Privacy policy
Version: October 2026. The German version is binding.
Controller
DevNordic Amin Ghiyati Waldeckestraße 28 24939 Flensburg Germany Email: kontakt@devnordic.de
What this is about
TalentHall connects training companies in Germany with applicants from abroad. For this we process the data you provide when signing up, in your listing or company profile and in the chat. We do not sell data and use neither advertising nor tracking.
Hosting
The website, app server, database and file storage run on a virtual server (VPS) in Germany that we operate ourselves, at: Contabo GmbH Aschauer Straße 32a, 81549 Munich, Germany Your IP address is processed for technical reasons to deliver the pages. We do not store access logs. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). A data processing agreement under Art. 28 GDPR is in place with Contabo. All connections are encrypted (TLS/HTTPS).
Sign-up and account
For an account we process your name, email address, password (stored only as a secure hash), account type (apprentice or company) and chosen language. You confirm your email address via a link. Legal basis: Art. 6(1)(b) GDPR (contract for using the platform).
Listings of applicants
In the listing we process the details you provide: first and last name, date of birth, country of origin and city, desired occupation, German level and certificate, availability, driving licence, other languages, texts about you, photos and uploaded certificates. The phone number is optional. Who sees what: · Public and companies not yet approved: only first name and initial of the last name, occupation, German level, place/country and start date. · Companies approved by us: additionally full name, age, photos, texts and documents. · Companies never see your phone number, email address or date of birth. Legal basis: Art. 6(1)(b) GDPR. Please do not provide health data or other particularly sensitive information that is not needed for the application.
Profiles of training companies
We process company name, address, industry, apprenticeships offered, contact person with position and phone number, website, description, logo and the uploaded proof (e.g. commercial register extract). Applicants see a company’s name, city, industry, occupations, description, website and logo once it has written to them. Phone number and proof are only visible to our team. Legal basis: Art. 6(1)(b) GDPR.
Review by our team
Before a listing becomes visible or a company is approved, our team reviews the details and sees all data, including phone number and documents. Texts are checked automatically for contact details (phone, email, social media); the result is only a hint, a person decides. We store decisions and reasons as a review log. Legal basis: Art. 6(1)(b) and (f) GDPR (protecting users from abuse).
Messages (chat)
We store messages, attachments, time and read status so that both sides can see the conversation. If a conversation is reported, our team may read it to handle the report. Legal basis: Art. 6(1)(b) GDPR, for reports (f).
Reports
When you report a listing or conversation, we store the reason, your comment and who reported it. The reported person does not learn who reported them. Legal basis: Art. 6(1)(f) GDPR.
Emails
We send emails to confirm your address, reset your password, inform you about decisions on your listing or company and about messages unread for more than 10 minutes. You can turn off the emails about unread messages in the settings. Our emails are processed by: Heinlein Hosting GmbH (mailbox.org) Schwedter Straße 8/9A, 10119 Berlin, Germany A data processing agreement under Art. 28 GDPR is in place. Legal basis: Art. 6(1)(b) GDPR.
Push notifications in the app
If you allow notifications in the iOS or Android app, your device receives an identifier (token) from Firebase Cloud Messaging, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We store this identifier with your account. When a new message arrives, we send the identifier, the sender’s name and the beginning of the message to Google, which delivers the notification to your device. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your device settings. When you sign out, we delete the identifier.
Cookies and local storage
For signing in we set a session cookie that is technically necessary for the service (§ 25(2) no. 2 TDDDG); it applies to talenthall.de and the subdomains app. and api. In the app, a session key is stored on the device instead. Your language choice is stored in your browser’s local storage. We do not use tracking or advertising cookies and load no third-party content; fonts are served from our own server.
Error reports
To find and fix technical errors, the API, the web app and the iOS and Android app send an error report to our own error log (Rustrak), which runs on our server in Germany. A report contains the error message, the location in the code, the page visited and the browser or app version and operating system. We do not send names, email addresses, cookies, form contents or messages; your IP address is only processed for technical reasons during transmission. We keep error reports only as long as we need them to fix the error. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working service).
Recipients
Other users only see your data to the extent described above. Our processors (Contabo, mailbox.org and, for push notifications, Google) process data on our behalf. There is no other disclosure.
Storage period and deletion
We store your data as long as your account exists. You can delete your account yourself at any time in the settings. We then immediately delete the listing or company profile, conversations (also for the other side), uploaded files, push identifiers and the review log. Sessions expire after 7 days without use. Statutory retention obligations remain unaffected.
Your rights
Under the GDPR you have the following rights: · Access to your stored data (Art. 15) · Rectification of inaccurate data (Art. 16) · Erasure of your data (Art. 17) · Restriction of processing (Art. 18) · Data portability (Art. 20) · Objection to processing (Art. 21) · Withdrawal of consent for the future (Art. 7(3)) To exercise your rights: kontakt@devnordic.de
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD) Holstenstraße 98, 24103 Kiel, Germany https://www.datenschutzzentrum.de/