Data protection

We are delighted by your interest in our company. Data protection is of particular importance to the management of friends & you GmbH. Use of the friends & you GmbH website is generally possible without providing any personal data. However, if a data subject wishes to use special services offered by our company via our website (registration and use of the job portal), the processing of personal data becomes necessary. Data protection is particularly important when publishing applicant data on the internet. When actively using our portal, i.e., when submitting your data to us for publication, you should always be aware that your data may then be accessible worldwide. Protecting your privacy is of utmost importance to us. With this privacy policy, our company would like to inform the public about the nature, scope, and purpose of the personal data we collect, use, and process. Furthermore, this privacy policy informs data subjects about their rights.

1. General 1.1 What is personal data? Personal data is information that reveals or can reveal the identity of the user. We adhere to the principle of data minimization. The collection of personal data is avoided as far as possible.

1.2 Handling of Personal Data

Personal data is used exclusively for the establishment, content-related structuring, execution, or processing of the contractual relationship (Art. 6 I S. 1 b GDPR).

Furthermore, personal data is only processed if we have received your consent to do so (Art. 6 I S. 1 a GDPR) or if it concerns data whose processing is necessary for our legitimate interests and if the balancing of interests shows that no overriding interests, fundamental rights, or freedoms on your part conflict with this (Art. 6 I S. 1 f GDPR).

We may use processors to process your personal data, with whom we have concluded a data processing agreement where necessary. However, we will generally not disclose personal data to third parties beyond this.

For processing payments, the necessary payment data is transmitted to the [payment provider/company name] with whom the [payment provider/company] is located. Payment details are forwarded to the commissioned credit institution and, if applicable, to the commissioned and selected payment service provider.

Your personal data is processed within the EU and in countries deemed safe or adequate by the EU. Should personal data be processed in the USA, we ensure that the services we use are certified under the "Data Privacy Framework".

1.3 Usage Data

When you visit the website, general technical information is collected. This includes the IP address used, the time and duration of the visit, the browser type, and, if applicable, the referring website. This usage data is automatically recorded in a log file and may be used and stored for the purpose of statistical analysis of this website.

This usage data will not be linked to your other personal data.

1.4 Storage Period

We store your personal data after the purpose for which it was collected has been fulfilled only as long as required by law (especially tax law).

Specifically, the following retention periods apply, for example:

Type of Data	Retention Period
Tax Data	10 years
Commercial or business correspondence (including emails and faxes) and other documents, insofar as they are relevant for taxation.	6 years from the end of the calendar year in which the last entry was made in the books, the inventory, the opening balance sheet, the annual financial statements or the management report was prepared, the commercial or business letter was received or sent, or the accounting document was created, and furthermore, the record was made or the other documents were created.
Transaction and Registration Data	10 years from the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance sheet, the annual financial statements or the management report was prepared, the commercial or business letter was received or sent, or the accounting document was created, and furthermore, the record was made or the other documents were created.
Data Protection Consent for Data Processing	For the duration of the possibility of asserting rights by the data subject.
(Electronic) Correspondence that has no tax relevance	For as long as this is necessary for the performance of the task, unless because the processing serves the purpose of establishing, exercising, or defending legal claims.
Usage data according to section 1.3 of this privacy policy	max. 30 days

2. Your Rights 2.1 Right of Access You can request information from us as to whether we process personal data concerning you. If so, you have the right to access this personal data and the further information specified in Article 15 of the GDPR. 2.2 Right to Rectification You have the right to rectification of inaccurate personal data concerning you and, in accordance with Article 16 of the GDPR, you can request the completion of incomplete personal data. 2.3 Right to Erasure You have the right to request that we erase personal data concerning you without undue delay. We are obligated to delete this data immediately, especially if one of the following grounds applies: Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed. You withdraw your consent on which the processing of your data was based, and there is no other legal basis for the processing. Your data has been processed unlawfully. The right to erasure does not apply insofar as your personal data is necessary for the establishment, exercise, or defense of our legal claims. 2.4 Right to Restriction of Processing You have the right to request that we restrict the processing of your personal data if: You contest the accuracy of the data and we are therefore verifying its accuracy; the processing is unlawful and you have the right to object to the processing. Refuse erasure and request restriction of use instead

we no longer need the data, but you require it for the establishment, exercise, or defense of legal claims,

you have objected to the processing of your data, and it is not yet clear whether our legitimate grounds override your grounds.

2.5 Right to Data Portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us, provided that the processing is based on consent or a contract and the processing is carried out by automated means.

2.6 Right to Withdraw Consent and Right to Object

Where the processing of your personal data is based on consent (Art. 6 para. 1 a GDPR), you have the right You may withdraw this consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.

If the processing of your personal data is based on Article 6(1)(e) GDPR or Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object at any time to the processing of personal data concerning you on grounds relating to your particular situation. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims.

2.7 General Information and Right to Lodge a Complaint

Exercising your above rights is generally free of charge for you.

You have the right to lodge a complaint directly with the supervisory authority responsible for us, the State Data Protection Commissioner.

3. Data Security

3.1 Data Security

All data on our website is protected against loss, destruction, access, alteration, and distribution by technical and organizational measures.

3.2 Sessions and Cookies

We use cookies and server-side sessions to operate our website, in which data can be stored. We only use cookies and server-side sessions that are technically necessary for the operation of this website (e.g., spam protection for the contact form, shopping cart function) and where, after careful consideration, it has been determined that there are no overriding legitimate interests on your part that would preclude this (Art. 6 para. 1 sentence 1 lit. f GDPR).

4. Newsletter

When you subscribe to our newsletter, we use the data required for this purpose or data you have separately provided to send you our email newsletter regularly based on your consent pursuant to Art. 6 Para. 1 Sentence 1 a GDPR.

You can unsubscribe from the newsletter at any time by sending us a message using the contact details provided in the legal notice or by using the unsubscribe link in the newsletter. After unsubscribing, we will delete your email address unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes permitted by law, about which we inform you in this privacy policy.

5. Applications

5.1 Registration on our website

You have the option of registering on our website by providing personal data. We collect your email address, a username, and a password based on Art. 6 Para. 1 Sentence 1 a GDPR. Our portal is not intended for persons under 16 years of age.

5.2 Further Data Entry

Further data can then be entered in the user profile. The specific personal data transmitted to us is determined by the respective input form. The voluntary provision of further personal data allows us to offer you content or services that, by their very nature, can only be offered to registered users. Registered users have the option to modify the personal data provided during registration at any time or to have it completely deleted from our database.

The following data, if you provide it, will be processed by us and stored by our hosting provider in Hamburg. This includes both data that we receive directly from you and information that you publish or send on the portal.

There are both mandatory fields (marked as such) and optional fields.

Applicant Account:

• Login data (username and password)
• Contact information such as title, name, email address, postal address, and telephone number
• Your CV, including professional experience, education, training, and details of your job search
• Application photos and certificates
• Profiling data
• Job suggestions, saved job postings, application activity
• Entries from the portal's calendar and address book

Employer Account:

• Login data (username and password)
• Contact information such as title, name, email address, postal address, and Telephone number
• Company information such as company name, company size, business sector
• Company logo
• Your job postings
• Entries from the portal's calendar and address book

Consultant account:

• Access data (username and password)
• Contact information such as title, name, email address, company name, postal address, and telephone number
• Entries from the portal's calendar and address book

The personal data you enter will be processed exclusively for the purpose for which it was collected. Within the context of your profile, the legal basis for processing your data is Art. 6 para. 1 sentence 1 b GDPR.

You can access, review, correct, update, or delete your CV or profile at any time by logging into the portal with your username and password. We do not share your contact information with third parties for advertising purposes.

5.3 Data Protection in Applications and the Application Process

When you create and publish a CV, we store it in our database in Hamburg. You can manage the status of your CV by setting it to "Publish job application." CVs with public status can be viewed anonymously by anyone with access to our CV and profile database. We have no control over the storage, use, or privacy of CVs that have been downloaded/copied by other individuals.

Unpublished CVs are not visible in our database. You can also use a private CV for an online job application. If you apply using a private CV or an online application from the system, it will be forwarded to the relevant employer, who may retain a copy of your CV. We try to restrict access to our database to legitimate users, but we cannot guarantee that other parties will not gain access to it. Once your CV has been published, we cannot retrieve it from third parties who have accessed it. In certain cases, we may transfer personal data to a country outside the EU or the EEA (so-called third countries). This can essentially be the case if you apply for a position and the employer is based in a third country.

Please note that if you submit a confidential application, you generally do not have the right to information about the recipient, unless legal requirements dictate otherwise, as this would infringe on the recipient's confidentiality interests.

The legal basis for this processing of personal data in the context of the application is Article 6(1)(b) GDPR.

5.4 Data Processors

We only disclose your personal data to third parties if this is necessary to fulfill our own business purposes (i.e., in particular to provide the services owed to you) (e.g., if we make your profile accessible to another user), if you have given your consent, or if we are legally obligated to do so by law or by a court or official order.

If we collaborate with external service providers in the context of data processing (e.g., For example, in software development, this is generally done on the basis of a so-called data processing agreement, in which we remain responsible for data processing. We check each of these service providers beforehand regarding the measures they have taken for data protection and data security, thus ensuring compliance with the legally required contractual regulations for the protection of personal data. 5.5 Disclosure We provide you with a platform to publish data about yourself so that you can make the most of your career opportunities. The data we collect may be disclosed to the following categories of third parties: Contractual partner: Jobcenter Kreis Düren Employer: If you make your anonymous resume available for search or if you apply for a position using the system with your documents (cover letter, resume, photo, certificates). When you apply for a job and provide your contact information to express interest, or when you respond to a communication from an employer, you consent to your data being shared with the respective employer and to being contacted by that employer for employment-related purposes. In certain cases, we may transfer personal data to a country outside the EU or the EEA (so-called third countries). This may occur, in particular, if you apply for a job and the employer is located in a third country. To provide our services, we use data processors, which we list below. The legal basis for the data processed within the scope of data processing is our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR. This legitimate interest lies in pursuing our business purposes, in particular providing the services otherwise described in this privacy policy. No conflicting interest is apparent, and we have also concluded a contract with the respective contractors in accordance with Article 28 GDPR.

Job posting: Federal Employment Agency

5.6 Links to other websites

Please note that we have linked to services from other providers in some areas. Clicking on these links will redirect you to the websites of reliable partners. The respective provider is responsible for compliance with legal regulations, in particular data protection, on these websites. For questions regarding data protection, please contact the respective provider.

6. Hosting and Email Delivery

For the purposes of hosting our platforms and providing backup services, we use data processors, meaning that personal data stored on our platforms is transferred to these data processors.

Our data processor is akquinet business service GmbH, Werner-Otto-Straße 6, 22179 Hamburg (the data is processed exclusively within the EU). The data processor stores personal data for as long as the data is stored on our platforms based on the purposes defined in this privacy policy. We also use the services of akquinet business service GmbH, Werner-Otto-Straße 6, 22179 Hamburg, for sending emails and messages as part of data processing. The aforementioned company may therefore receive your personal data within the framework of the data processing agreement we have with them. The data is stored there for the duration for which storage for purposes under this privacy policy would otherwise be lawful, in particular for contractual communication within the framework of existing contracts with you.

STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin is used for hosting.

You can view the privacy policy of akquinet business service GmbH here: https://akquinet.com/datenschutz.html/

The privacy policy of STRATO AG can be found here: https://www.strato.de/datenschutz/

The legal basis for the data processed within the scope of order processing is our legitimate interest pursuant to Art. 6 Para. 1 Sentence 1 f GDPR, namely the secure, fast, and efficient provision of our services as well as uncomplicated communication.

to enable us. No conflicting interest is apparent, and we have also concluded a data processing agreement with our data processors.

7. Cloudflare

We use the Cloudflare service (operated by Cloudflare Inc., 101 Townsend St, 94107 San Francisco, USA) to load our content and to ensure the full functionality of our website. In this context, your browser may transmit personal data (e.g., your IP address) to Cloudflare to provide the service. Data processing may also take place in the USA.

Cloudflare is certified under the EU-US Data Privacy Framework, which ensures GDPR-compliant processing of personal data of EU citizens within the USA.

Cloudflare itself may also use a CDN. A CDN is a network of high-performance servers that cache content in various locations around the world.

A CDN has two tasks: firstly, to deliver content as quickly as possible, and secondly, to relieve the web host by distributing data traffic. ...

You can prevent Cloudflare from collecting and processing your data by disabling script execution in your browser or by installing a script blocker (you can find these, for example, at www.noscript.net or www.ghostery.com

The service is used based on our legitimate interest in enabling simple and appealing use of our online services (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on the handling of the transferred data can be found in Cloudflare's privacy policy: https://www.cloudflare.com/de-de/privacypolicy/

8. Lime Connect

We use the chat tool from the provider Lime Connect (hereinafter "Lime Connect") (operated by Userlike UG (limited liability), Probsteigasse 44-46, 50670 Cologne, Germany) to communicate with you on our website. Messages you send us can be stored in the Lime Connect ticket system or answered by our staff in the live chat.

When you communicate with us via Lime Connect, we and Lime Connect store, among other things, your name and email address (if you have provided them), as well as your chat history. Furthermore, the browser you are using, your operating system, your IP address, and your location are recorded. This data is aggregated in a profile. Therefore, the service is only used with your consent (Art. 6 para. 1 sentence 1 a GDPR).

Further information on data processing at Lime Connect can be found at https://connect.lime-technologies.com/de/products/data-privacy/

You can view Lime Connect's privacy policy here: https://connect.lime-technologies.com/de/legal/privacy-policy/

9. Use of Google Maps

This website uses Google Maps, a map service provided by Google, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). When using Google Maps, data about the use of the map functions by website visitors is also collected, processed, and used. The use of Google Maps only occurs with your consent (Art. 6 I S. 1 a GDPR). You can view Google's privacy policy at https://www.google.de/intl/de/policies/privacy/. You can view the additional terms of service for Google Maps at https://www.google.de/intl/de/policies/privacy/. You can view the additional terms of service for Google Maps at https://www.google.com/intl/de_de/help/terms_maps.html

10. Contacting Us

For inquiries regarding data protection, please feel free to contact us using the contact options below. Data controller within the meaning of the GDPR:

friends & you GmbH
Imperial Post Office
Französische Straße 12
D-10117 Berlin

Email: info@friendsandyou.com
Website: https://friendsandyou.com
Head Office: +49 30-7543566-0

You can reach our data protection officer at datenschutz@friendsandyou.com or at our postal address with the addition "The Data Protection Officer".