Privacy notice

1. Data controller

The data controller for this website and initial enquiries is:

2. Scope of this notice

This notice covers visits to our website and initial enquiries from applicants and businesses by email, telephone or WhatsApp. Our website has no application or contact form and does not offer user accounts.

3. Website hosting by Netlify

Our static website is delivered via Netlify, Inc. (USA). When you access the site, technical data may be processed as necessary for delivery and security, including your IP address, date and time, requested file or page, HTTP status, amount of transferred data, browser and device information, and possible referrer data.

The purpose is reliable, secure website delivery, fault diagnosis and protection from attacks; legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure website). Recipients include Netlify and its technical subprocessors. Netlify provides processing terms (DPA) for its services. We do not maintain a visitor database or independently define Netlify's server-log retention. The host's applicable operational and security rules govern its technical logs; we do not publish an unverified number of retention days.

As Netlify is a US provider, data may be processed in the United States or other countries. Netlify states that it is certified under the EU-US Data Privacy Framework, with additional contractual safeguards as applicable. Details: Netlify privacy policy and Netlify DPA.

Netlify DPA: https://www.netlify.com/pdf/netlify-dpa.pdf · Unterauftragsverarbeiter: https://www.netlify.com/trust-center/

4. Domain and email by STRATO

Our domain and business email account are provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you contact us by email, we process your sender address, message, timestamps and any details you choose to provide in order to respond. The legal bases are Art. 6(1)(b) GDPR for pre-contractual or contractual enquiries, or Art. 6(1)(f) GDPR for general enquiries; Art. 6(1)(c) may apply to statutory records retention. STRATO privacy policy.

5. Telephone enquiries

When you call us, we may process your number and the information you share in order to respond. Our website does not record calls. The legal basis is Art. 6(1)(b) or (f) GDPR, depending on the request.

6. WhatsApp

We provide only a direct link to WhatsApp, not an embedded chat widget. Data is not sent to WhatsApp by a widget on our site. When you choose to follow the link, WhatsApp may process technical and personal information under its own terms. For users in the EEA, WhatsApp Ireland Limited generally provides the service, and other Meta group companies may be involved.

If you choose to message us on WhatsApp, we process your phone number, profile data (where visible), message content and related communication details to respond (Art. 6(1)(b) or (f) GDPR). Please do not send identity documents, health information or other sensitive files. You can contact us by email or phone instead. International transfers by WhatsApp may occur. WhatsApp privacy information.

7. Applicant enquiries and onward introductions

When you contact us about work, we initially process only the details you provide, such as your contact information, profession, experience, language skills and professional goals. You do not have to provide a full CV or documents in your first message. We will discuss any further information separately if needed.

We use this information to respond to your enquiry, assess possible introductions and coordinate an initial conversation, relying on Art. 6(1)(b) or (f) GDPR as appropriate. We do not automatically distribute your personal data across a network of businesses. Before any specific onward disclosure, we identify the intended recipient, explain the purpose and obtain your approval for that disclosure. Recipient categories may include employers, recruitment agencies or specialist cooperation partners; there is no static public list of individual partners.

Where disclosure relies on consent under Art. 6(1)(a) GDPR, you can withdraw it at any time with future effect. Once data is lawfully disclosed, the recipient may act as an independent controller and provide its own privacy information. If an introduction involves transferring personal data outside the EU/EEA (such as to Türkiye), we separately assess and communicate the applicable GDPR Chapter V transfer mechanism, including adequate safeguards where required. We do not treat exceptional derogations as a routine transfer mechanism.

We do not make solely automated hiring decisions or engage in profiling within the meaning of Art. 22 GDPR.

8. Business contacts

When businesses approach us, we process professional contact details, business information and the content of the enquiry to assess possible cooperation and coordinate introductions (Art. 6(1)(b) and (f) GDPR). Sharing identifiable contact details requires an appropriate legal basis and transparent information for the people concerned.

9. Retention and deletion

We retain personal data only while necessary for the relevant enquiry, possible introduction or business relationship. When the matter is completed and no other lawful purpose remains, data no longer needed will be deleted. Statutory records retention and the establishment, exercise or defence of legal claims may justify longer retention. We do not publish invented fixed retention periods. Deletion of data held by external service providers is additionally subject to their own operational and legal requirements.

10. Cookies and analytics

Our static website does not contain a contact or application form, externally loaded fonts, embedded social media widgets or maps, advertising pixels or any analytics tool configured by us. We do not use optional marketing cookies or behavioural tracking. If you actively visit an external linked service, that provider's policies may apply.

11. Your rights

Subject to applicable GDPR requirements, you may request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and object to processing based on legitimate interests (Art. 21). Consent may be withdrawn at any time with future effect (Art. 7(3)). Please contact info@cs-vermittlung.de to exercise your rights.

12. Right to complain

Under Art. 77 GDPR, you may complain to a supervisory authority. The local authority in Hesse is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany. Complaint information.

13. Required data and updates

Providing personal data through our website is voluntary. However, we may be unable to respond without a contact method and the essential details of your enquiry. This notice will be updated if our services, data handling or legal obligations change.