Controller
The controller within the meaning of Art. 4(7) GDPR for the processing of personal data on this website and on the AzubiWay platform is:
- Controller
- pivot recruiting GmbH
Straße der Hoffnung 7
64832 Babenhausen
Germany - Represented by
- David Alexander Neu, Marc Trojan
- Telephone
- 06106 6671355
- E-mail for data protection enquiries
- datenschutz@pivot-recruiting.de
These details correspond to those in the legal notice.
Data protection officer
Since identity, health and contract documents are processed extensively in the course of the visa support, it must be examined before going live whether the appointment of a data protection officer pursuant to Art. 37 GDPR in conjunction with §38 Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) is mandatory.
Data protection enquiries reach us at datenschutz@pivot-recruiting.de.
Hosting, server log files and storage locations
The website is operated by a hosting service provider. The platform’s database, file storage and authentication run on Supabase in the EU region Frankfurt am Main.
When a page is accessed, access data is automatically recorded in server log files: IP address, date and time of the request, requested resource, transfer status, amount of data transferred, referrer and the identifier of the browser used. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and uninterrupted operation of the service.
Documents from the visa procedure are held in private storage buckets and can only be retrieved via short-lived signed links.
Contact form
If you write to us via the contact form, we process your name, the name of your organisation, your e-mail address, optionally your telephone number and the content of your message in order to handle the enquiry.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and, insofar as the enquiry is aimed at the conclusion of a contract, Art. 6(1)(b) GDPR. You can withdraw your consent at any time with effect for the future.
Your enquiry is delivered to our team by e-mail and stored in our system. We delete contact requests automatically six months after they arrive. If an enquiry leads to a contract, we keep the related correspondence for as long as retention obligations under commercial and tax law require.
To protect the form against abusive mass submissions, we limit the number of enquiries per sender and per e-mail address. For this purpose we store, for no longer than 24 hours, a checksum of your IP address and your e-mail address formed with a secret key (HMAC), from which these details cannot be derived. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the form and our mailboxes against misuse.
User account and use of the platform
For the use of the platform, we process different categories of data depending on the role:
- All roles: e-mail address or telephone number for signing in with a one-time code, language choice, notification settings, times of account use.
- Apprentices: basic personal data, date of birth, photo, introduction video, schooling and experience, preferred occupations, language level and language certificates.
- Companies and language schools: company or school data, documents for verification, job postings, contact persons.
- Procedure documents: training contract, confirmation of registration, prior approval, passport data, certificates, proof of financial means and other documents of the visa procedure.
- Communication: chat messages including machine translation, comments on tasks, interview appointments.
The legal basis is Art. 6(1)(b) GDPR for the performance of the user agreement, Art. 6(1)(c) GDPR for legally required evidence and Art. 6(1)(a) GDPR for consents obtained separately during onboarding, for example for the publication of the introduction video and for the machine translation of messages.
Full contact details of apprentices only become visible to companies once a procedure has been opened following an acceptance. This limit is enforced in the database through access rules.
Recipients and processors
We use the following service providers, which process data on our behalf. A data processing agreement pursuant to Art. 28 GDPR is in place with each of them. Recipients other than those named here and in the following section do not receive your data; in particular, we do not use any analytics or advertising services.
Vercel
The provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel provides the website and the web application and delivers them via a worldwide network of servers; the server-side functions run in the Frankfurt am Main region. In the process, the access data mentioned above is processed. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in fast and secure delivery of the service. For transfers to the USA, Vercel is certified under the EU-U.S. Data Privacy Framework; in addition, the Standard Contractual Clauses of the European Commission apply. Further information: vercel.com/legal/privacy-policy.
Supabase
The provider is Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. Supabase operates the platform’s database, file storage, sign-in and background processes; all account, profile and procedure data is held there. The data is stored in the EU region Frankfurt am Main. The legal basis is Art. 6(1)(b) GDPR. Insofar as Supabase may access data from third countries for maintenance and support, the Standard Contractual Clauses of the European Commission apply. Further information: supabase.com/privacy.
Resend
The provider is Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. We use Resend to send e-mails: sign-in codes, notifications, deadline reminders and the forwarding of enquiries from the contact form. The e-mail address, name and content of the message are processed. The legal basis is Art. 6(1)(b) GDPR. Processing takes place in the USA; Resend is certified under the EU-U.S. Data Privacy Framework, and in addition the Standard Contractual Clauses of the European Commission apply. Further information: resend.com/legal/privacy-policy.
DeepL
The provider is DeepL SE, Maarweg 165, 50825 Köln, Germany. DeepL machine-translates chat messages, job postings and statements of reasons between German, Vietnamese and English. Only the text to be translated is transmitted, without names or contact details of the persons involved; DeepL does not use it to train its models. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which we obtain separately during onboarding. Processing takes place in the EU. Further information: deepl.com/en/privacy.
Expo
The provider is 650 Industries, Inc., 624 University Avenue, Palo Alto, CA 94301, USA. We use Expo’s push service to deliver notifications to the mobile app, for example new messages, deadlines and job suggestions. The device identifier for notifications (push token) and the content of the notification are processed. Expo forwards the notification to the operating system’s delivery service: on iPhones to the Apple Push Notification Service of Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA, and on Android devices to Firebase Cloud Messaging of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you give in the app and can withdraw at any time in the device settings. For transfers to the USA, Expo is certified under the EU-U.S. Data Privacy Framework. Further information: expo.dev/privacy.
Mapbox
The provider is Mapbox, Inc., 1133 15th Street NW, Suite 825, Washington, DC 20005, USA. Mapbox provides the map display that allows apprentices to view training positions on a map in the app. When the map is loaded, the IP address, information about the app and device, and the map section displayed are transmitted to Mapbox; the app does not query your device’s location. Mapbox deletes IP addresses after 30 days. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in a clear presentation of the offers. For transfers to the USA, Mapbox is certified under the EU-U.S. Data Privacy Framework; in addition, the Standard Contractual Clauses of the European Commission apply. Further information: mapbox.com/legal/privacy.
Transfer to authorities and parties involved in the procedure
The visa procedure under §16a Residence Act (Aufenthaltsgesetz, AufenthG) cannot be carried out without passing on documents. Depending on the stage of the procedure, data is transferred to the following bodies: the body responsible for the training (for example the Chamber of Industry and Commerce [Industrie- und Handelskammer], the Chamber of Crafts [Handwerkskammer] or the Chamber of Agriculture [Landwirtschaftskammer]), the International Placement Services (Zentrale Auslands- und Fachvermittlung) of the Federal Employment Agency (Bundesagentur für Arbeit), the vocational school or nursing school, the German Embassy in Hanoi or the Consulate General in Ho Chi Minh City, including the service provider commissioned there, the competent foreigners authority (Ausländerbehörde) and the statutory health insurance fund.
The legal basis is Art. 6(1)(b) and (c) GDPR. In each case, data is transferred only to the extent that the receiving body requires for the specific application.
Transfer to Vietnam
Apprentices and partner language schools are located in Vietnam. There is no adequacy decision of the European Commission pursuant to Art. 45 GDPR for Vietnam.
Insofar as data is transferred there, we base the transfer on appropriate safeguards pursuant to Art. 46 GDPR, in particular standard contractual clauses, or on Art. 49(1)(b) GDPR where the transfer is necessary for the performance of the contract with the data subject.
Retention period and deletion
We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention periods.
- Accounts can be deleted by their holders themselves at any time. The deletion takes effect immediately; the data is permanently removed after thirty days.
- Procedure documents remain stored for the duration of the ongoing procedure and thereafter for as long as retention obligations under commercial and tax law exist.
- Contact form enquiries are deleted automatically six months after they arrive.
- Checksums used to limit contact requests are deleted after 24 hours at the latest.
- Server log files are deleted after a short period.
Your rights
You have the following rights vis-à-vis the controller:
- Access to the data processed (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on a legitimate interest (Art. 21 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
Right to lodge a complaint with a supervisory authority
Without prejudice to other legal remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your place of residence, your place of work or the place of the alleged infringement.
The authority competent for the registered office of pivot recruiting GmbH in Babenhausen is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit) in Wiesbaden.
Changes to this policy
We amend this privacy policy when the processing or the legal situation changes. The version published on this page at any given time, with the date stated above, applies.