Privacy Policy

1) Introduction and Contact Details of the Controller

1.1 We are delighted that you are visiting our website and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website and our app for Android and iOS (section 14.8). Personal data in this context is all data with which you can be personally identified.

1.2 The controller responsible for data processing on this website and in our app within the meaning of the General Data Protection Regulation (GDPR) is Actilize UG (haftungsbeschränkt), Am Isarkanal 24, 81379 Munich, Germany, Tel.: +498921540853, e-mail: [email protected]. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website

2.1 When you use our website for purely informational purposes, i.e. if you do not register or otherwise submit information to us, we only collect data that your browser – or our app (section 14.8) – transmits to the site server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

Our visited website
Date and time at the moment of access
Amount of data sent in bytes
Source/reference from which you reached the page
Browser used (for requests from our app, additionally its version number)
Operating system used
IP address used (where applicable: in anonymized form)

The processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to check the server log files retrospectively should concrete indications point to unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to us), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string "https://" and the lock symbol in your browser bar.

3) Hosting & Content Delivery Network

3.1 For hosting our website and displaying the site content, we use a provider that performs its services itself or through selected sub-contractors exclusively on servers within the European Union.

All data collected on our website is processed on these servers.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

3.2 Cloudflare

We use a content delivery network of the following provider: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content or scripts more quickly via a network of regionally distributed servers. The processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-U.S. Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

4) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your end device. Some of these cookies are automatically deleted after closing the browser (so-called "session cookies"), while others remain on your end device for longer and enable page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the storage duration in the overview of the cookie settings of your web browser.

If personal data is also processed by individual cookies used by us, the processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of the contract, in accordance with Art. 6(1)(a) GDPR in the case of consent given, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the site visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually about their acceptance, or exclude the acceptance of cookies for certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be restricted.

5) Contacting Us

5.1 Tidio

This website uses a live chat system of the following provider: Tidio Poland Sp. z o.o., Wojska Polskiego 81, 70-481 Szczecin, Poland

The chat is not loaded automatically. We initially show only a button of our own; on some pages, and on narrow screens on a few more, we leave it out so that it does not cover any controls. We load the chat from Tidio only once you click it and confirm the notice that follows. Until then, no data is transmitted to Tidio and no information is stored on your end device. The basis for this is Section 25(2) no. 2 TDDDG: the storage is necessary in order to provide the chat you have expressly requested. Once you have opened the chat, we load it automatically on later visits so that you do not miss any replies. This applies only while the "Live chat" setting is enabled — you can reach it at any time via the "Cookie settings" link in the footer. If you switch it off, we ask again before the next load.

The processing of personal data transmitted via the chat is carried out either in accordance with Art. 6(1)(b) GDPR, because it is necessary for the initiation or performance of a contract, or in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the effective support of our site visitors. Your data transmitted in this way will be deleted, subject to statutory retention periods to the contrary, once the matter in question has been conclusively resolved.

When you use the chat, Tidio processes not only your messages but also context data from your visit. This includes your IP address and the approximate location derived from it, details about your device, browser and language, as well as the pages you have opened and the page you came to us from. Added to this is whatever you enter yourself, such as your name and e-mail address. We see these details in the chat window so that we can place and answer your request. The same legal bases apply as for your messages.

Your behaviour is not evaluated for statistical or optimisation purposes. The event tracking provided for this is switched off in our Tidio account. We do not transmit any data from your Yeahbase account to Tidio.

You can prevent the setting of cookies through appropriate browser settings. The functionality of the chat may then be restricted. Where we process data on the basis of our legitimate interest, you may object at any time with effect for the future by sending us an informal objection by e-mail to the address given in our legal notice.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

5.2 Trustpilot

On our website we link to our review profile at the following provider: Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark.

As long as you do not click the link, no data is transmitted to the provider. If you click it, you leave our website; from that point the provider's privacy terms apply. We transmit no e-mail addresses to the provider and send no review invitations through it.

The link is provided in accordance with Art. 6(1)(f) GDPR, on the basis of our legitimate interest in presenting customer reviews.

5.3 Meetergo

For the provision of an online appointment booking function, we use the services of the following provider: meetergo GmbH, Hauptstr. 44, 40789 Monheim am Rhein, Germany

For the purpose of scheduling appointments, your first and last name and e-mail address (and, if applicable, your telephone number if a telephone appointment is desired) are collected in accordance with Art. 6(1)(b) GDPR and, in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in effective customer management and efficient appointment administration, transmitted to the provider and stored there for the organization of appointments.

After the appointment has been held or after the agreed appointment period has expired, your data will be deleted by the provider.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

5.4 WhatsApp Business

We offer you the possibility of contacting us via the messaging service WhatsApp of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this we use the so-called "business version" of WhatsApp.

If you contact us via WhatsApp in connection with a specific transaction (for example, an order you have placed), we store and use the mobile phone number you use with WhatsApp and — if provided — your first and last name in accordance with Art. 6(1)(b) GDPR to process and answer your request. On the basis of the same legal basis, we may ask you via WhatsApp to provide further data (order number, customer number, address or e-mail address) in order to be able to assign your request to a specific transaction.

If you use our WhatsApp contact for general inquiries (for example, about our range of services, availability or our website), we store and use the mobile phone number you use with WhatsApp and — if provided — your first and last name in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing the requested information efficiently and promptly.

Your data is always used only to answer your request via WhatsApp. It is not passed on to third parties.

Please note that WhatsApp Business gains access to the address book of the mobile end device we use for this purpose and automatically transmits phone numbers stored in the address book to a server of the parent company Meta Platforms Inc. in the USA. For the operation of our WhatsApp Business account, we use a mobile end device in whose address book only the WhatsApp contact details of those users are stored who have also contacted us via WhatsApp.

This ensures that every person whose WhatsApp contact details are stored in our address book has already consented, when first using the app on their device, by accepting the WhatsApp terms of use, to the transmission of their WhatsApp phone number from the address books of their chat contacts in accordance with Art. 6(1)(a) GDPR. A transmission of data of users who do not use WhatsApp and/or have not contacted us via WhatsApp is thereby excluded.

For the purpose and scope of the data collection and the further processing and use of the data by WhatsApp, as well as your rights in this regard and setting options for protecting your privacy, please refer to WhatsApp's privacy policy: https://www.whatsapp.com/legal/?eea=1#privacy-policy

In the context of the processing operations mentioned above, data may be transferred to servers of Meta Platforms Inc. in the USA.

5.5 When you contact us (e.g. via contact form or e-mail), personal data is processed — exclusively for the purpose of processing and answering your request and only to the extent necessary for this purpose.

The legal basis for processing this data is our legitimate interest in answering your request in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted if it can be inferred from the circumstances that the matter in question has been conclusively resolved and provided that no statutory retention obligations exist to the contrary.

6) Comment Function

In the context of the comment function on this website, in addition to your comment, information on the time the comment was created and the commenter name you have chosen are stored and published on this website. Furthermore, your IP address is logged and stored. This storage of the IP address is carried out for security reasons and in case you violate the rights of third parties or post unlawful content through a submitted comment. We need your e-mail address in order to contact you if a third party should object to your published content as unlawful.

The legal bases for storing your data are Art. 6(1)(b) and (f) GDPR. We reserve the right to delete comments if they are objected to as unlawful by third parties.

As a user, you can subscribe to follow-up comments. You will receive a confirmation e-mail to ensure that you are the owner of the e-mail address provided (double opt-in procedure). The legal basis for data processing in the case of subscribing to comments is Art. 6(1)(a) GDPR. You can unsubscribe from ongoing comment subscriptions at any time with effect for the future; please refer to the confirmation e-mail for more detailed information on how to unsubscribe.

7) Data Processing When Opening a Customer Account

In accordance with Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary in each case if you provide it to us when opening a customer account. You can find out which data is required for opening an account from the input mask of the corresponding form on our website.

If you create a profile as a job seeker, that profile is publicly accessible — that is the point of the platform: employers are meant to find you. What is visible is what you put in your profile, including your name and, if you upload one, your profile picture. The profile page can be picked up by search engines and appears in our public profile listing.

Using private mode (the setting under “My profile”) you can change this yourself at any time: your profile page is then no longer reachable for visitors who are not signed in, is no longer reported to search engines and no longer appears in the public listing; on top of that, your name and profile picture are masked. Signed-in users still see your profile in full — private mode takes you out of open visibility on the internet, not out of visibility inside the platform. It has no effect on your applications: they reach the employers you send them to either way.

Applying without an account: If you click “Apply” on a job ad without an account, you create your profile before you register. So that nothing is lost when you register, we store what you enter until then together with the ad you want to apply for – without a profile photo. When you register, it becomes the draft of your profile; if you do not register, we delete it after seven days. All that remains is for which ad and when an application without an account was started and whether an account came of it; we delete that too after 180 days. You can send your first application before you upload a profile photo. The company you applied to then already sees your profile as a draft; it becomes publicly accessible, visible to search engines and part of the AI matching only once you publish it with a profile photo. The legal basis is Art. 6(1)(b) GDPR.

Improving profile creation: When you open profile creation with your account, we store when you first did so. If you click “Next” or a later step in the first step while required details are still missing or invalid, we store which fields those were the last time, how often this happened and when it last happened – only the names of the fields, never what you entered. This shows us where profile creation holds people up, so we can make it simpler. The legal basis is our legitimate interest in a working profile creation under Art. 6(1)(f) GDPR. We delete these details after 90 days, and at the latest with your account.

Review of accounts, profiles and job ads: To protect users from fraud, identity misuse and dubious offers, we review accounts, profiles and job ads – upon registration, before or after publication, on a random basis, in case of irregularities and upon reports from other users (clauses 3.6 and 9 of the Terms of Use). In doing so, we process the details from your account, your profile or your ad, your communication with us and evidence you have submitted, as well as information from publicly accessible sources, such as the company website and its imprint, the commercial register, the register of associations and the company register, review portals, professional networks and search engines. We only collect what is necessary to determine whether a person or company actually exists and presents itself as stated, and whether content complies with our Terms of Use. We do not collect special categories of personal data (Art. 9 GDPR) for this purpose, and we do not assess the professional suitability of job seekers. If a review leads to a request to you or to a protective measure, we keep a record of its result, the sources used and the measure; reviews that remain unremarkable without a request are not recorded. decisions on protective measures are taken by a human. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the users of our platform from fraud and misuse and in the integrity of the platform (Recital 47 GDPR). Insofar as the review serves the performance of the user agreement, for example when requested evidence is provided, the legal basis is Art. 6(1)(b) GDPR. We delete review notes without findings no later than twelve months after the review; we retain notes on a protective measure for the duration of the measure and for up to three years thereafter in order to detect repeated misuse and to defend against claims, but at the latest when your account is deleted. You can object to this processing on grounds relating to your particular situation (section 16.2).

You can delete your customer account at any time by sending a message to the above-mentioned address of the controller. After deletion of your customer account, your data will be deleted, provided that all contracts concluded via the account have been fully processed, no statutory retention periods exist to the contrary and no legitimate interest on our part in the continued storage persists. How to delete your account yourself – in the app, on the website or by e-mail – and what is deleted or kept afterwards is explained on our page Delete your account. After the deletion we keep your orders, subscriptions, Flex bookings and withdrawals because tax and commercial law require it (sections 147 AO, 257 HGB, 14b and 22 UStG): uniformly for ten years from the end of the calendar year in which anything was last booked or noted on them, such as a payment or refund. After that we automatically remove your name, address, e-mail address and phone number, any VAT identification number, free-text notes and the identifiers of your payments and invoices at our service providers from these records; we keep amount, date, status and product for our statistics. The invoices themselves are held by our invoicing provider Quaderno (section 9.4); we delete them there after the same period. If a tax audit or other proceedings of the tax office concerning those years are under way, we keep the data until they are concluded (section 147(3) sentence 5 AO). After every deletion we record which account (e-mail address and former account number) was deleted, when and by which route. This record proves that we deleted your account and helps us remove your address from our other systems as well; the legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 5(2) and Art. 17 GDPR. We delete it after three years, the end of the regular limitation period.

8) Use of Customer Data for Direct Advertising

8.1 Sending the e-mail newsletter to existing customers

If you have provided us with your e-mail address when purchasing goods or services, we reserve the right to regularly send you offers by e-mail for goods or services from our range similar to those already purchased. Pursuant to Section 7(3) UWG, we do not need to obtain separate consent from you for this. In this respect, the data processing is carried out solely on the basis of our legitimate interest in personalized direct advertising in accordance with Art. 6(1)(f) GDPR. If you have initially objected to the use of your e-mail address for this purpose, we will not send you any e-mails.

You are entitled to object to the use of your e-mail address for the aforementioned advertising purpose at any time with effect for the future by notifying the controller named at the beginning. You will only incur transmission costs in accordance with the basic rates. After receipt of your objection, the use of your e-mail address for advertising purposes will cease without delay.

8.2 These e-mails are sent via the service provider we also use for our other e-mails; see section 15.3 for details.

8.3 Naming employers as references and in case studies

If you have published job postings on our platform as an employer, we may show your company name and logo as a reference, for example in the logo bar on our homepage, and present one of your job postings as a case study, with figures on its reach and results (such as impressions in search engines, views or applications) and the period they cover. We do this on our platform and in our advertising, for example in online ads, social media, newsletters and presentations, including after the job posting has ended. Personal data is only involved insofar as your company name or logo refers to a natural person, for example in the case of a sole proprietorship. The legal basis is our legitimate interest in presenting our service with real customer examples (Art. 6(1)(f) GDPR); the details are set out in section 4.6 of our terms of use.

You can object to this at any time without giving reasons, for example by e-mail to [email protected]. We will then remove the information concerned from the platform and from running advertising without undue delay, and at the latest within seven days; materials already sent or handed over, such as newsletters already sent, are not affected.

9) Data Processing for Order Handling

9.1 Insofar as necessary for the performance of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6(1)(b) GDPR.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data you provided when placing the order (name, address, e-mail address) in order to inform you personally, within the framework of our statutory information obligations pursuant to Art. 6(1)(c) GDPR, via a suitable communication channel (for example by post or e-mail) about upcoming updates within the period provided for by law. Your contact data will be used strictly for the purpose of notifications about updates owed by us and will only be processed by us for this purpose to the extent necessary for the respective notification.

To process your order, we also work with the following service provider(s), who support us in whole or in part in the performance of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

9.2 OpenAI

To provide our services, we use software with artificial intelligence of the following provider: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland

Information you provide in the context of a contractual relationship may be fed into the provider's software in order to organize, analyze, aggregate, modify, evaluate or prepare it for the provision of our service.
Information may also be transmitted to: OpenAI OpCo, LLC, USA

The collection and further processing of this information is strictly limited to the purpose of contract performance. Processing for the purposes of training and further developing the provider's AI language models is expressly prevented.

Insofar as personal data is also the subject of the processing, it is carried out on the basis of our legitimate interest in the efficient design of our services and the optimal use of existing resources and technologies in accordance with Art. 6(1)(f) GDPR. Where section 10 names a different legal basis for an AI function, that basis applies to that function.

We have, for our part, concluded a data processing agreement with the provider which ensures the protection of personal data processed via the provider and prohibits unauthorized disclosure to third parties.

For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.

9.3 Use of payment service providers (payment services)

- PayPal

One or more online payment methods of the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method of the provider in which you make an advance payment, the payment data you provided during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider in accordance with Art. 6(1)(b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method in which we make an advance payment, you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, telephone number and, if applicable, data on an alternative means of payment).

In such cases, to safeguard our legitimate interest in determining your ability to pay, we forward this data to the provider for the purpose of a credit check in accordance with Art. 6(1)(f) GDPR. On the basis of the personal data you provided as well as further data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment option you selected can be granted with regard to payment and/or bad debt risks.

The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, but is not limited to, address data.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

- Stripe

One or more online payment methods of the following provider are available on this website: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

If you select a payment method of the provider in which you make an advance payment (such as credit card payment), the payment data you provided during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider in accordance with Art. 6(1)(b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method in which the provider makes an advance payment (such as purchase on invoice or installment purchase or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, telephone number and, if applicable, data on an alternative means of payment).

To safeguard our legitimate interest in determining the ability of our customers to pay, we forward this data to the provider for the purpose of a credit check in accordance with Art. 6(1)(f) GDPR. On the basis of the personal data you provided as well as further data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment option you selected can be granted with regard to payment and/or bad debt risks.

9.4 Invoicing

To create invoices and to check VAT details, we use the Quaderno service of the following provider: Recrea Systems, S.L., Venegas 2A – Local 1, 35003 Las Palmas, Spain.

On our behalf, the provider processes the data required for the invoice, in particular your name, your billing address, any VAT identification number, and the service purchased and its amount.

The legal basis is Art. 6(1)(b) GDPR insofar as the processing is necessary to handle your purchase, and Art. 6(1)(c) GDPR with regard to our commercial and tax retention obligations.

We have concluded a data processing agreement with the provider which ensures the protection of our customers' data and prohibits unauthorized disclosure to third parties. The provider is based in the European Union; no transfer to a third country takes place here.

9.5 Electronic cancellation option for continuing obligations with consumers

Consumers who have entered into contracts for paid continuing obligations (such as subscription contracts) on this website have the option of cancelling them via an electronic button in accordance with the applicable notice periods.

Clicking the button leads to a confirmation page on which the consumer can provide further details about the cancellation, clearly identify themselves and then declare their cancellation electronically.

The collection of personal data and its transmission to us is carried out in accordance with Art. 6(1)(b) GDPR and only to the extent necessary for the proper processing of the cancellation. Likewise on the basis of Art. 6(1)(b) GDPR, the personal data provided is used to confirm receipt of the cancellation declaration and the time of cancellation electronically in text form. A further legal basis for the processing is Art. 6(1)(c) GDPR. We are legally obliged to provide an electronic cancellation option for consumer contracts for paid continuing obligations concluded by way of electronic commerce.

9.6 Electronic withdrawal function for distance contracts

Consumers who conclude contracts on this website for which a statutory right of withdrawal exists have the option of declaring the withdrawal via an electronic withdrawal function in accordance with the applicable withdrawal provisions.

When using the withdrawal function, in addition to the information identifying the contract to be withdrawn from, further personal information such as the consumer's first and last name and e-mail address must be provided or confirmed.

The collection of this information and its transmission to us takes place pursuant to Art. 6(1)(b) GDPR and only insofar as it is necessary for the proper processing of the withdrawal. Also on the basis of Art. 6(1)(b) GDPR, the personal data provided is used to confirm receipt of the declaration of withdrawal by e-mail. A further legal basis for the processing is Art. 6(1)(c) GDPR. We are legally obliged to provide an electronic withdrawal function for paid consumer distance contracts.

10) AI-Assisted Features

10.1 General information

A central element of our services is the automated matching of job postings with candidate profiles. Profile and posting contents are evaluated in several stages: first, we use structured information (such as field of work, desired working hours, type of employment, languages, location and willingness to relocate) to determine whether a combination is eligible at all. Only the remaining combinations are then evaluated in substance by an AI language model.

The evaluation follows a fixed weighting specified by us and is expressed as a score between 0 and 100. The required skills carry the most weight, followed by the relevance of the professional experience, the mandatory requirements of the position and the similarity of the job title. Field of work, industry, the distance to the place of work, activity on the platform, the existence of a profile video and an existing membership have less influence.

10.2 Suggesting profiles to employers (AI matching)

Employers with an active job posting receive a list of suitable profiles for it, sorted by score. Displayed are the contents of the respective public profile, the score together with its breakdown, and an automatically generated brief summary of why the profile fits the position. From this list, employers can send an interview request or hide a profile. For an individual job posting they can additionally switch on an auto mode: the platform then sends interview requests on their behalf to profiles that reach a fixed minimum score, within the request allowance of their package. Every request sent this way is logged and reported to the employer weekly.

Only profiles that are published and active are taken into account. The matching is an additional way of being suggested to employers and is not a prerequisite for applying: all job postings remain publicly accessible irrespective of it, and you can apply to any position yourself at any time, even if your profile is not suggested for that posting. Applications received are reviewed by the employers and are not decided by AI.

If you apply to a job posting whose employer uses a paid advertising package or a paid matching upgrade, we evaluate your profile against that posting with the same method. The employer sees the score together with its breakdown on your application and can sort their applications by it once they have confirmed our guidance on how to read the score. No application is hidden or rejected by this; employers review every application themselves. If there is no published profile, or if you have objected (section 10.3), no evaluation is produced; the employer then only sees that there is no score – not why.

The evaluation therefore constitutes a pre-selection for one of several ways of establishing contact; whether contact is made – individually by hand or in the auto mode they switched on themselves – and every further step in the application process is decided by the employers themselves. An interview request is an invitation; anyone who does not receive one can still apply on their own. The score on an application is a sorting aid as well: it orders, it hides nothing and it replaces no review by the employer. It therefore does not involve an automated decision producing legal effects or similarly significantly affecting you within the meaning of Art. 22 GDPR.

The legal basis is Art. 6(1)(b) GDPR insofar as the processing serves the performance of the user agreement concluded with you, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest and the interest of employers in efficiently bringing together supply and demand in the labour market.

In weighing the interests we have taken into account that you publish your profile on a job platform in order to be found by employers. Suggesting your profile therefore corresponds to the purpose for which you created it and is foreseeable for you. As safeguards we have provided that your name and contact details are not transmitted to the AI providers, that the transmitted contents may not be used to train the models, and that you can object to the processing at any time with immediate effect (section 10.3). You are informed of this privacy policy as early as registration.

10.3 Objection and deactivation

You may object to your profile being suggested to employers and to the evaluation of your applications at any time and without giving reasons. You can find the corresponding setting in your account under "Settings" ("Use supporting AI features"). Following your objection, your profile will neither be evaluated again nor suggested to employers; evaluations and summaries already stored about your profile and the scores on your applications will be deleted. Irrespective of this, your profile remains discoverable via the regular candidate search, and your applications reach the employers unchanged.

10.4 Suggesting job postings to job seekers (Apply Agent)

Job seekers can activate the so-called Apply Agent. It continuously matches published job postings against their own profile and identifies suitable positions using the same procedure. Depending on the setting you have chosen, the results are either merely displayed to you as a suggestion, or an application to the relevant position is submitted in your name. In both cases only your existing profile is transmitted; no application text is generated by AI.

The Apply Agent, too, is an additional aid and not a prerequisite for applying: irrespective of it, you can apply to any published position yourself at any time. The Apply Agent does not decide on your application but submits it on your behalf; reviewing the application is solely a matter for the employers.

You decide yourself whether and in which mode the Apply Agent operates, and you can switch it off in your account at any time. The legal basis for the processing is Art. 6(1)(b) GDPR for the performance of the user agreement.

10.5 AI providers used and scope of data

For the evaluation of content we use language models from OpenAI (section 9.2); no other AI provider receives this data. The following is transmitted from your profile:

an internal identifier of your account and of your profile
the type of profile (sales or nursing)
your job title
your fields of work and desired job titles
your activities and main responsibilities
your experience reports, each with title, company or organisation, your description in your own words and the skills applied; entries from the earlier form of the editor carry the initial situation, your contribution and the outcome instead of the description
your education and training, with title, the institution and the details you have entered for them
your skills with the respective duration of experience in years and whether you have marked them as a focus
your preferred industries

The corresponding requirements are transmitted from the job posting. Name, address, profile picture, profile video, date of birth, contact details and information on salary expectations are not transmitted.

The transmission is pseudonymous: the providers receive the aforementioned contents, but not your name or your contact details. Processing of the transmitted contents for the purpose of training the providers' AI models is contractually excluded.

10.6 Storage period

We store evaluation results for as long as the underlying job posting is active and you have not objected to the matching. They are recalculated if your profile or the job posting changes in a relevant way. They are deleted immediately when you object or when your account is deleted; at the latest 30 days after the job posting ended or was filled; and in any case once you have not been active on Yeahbase for more than 180 days — from that point employers cannot reach you anyway. The score on an application is stored for as long as the application itself; it is deleted with it, and immediately if you object or delete your account.

10.7 AI features that write text for you

The sections above concern the evaluation of what you have already entered. We also offer features in which a language model drafts text for you. They only run when you start them yourself or, for the skill suggestions under “My story”, when you have written or spoken a text about one point in your career; what comes back is always a draft you see, can change and can discard before anything is saved. The one exception is the one-time merge of older experiences, which runs in the background (below).

Experiences under “My story”: you describe one point in your career in your own words – typed or spoken. Instead of typing, you can tell the experience in a short voice message (up to 90 seconds, led by three questions on screen); your browser uses the microphone only after you allow it and only while you are recording. We transmit the recording, together with your role and the company or organisation, to the same provider, which turns it into text; the role and the company help it spell names correctly. We do not store the recording, it is discarded once converted, and the text then sits in the text box like typed text, where you see it, change it and take it into your profile only by saving the experience. We read nothing else out of the recording – no role, company or years. If you click “Improve text”, we transmit that text, your role and the kind of experience; back comes your text in readable sentences, with nothing added; if it is longer than the text box holds, it is worded more briefly, with no fact left out. When you leave the text box after writing or changing a sentence or two, or when the text of a voice message has just landed in the box, we transmit the same plus the skills you have already entered for that experience; back come suggested skills, and you take over, one by one, what fits. None of them reaches your profile without your choice.
One-time merge of older experiences: each experience used to have three boxes – the situation, your contribution and the outcome – and now it has one text box. If you saved an experience with text in more than one of those boxes, we transmit those boxes, your role and the kind of experience once, the first time you use the website after the change; back comes a text in your own words, with nothing added, which replaces the three boxes in your profile. For experiences carried over from your earlier profile, the situation box holds the company name; it does not count, is not transmitted and stays as the company. Where only one box holds text, or only a company name, we take it over without a language model. The three earlier boxes stay stored for 90 days and are then deleted. In the profile editor we point the merge out to you, so you can check and change the text.
Bio: at your explicit request we create a short bio in German and English from the details in your profile.
Profile check: at your request we check your profile against the job titles and activities you are aiming for and tell you what you could add or sharpen.

The providers are the same as under 10.5, and here too they do not process the transmitted content to train their models. The legal basis is Art. 6(1)(b) GDPR: you start the feature yourself, as part of the service you use; the one-time merge runs so that your earlier experiences stay readable and editable in the new form of your profile.

To investigate faults and to document quality, we record each bio creation and each profile check — including the profile details transmitted and the text produced. After 30 days we erase that content from the record, leaving only that a run took place and when. After 180 days we delete that too. If you delete your account, the records go immediately, regardless of these periods. A draft for an experience is not recorded separately, and a voice message for one not at all: what you save then sits in your profile.

10.8 AI-assisted job search

In the search box on the job list you can describe in your own words what you are looking for. A language model reads your input and translates it into search filters; the search itself then runs in our own database. Only your input is transmitted — the language model receives neither the job ads nor data from your profile. We use the same providers as under section 10.5; here too they do not process the transmitted content to train their models. The legal basis is Art. 6(1)(b) GDPR: you trigger the search yourself.

We record your input in order to improve the search and to see what people look for when no matching ads exist. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest lies in aligning what we offer with actual demand. This record contains neither your name nor your IP address nor any identifier of your device; it cannot be traced back to you. After 30 days we delete the text of your input. What remains is only the anonymous information that a search took place, with which filters, and how many results it returned.

10.9 CV check

On the page for job seekers you can upload your CV to see which of our job ads fit you and to create a profile from it. If you already have a profile, you can use your CV to fill its empty fields; existing details are left untouched. This also works without an account, including when you apply for a job without an account (section 7) – we then only create your profile from the CV and do not match it against job ads. A language model reads the CV and translates it into the structure of our profile: name, place of residence, contact details, languages, career history, skills, certificates, links, driving licence categories and hobbies. Unlike the matching described in section 10.5, the language model receives the complete CV in this step, including your name and contact details and everything you wrote into the document yourself. Details we do not need for the profile, such as a date of birth or a photo, are not taken over. The subsequent matching against the job ads runs as described in section 10.1, without name and contact details. The providers are the same as under section 10.5; here too, they do not process the transmitted content to train their models. The legal basis is Art. 6 (1) (b) GDPR: you trigger the check yourself in order to create a profile with us.

We do not store the uploaded file itself; it is discarded once it has been read. What the language model read from it and the result of the matching are kept for 7 days so that you can return to your result and create the profile from it. If you create a profile, the details move into your profile and the record is emptied immediately; if you apply without an account, the period under section 7 applies to the details from then on. After 7 days we delete the content in any case; what remains is only that and when a check took place and how many ads fitted. After 180 days we delete that too. Results shown to visitors without an account are tied to their browser and cannot be retrieved by others.

10.10 AI proposals in the candidate search

In the skill box of the candidate search you can describe in your own words which skill you are looking for. If the word match finds nothing, you can ask a language model which skills from our list you mean; you pick from its proposals yourself, and the search itself then runs in our own database. Only your input is transmitted — the language model receives neither candidate profiles nor data from your account. We use the same providers as under section 10.5; here too they do not process the transmitted content to train their models. The legal basis is Art. 6(1)(b) GDPR: you trigger the request yourself.

We do not store your input. We keep the language model's answer for 24 hours under a checksum of the input, so the same words need not be transmitted a second time; this record contains neither your name nor your account nor your IP address. To limit abuse and cost we count requests per account, and per IP address for visitors without an account; these counters are deleted after 24 hours at the latest. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the service from abusive use.

10.11 Ad from link

As an employer you can paste the link to a job ad you have already published elsewhere, or its text, to create an ad on Yeahbase from it. Instead of a link or text you can also describe the position in a short voice message (up to four minutes); your browser uses the microphone only after you allow it and only while you are recording. Or you upload screenshots of the ad (up to ten pictures) or paste the share link of a screenshot tool, behind which our server retrieves the picture. This also works without an account; the account is created at the end. Our server retrieves the page behind the link; its operator learns nothing about you in the process. A voice message is transmitted to the provider named below, which turns it into text, and the part in which you give the title additionally as a short clip of its own; we then read that text like a pasted ad. Screenshots are transmitted to the same provider, whose model reads the text of the ad off the pictures; we do not store the pictures, they are discarded once read. A language model reads the text of the ad and translates it into the structure of our job ad: title, category, tasks, requirements (such as languages, experience, skills), type of employment and working hours, place of work, pay and benefits, details about the company and, where the ad names one, the contact person with their contact details. As with every ad, we have Google translate the named place of work (the place name, no personal data) into coordinates. In this step the language model receives the complete text of the ad, that is everything the ad says. The providers are the same as under section 10.5; here too, they do not process the transmitted content to train their models. The legal basis is Art. 6 (1) (b) GDPR: you trigger the reading yourself in order to create an ad with us. Where the ad contains details of a contact person, we process them because you take them over into your ad with us; they are already part of your published ad, and you see and change them before publishing.

On the "Job ad check" page (/job-ad-check and its variants for the skilled trades, nursing and sales) we read your ad the same way, check it against fixed rules (such as the title, the text length, the salary, the experience required) and have the language model named above (the same providers as under section 10.5) write a suggestion for the title and the description from what was read. The suggestion is kept together with what was read and emptied with it. If you decide to post the improved ad with us, we take the suggestion over into the ad wizard. Here too we count the requests per hour and per day to limit abuse and cost; we write a suggestion at most three times a day per account, or per IP address (for IPv6, per network range of the address) for visitors without an account, and delete this counter after 24 hours. The legal basis of the check is Art. 6(1)(b) GDPR: you request it yourself; the legal basis of the counters is Art. 6(1)(f) GDPR, our legitimate interest being to protect the service from abuse.

We do not store the retrieved page content, the voice recording or the text made from it; they are discarded once they have been read. The link, what was read and the details you add in the ad wizard afterwards are kept for 7 days so that you can return to your result and create the ad from it. If you create the ad, the details move into the ad and the record is emptied immediately. After 7 days we delete the content in any case; what remains is only that and when a reading took place, by which way (link, text or voice message, and for a voice message its length in seconds), from which website and with what result. After 180 days we delete that too. If you delete your account, the records assigned to your account are removed immediately and regardless of these periods; a reading without an account is assigned to no account and falls under the periods above. Results shown to visitors without an account are tied to their browser and cannot be retrieved by others. To limit abuse and cost, we count the requests per account, and per IP address for visitors without an account; we delete these counters after one hour at the latest. The legal basis for this is Art. 6 (1) (f) GDPR; our legitimate interest lies in protecting the service against abusive use.

If you would rather not have anything read, you can also open the ad wizard empty ("classic") and fill it in yourself, likewise without an account; the account is then created at the end. So that your details survive the registration, we save them after every step. If you create the ad, they move into the ad and the record is emptied immediately; otherwise we delete them after 7 days. What remains is only that and when you started this way ("classic") and whether an ad came of it; after 180 days we delete that too. If you have the wizard suggest the main tasks from your description, the language model receives the title and the description of your ad. The legal basis here too is Art. 6 (1) (b) GDPR.

10.12 English version of job ads

Where a job ad lists English as a language, we show it in English on the English version of our website. For this, a language model automatically translates the title, the ad text, the skills you entered yourself and your company's mission from German – after publishing and after every change to these texts. The language model receives exactly these texts, and with them any details of persons contained in the ad text (such as the name of a contact person); we do not transmit any other details from the ad or from your account for this purpose. The providers are the same as under section 10.5; here too, they do not process the transmitted content to train their models. Your original remains unchanged and stays on the German version of the website; below the translated ad we point out the automatic translation and link to the original. We also show the English version in lists, notifications and emails to job seekers who use our website or our emails in English. We store it with the ad and delete it with the ad; if the ad no longer lists English as a language, it is removed at the next check. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in making job ads that also address English-speaking job seekers readable for them.

10.13 Your update in the Yeahbase app

In our app for Android and iOS we can sum up, in about half a minute, what has happened since you last listened – for example new applications, interview requests, acceptances or unread conversations – and what comes next; for job seekers we also name new matching job ads. We put the text together ourselves from fixed sentences we have written; no language model is used for it. It contains your first name and, depending on the content, names of companies, titles and locations of job ads and, in the employer view, the first names of applicants. If you wish, we remind you of it every morning at 7:30 am with a push notification; this notification is off until you switch it on in the app. How push notifications are delivered is described in section 14.8.

When you tap “Play” in the app, we have this text read out by an AI voice; the app marks the voice as an AI voice. For this, we transmit the text at that moment to Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA (“ElevenLabs”). Only the text is transmitted, not your email address, no last name and no identifier of your account. ElevenLabs creates an audio file from it; we have the copy that ElevenLabs keeps in its history deleted shortly afterwards, usually after one minute. We store the audio file on our server so that you can listen to it again without it being created anew, and delete it after 25 hours at the latest; in the app it stays in the cache until the next update replaces it or your device clears the cache. If you do not tap “Play”, nothing is transmitted to ElevenLabs; you can also read the text in the app without sound.

So that the next update starts where you left off, we store per account, view (job seeker or employer) and day when an update was ready, whether the push notification was sent, and when you played it and listened to the end; from this we also count how often the update is used. This information does not include the content of the update; we delete it together with your account. Once you have played an update, we also store its text until midnight so that you can listen to it again until then, and delete it no later than one hour after that. To limit costs and misuse, we also count how many texts are read out per account and day; we delete this counter after two days.

The legal basis is Art. 6(1)(b) GDPR: the update is part of our service, and you request the reading yourself. Insofar as the text in the employer view contains first names of applicants, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest and that of employers lies in being informed about applications to their own job ads also by voice. Only the first name is mentioned, no last name and no contact details. The legal basis for the counters is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the service against misuse and in limiting costs.

We have concluded a data processing agreement (Data Processing Addendum) with ElevenLabs. For the transfer to the USA, ElevenLabs states that it is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists; in addition, ElevenLabs relies on the European Commission's standard contractual clauses.

10.14 German version of English profiles

If your profile is written in English, we show it in German on the German version of our website. We check whether it is English without AI, from the sentences in which you describe the entries under “My story”; if they are not conclusive, we go by the language of the website on which you first filled in your profile. A language model then automatically translates from English: your professional title, the entries under “My story” (title, your description in your own words, industry and skills; for entries from the earlier form of the editor the initial situation, your contribution and the outcome), the skills you entered yourself, your certificates, and your hobbies and interests – after publishing and after every change to your profile, and also once a night for profiles where this did not happen. Only texts that have no translation yet are transmitted. The language model receives exactly these texts, and with them everything you wrote in them yourself; we do not transmit your name, your contact details, your bio, your photo, your video or any identifier of your account or profile for this purpose. Terms our website already knows in both languages – such as skills and industries from our selection lists or the names of languages – are translated without a language model. The providers are the same as under section 10.5; here too, they do not process the transmitted content to train their models.

Your original remains unchanged: you always edit your own version, and the English version of the website keeps showing it. We show the German version where others see your profile on the German website, for example on your profile page, in the candidate search and with your applications; on your profile page we point out the automatic translation below the profile and link to the original. We store the translation with your profile and delete it with your profile; if you rewrite your profile in German, it is removed at the next check.

The legal basis is Art. 6 (1) (b) GDPR: we show your published profile to employers so that they can find you, and this includes enabling employers who use our website in German to read it in their language. The translation is therefore part of the service for which you publish your profile with us.

11) Online Marketing

11.1 Consent as a prerequisite

We use the services for reach measurement, conversion tracking and retargeting described in sections 12 and 13 only with your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Without your consent, none of these services is loaded in your browser, and our server does not transmit any events to the providers. We do not upload customer lists containing e-mail addresses or other contact details to any provider for advertising purposes.

11.2 Revocation and its effect

You can revoke your consent at any time with effect for the future, via the "Cookie settings" link in the footer of every page or in your account (section 15.1). Once revoked, the services concerned are no longer loaded from the next page load onwards. If you are signed in to your account when you revoke, we also discard the details our server holds for the server-side transmission to Meta (section 13.1) about transactions of your account that have not yet been reported; those transactions are then no longer transmitted.

A revocation does not act retroactively: events transmitted with your consent before the revocation remain lawfully processed (Art. 7(3) sentence 2 GDPR) and are stored by the providers under their own rules. With Meta, your browser may remain part of a website audience for up to 180 days after the last page view recorded with your consent, because Meta does not offer the removal of individual persons from such audiences; no new page views are added after the revocation.

12) Web Analytics Services

12.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables an analysis of your use of our website.

When you visit the website, Google Analytics 4 sets cookies, which are stored as small text modules on your end device and collect certain information about your use, such as the pages accessed and the approximate region of access. According to the provider, Google Analytics 4 does not log or store IP addresses; they are only used briefly to derive approximate location data and, for accesses from the EU, are processed on servers within the EU.

The information is transmitted to Google servers and further processed there. Transfers to Google LLC, based in the USA, are also possible.

Google uses the information collected on our behalf to evaluate your use of the website and to compile reports on website activities for us. The data collected at user and event level is stored for a period of two months and then deleted; aggregated statistics without personal reference may persist beyond that.

All processing operations described above, in particular the setting of cookies on the end device used, will only take place if you have given us your express consent to do so in accordance with Art. 6(1)(a) GDPR. Without your consent, Google Analytics 4 will not be used during your visit to the site. You can revoke your consent at any time with effect for the future. To exercise your right of revocation, please deactivate this service via the "cookie consent tool" provided on the website.

We have concluded a data processing agreement with Google which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

Further legal information on Google Analytics 4 can be found at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy?hl=de&gl=de and at https://policies.google.com/technologies/partner-sites

13) Retargeting/ Remarketing and Conversion Tracking

13.1 Meta Pixel

Within our online offering, we use the "Meta Pixel" service of the following provider: Meta Platforms Ireland Limited, 4 Grand Canal Quare, Dublin 2, Ireland ("Meta").

If you click on an advertisement placed by us on Facebook and/or Instagram, the URL of our linked page is extended by a parameter with the help of the "Meta Pixel". After the redirection, this URL parameter is then entered in the user's browser by a cookie that our linked page itself sets.

On the one hand, this enables Meta to identify the visitors of our online offering as a target group for the display of advertisements (so-called "ads"). Accordingly, we use the service to display the Facebook and/or Instagram ads placed by us only to those users who have also shown an interest in our online offering or who have certain characteristics (e.g. interests in certain topics or products determined on the basis of the websites visited) which we transmit to Meta (so-called "custom audiences").

On the other hand, the "Meta Pixel" can be used to track whether users were redirected to our website after clicking on an advertisement and which actions they carry out there (so-called "conversion tracking").

For this conversion tracking, we additionally transmit certain events directly from our server to Meta (the so-called "Conversions API"). An ad blocker or technical restrictions of the browser can prevent the "Meta Pixel" from reporting an event; the server-side transmission closes this gap. Both reports carry the same event identifier, so Meta counts an event reported twice only once. As part of the server-side transmission, we send to Meta for each event:

the type of event (e.g. purchase, published job ad, created profile) together with its time and event identifier,
for purchases, the order value, the currency and the purchased products,
your email address and your user identifier, each exclusively in a form hashed using the SHA-256 procedure, i.e. transformed irreversibly,
the IP address and the browser identifier (user agent) of your device, and
where present, the identifiers from the cookies set by Meta.

The data we transmit thus relates to your user account and is not anonymous to us. Your email address never leaves our server in plain text; however, Meta can match the hashed identifiers against existing user profiles. The data is stored and processed by Meta, so that a connection to the respective user profile is possible and Meta can use the data for its own advertising purposes.

All processing operations described above, in particular the setting of cookies for reading information on the end device used and the server-side transmission via the "Conversions API", will only be carried out if you have given us your express consent to do so in accordance with Art. 6(1)(a) GDPR. Without your consent, our server does not transmit any events to Meta. You can revoke your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

The information generated by the "Meta Pixel" in the browser and the information transmitted by our server is usually transferred to a Meta server and stored there; in this context, it may also be transferred to servers of Meta Platforms Inc. in the USA.

Storage period: We keep the information required for the server-side transmission (IP address, browser identifier and the identifiers from the cookies set by Meta) on our server only for as long as it is needed to transmit the respective event: we delete it upon transmission, at the latest seven days after the associated payment and, if no payment occurs, at the latest 30 days after the transaction. If a transmission fails permanently, we delete the resulting error data at the latest one day after the final failure. How long Meta stores the transmitted data is governed by Meta's own specifications; the information in Meta's data policy is authoritative in this respect, available at https://www.facebook.com/privacy/policy/.

13.2 LinkedIn Insight

This website uses retargeting technology of the following provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

This makes it possible to specifically address visitors of our websites with personalized, interest-based advertising who have already shown interest in our shop and our products. The advertising material is displayed on the basis of a cookie-based analysis of previous and current usage behavior.

In the cases of retargeting technology, a cookie is stored on your computer or mobile end device in order to collect pseudonymized data about your interests and thus to adapt the advertising individually to the stored information. These cookies are small text files that are stored on your computer or mobile end device. You are thus shown advertising that is highly likely to correspond to your product and information interests.

All processing operations described above, in particular the setting of cookies for reading information on the end device used, will only be carried out if you have given us your express consent to do so in accordance with Art. 6(1)(a) GDPR. Without this consent, retargeting technology will not be used during your visit to the site.

You can revoke your consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the "cookie consent tool" provided on the website.

The data may also be transferred to: LinkedIn Corp., USA.

We have concluded a data processing agreement with the provider which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

13.3 Google Ads Conversion Tracking

This website uses the online advertising program "Google Ads" and, in the context of Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). We use the Google Ads service to draw attention to our attractive offers on external websites with the help of advertising material (so-called Google Adwords). In relation to the data of the advertising campaigns, we can determine how successful the individual advertising measures are. In doing so, we pursue the aim of showing you advertising that is of interest to you, making our website more interesting for you and achieving a fair calculation of the advertising costs incurred.

The cookie for conversion tracking is set when a user clicks on an Ads advertisement placed by Google. Cookies are small text files that are stored on your end device. These cookies usually lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the advertisement and was redirected to this page. Every Google Ads customer receives a different cookie. Cookies can therefore not be tracked across the websites of Google Ads customers. The information obtained with the help of the conversion cookie is used to create conversion statistics for Google Ads customers who have opted for conversion tracking. The customers learn the total number of users who clicked on their advertisement and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information with which users can be personally identified. In the context of the use of Google Ads, personal data may also be transmitted to the servers of Google LLC. in the USA.

Details on the processing operations triggered by Google Ads conversion tracking and on Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites

All processing operations described above, in particular the setting of cookies for reading information on the end device used, will only be carried out if you have given us your express consent to do so in accordance with Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

You can also permanently object to the setting of cookies by Google Ads conversion tracking by downloading and installing the Google browser plug-in available at the following link: https://support.google.com/My-Ad-Center-Help/answer/12155656?hl=de

Please note that certain functions of this website may not be available or may only be available to a limited extent if you have deactivated the use of cookies. Google's privacy policy can be viewed here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

13.4 TikTok Pixel

This website uses the conversion tracking technology of the following provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

If you have reached our website from an advertisement on the provider's domain, the success of the advertisement can be tracked with the help of cookies and/or comparable technologies (tracking pixels, web beacons, pings or HTTP requests).

For this purpose, certain end device and browser information, including your IP address where applicable, is read via the tracking technology in order to record and evaluate user actions predefined by us (e.g. completed transactions, leads, search queries on the website, views of product pages). This enables the creation of statistics on usage behavior on our website after redirection from an advertisement, which serve us to optimize our offering.

All processing operations described above, in particular the setting of cookies for reading information on the end device used, will only be carried out if you have given us your express consent to do so in accordance with Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

14) Site Functionalities

14.1 Cloudflare Stream

Videos on our website – company videos in job ads, profile videos and application videos – are stored and delivered via the Cloudflare Stream and Cloudflare R2 (file storage) services of the following provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. An uploaded video may – for instance until it has been taken over into Cloudflare Stream – also be delivered directly as a file from that storage; the provider and the data processing are the same in both cases.

When a video is played, your browser loads it directly from the provider's servers. Your IP address is transmitted in the process. If you upload a video yourself, the provider processes that video on our behalf; for profile and application videos this includes your image and your voice.

The legal basis is Art. 6(1)(b) GDPR insofar as the processing is necessary to perform the contract or your application, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in fast and reliable playback. How long we keep videos is set out in section 17.

We have concluded a data processing agreement with the provider which ensures the protection of our users' data and prohibits unauthorized disclosure to third parties.

14.2 Google Maps API

To enable certain entries in the address form of the ordering process of our web shop to be checked for input errors in real time, we use the services of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Data may also be transmitted to: Google LLC., USA.

The provider validates the address entered, verifies the spelling and, if necessary, adds missing data. In the case of ambiguous addresses, correct alternative suggestions are displayed. For this purpose, the address data you entered is transmitted to the provider, stored there and evaluated.

This processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the proper recording of the customer's correct address data for the conscientious fulfillment of our contractual delivery obligations and for the prevention of problems in the performance of contracts.

The provider processes the data concerned separately, does not merge it with other data sets and deletes it as soon as its status or correctness has been confirmed, but no later than after 30 days.

Further information on Google's privacy policy can be found here: https://business.safety.google/intl/de/privacy/

14.3 jsDelivr

For the country flags in our language selector, we load an icon set via the content delivery network of the following provider: Volentio JSD Limited (trading as jsDelivr), Suite 2a1, Northside House, Mount Pleasant, Barnet, England, EN4 9EB, United Kingdom.

When you access a page, your browser loads those icons directly from the provider's servers. Your IP address and further details sent by your browser are transmitted in the process, such as browser type and version, the date and time of the request and the referring domain. According to the provider, these details are used for statistics and security and are not associated with any individual person. No cookies are set and nothing is stored on your end device.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable display of our language selector. We do not ask for consent for this: because nothing is stored on or read from your end device, Section 25 TDDDG does not apply here. You may object to the processing at any time with effect for the future by sending us an informal objection by e-mail to the address given in our legal notice.

For transfers to the United Kingdom, an adequacy decision of the European Commission is in place, confirming a level of data protection equivalent to European law.

14.4 Zapier

This website uses the services of the following provider for the integration and synchronization of databases and web applications: Zapier Inc., 548 Market St #62411, San Francisco, California 94104, USA

In this process, our processing operations are automated and various workflows are established in order to manage and execute internal processes in our processing system efficiently. Insofar as personal data is also processed in this context, this is done in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in optimizing our internal organization.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

14.5 Microsoft Teams

For conducting online meetings, video conferences and/or webinars, we use this provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA

The provider processes various data, whereby the scope of the data processed depends on which data you provide before or during participation in an online meeting, a video conference or a webinar. Your data as a communication participant is processed and stored on the provider's servers. This may in particular include your registration data (name, e-mail address, telephone number (optional) and password) and session data (topic, participant IP address, device information, description (optional)).

In addition, image and audio contributions of the participants as well as voice inputs in chats may be processed. For the processing of personal data that is necessary for the performance of a contract with you (this also applies to processing operations that are necessary for the implementation of pre-contractual measures), Art. 6(1)(b) GDPR serves as the legal basis. If you have given us your consent to the processing of your data, the processing is carried out on the basis of Art. 6(1)(a) GDPR. You can revoke consent given at any time with effect for the future. Otherwise, the legal basis for data processing when conducting online meetings, video conferences or webinars is our legitimate interest pursuant to Art. 6(1)(f) GDPR in the effective conduct of the online meeting, webinar or video conference.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

14.6 Applications for job vacancies by e-mail

On our website, we advertise currently vacant positions in a separate section, for which you can apply by e-mail to the contact address provided.

Applicants must provide all personal data required for a well-founded assessment, including general information such as name, address and contact options, as well as performance-related evidence and, where applicable, health-related information. Details on the application can be found in the job advertisement.

Upon receipt of the application by e-mail, the data is stored and evaluated exclusively for the purpose of processing the application. In the event of queries, we use either the applicant's e-mail address or telephone number. The processing is carried out on the basis of Art. 6(1)(b) GDPR (or Section 26(1) BDSG), within the meaning of which going through the application procedure is deemed to be the initiation of an employment contract.

Insofar as special categories of personal data within the meaning of Art. 9(1) GDPR (e.g. health data such as information on severely disabled status) are requested from applicants in the course of the application procedure, the processing is carried out in accordance with Art. 9(2)(b) GDPR so that we can exercise the rights arising from employment law and the law on social security and social protection and comply with our obligations in this regard.

Cumulatively or alternatively, the processing of the special categories of data may also be based on Art. 9(1)(h) GDPR if it is carried out for the purposes of preventive healthcare or occupational medicine, for the assessment of the applicant's working capacity, for medical diagnostics, care or treatment in the health or social sector, or for the management of systems and services in the health or social sector.

If the applicant is not selected or if an applicant withdraws their application early, their transmitted data and all electronic correspondence, including the application e-mail, will be deleted no later than 6 months after a corresponding notification. This period is based on our legitimate interest in answering any follow-up questions about the application and, if necessary, in being able to comply with our obligations to provide evidence under the provisions on the equal treatment of applicants.

In the event of a successful application, the data provided will be processed on the basis of Art. 6(1)(b) GDPR (in the case of processing in Germany in conjunction with Section 26(1) BDSG) for the purpose of carrying out the employment relationship.

14.7 Online applications via a form

On our website, we advertise currently vacant positions in a separate section, for which you can apply via a corresponding form.

In the course of submitting the form, the applicant data is transmitted to us encrypted in accordance with the state of the art, stored by us and evaluated exclusively for the purpose of processing the application. The processing is carried out on the basis of Art. 6(1)(b) GDPR (or Section 26(1) BDSG), within the meaning of which going through the application procedure is deemed to be the initiation of an employment contract.

If the applicant is not selected or if an applicant withdraws their application early, the data transmitted via the form and all electronic correspondence, including the application e-mail, will be deleted no later than 6 months after a corresponding notification. This period is based on our legitimate interest in answering any follow-up questions about the application and, if necessary, in being able to comply with our obligations to provide evidence under the provisions on the equal treatment of applicants.

14.8 Yeahbase app for Android and iOS

Our app shows the website in a built-in browser and adds a start screen of its own with the events of your account, push notifications and “Your update” (section 10.13). For everything you do on our website inside the app, the other sections of this policy apply unchanged – with one exception: inside the app we load no web analytics or conversion tracking services (sections 12 and 13) and therefore show no cookie banner (section 15.1); only technically necessary services run there. A consent you gave in a browser is not carried over into the app. The app loads the live chat (section 5.1) only after you confirm the notice shown before it, and it does not remember this: we ask again before every opening. So that the website knows it is running inside the app, the app appends “YeahbaseApp” and its version number to the browser identifier; this lets us hide, for example, purchase paths in the app. Downloading and updating the app is handled by the stores – Google Play of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and the App Store of Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; the privacy notices of the respective store operator apply to that.

Login and app key: In the app you log in on our website as usual; there is no separate app password. After login, the app exchanges the website session for an app key with which it fetches your start screen, your account data, your push settings and “Your update” – the key allows nothing more. We store it as a checksum together with the operating system of your device (Android or iOS), the time of its last use and its expiry date; on your device it lies in the operating system's protected storage. So that you only have to log in once in the app, our website additionally places a login cookie in the app's browser that keeps you logged in for up to 400 days from login – even after a longer break. It contains a random value that only this device has; we store only a checksum of it together with the time of login and of its last use. The key is valid for 90 days; when you use the app, we extend it – at most once a day – back to 90 days; once it has expired, the app receives a new one without you entering your password again, as long as the login cookie is valid. If you log out in the app, we immediately delete the key and the login cookie's checksum; the login cookie is removed from the app and is then no longer valid, not even as a copy. You stay logged in on your other devices. If you change your password or delete your account, we immediately delete all keys and all checksums; expired keys and checksums are deleted daily. If you choose “Remember me” when logging in on the website, it places the same login cookie in your browser; the same applies there. The legal basis is Art. 6(1)(b) GDPR; storing the key and the login cookie on your device is strictly necessary for the app function you requested (Section 25(2) no. 2 TDDDG).

Push notifications: The app can notify you on your device when something happens in your account: about applications and job ads (for example a new application to your ad, an interview request, an acceptance or a rejection), about new messages, about the Apply Agent and – only if you switch it on – about “Your update”. You decide in two places whether you receive notifications: at the first start your device asks whether the app may show notifications, and in the “Account” tab of the app you switch each of the four kinds on or off individually. The first three kinds are on as soon as you allow notifications on the device; “Your update” stays off until you switch it on. A notification says what happened in the same words as your start screen: it may contain the name of a company, the first name of an applicant, the title of a job ad, the name of the sender and, for messages, the first 100 characters of the text; it does not mention payment matters. Tapping it opens the matching page in the app.

So that notifications reach your device, the app registers it with us as soon as you have allowed notifications: it obtains a push token from the push service of our provider Expo (see below) and transmits this token, the operating system and the app's language to us. The push token identifies the app on exactly this device; it contains neither your name nor your phone number or any other identifier of your device. The app does not read any further device identifiers – such as the advertising ID or the serial number. We store the push token with your account and the app key under which it was registered, and delete it together with that key (that is, on logout, after a password change, after the key has expired and with your account), as well as when the app unregisters your device because you have switched notifications off in your device's settings (see below), and when the push service tells us that the app on the device can no longer be reached, for example because you have deleted it. If another person logs in on the same device, the token passes to their account: notifications only ever go to the account last logged in on the device.

Each notification goes from our server to the push service of 650 Industries, Inc. (“Expo”), 624 University Ave, Palo Alto, CA 94301, USA, which passes it on to the push service of your device's operating system: on Android to Firebase Cloud Messaging of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on iOS to the Apple Push Notification Service of Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA (for users in the European Economic Area, Apple names Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, as the controller). Expo receives the push token, the title and text of the notification, the page a tap opens and, for messages, the number of your unread conversations for the badge on the app icon; according to its own statement, Expo stores the content only until it has been handed over to Google or Apple, and keeps the delivery receipts for 24 hours. Google or Apple receive the notification including its content and the identifier of your device for their push service; on Android, Google creates an installation identifier for this (Firebase Installation ID), which Google states it stores until it is deleted via the Firebase interface.

All three services may transfer data to the USA: Expo and Google LLC are certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists; Expo processes the notifications on our behalf on the basis of its terms, which include the European Commission's standard contractual clauses, Google's data processing terms apply to Firebase Cloud Messaging, and Apple states that it bases transfers on standard contractual clauses. We do not learn whether a notification was displayed on your device; we only ask Expo whether Google or Apple accepted it, and record a refused delivery together with the last eight characters of the push token.

The legal basis for notifications about your applications, job ads, messages and the Apply Agent is Art. 6(1)(b) GDPR: they are part of our service, and you control them yourself – on the device and in the app. The same applies to “Your update”, which you switch on specifically. Insofar as a notification to employers names the first name of an applicant, or a notification to job seekers names the sender of a message, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest and that of the recipients lies in being informed promptly about applications to their own job ads or about the status of their own applications and new messages. We base the transfer to Expo, Google and Apple on Art. 6(1)(f) GDPR; our legitimate interest lies in being able to deliver notifications at all – there is no other way onto an Android or iOS device. If you switch off a kind of notification in the app, we save that in your account settings and send nothing more about it to the push services. If you switch notifications for the app off entirely in your device's settings, your device no longer shows them, and the app unregisters your device with us the next time you open it with an internet connection; we then delete the push token and send nothing more to the push services. Until then, the push services keep receiving the notifications, as they also do if you only switch off individual categories or alert styles there. If you allow notifications again later, the app registers your device again the next time you open it.

What else the app stores, and what it does not: On your device, besides the app key, the app remembers which view (job seeker or employer) you last chose, whether you prefer the light or the dark appearance and, once it registers your device with us for notifications, its push token, so that it can unregister the device again (it deletes the token once it has unregistered your device or you log out of the app); the audio file of your update lies in its cache (section 10.13), and the cookies of our website lie in the app's browser as in any other browser (section 4). The app's language follows the language of your device (German, otherwise English); we receive it only so that notifications arrive in your language as long as you have not chosen a language on Yeahbase. The app requests no permission for camera, microphone, location or contacts, uses no analytics, advertising or crash reporting services and does not read an advertising ID. We store your chosen view and your push settings in your account settings; requests from the app appear in our server log files like requests to the website (section 2). You can also delete your account from within the app (“Delete account” in the “Account” tab leads to the account settings); app keys and push tokens are deleted along with it.

14.9 Interface for AI assistants (job connector)

At yeahbase.com/mcp/jobs we provide a read-only interface through which AI assistants (for example Claude by Anthropic or ChatGPT by OpenAI) can search and retrieve our public job ads. The interface returns only content that is also shown on the public ad pages, and only ads that are already visible to everyone; job seeker profiles and the employers' internal contact addresses are not included. No sign-in is required.

To measure usage, we count each call with the tool used, the assistant software and a coarse topic class of the search (for example “closer” or “nursing”). We do not store search texts, IP addresses or any other details about the person asking; the server log files described in section 2.1 arise as with every request. To prevent overload, we count the calls per IP address for one minute at a time. For this we do not store the address itself but a keyed hash of it, which we no longer use once the minute has passed. Links from the interface to an ad carry an identifier of the assistant. If you open an ad through such a link and apply to that ad in the same session, we store this origin on your application (for example “connector-claude”). The session ends after 24 hours without activity. The legal basis is Art. 6 (1) lit. f GDPR, based on our legitimate interest in measuring the reach of our ads and the effect of this channel. The origin remains stored with the application and is subject to its deletion periods. Which data the respective assistant processes itself follows from its provider's privacy policy.

14.10 Teams

Companies can run a team on Yeahbase. You belong to a company’s team if you accepted an offer from that company in the Job Hub, followed an invitation, or an admin confirmed your request. Admins are the people who manage the company account. They run the company’s job ads together: every admin sees and edits all of the company’s ads and the applications on them, receives the notices about new applications and can write to applicants. If an ad names its own application address, the e-mails about new applications and about an accepted offer go to that address instead. When an admin’s account is deleted, their ads and the applications on them stay with the company as long as it has another admin; otherwise we delete the company with its ads and applications.

Company inbox: Messages about one of the company’s job ads run in the company’s inbox, as do conversations an admin holds for the company – such as about a candidate’s profile – and messages to admins who use Yeahbase only as an employer. When someone becomes an admin, their earlier conversations about the company’s ads move there too. Every admin sees these conversations and can answer; each message shows which admin wrote it, and applicants see that name too. Whether a message has been read, or a conversation archived or deleted, applies to all admins alike. We inform every admin about new messages in the company inbox by push notification in the app (section 14.8) and by e-mail reminder. Conversations from before the company inbox belong to the company’s inbox by the same rules: an admin’s conversations about one of the company’s ads or about a candidate’s profile, and all conversations of admins who use Yeahbase only as an employer. If an admin’s account is deleted, the company inbox’s conversations stay with the company as long as it has another admin – including the messages that admin wrote in them, which then show “Former team member” instead of the admin’s name. Your own conversations as a job seeker stay in your personal inbox; under “Use Yeahbase as” you switch between your inboxes.

Team list: Under “My teams” you see the first and last names and profile pictures of the admins and of the other members of your team; they see yours in the same way. The admins see the same list and, in addition, since when someone has been part of it. The list does not show e-mail addresses. Your profile’s private mode hides your name and picture only from visitors who are not signed in; your team sees both. We do not show the picture of a profile we have suspended.

Invitation by e-mail: An admin can invite a person by entering their e-mail address. We store the address, who invited, when, and what became of the invitation. Before it is sent, we have MailerSend check whether the address can receive mail (section 15.3); only the address is transmitted for this. The invitation names the company and the inviting person and contains a personal link that is valid for 30 days. The admin can send a reminder at most once a day. Anyone signed in with an account under a different address sends a request via the link. If an account already exists for the invited address, the invitation also appears under “My teams”; a click on “Ask to join” there sends a request.

Confirmation before the first invitation: Before an admin invites for the first time, passes on the team link or confirms a request, they confirm once that they invite only people who work for the company. We store who confirmed this, when, for which company and in which version, until the admin’s account or the company is deleted.

Team link and request: Companies can pass on a team link. Whoever opens it sends a request with their account, including an account they create in the process. The admins see the requesting person’s name and profile picture, or their e-mail address if the account has no name, and confirm or decline.

Notifications: The admins receive an e-mail when someone sends a request or accepts an invitation. Whoever sent a request receives an e-mail when an admin confirms it. These e-mails are sent via MailerSend (section 15.3).

Legal basis: For account holders, the legal basis is Art. 6(1)(b) GDPR. Teams are part of our service, and you decide yourself whether you join or leave again. For an invitation to an address without an account, the legal basis is Art. 6(1)(f) GDPR. The legitimate interest of the inviting company lies in bringing colleagues into its team, ours in offering this feature. You can decline the invitation or object under Art. 21 GDPR.

Storage period: We delete invitations and requests six months after they were accepted, declined, withdrawn or expired. Open requests remain until an admin answers them. Once a team connection has ended, no one sees it any more; it stays stored until your account is deleted. If your account is deleted, we delete your requests and the invitations you accepted along with it.

14.11 Team feedback

Companies can ask their team on Yeahbase for anonymous feedback (“team feedback”). If a company switches it on, you as a team member can give the company feedback every three months if you wish – at the earliest three months after an accepted offer in the Job Hub or six months after an invitation or request. The company’s admins give no feedback. You rate up to ten points, at least three (for example pay, onboarding, leadership), each as “good”, “neutral” or “could be better” and answer whether you would recommend the company. There is no free text. We store your answers, the company, your account, your team connection and the time; for the company also which admin switched team feedback on and when. Once sent, your feedback stays as it is. While you can give feedback, we open the feedback page on your first visit of the day to Yeahbase; “Later” takes you straight on to the page you wanted to open – at most three times in three months and at most once a week. For this we store when we asked you and delete it after three months. The company does not remind you and does not learn whether or when we asked you.

What the company sees: Combined results only, and only from three responses on – per point only from three answers to that point. New responses always enter the results in threes, so that no single answer can be read out of them. The company never sees a single response, never who answered and never when. The results can earn a seal “Recommended by the team”: if at least 75 % of those answering recommend the company, we show the seal with the share (for example “8/10”), the number of responses and the month on the company’s job postings, on its company page and – if the company embeds the code – on its own website. Also public are only the points that at least 75 % rated “good”. The seal cannot be bought and feeds neither into matching nor into the order of search results. Yeahbase computes the figures; Yeahbase reviews a company’s first seal by hand before it is published.

Before we store your feedback: So that only genuine team members give feedback, we ask you once for two things when you send your first feedback. Until then your answers stay in your browser only. First, a picture for the team list – only if your account has none yet; it is your account photo (section 7) and, like every account photo, appears in the team list and in your profile, never with your feedback. Second, you confirm your mobile number with a code by SMS. If your profile already has a mobile number, we fill it in; you can change it. For this we transmit the number to our SMS provider seven communications GmbH & Co. KG, Kiel, Germany, which checks the type of line (mobile, landline, internet number) and delivers the SMS; we accept mobile numbers only. We do not store the number itself. At seven, the number, the text of the SMS and whether it was delivered stay in the sending log for seven days, so that we can look into delivery problems; seven then deletes them. For billing, seven keeps the recipient number (possibly shortened) and the time of sending for up to 60 days after billing, or until an objection to the bill is settled. We store only a check value (hash) formed with a secret key, so that one number counts for one account only. With your response we also keep the check value for three months, even if you delete your account, so that one number counts only once per period for a company; after that we delete it there. Neither your company nor other users see the number or the check value. The code expires after ten minutes. So that nobody is flooded with codes and the SMS costs stay limited, we count the codes requested per account and per number (by its check value) and delete these counters after 24 hours.

Review and report: We review teams and responses with visible and invisible methods. Invisible means: we look at data we store anyway, such as when accounts were created, team connections came about and responses were given. Team members can tell us about any person in their team list that this person does not work at the company (“does not work here”). We store who reported whom and when; the company learns nothing of it. Our support receives an e-mail about it via MailerSend (section 15.3), with ID numbers instead of names. In case of irregularities we may ask a person or the company individually for evidence of the working relationship, such as the first page of their employment contract with amounts redacted (clause 3.6 of the terms of use). We look at such evidence only for this review and delete it immediately afterwards; we do not request payslips. If a response turns out not to be genuine, it no longer counts; it stays stored internally with that note.

Legal basis: For your feedback, the question on a visit and the combined results the legal basis is Art. 6(1)(b) GDPR – team feedback is part of our service, and whether you give feedback is your decision. For the picture in the team list, the confirmation of the mobile number, the reports and the review of evidence the legal basis is Art. 6(1)(f) GDPR; our legitimate interest and that of companies and job seekers lies in seal and results reflecting genuine team members; for the code counters, also in limiting abuse and cost.

Storage period: We store responses as long as the company exists on Yeahbase; we delete them with the company. If you delete your account, your response remains without reference to your account (the answers and their time, for the results; the check value of the number until the end of the three months). We store the check value of your mobile number until your account is deleted. We store a report until the account of the reported person is deleted; if the reporting person’s account is deleted, the report remains without reference to them.

15) Tools and Miscellaneous

15.1 Cookie consent tool

This website uses a so-called "cookie consent tool" to obtain effective user consent for cookies and cookie-based applications that require consent. We developed this tool ourselves and operate it on our own systems. No external provider is involved, and no data is transmitted to third parties for this purpose.

The cookie consent tool is shown to you as a notice window when you access the site. There you can either consent to all categories with one button or allow only the technically necessary services. The "Settings" button takes you to a second layer where you can enable and disable the "Statistics" and "Marketing" categories individually. There you can also consent to all categories at once with a single control; that shortcut is deliberately less prominent than saving your own selection. There you will also find the "Live chat" switch. It is not a consent category; it only controls whether the chat may be loaded on later visits without asking again (section 5.1), which is why it is stored neither in the cookie nor in the consent log. All cookies and services requiring consent are only loaded once you have released the respective category. If you close the notice window without making a choice, only the technically necessary services are loaded. Independently of this, the live chat may load if you enabled it during an earlier visit – that release is not tied to the consent cookie and persists after it expires, until you take it back via the "Live chat" switch (section 5.1).

To store your decision, the tool sets a technically necessary cookie named "hu-consent" on your end device. It contains the categories you released, the time of your decision, its storage period and a randomly generated consent identifier. The identifier is a random string and contains no information about you as a person. The cookie has a lifetime of 180 days. This lifetime applies equally to consent and to refusal. Once it expires, we ask again.

We are legally obliged to be able to demonstrate the consent given (Art. 7(1) GDPR). We therefore additionally log every decision saved through the tool on our server. The log contains the consent identifier from the cookie, the released categories, the version of the consent texts, the language, the storage period and the time. If you are signed in to your account at the time of your decision, we additionally store the assignment to your account; if you later sign in or create an account in the same browser, we subsequently assign the decision made there to your account. We do not store your IP address or your browser identifier (user agent) in this context.

While you are signed in, your most recent decision applies on all your devices (not in the app, section 14.8): a device without a decision of its own takes it over, and a newer decision replaces an older one on your other devices as soon as you use them again. This applies only while the decision is within its storage period and was given for the current version of this notice; otherwise we ask again. An acceptance you gave as a guest before signing in applies only on the device it was given on – on a shared device we cannot know who clicked; a decline, however, is carried over even then. You can see your current decision in your account under "Consents and confirmations".

The legal basis for this logging is Art. 6(1)(c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on your consent and to be able to demonstrate that consent. In addition, we base the logging on Art. 6(1)(f) GDPR, on our legitimate interest in legally compliant and verifiable consent management.

We keep the log entries for the duration of the respective consent and beyond that for as long as the proof may still be required, in particular until the statutory limitation periods have expired.

You can change or revoke your decision at any time with effect for the future. You will find the "Cookie settings" link permanently in the footer of every page. In your account, you can reach the same setting under "Revoke consent". After a revocation, we stop the transmission to the services concerned immediately. The lawfulness of the processing carried out up to that point remains unaffected.

Benefit with marketing consent: see locked job ads earlier

New free job ads in the sales category are visible for the first 72 hours only to members with a Business plan (right away) and a Pro plan (after 24 hours). Everyone else sees a preview with a countdown during that time. If you have released the "Marketing" category, you can unlock such an ad right away on request, up to 5 ads within 30 days. The unlock is a voluntary benefit and not a condition for using the website: without consent you see the same ad once the waiting time has passed or with a subscription. We only unlock after you have clicked "Unlock" on the preview and granted the marketing consent; we do not ask for your consent again on our own.

We store which ads you have unlocked separately from your consent: in an encrypted cookie named "yb-job-unlocks" that only our server can read (lifetime 30 days from the last unlock) and, while you are signed in, additionally in your account. The account entry makes an unlock apply on your other devices; the cookie keeps your allowance from starting over when you sign out. Only the identifier of the ad and the time of the unlock are stored. The legal basis is Section 25(2) no. 2 TDDDG, because the storage is necessary to show you the unlock you expressly requested, together with Art. 6(1)(b) GDPR for signed-in users and Art. 6(1)(f) GDPR for guests. An unlock remains in place even if you later revoke your consent; new unlocks require an active marketing consent. The unlock is neither recorded in the consent log nor transmitted to advertising partners. We delete entries in your account 30 days after the unlock, and at the latest together with your account.

Benefit with marketing consent for employer accounts: Credits

If you are signed in with an employer account and have released the "Marketing" category, we credit your account 10 Credits every 30 days for as long as that consent stands. Credits are a discount on future purchases on our platform and are not paid out (section 5 of our terms and conditions). The credit is a voluntary benefit and not a condition for using the website or your account. Only a decision made in your signed-in account counts, for example via the cookie settings in your account settings; a decision you made as a guest before signing in does not trigger a credit. We do not ask for your consent again on our own; the offer is shown in your account settings and on the page where Credits can be purchased. If you revoke the consent, future credits end; Credits already granted remain yours. Each credit is recorded in your Credit history with a reference to the matching entry in the consent log; nothing about it is transmitted to advertising partners. The legal basis for the credit and its booking is Art. 6(1)(b) GDPR, because it fulfils the promise in section 5.5 of our terms and conditions that you took up with your consent, together with Art. 6(1)(f) GDPR on the basis of our legitimate interest in recording the consideration for a consent in a traceable way (Art. 7(1) GDPR). The consent itself is unaffected: it is voluntary, can be revoked at any time and is not a condition for your account.

15.2 Cloudflare

For security purposes, this website uses the service of the following provider: Cloudflare, Inc., 101 Townsend St. San Francisco, CA 94107, USA.

The provider protects the website and the associated IT infrastructure against unauthorized third-party access, cyberattacks, and viruses and malware. We collect the IP addresses of users and, where applicable, further data about your behavior on our website (in particular URLs accessed and header information) in order to detect and ward off illegitimate site access and threats. In this process, the collected IP address is compared with a list of known attackers. If the collected IP address is identified as a security risk, the provider can automatically block it from accessing the site. The information collected in this way is transferred to a server of the provider and stored there.

The data processing operations described are carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interests in protecting the website against harmful cyberattacks and in maintaining structural and data integrity and security.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

15.3 E-mail delivery

To send our e-mails – such as registration confirmations, notifications about applications and orders, and the advertising e-mails covered in section 8 – we use the service of the following provider: MailerSend, Inc., 228 Park Ave S, PMB 54955, New York, NY 10003-1502, USA.

On our behalf, the provider processes your e-mail address, the content of the message in question and technical delivery data, such as whether an e-mail could be delivered.

The legal basis is Art. 6(1)(b) GDPR insofar as the e-mail is necessary to perform the contract or your application, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in reliable e-mail delivery.

We have concluded a data processing agreement with the provider which ensures the protection of our users' data and prohibits unauthorized disclosure to third parties.

16) Rights of the Data Subject

16.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis us as the controller with regard to the processing of your personal data, whereby reference is made to the legal basis cited for the respective conditions of exercise:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to notification pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent given pursuant to Art. 7(3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

16.2 RIGHT TO OBJECT

IF, IN THE CONTEXT OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO FURTHER PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.

17) Duration of Storage of Personal Data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing and — where relevant — additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

When personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

If statutory retention periods exist for data that is processed within the framework of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data will be routinely deleted after expiry of the retention periods, provided that it is no longer required for the performance or initiation of a contract and/or no legitimate interest on our part in the continued storage persists.

In addition, the following storage periods apply to uploaded videos: We delete videos in job advertisements no later than three months after the advertisement has expired or been deactivated. We delete application videos six months after the application process has concluded (for example through rejection, withdrawal or hiring). We delete profile videos as soon as you replace or remove them, and at the latest when your account is deleted. Technical playback copies held with our video service provider are deleted along with them.

When personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

When personal data is processed for the purpose of direct advertising on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(2) GDPR.

Unless otherwise stated in the other information in this declaration on specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Last updated: 27.10.2026

Privacy Policy

1) Introduction and Contact Details of the Controller

2) Data Collection When Visiting Our Website

3) Hosting & Content Delivery Network

4) Cookies

5) Contacting Us

6) Comment Function

7) Data Processing When Opening a Customer Account

8) Use of Customer Data for Direct Advertising

9) Data Processing for Order Handling

10) AI-Assisted Features

11) Online Marketing

12) Web Analytics Services

13) Retargeting/ Remarketing and Conversion Tracking

14) Site Functionalities

15) Tools and Miscellaneous

16) Rights of the Data Subject

17) Duration of Storage of Personal Data

Choose language