Privacy policy

2. What data we process

When you apply, we process the details you send us:

• name, date of birth, nationality, place of residence
• phone number and email address
• desired occupation, work experience, qualifications, driving licence categories, language skills
• uploaded documents such as passport, CV, driving licence, references
• contract documents: the placement agreement and information sheet, your employment contract with the employer and the decision of the Federal Employment Agency (pre-approval) — each also as a scan of the version signed on paper
• case-handling data: the status of your placement, internal notes, the time of your consent and the IP address used

3. Purposes and legal bases

• job placement and preparation of the employment relationship — Art. 6(1)(b) GDPR
• passing your documents to specific employers and, where the procedure requires it, to competent authorities — Art. 6(1)(a) GDPR (your consent)
• operation and security of the website — Art. 6(1)(f) GDPR
• internal notification of new applications and requests via Telegram — Art. 6(1)(f) GDPR (details below)
• audience measurement with Google Analytics, only after your consent — Art. 6(1)(a) GDPR, § 25(1) TDDDG
• compliance with statutory retention duties — Art. 6(1)(c) GDPR

4. Recipients

Your data is received only by: potential employers in Germany to whom we present you with your consent; the Federal Employment Agency and the competent German mission where the procedure requires it; and technical service providers acting for us as processors — among them, only if you have agreed to statistics, Google Ireland Limited (Google Analytics, see below). If you use address suggestions in the applicant area, Google Ireland Limited receives what you type in the address field (see “Hosting and technical providers”). For our internal notifications we also transfer selected data to Telegram (see “Internal notifications via Telegram”).

5. Hosting and technical providers

• Server and database: Contabo GmbH, Munich. The data centre used is located in France, i.e. within the European Union. Uploaded documents are stored there encrypted (AES-256-GCM) and are not reachable via public addresses.
• Email delivery: Resend, Inc. (USA), on the basis of the European Commission's standard contractual clauses.
• Network and bot protection: Cloudflare, Inc.
• Online payment of invoices (employers and – where it is agreed that the placed person pays – applicants): Stripe Payments Europe, Limited (Ireland). Anyone paying an invoice via the payment link enters the payment details directly with Stripe; we only receive the amount, currency, payment method, time and a payment ID. Stripe processes the payment data under its own responsibility (stripe.com/privacy); the legal basis is Art. 6(1)(b) GDPR.
• Address suggestions in the applicant area and the admin area: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Maps Platform, Places API). When you type in the field “Address in your home country”, our server sends the typed text, the language of the page and a random session identifier to Google to show suggestions; if you pick a suggestion, we request the parts of that address (street, number, postcode, town, country). Your IP address, name and email address are not sent to Google — the request runs through our server. We do not store or log the search text; only the address you accept is stored. You can always enter the address entirely by hand. The legal basis is Art. 6(1)(b) GDPR (carrying out the placement) and (f) (correct addresses). A transfer to Google LLC in the USA cannot be ruled out; it relies on the adequacy decision for the EU-US Data Privacy Framework and standard contractual clauses. Privacy notice: policies.google.com/privacy

6. Internal notifications via Telegram

So that new applications and requests are handled without delay, our system reports certain events through its own Telegram bot to the management of Hirenord and — for applications only — to individual staff members who are in any case allowed to see these applications in the admin area. The messenger is provided by Telegram FZ-LLC, Dubai (United Arab Emirates). The messages are transmitted via and stored on Telegram's servers; they are not end-to-end encrypted. Only the following is sent:

• New application via the form: reference number, first and last name, desired occupation and field, country of origin, place of residence, German skills, driving licence classes, phone and, where given, WhatsApp number, email address, whether a CV is attached, where applicable the job reference, and the time of receipt.
• Application for a further vacancy in the applicant area: reference number, name, vacancy, country of origin, phone number, email address and whether a CV is on file.
• Requests and registrations from employers: company name, name of the contact person, demand (number and occupation), location, phone number and email address; for requests also the message (shortened), for registrations the type of proof submitted.
• Responses from the employer area: whether a presented applicant suits the vacancy or not — with the applicant's name and reference number, company, vacancy and the name of the person at the company who decided; likewise when we withdraw such a decision.
• Process after acceptance by a company: that the company has accepted an applicant, the status of the service contract and the employment contract, our release and the status of the pre-approval — with the applicant's name and reference number, company, vacancy and the name of the person at the company who accepted; never contact details, date of birth or passport data.
• Submissions from the employer area: the upload of a pre-approval (applicant's name and reference number, company, vacancy, number of pages), as well as vacancy submissions, change requests, messages and requests to change company details — only company name, reference and job title or the names of the changed fields, never the content.
• With each of these messages that concerns an applicant, also the status of the applicant file: whether it is complete or which documents or details are still missing (names only, e.g. “passport copy” or “place of birth”, never their content); and a message with name and reference number as soon as a file is complete.
• Once a day a summary that contains numbers only.
• Look-up by staff (since 21 October 2026): Hirenord staff whose staff account is enabled for the bot can search for companies and applicants there and call up an overview — only with the permissions they also have in the admin area. For applicants: reference number, name, country of origin, desired occupation, German skills, driving licence classes, phone number, email address, processing status, status of the file (only the names of missing items) and ongoing placements with company and phase. For companies: name, reference, location, contact person, phone number, email address, verification status, status of the service agreement, number of ongoing cases and candidates, and open invoices. For individual placement cases: a case overview with the applicant's reference number, name and country of origin, the company and position, and the status of the employment contract, the service agreement, the pre-approval and the visa. Through the bot these staff members can also request missing documents, activate a company or record an invoice as paid; every look-up of an applicant or case overview and every such action is logged as in the admin area.
• Invoices to companies and to applicants: new invoice, payment received, payment reminders and dunning notices, as well as notices of duplicate or incorrect payments — with invoice number, company name or the applicant's name and customer number (reference), amount, due date, payment method (bank transfer or Stripe) and, where applicable, the ID and type of the Stripe payment; once a day the list of open and overdue invoices with the same details.

No files are sent via Telegram — no CV, passport, contracts, pre-approval or other documents — and neither date of birth nor passport number, including when staff look data up. The messages only contain links to our protected admin area, which requires sign-in with two-factor confirmation.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to handle applications and requests quickly — also in your interest, as vacancies are often open only briefly. There is no adequacy decision of the European Commission for the United Arab Emirates, and Telegram offers neither standard contractual clauses nor a data processing agreement; appropriate safeguards under Art. 46 GDPR therefore do not exist. There is a risk that your data does not enjoy the same level of protection there as in the EU and that you may find it harder to enforce your rights against Telegram. We therefore limit the transfer to the data listed above and, insofar as it serves the handling of your application or request, base it on Art. 49(1)(b) GDPR.

Retention: the messages remain stored with Telegram until they are deleted in the chat. We delete them there no later than three months after receipt, earlier on request. Every case is handled exclusively in the admin area, where the periods under “Retention” apply. Telegram's privacy policy: telegram.org/privacy

You may object to this processing under Art. 21 GDPR, for example by email to kontakt@hirenord.com; we will then delete the messages concerning you in the chats.

7. Cookies and consent

We store information on your device only where that is strictly necessary to run the site. Such storage requires no consent under § 25(2) no. 2 TDDDG:

• hn_applicant, hn_employer — signing in to your account area. Without them the area stays closed. Lifetime: until you sign out, at most 30 days. Readable only by the server (HttpOnly), only over HTTPS.
• hn_staff, hn_staff_ablauf — sign-in of our staff to the internal area. Lifetime: 60 minutes without activity, at most 12 hours from sign-in. hn_staff is readable only by the server (HttpOnly); hn_staff_ablauf holds only the expiry time so the page can warn in time. Only over HTTPS.
• hn_consent — your cookie decision itself, so that we do not ask again. Lifetime: 12 months.
• Cloudflare Turnstile — protects our forms against automated requests. We run it without a clearance cookie (“no_clearance”); it serves security alone, not recognition for advertising.

Anything beyond that — audience measurement and evaluating our adverts — runs only after your express consent under Art. 6(1)(a) GDPR. No such script is loaded before. Where such services are configured, we ask on your first visit; refusing is exactly as easy as agreeing.

You can withdraw your consent at any time with effect for the future, via “Cookie settings” in the footer of every page. We record when you decided so that we can demonstrate it under Art. 7(1) GDPR.

8. Audience measurement with Google Analytics

If you agree to statistics under “Cookie settings”, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Purpose: to see which pages of our public website are opened and where visitors leave it, so that we can improve the service. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without consent, Google Analytics is not loaded.

• Processed: the page opened and the previous page, always without address additions (no search parameters, no codes from confirmation links), the page title, the time, details of browser, operating system and device, screen size and language, and the approximate location (country, region) that Google derives from the IP address. According to Google, the IP address itself is not stored in Google Analytics 4.
• Google Analytics runs on the public pages only — never in the applicant area, the employer area, the admin area or on the confirmation page. We do not send names, email addresses or customer identifiers to Google; Google signals and use for personalised advertising are switched off.
• Cookies: _ga and _ga_<ID> tell visitors apart pseudonymously by a random identifier. Lifetime: up to 2 years. Event data is deleted automatically in Google Analytics after 2 months.
• Google processes the data as a processor under a contract pursuant to Art. 28 GDPR. A transfer to Google LLC in the USA cannot be ruled out; it relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Google is certified, and on standard contractual clauses.

Withdrawal: at any time with effect for the future via “Cookie settings” in the footer. From then on the site sends nothing more to Google, and the Google Analytics cookies are deleted. More information in Google's privacy policy: policies.google.com/privacy

9. Retention

We delete or anonymise applicant data no later than 24 months after the last contact, provided no placement has come about and no statutory retention duty applies. If a placement comes about, the commercial and tax retention periods apply. If you have signed a placement agreement or the acknowledgement of the information sheet, we keep the signed version and the proof of signature (name, time, IP address) as business correspondence for up to six years after the end of the calendar year (Section 257 HGB), even if no placement came about. The same applies to the scan of your signed employment contract: it proves that a fee claim has arisen (Section 296(2) SGB III); if it belongs to an invoice, the ten-year tax retention period applies. All other data is still deleted in that case. Notifications via Telegram are deleted no later than three months after receipt (see above). You may request earlier deletion at any time.

10. Your rights

You have the right of access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection (Art. 21 GDPR). You may withdraw consent at any time with effect for the future.

An email to kontakt@hirenord.com is enough for any request.

You may also lodge a complaint with a data protection supervisory authority.