Privacy policy

This site runs without an ad network, without tracking across other domains and without any data transfer to the USA, as long as you do not expressly agree. What does arise is set out here — in full, with purpose, legal basis and retention period.

Controller

The controller for the processing of your data on this website within the meaning of Art. 4 no. 7 GDPR is:

Control-F GmbH, Am Seerhein 6, 78467 Konstanz, Germany
datenschutz@control-f.de

The full provider details — register court, representation, responsibility under § 18 (2) MStV — are in the Legal notice.

Data protection officer

We have not appointed a data protection officer and are not obliged to: fewer than 20 people here are permanently engaged in the automated processing of personal data, and we carry out neither large-scale processing of special categories nor systematic monitoring (§ 38 (1) BDSG, Art. 37 (1) GDPR). Questions about data protection are answered by datenschutz@control-f.de directly.

Your rights

You have the following rights in relation to us at any time. You only have to give a reason where it expressly says so, and you incur no costs.

• Access to whether and which data we process about you (Art. 15 GDPR).
• Rectification of incorrect data and completion of incomplete data (Art. 16 GDPR).
• Erasure, unless a statutory retention obligation stands in the way (Art. 17 GDPR).
• Restriction of processing instead of erasure, if you still need the data (Art. 18 GDPR).
• Data portability in a machine-readable format (Art. 20 GDPR).
• Objection to any processing we base on a legitimate interest — on grounds arising from your particular situation (Art. 21 GDPR).
• Withdrawal of consent with effect for the future, at any time and as easily as it was given (Art. 7 (3) GDPR). For cookies, use the switch under Cookies and storage on your device.

Independently of that, you can complain to a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart. You may also turn to the authority where you live.

Hosting and server log files

This website is served by Cloudflare (Cloudflare, Inc., USA); the piece of software that receives the form runs there too (see Contact form). An identical copy of the pages is held by GitHub Pages (GitHub, Inc., USA). Both are processors under Art. 28 GDPR and both process in the USA; what that means is set out under Recipients and third countries.

Every request creates a log entry at the provider, which no web server does without:

• IP address
• Date and time of the request
• requested address and volume of data transferred
• Status code of the response
• Browser type and operating system, as the browser reports them

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is operating and securing the website — without logs an attack can be neither detected nor reconstructed. The entries arise at the providers and are deleted according to their retention periods; we do not retrieve them and do not combine them with other data.

Cookies and storage on your device

§ 25 TDDDG covers every storing of information on your device and every access to it — cookies as much as localStorage and sessionStorage. Without your consent, either is permitted only where it is strictly necessary for the service you have expressly requested. Everything else we ask about in advance, by opt-in: nothing is preselected, declining is as quick as agreeing, and without a decision nothing is set.

The legal basis for the entries requiring consent is § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR; for the necessary ones, § 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR.

Change settings

The three tables correspond exactly to the three categories in the settings dialogue. The number in the caption is the same one the dialogue names.

Audience measurement

We measure with Matomo, which we host ourselves on the same server. No data is passed to an analytics provider, the IP address is truncated before it is stored, and the evaluation is pseudonymous: we see which pages are read, not who reads them.

Measurement only runs if you have activated the category Statistics (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). Without consent the script is not even loaded — it sits in the document as type="text/plain" and is only executed after consent. You can withdraw your decision under Cookies and storage on your device at any time.

External media and campaigns

On individual pages we embed content from LinkedIn and measure whether a campaign led to a visit. Both run exclusively with the category Marketing, both set cookies from LinkedIn Ireland Unlimited Company, and your IP address is transmitted to LinkedIn in the process.

LinkedIn also processes data in the USA. The basis for that is the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses. A level of protection equivalent to the European one cannot be guaranteed for third countries — which is why this category is optional, off by default, and the site is fully usable without it.

Contact form

If you write to us through the form , we process your details solely to answer the enquiry. The legal basis is Art. 6 (1) (b) GDPR — pre-contractual measures at your request. There is deliberately no consent checkbox: it would feign a choice that does not exist here.

The form carries a hidden field as a spam trap. No human ever fills it in and no assistive technology reads it out; a submission that fills it is discarded silently. There is no captcha and no third party in front of it, and therefore no data transfer to one.

To deliver the form message to our mailbox we use Resend (Resend, Inc., USA) as a processor under Art. 28 GDPR. Delivery runs through the USA region; according to the provider, the service's account data, logs and metadata — and with them your name, your address and the text of your message — are stored there as well. It is therefore a transfer to a third country; it is safeguarded by a data processing agreement with standard contractual clauses under Art. 46 (2) (c) GDPR. If you would like to avoid that, you can reach us at the address and telephone number given on Contact under Direct — that route bypasses the service.

Your message itself then sits in our mailbox in the EU. Once the correspondence is finished we delete it, unless a commercial or tax retention obligation applies.

Applications

We process application documents in order to decide on the employment relationship (§ 26 (1) BDSG, Art. 6 (1) (b) GDPR). Where no appointment follows, we delete the documents six months after the procedure closes — the period covers a possible dispute under the AGG. We keep them longer only if you expressly consent to a talent pool; you can withdraw that consent at any time. What an application needs is set out on Careers.

Through the application form we collect your name, your email address, the role you are applying for, the links you give us and the files you attach — CV, cover letter and optionally a paper. The form asks for nothing beyond that: no photo, no date of birth, no telephone number. Your details and your attachments go to our mailbox as an email; delivery is handled by the same processor as the contact form, Resend (Resend, Inc., USA), which means your documents leave the EU as well. That is a transfer to a third country and is listed under Recipients and third countries as well. If you would like to avoid it, send your documents directly to the postal address in the Legal notice — that route bypasses the service.

We do not store your attachments on this website; they are received, forwarded and not filed. What happens to them after that follows the six-month period in the paragraph above.

Recipients and third countries

We do not sell data and pass nothing to ad networks. Only those who need access for their task have it — and outside the company:

• Cloudflare, Inc. (USA) and GitHub, Inc. (USA), as processors under Art. 28 GDPR, for serving the website (see Hosting and server log files);
• Resend, Inc. (USA), as a processor under Art. 28 GDPR, solely for delivering the messages from the Contact form and the documents from the application form;
• LinkedIn Ireland, but only where you have activated the category Marketing (see External media and campaigns);
• Public authorities, where we are legally obliged to disclose.

A transfer to a third country takes place in three cases: when the website is served, because both providers are based in the USA and every request therefore goes there; at Resend for every message sent through the form; and at LinkedIn, if you have enabled the category Marketing . All three are safeguarded by standard contractual clauses under Art. 46 (2) (c) GDPR. We do not carry out automated decision-making including profiling under Art. 22 GDPR.

Retention periods

We store personal data for as long as the respective purpose requires, and delete it afterwards. The periods at a glance:

Changes to this policy

If what we process changes, this page changes with it. The date at the top of the page says which version you are reading. A change that affects consent you have already given, we obtain again — it does not apply retroactively to anything other than what you agreed to.