engineering-talents.com

Privacy Policy

This notice informs you about the nature, scope and purpose of the processing of personal data on engineering-talents.com in accordance with Art. 13, 14 GDPR.

For readability, German personal terms such as candidate, user or contact person are used in the masculine form. They apply equally to people of every gender.

1. Controller

The controller within the meaning of the GDPR is the Platform operator named in the Legal Notice.

2. What Data We Process

  • Registration data: email address, first and last name, selected role (company/candidate), password (stored encrypted). When registering/logging in via LinkedIn, Google or Microsoft, we instead receive your email address and name from the respective provider, see section 7.
  • Profile data (candidate role only; an applicant profile and, if you are looking for projects, a separate freelancer profile): intent (employment and/or freelance projects), salutation, phone number, title, job title, short profile, education, career stations with activities (each classified by activity, discipline, field of application and tool), development wish (visible only to you), availability, desired salary and notice period if you are seeking employment, in the freelancer profile a separate job title, separate profile text, hourly rate and visibility settings (including whether companies may see your profile as a preview before you express interest), location/postcode, profile photo, CV (PDF).
  • Job posting data (company role only): title, description, requirements (combinations of activity, discipline, application area and tool with minimum experience), location, duration, workload or employment type, contract type, career level, salary range, start date for permanent positions. If the function is active, the description is transmitted to the provider of the AI language model (Anthropic PBC, USA) to determine a suggestion for the requirements; please do not include personal data of third parties in the description.
  • Data on interest and match: for each posting and profile, who expressed interest and when, the optional short message, the match, decline or withdrawal with short feedback, expiry and, for companies, which user expressed the interest.
  • Usage data: hidden candidates and companies, internal marks and notes of a company on candidates or your own notes on postings, automatically calculated matching results, feedback entries (bug reports/feature requests).
  • Membership data (only if the paid ad-free membership is taken out): Stripe customer/subscription ID, subscription status, end of term. The actual payment data (card number, etc.) is processed exclusively by our payment provider Stripe, not by us (see Section 7).
  • Company membership data (companies only): plan, billing interval, Stripe customer/subscription ID, subscription status, end of term and whether it was cancelled. Billing address, VAT ID and payment data are collected and processed by Stripe (see Section 7); invoices are subject to statutory retention periods.
  • Data of a start phase request (companies only, only on request): company, name, email address, phone number, your message and the time and version of your consent. If we set up your company from it, we take over the company, name, email address and phone number as the contact person.
  • Public company page data (companies only, only at the company's request): company name, logo, location, website and the texts entered by the company. They are shown publicly together with the active postings and can be indexed by search engines. The company can deactivate the page at any time.
  • Consent log: time and version of your agreement to the terms, your acknowledgement of the privacy policy and your consent to AI processing (proof obligation, Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR). The entries are kept until your account is deleted; a withdrawal is recorded.
  • CV import data (candidates only, only on request): the uploaded PDF, the text extracted from it, the structured evaluation created from it (job title, positions with activities, education) and your answers to the AI's follow-up questions about your CV. Name, contact details, age, gender, marital status, origin and photo from the CV are not transferred to your profile.
  • Technical data: IP address and timestamp for every server request (server log files), cookies (see Section 6).

3. Purposes and Legal Bases of Processing

  • Providing the user account, profiles and job postings, and automatic matching: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures).
  • Email verification, password reset, protection against abuse (rate limiting): Art. 6(1)(f) GDPR (legitimate interest in secure operation).
  • Display of advertising (e.g. via Google AdSense), where we show advertising, and related cookies: Art. 6(1)(a) GDPR (consent via the cookie banner). Without your consent no data is transmitted to advertising partners for advertising purposes.
  • Processing feedback (bug reports/feature requests): Art. 6(1)(f) GDPR (legitimate interest in product improvement).
  • Processing the paid ad-free membership (payment processing via Stripe): Art. 6(1)(b) GDPR (performance of a contract).
  • Handling the company membership (payment processing via Stripe, automatic closing of postings when the membership ends, notices by email): Art. 6(1)(b) GDPR (performance of a contract).
  • Processing of start phase requests, setting up the company and personal support during the start phase (we create and change postings on your behalf via a separate 'Support' access; we log every use of this access with the name of the staff member): Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract).
  • Creating a profile suggestion from your CV with an AI language model: Art. 6(1)(a) GDPR (consent at upload, revocable at any time). No decision with legal effect is made solely by automated means: you review the suggestion and confirm your profile yourself.
  • Showing your profile to companies as a preview without name and contact details when you express interest or have made your profile available for suggestions: Art. 6(1)(a) GDPR (consent through the switch or by expressing interest after prior notice, revocable at any time with effect for the future).
  • Handling of interest and match, disclosure of names and contact details on a match and related e-mail notifications: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures); the disclosure on a match additionally Art. 6(1)(a) GDPR (consent by expressing interest after prior notice).

4. Sharing of Contact Details Between Users

The name, e-mail address, phone number, photo and CV of a candidate and the contact person of a company are never shown publicly and are not disclosed before a match. Only once both sides have expressed interest do the parties see this information (Section 5). The platform does not make contact itself; it asks both sides by e-mail to get in touch with each other.

5. Interest, match and release of contact details

Before a company learns your name and contact details, it sees your profile as a preview: job title, short profile, education, stations with activities, availability, location and the match with the posting, without name, contact details, profile photo and CV. Employer names, education and location appear in the preview, so a company, in particular your current employer, might recognise you. Before you express interest, we show you what the company sees; with 'Hide company' you exclude a company. Without your interest, companies only see your profile if you have made it available for suggestions to companies (default: off).

If both sides express interest, a match is created. The company then receives your name, e-mail address, phone number, photo and CV, and you receive the company's contact person. Users of a company only see the contact details with the corresponding permission from the company admin. From that point on, the company is an independent controller within the meaning of the GDPR for the data received; it confirms a data protection commitment statement beforehand.

With your interest you can send a short message of up to 1,000 characters, which the other side sees. An open interest expires after 30 days; you can withdraw it or decline a company's interest. We inform you by e-mail about interest, match, decline and expiry.

In companies with several users, users can mark profiles internally as interesting and create notes; only the users of that company see them. Only users with the corresponding permission express interest externally; the log records who expressed the interest.

Feedback on suggestions: If a suggestion does not fit in your view, you can voluntarily give us feedback (a reason, your own assessment in percent and optionally reasons to tick), also when hiding or declining. The feedback goes only to us, not to the other side, and has no consequence for the suggestion. We store it together with a snapshot of the assessment (requirements of the job posting, classified activities of the profile with duration and level, values per requirement), without names, contact details or CV, and use it to improve the matching for future cases. The legal basis is our legitimate interest in accurate suggestions (Art. 6(1)(f) GDPR). Please do not enter names or contact details in the reason.

6. Cookies

  • Technically necessary cookies (always set): login session, CSRF protection.
  • Advertising cookies (only with your consent in the cookie banner, where we show advertising): e.g. Google AdSense for displaying personalised or non-personalised advertising.

If we use services that require your consent (e.g. advertising via Google AdSense), we show a cookie banner. It is provided by a certified consent management provider (IAB Transparency & Consent Framework), which stores your decision in a cookie of its own and technically blocks advertising cookies and scripts until you have consented. Without your consent we do not load third-party advertising services. The access statistics count page views anonymously per calendar day, without IP address, identifier or profiling.

7. Recipients and Data Processing

  • Hosting and email delivery (registration/reset/reminder emails): Alfahosting GmbH, with whom a data processing agreement under Art. 28 GDPR is in place. Emails are sent directly via the hosting server, without a separate external email provider.
  • Provider of the cookie banner (certified consent management platform), where we use a banner: provides the banner and records your decision, see section 6.
  • Google AdSense (Google Ireland Limited), where we show advertising: data is transmitted, also to third countries, only with your consent in the cookie banner, see Google's privacy notices.
  • Payment processing for the ad-free membership and the company membership: Stripe Payments Europe, Limited. When you sign up, your email address and payment data are transmitted to Stripe; we do not store card data ourselves, only the customer/subscription ID and subscription status reported back by Stripe.
  • Review of positions: If you create or change a career position, its details (role, company, period, description and existing activities) are sent to the provider of the AI language model (Anthropic PBC, USA) to classify the activities, provided this function is active. If an activity cannot be classified reliably, the AI asks follow-up questions; your answers are sent to the same provider and deleted after the evaluation. Your name, contact details and other profile data are not sent.
  • CV evaluation: After we have removed your name, street, phone number, email address, links and details about date of birth, marital status and nationality using rules (individual details in running text, such as names of third parties, cannot be ruled out this way), the text extracted from your CV is transmitted for evaluation to the provider of the AI language model (Anthropic PBC, USA), exclusively with your consent at upload. According to its own statements, the provider automatically deletes inputs and outputs within 30 days, so deletion on its side may take place later than on ours.
  • Companies with which a match exists receive your name, contact details and documents, see Section 5. Before the match they only see the preview without name and contact details.
  • LinkedIn (LinkedIn Ireland Unlimited Company): only if you voluntarily register or log in via the 'With LinkedIn' button. LinkedIn provides us with your email address and name in this case, see LinkedIn's own privacy notices.
  • Google (Google Ireland Limited): only if you voluntarily register or log in via the 'With Google' button. Google provides us with your email address and name in this case, see Google's own privacy notices.
  • Microsoft (Microsoft Ireland Operations Limited): only if you voluntarily register or log in via the 'With Microsoft' button. Microsoft provides us with your email address and name in this case, see Microsoft's own privacy notices.

8. Retention Period and Deletion

  • We delete feedback on suggestions (section 5) 24 months after the last change. If you delete your account, your profile or the job posting before then, we remove the link to you; the feedback remains available for evaluation without personal reference until the period expires.
  • User accounts without a login are automatically paused after 12 months (visibility deactivated) and automatically reactivated upon the next login.
  • You can permanently delete your account at any time yourself via 'Delete account' in your account, including all profile, job posting and file data (including uploaded CVs).
  • Data disclosed to a company after a match (see Section 5) remains under its own responsibility and is not automatically deleted there when you delete your account with us. We delete your interests and matches together with your profile or account.
  • The uploaded CV, the text extracted from it, and the AI's follow-up questions with your answers and interim drafts are deleted as soon as you have confirmed your profile or discarded the import, at the latest 14 days after upload. The structured evaluation remains part of your profile until you delete your profile or account.
  • We delete start phase requests from which no company was set up, or whose company has been deleted, 6 months after receipt.
  • Feedback entries remain, for internal evaluation purposes, even after account deletion, without personal reference (the email association is removed).

9. Your Rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), as well as the right to object to processing (Art. 21) and to withdraw consent given, with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.

Contact for inquiries: see Legal Notice.

10. Data Security

Data is transmitted encrypted via TLS/HTTPS. Passwords are not stored in plain text.