Privacy Policy
1. General Information
1.1. Data Protection Officer
The responsible party is Introfy GmbH, Essener Str. 88c, 22419 Hamburg, Germany, info@introfy.app.
1.2. Legal Basis for the Processing of Personal Data
We process personal data of an individual ("data subject") based on the following legal grounds:
1.2.1. Consent of the Data Subject
Insofar as we obtain consent from the data subject for certain purposes, Art. 6 para. 1 sentence 1 lit. a GDPR is the legal basis.
1.2.2. Fulfillment of Contractual Obligations
Insofar as the processing is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.
1.2.3. Legal Requirements and Obligations
Insofar as the processing is necessary for compliance with a legal obligation to which we are subject, Article 6(1) Sentence 1 lit. c GDPR is the legal basis.
1.2.4. Protection of Legitimate Interests
Insofar as the processing is necessary for the protection of our legitimate interests or those of a third party, and the interests, fundamental rights, and freedoms of the data subject do not override the aforementioned interest, Article 6(1)(1)(f) GDPR serves as the legal basis.
1.3. Storage Duration and Deletion of Personal Data
The personal data will be deleted or blocked as soon as there is no longer any legal basis for processing.
1.4. Recipient of Personal Data
Internally, only the departments that need personal data to fulfill their processing purposes handle such data. This also applies to the processors, service providers, and agents we use. All departments and individuals working with personal data are obligated to maintain data confidentiality and are instructed on the sensitive handling of such data.
Personal data will only be shared with third parties if it complies with data protection regulations. In particular, individuals employed to carry out our business operations (e.g., banks, tax advisors, IT and computing service providers) as well as government bodies/agencies may receive your personal data if it is necessary to fulfill a legal obligation.
1.5. Data Processing in Third Countries
In some cases, our services require the processing of personal data in countries outside the EU/EEA ("third countries") by our processors. If personal data is processed and there is no level of data protection in the country equivalent to the European standard, as confirmed by an adequacy decision according to Art. 45(3) GDPR by the EU Commission, we have concluded EU Standard Contractual Clauses with the affected processors to establish appropriate safeguards in accordance with Art. 46 GDPR. A copy of the EU Standard Contractual Clauses can be found at https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN.
1.6. Rights of Affected Persons
The data subject has the following rights under the GDPR against us as the data controller:
1.6.1. Right of Access
According to Art. 15 GDPR, there is the right to request information about the personal data we process. In particular, the data subject can request the following information:
• Processing Purposes
• Categories of Data,
• Categories of Recipients to Whom the Personal Data Have Been or Will Be Disclosed, as Well as Information on Whether the Personal Data Are Transferred to a Third Country or an International Organization (In This Context, the Data Subject May Request Information on the Appropriate Safeguards in Accordance with Art. 46 GDPR).
• Planned Retention Period
• Existence of a Right to Rectification, Erasure, Restriction of Processing, or Objection
• Existence of a Right to Complain, the Origin of Your Data, if It Was Not Collected by Us,
• Any existence of automated decision-making, including profiling, as per Art. 22 (1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved as well as the significance and intended effects of such processing for the data subject may be required.
1.6.2. Right to Rectification
According to Art. 16 GDPR, there is a right to rectification and/or completion of personal data if it is incorrect or incomplete.
1.6.3. Right to Restriction of Processing
According to Article 18 of the GDPR, there is the right to request the restriction of the processing of personal data if the accuracy of the personal data is contested by the data subject or if the processing is unlawful.
If the restriction of processing has been lifted, the affected person will be informed by us before the restriction is removed.
1.6.4. Right to Erasure
According to Article 17 of the GDPR, there is the right to erasure of personal data unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.
1.6.5. Right to Information
If the data subject has exercised the right to rectification, erasure, or restriction of processing with us, we are obliged to inform all recipients to whom the personal data have been disclosed about the rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort.
1.6.6. Right to Data Portability
According to Art. 20 GDPR, there is a right to receive the personal data that the data subject has provided to us in a structured, commonly used, and machine-readable format, or to request the transmission to another controller.
1.6.7. Right to Object
According to Art. 21 GDPR, there is the right to object to processing if the processing is based on Art. 6 Para. 1 Sent. 1 lit. e or lit. f GDPR.
1.6.8. Right to Withdraw Consent to Data Protection Declaration
According to Article 7(3) of the GDPR, there is a right to withdraw the data protection consent declaration at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
1.6.9. Right to Lodge a Complaint with a Supervisory Authority
According to Art. 77 GDPR, there is the right to lodge a complaint with a data protection supervisory authority about our processing of personal data.
2. Additional Notes for the Website
We are responsible for our website introfy.app as well as its subpages ("website"). Personal data is processed through the use of our website.
2.1. Website Provision and Logfile Creation
When accessing our website, we automatically collect data and information from the user's device (so-called log files). This specifically includes:
• IP Address
• Date/Time
• Browser Type
• Internet Service Provider
• Operating System of the Terminal Device
2.1.1. Data Processor
To provide our website, we use the services of Google Cloud EMEA Ltd., with whom we have concluded a data processing agreement.
2.1.2. Processed Information & Duration of Processing
In the log files, information about the browser type and version used, the operating system of the device, the internet service provider of the user, the IP address of the device, as well as date and time of access to the website are stored.
The log files are deleted within 30 days.
2.1.3. Purpose of Processing & Legal Basis
The data is required to display the website on the user's device, ensure its functionality, and analyze any disruptions. Additionally, the data helps us optimize the website and ensure the security of our information technology systems.
The legal basis is Art. 6(1) sentence 1 lit. f GDPR. The collection of log files is essential for the operation of the website. Consequently, the user has no right to object.
2.2. Use of Strictly Necessary Cookies
We use strictly necessary cookies on our website to provide our website. Cookies are text files that are stored on or by the internet browser on the user's device system when visiting a website.
Each cookie contains a unique character string that allows the browser and thus the respective user device to be uniquely identified the next time the website is accessed. Details about the cookies can be found in the consent manager under the "Cookies" link in the footer of this website.
The legal basis for storing the strictly necessary cookies is § 25 para. 2 no. 2 TDDDG. The legal basis for the processing of the related personal data is Art. 6 para. 1 sentence 1 lit. f GDPR. The use of these cookies is absolutely necessary for the operation of the website. Therefore, there is no option for the user to object.
2.3. Marketing
We use marketing tools on our website that utilize so-called pixels ("Meta-Pixel").
2.3.1. Joint Responsibility & Third Country Processing
The Meta Pixel we use is offered by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"), a subsidiary of Meta Platforms Inc., 1601 Willow Road, Menlo Park, CA 94025, USA, which acts as a joint controller with us. The essential information on the agreement between Meta and us regarding joint responsibility can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data
It is possible that Meta processes personal data at Meta Platforms, Inc., in the USA. In this case, the processing is based on an adequacy decision by the EU Commission in connection with the certification of Meta Platforms, Inc., under the Data Privacy Framework (Art. 45 GDPR).
2.3.2. Process Information & Duration of Processing
After consent to use the Meta Pixel, the following data, among others, is transmitted to Meta:
• Pages or URLs Accessed
• The Achievement of "Website Goals" (e.g., Contact Inquiries, Newsletter Sign-ups)
• Internet Connection Data (IP Address, Date/Time)
• Technical Information Such as Browser, Device, and Screen Resolution
• Randomly Generated User ID
• Randomly Generated Ad Click ID, If You Came to Our Website Through an Advertisement
2.3.3. Purpose & Legal Basis
The use of the Meta Pixel enables us to measure the success of Facebook advertising campaigns, retarget visitors of our website with ads on Facebook and Instagram, and personalize ads based on previous page visits.
The processing is based on the user's consent, which can be given upon first visiting the website and can be revoked at any time. The consent includes, on the one hand, the storing and retrieving of information on the user's device according to § 25 para. 1 TDDDG, and on the other hand, the processing of the resulting personal data for marketing purposes according to Art. 6 para. 1 sentence 1 lit. a GDPR. Further information on the Meta Pixel and the possibility to revoke consent can be found in the consent manager under the link "Cookies" in the footer of this website.
3. Additional Notes on Platform Usage
We offer a platform for the mutual mediation of candidates and employers (together referred to as "users"). While providing profile information and other user content is done under the respective individual responsibility, we also process personal data under our own responsibility. We refer to the latter processing operations below:
3.1. Registration, Verification, and Login as a Candidate
3.1.1. Processed Information & Duration of Processing
As part of the registration, verification of your identity, and subsequent login, the following personal data can be processed by us, provided that you make it available to us:
• First Name
• Last Name
• Email Address
• Telephone Number
• Password
The personal data will be deleted when the user agreement ends due to termination, you delete your account with us, and provided that there are no further statutory retention periods for the data.
Note: Further personal data stored in your account by you, such as title, gender, date of birth, place of birth, street and house number, address additional information, postal code, city, state, country, nationalities, profile picture, short biography, preferred type of employment, language skills, interests and hobbies, skills, certificates, other resume information, short introduction videos and similar user content, are processed by us solely on your behalf. As such, you as the user also decide to what extent employers can gain knowledge of these contents by publishing them on the platform, deleting them, or setting the profile to "inactive."
3.1.2. Purpose & Legal Basis
The processing of personal data is carried out to fulfill our contractual obligations based on the user agreement concluded with you (Art. 6 para. 1 sentence 1 lit. b GDPR).
3.2. Registration, Verification and Login as Employer
3.2.1. Processed Information & Duration of Processing
As part of the registration, company verification, and subsequent login, the following personal data may be processed by us, provided that you provide it to us:
• Contact Information of the Company's Point of Contact.
The personal data will be deleted when the user agreement ends due to termination, the company deletes the account with us, and there are no further statutory retention periods for the data.
We process additional user content stored in the employer account by the account holder exclusively on their behalf.
3.2.2. Purpose & Legal Basis
The processing of personal data is carried out to fulfill our contractual obligations based on the user agreement concluded with you (Article 6(1)(b) GDPR). Insofar as personal data of an employee is processed for the stated purpose, the processing is based on our overriding legitimate interest pursuant to Article 6(1)(f) GDPR, as this data is necessary to offer our services to the employer.
4. Supplementary Notes for Communication with Us
The following notes apply to all communication with us.
When contacting us, the personal data of the inquirer, which they provide directly or are communicated to us through the respective communication channel, is processed solely for the purpose of handling the inquiry and in case of follow-up questions. If the communication aims at the conclusion of a contract, the legal basis for processing is Art. 6 para. 1 sentence 1 lit. b GDPR. In all other cases, Art. 6 para. 1 sentence 1 lit. f GDPR is the legal basis. The interest of the inquirer does not outweigh our interest in responding to the inquiry; since the inquirer contacts us, a response is also in their interest, and the inquirer is aware that we must process their personal data to respond to their inquiry.
The deletion of personal data occurs as soon as the purpose for contacting is resolved and there is no longer any legal basis for processing.
5. Supplementary Notes for Contractual Partners
Additionally, the following notes apply if a contractual relationship exists.
5.1. Right to Lodge a Complaint with a Supervisory Authority
Which specific personal data is processed depends on the tasks within the contractual relationship. We use personal data exclusively for the purpose for which it was provided to us. These include personal details (name, address and other contact details, date and place of birth). Furthermore, this may also include order data (e.g., payment order), data from the fulfillment of our contractual obligations (e.g., transaction data in payment processing), information about your financial situation (e.g., creditworthiness data), advertising and sales data, as well as other data comparable to the aforementioned categories.
The personal data will be deleted as soon as the contractual relationship has ended and provided there is no other reason for processing.
5.2. Right to Lodge a Complaint with a Supervisory Authority
The processing is mainly carried out for the purpose of establishing and conducting the contractual relationship; the legal basis is Article 6 Paragraph 1 Sentence 1 Letter b of the GDPR.
In addition, we also process personal data based on our legitimate interest, namely for the purposes of contact and communication management, economic control, contract and project management, as well as ensuring the operation of information and telecommunication systems. The legal basis is Article 6(1) sentence 1 lit. f GDPR.
Furthermore, as a company, we are bound by various legal obligations that must be adhered to under applicable laws and regulations. The legal basis for processing to fulfill statutory requirements and obligations is Article 6 (1) sentence 1 lit. c GDPR. This includes, in particular, tax law retention obligations.