Privacy Policy

Last updated: August 2026

1. Data controller

The controller responsible for processing your personal data is:

2. What data we process

When you register, we process the information you submit through the form. This includes in particular:

• first name, last name, email address, and telephone number;
• current country of residence, nationality, and the EU status derived from this information;
• industry, profession, qualifications, professional experience, current country of employment, and specializations;
• German-language skills, other foreign-language skills, and driving-licence information;
• interest in job opportunities in other Western European countries;
• your decision regarding publication of an anonymized profile;
• an optionally uploaded CV and optional profile photo;
• technical and attribution-related data such as the time of submission, server logs, UTM parameters, and Google Click ID.

3. Purposes and legal bases

We process your data for the following purposes:

• Registration and recruitment: creating your candidate profile, reviewing your information, matching you with suitable employers and job offers, and contacting you about specific opportunities. The legal basis is Article 6(1)(b) GDPR.
• Communication: answering your questions and coordinating the next recruitment steps. The legal basis is Article 6(1)(b) GDPR.
• Public candidate profile: publication exclusively according to your selected permission, with a photo, without a photo, or without publication. The legal basis is your consent under Article 6(1)(a) GDPR, which may be withdrawn at any time.
• Secure and reliable platform: operation, error analysis, prevention of misuse, and protection of our systems. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and traceable operation of the candidate platform.
• Reach and conversion measurement: attributing registrations to advertising campaigns and optimizing our candidate outreach. The legal basis is Article 6(1)(f) GDPR; where consent is required for cookies or similar technologies, the legal basis is Article 6(1)(a) GDPR.
• Legal obligations and claims: complying with statutory requirements and asserting, exercising, or defending legal claims. The legal bases are Article 6(1)(c) and (f) GDPR.

4. Required and optional information

We need the information marked as required fields in order to process your registration and assign you to suitable activities. Registration is not possible without this information.

Your CV and profile photo are voluntary. A complete profile with a photo may be more interesting to employers, but your registration will also be processed without a CV or photo. Please do not submit special categories of personal data that are not required for recruitment, such as information about health, religion, political opinions, or trade-union membership.

5. Publication and disclosure to employers

In the form, you decide whether your anonymized profile may be published with a photo, without a photo, or not at all. A public profile contains only your first name and professionally relevant information. Your last name, email address, telephone number, address, and private place of residence are not published.

Publicly authorized profiles may be viewed by visitors to our candidate and recruitment websites. We disclose your contact details or complete documents to a specific employer only after you have consented to disclosure to that employer.

You may withdraw your publication decision at any time with effect for the future.

6. Software- and AI-assisted processing

When you upload a CV, our software processes the document for speech recognition, translation into German, structuring, anonymization, and the creation of a standardized professional presentation. If you register as an unskilled assistant, documented practical experience may additionally be classified internally.

For this processing, we use the API of OpenAI Ireland Limited as a processor. The CV is transmitted to the API in encrypted form. API data is not used to train the models by default. The request is submitted with persistent storage disabled; OpenAI may retain API inputs and outputs for up to 30 days for abuse prevention and security monitoring.

Further information is available in the official information on privacy in the OpenAI API and in OpenAI's Data Processing Addendum.

No solely automated decision is made that rejects you or otherwise produces legal or similarly significant effects. A profile is not automatically published or disclosed to an employer solely on the basis of a software assessment.

7. Recipients of your data

Access is granted only to persons and service providers who need the data for the stated purposes. These include:

• authorized persons at East Talent;
• hosting, database, email, IT security, and maintenance providers;
• OpenAI Ireland Limited and its subprocessors for optional CV processing;
• Google Ireland Limited and affiliated companies in connection with the Google services described below;
• employers to whom you have authorized a specific disclosure;
• visitors to our websites, where you have authorized publication of a public anonymized profile;
• authorities or other bodies where we are legally required to transmit the data.

8. Google Ads, conversion measurement, and Google Fonts

A Google Ads tag is embedded on the landing page. Technical usage data such as IP address, browser and device information, pages visited, Google Click ID, and campaign parameters may be processed. After a successful registration, a conversion event containing the source identifier, candidate status, German-language skills, publication decision, and interest in other Western European countries may be transmitted to Google. Your name, email address, telephone number, CV, and profile photo are not transmitted as conversion parameters.

We also load fonts from Google Fonts for consistent presentation. When they are retrieved, Google may receive your IP address and technical connection data. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information is available in Google's Privacy Policy.

9. Transfers outside the European Economic Area

When OpenAI and Google services are used, data may be processed by affiliated companies or subprocessors outside the European Economic Area. Such transfers are based on an adequacy decision, the EU-U.S. Data Privacy Framework, or the European Commission's Standard Contractual Clauses and supplementary safeguards.

10. Retention period

We retain your candidate profile and the associated documents only for as long as they are needed for recruitment. Deletion or anonymization takes place no later than twelve months after registration, or earlier if you request deletion or recruitment has been completed, unless statutory retention obligations or legitimate reasons for preserving legal claims prevent this.

Publicly authorized profiles are removed when publication permission is withdrawn, recruitment has been completed, or no later than twelve months after registration. Technical logs and backups are deleted or overwritten after the periods required for security and recovery have expired.

11. Your rights

Under the GDPR, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

To exercise your rights, simply email datenschutz@east-talent.de. Further information about data-subject rights is available on the European Commission's information page.

12. Objection to processing based on legitimate interests

You may object to processing based on Article 6(1)(f) GDPR for reasons arising from your particular situation. We will then stop the relevant processing unless compelling legitimate grounds or the assertion, exercise, or defense of legal claims prevent this.

13. Data security

We use technical and organizational measures to protect your data against loss, alteration, unauthorized access, and unlawful disclosure. These measures include encrypted transmission, access restrictions, separate storage areas, and anonymization of the CV version intended for employers.

14. Right to lodge a complaint

You may lodge a complaint with a data-protection supervisory authority. For East Talent, the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, is particularly responsible.

15. Changes to this Privacy Policy

We update this Privacy Policy when the candidate process, the services used, or legal requirements change. The version published on this page is authoritative.