, data subjects have the right to request restriction of the processing of their personal data where the accuracy of the personal data is contested by the data subject or the processing is unlawful.

If the processing has been restricted, we will inform the data subject before the restriction is lifted.

1.6.4. Right to Erasure

Pursuant to Art. 17 GDPR, data subjects have the right to have their personal data erased, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

1.6.5. Right to Notification

If the data subject has asserted the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom the personal data have been disclosed of the rectification, erasure of the personal data or restriction of processing, unless this proves impossible or involves disproportionate effort.

1.6.6. Right to Data Portability

Pursuant to Art. 20 GDPR, data subjects have the right to receive the personal data they have provided to us in a structured, commonly used and machine-readable format or to request that the data be transmitted to another controller.

1.6.7. Right to Object

Pursuant to Art. 21 GDPR, you have the right to object to processing where the processing is based on Art. 6(1)(1)(e) or (f) GDPR.

1.6.8. Right to Withdraw Consent Under Data Protection Law

Pursuant to Art. 7(3) GDPR, you have the right to withdraw your consent under data protection law at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent up to the time of withdrawal.

1.6.9. Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data.

2. Supplementary Information for the Website

We are responsible for our website introfy.app and its subpages (the “Website”). Personal data is processed when you use our Website.

2.1. Provision of the Website and Creation of Log Files

When our Website is accessed, we automatically collect data and information from the user’s device (so-called log files). This includes, in particular:

  • IP address

  • Date/time

  • Browser type

  • Internet service provider

  • Operating system of the device

2.1.1. Processor

To provide our Website, we use the services of Google Cloud EMEA Ltd., with which we have concluded a data processing agreement.

2.1.2. Processed Information & Processing Period

The log files store, in particular, information about the browser type and version used, the operating system of the end device, the user's internet service provider, the IP address of the end device, and the date and time of access to the website.

The log files are deleted within 30 days.

2.1.3. Purpose of Processing & Legal Basis

The data is required to display the website on the user's end device, ensure its functionality, and analyze any malfunctions. The data also helps us optimize the website and ensure the security of our information technology systems.

The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. Collecting log files is strictly necessary to operate the website. Consequently, users have no option to object.

2.2. Use of Strictly Necessary Cookies

We use strictly necessary cookies on our website to provide our website. Cookies are text files that are stored in or by the internet browser on the user's end device when they visit a website.

Each cookie contains a characteristic string of characters that enables the browser and the respective user's end device to be uniquely identified the next time the website is accessed. Details about the cookies can be found in the consent manager under the “Cookies” link in the footer of this website.

The legal basis for storing strictly necessary cookies is Section 25 para. 2 no. 2 TDDDG. The legal basis for processing the related personal data is Art. 6 para. 1 sentence 1 lit. f GDPR. The use of these cookies is strictly necessary for operating the website. Consequently, users have no option to object.

2.3. Marketing

We use marketing tools on our website that use so-called pixels (“Meta Pixel”).

2.3.1. Joint Controllership & Processing in Third Countries

The Meta Pixel we use is provided by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), a subsidiary of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA, which acts as a joint controller with us. The key information regarding the agreement on joint controllership between Meta and us can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data

Meta may process personal data through Meta Platforms, Inc. in the USA. In this case, the processing is carried out on the basis of an adequacy decision by the EU Commission in conjunction with the certification of Meta Platforms, Inc. under the Data Privacy Framework (Art. 45 GDPR).

2.3.2. Information Processed & Processing Duration

After consent has been given to use the Meta Pixel, the following data, among others, is transmitted to Meta:

  • pages or URLs accessed

  • achievement of “website goals” (e.g. contact requests, newsletter subscriptions)

  • internet connection data (IP address, date/time)

  • technical information such as browser, end device and screen resolution

  • randomly generated user ID

  • randomly generated ad click ID if you arrived at our website via an advertisement

2.3.3. Purpose & Legal Basis

The use of the Meta Pixel enables us to measure the success achieved by Facebook advertising campaigns, retarget visitors to our website with advertising on Facebook and Instagram, and personalize advertising based on previous page visits.

The processing is based on the user’s consent, which can be given when visiting the website for the first time and can be withdrawn at any time. The consent covers, firstly, the storage of and access to information on the user’s device pursuant to Section 25 (1) TDDDG and, secondly, the processing of the personal data generated in this process for marketing purposes pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. Further information about the Meta Pixel and the option to withdraw consent can be found in the consent manager under the “Cookies” link in the footer of this website.

3. Additional Information on Platform Use

We offer a platform for the mutual placement of candidates and employers (collectively, “users”). While the provision of profile details and other user content is the respective user’s responsibility, we also process personal data under our own responsibility. The following section addresses these latter processing activities:

3.1. Registration, Verification and Login as a Candidate

3.1.1. Processed Information & Processing Period

As part of registration, verification of your identity and subsequent login, we may process the following personal data insofar as you provide it to us:

  • First name

  • Last name

  • Email address

  • Phone number

  • Password

The personal data will be deleted when the user agreement ends due to termination, when you delete your account with us, and provided that no further statutory retention periods apply to the data.

Note: We process other personal data that you have entered in your account, such as title, gender, date of birth, place of birth, street and house number, address supplement, postal code, city, federal state, country, nationalities, profile picture, short biography, preferred type of employment, language skills, interests and hobbies, skills, certificates, other CV information, short introduction videos and similar user content solely on your behalf. As the user, you therefore also decide the extent to which employers can access this content by publishing it on the platform, deleting it again, or setting the profile to “inactive”.

3.1.2. Purpose & Legal Basis

The personal data is processed to fulfill our contractual obligations on the basis of the user agreement concluded with you (Art. 6 para. 1 sentence 1 lit. b GDPR).

3.2. Registration, Verification and Login as an Employer

3.2.1. Processed Information & Processing Period

As part of registration, company verification and subsequent login, we may process the following personal data insofar as you provide it to us:

  • Contact details of the company's contact person.

The personal data will be deleted when the usage agreement ends due to termination, when the company deletes its account with us, and provided that no further statutory retention periods apply to the data.

We process additional user content stored in the employer account by the account holder exclusively on their behalf.

3.2.2. Purpose & Legal Basis

The personal data is processed to fulfill our contractual obligations on the basis of the usage agreement concluded with you (Art. 6 para. 1 sentence 1 lit. b GDPR). If an employee's personal data is processed for the aforementioned purpose, the processing is based on our overriding legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, as this data is required in order to offer our services to the employer.

4. Additional Information on Communication with Us

The following information applies to all communication with us.

When contacting us, the personal data of the person making the inquiry, which they provide directly or communicate to us via the respective communication channel, is processed by us exclusively for the purpose of handling the inquiry and in case of follow-up questions. If the communication is aimed at concluding a contract, the legal basis for processing is Art. 6 para. 1 sentence 1 lit. b GDPR. In all other cases, Art. 6 para. 1 sentence 1 lit. f GDPR is the legal basis. The interests of the person making the inquiry do not outweigh our interest in responding to the inquiry; since the person making the inquiry contacts us, responding is also in their interest, and they are aware that we must process their personal data in order to respond to their inquiry. Personal data will be deleted as soon as the matter for which contact was made has been resolved and there is no longer a legal basis for processing.

If communication takes place via WhatsApp, please note that the provider of the interface (API) we use is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“WhatsApp”), which provides the communication conducted via this service as a telecommunications service provider. With regard to data protection at WhatsApp, please refer to its privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea

5. Supplementary Information for Contractual Partners

The following information also applies where a contractual relationship exists.

The specific personal data processed depends on the tasks involved in the contractual relationship. We use personal data exclusively for the purpose for which it was provided to us. This may include, for example, personal details (name, address and other contact details, date and place of birth). It may also include order data (e.g. payment orders), data arising from the performance of our contractual obligations (e.g. transaction data relating to payment processing), information about your financial situation (e.g. creditworthiness data), advertising and sales data, and other data comparable to the categories mentioned above.

Personal data will be deleted as soon as the contractual relationship has ended, provided that there is no other reason for processing. The processing is primarily carried out for the purpose of establishing and performing the contractual relationship; the legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

In addition, we also process personal data in part on the basis of our legitimate interest, namely for the purpose of managing contacts and communications, conducting efficiency checks, managing contracts and projects, and ensuring the operation of information and telecommunications systems. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR.

Furthermore, as a company, we are subject to various legal obligations that must be complied with under applicable laws and regulations. Where processing is carried out to fulfill statutory requirements and obligations, the legal basis is Art. 6 para. 1 sentence 1 lit. c GDPR. These include, in particular, statutory tax retention obligations.