Privacy Policy

The controller is Nomado24 UG (haftungsbeschränkt), Donnersbergweg 1, 67059 Ludwigshafen am Rhein, Germany. Contact for privacy and data protection rights: anton.petuchow@nomado24.de, phone +49 176 38445436. This notice describes processing when you use our website and services.

For an account we process name, email address, password hash, account role and login/security data. Google sign-in supplies the account data you authorise Google to share. The legal basis is Article 6(1)(b) GDPR; security checks serve our legitimate interest in protecting the service (point (f)). Required fields are marked; without them the account cannot be used. Public pages work without an account. Account data remains until account deletion, subject to section 23.

Optional profile information such as qualifications, work history, location and CV is used for the profile, search and application functions you choose (Article 6(1)(b) GDPR). You can edit or remove it. Specially protected data is not required. If you deliberately wish to store such data in a profile CV, we first request separate explicit consent (Article 9(2)(a)). It applies to that file and can be withdrawn by removing it. Applications and AI analysis are separate purposes.

For applications through Nomado24 we store and transmit contact details and selected documents to the named employer (Article 6(1)(b) GDPR). The employer decides on recruitment and explains its own processing. Specially protected data, such as health information, is not needed for our application function. Voluntarily included special data requires separate explicit consent for this application (Article 9(2)(a)). Withdraw by deleting the application in your account or contacting us. External application sites collect data entered there themselves. Contact the employer separately regarding copies it holds. Storing the CV in your profile is a separate purpose.

Messages between applicants and companies are stored and shown to the respective participant for the requested communication (Article 6(1)(b) GDPR). Account deletion removes the user’s message text from remaining conversations. Copies held independently by recipients are not automatically deleted.

Requested search and matching functions compare profile details and search criteria with job listings, including through Microsoft Azure AI and search services (Article 6(1)(b) GDPR). Results are recommendations; Nomado24 does not make solely automated hiring decisions with legal or similarly significant effects. Derived profile features are updated or removed when the underlying data changes or is deleted. See sections 20/21 for Microsoft.

The AI advisor processes your input, conversation history and relevant profile/application information through Microsoft Azure OpenAI to answer your questions (Article 6(1)(b) GDPR). Chats remain until chat or account deletion. Deliberately volunteered special data has separate explicit consent per chat (Article 9(2)(a)); withdraw by deleting the chat or contacting us. Do not enter other people’s sensitive data. Such chats are excluded from additional quality classification and automated titles. Other quality classification records topic and outcome to improve the advisor (Article 6(1)(f)); separate reading of conversation text by our team requires its own consent. Ratings contain no question/answer copy, only an optional fixed error category. Older feedback text and links are removed in monthly cleanup after 180 days; classification results after 24 months. Microsoft processing is described in sections 20/21.

Newsletters, job alerts and optional matching emails use your email address and selected topics/search criteria with your consent (Article 6(1)(a) GDPR). Unless an account is already verified, the address is confirmed by a link. Verified accounts can activate requested alerts directly. Unsubscribe through the email link or account settings. Delivery data and consent records also support delivery, abuse prevention and proof of lawful sending (Article 6(1)(f)). After unsubscribing we retain only necessary evidence during the applicable limitation period and suppression records to honour the choice. Email provider: Resend.

For coworking bookings we process name, contact details, booking dates and payment/booking status and send the selected operator the information needed to provide the service (Article 6(1)(b) GDPR). The operator is responsible for its service and own processing. Reviews are published at your request. Booking and accounting evidence follows section 11; you can request review removal.

Community posts and the displayed author name are public. Processing provides the community (Article 6(1)(b) GDPR) and moderates unlawful or abusive content (point (f), or (c) where required). Account deletion removes your post text and replaces the author link. Other people’s replies remain. Do not publish others’ personal data or specially protected information.

Stripe processes payment and billing data needed for payments. We retain service/plan details, payment status, Stripe identifiers and contract/invoice evidence, not complete card data. Bases are contract performance and statutory retention duties (Article 6(1)(b) and (c) GDPR, including German AO section 147 and HGB section 257). The period depends on document type and statutory starting date. Cancellation and withdrawal declarations are stored with content and receipt time for handling and evidence until applicable limitation/retention periods expire. Account deletion does not prematurely destroy this evidence.

Company profiles, listings and team access support requested employer functions (Article 6(1)(b) GDPR). For team invitations we receive the email address from the inviting company for invitation and access management. Public listings and company details may come from public employer sites, applicant tracking systems and data suppliers. Public professional contact details support our legitimate interest in maintaining an up-to-date job index (point (f)). Request correction or removal through our contact.

We handle enquiries and support using the contact details and content you provide (Article 6(1)(b) GDPR for contract matters, otherwise point (f) to respond). Resend supports email delivery. HubSpot supports customer contacts and, with separate consent, marketing contacts; no HubSpot website tracker is loaded for this. Retention lasts until the enquiry is resolved and necessary evidence periods expire. Do not send information unnecessary for the enquiry.

To approach suitable employers we may process public professional contact and vacancy details from company websites and the Federal Employment Agency job search, plus contact notes. The basis is our legitimate interest in relevant business relationships (Article 6(1)(f) GDPR). This is not blanket permission for advertising calls or emails; German UWG section 7 requirements apply separately. We provide source and processing information within one month of collection, earlier at the first contact or disclosure, unless a statutory exception applies. Untouched contacts without our own contact notes are removed six months after the vacancy was last seen; worked contacts after 24 months without an update or contact. Ongoing business relationships follow contract retention. A suppression record necessary to honour an objection remains.

For audience measurement we use self-hosted Umami on our Azure servers in the EU. Umami sets no cookies and stores nothing on your device. It records pages viewed, referrers, approximate location (country, region, city), device/browser characteristics (browser, operating system, device type, screen size, language), page performance and selected events. Visits are grouped by a hash of IP address and browser identifier with a key that rotates monthly; the IP address itself is not stored. The legal basis is our legitimate interest in understanding and improving how our service is used (Article 6(1)(f) GDPR). You can object at any time (Article 21 GDPR): if Global Privacy Control or Do Not Track is enabled in your browser, we do not load Umami. Cancellation and withdrawal pages are not measured.

With your consent we additionally record feature usage with our own product analytics, which stores pseudonymous identifiers in your browser for this purpose (Article 6(1)(a) GDPR, TDDDG section 25(1)). Free search text and access tokens are removed from URLs before transmission. Product analytics identifiers are detached in monthly cleanup after 13 months; Umami event data is deleted in monthly cleanup after 13 months. Associated session records remain only while more recent events still reference them. You can withdraw consent to product analytics at any time in Cookie settings.

To provide the requested functions reliably and improve them, we also record server-side operations such as registration, applications or payments with their time, status and, where relevant, account/transaction identifier (Article 6(1)(f) GDPR). This adds no storage on your device. Personal links in these product records are removed in monthly cleanup after 13 months; statutory contract records are separate.

Necessary storage enables login, security, requested language/appearance and remembering privacy choices (TDDDG section 25(2)(2); Article 6(1)(b) or (f) GDPR). Optional recognition, product analytics and consent-based advertising require the relevant consent. Separate transmission and fraud-prevention information for Limited Ads is set out in section 26. The Cookie Policy explains our browser storage. Change settings in the footer at any time. Remembering a refusal does not require analytics or advertising consent.

Google Maps loads only after your separate map permission. Google then receives in particular IP address, browser data and the requested map (Article 6(1)(a) GDPR, TDDDG section 25(1)). Map permission is separate from advertising consent. Location/address search also uses OpenStreetMap/Nominatim to resolve the place/address you request (Article 6(1)(b) GDPR). Do not enter additional private information in address search fields.

Microsoft Azure hosts the website, database and files. Our main resources are in the EU; worldwide content delivery and AI processing are separate matters (section 21). Technical logs contain time, request path, IP/connection data and error status for secure operation and troubleshooting (Article 6(1)(f) GDPR). Central Azure log retention is configured to 30 to 90 days; necessary evidence of specific security incidents is kept separately until resolution or the relevant limitation deadline.

Nomado24 may earn a fee from labelled partner/affiliate links. Our click counting and technical redirects support operation and accounting of referrals (Article 6(1)(f) GDPR). After navigation the destination receives normal connection data and processes additional information under its own notice. The former Careerjet integration is described in section 28.

Recipients depend on the service used: Microsoft Ireland Operations Ltd. for hosting, files, search and Azure OpenAI; Resend (Plus Five Five, Inc.) for email; HubSpot Ireland Ltd./HubSpot Inc. for contacts and CRM; Stripe Payments Europe Ltd. and affiliated payment companies for payments; Google Ireland Ltd. for sign-in, maps, consent management and advertising; OpenStreetMap Foundation for location services; Careerjet Ltd. for former optional partner listings. Employers and coworking operators receive the data needed for transactions you request and process it for their own purposes. Technical providers act on our behalf unless responsible for their own statutory or specifically described purposes. Google advertising partners and their roles appear in the consent message’s current vendor list.

Some providers process data outside the EEA. Microsoft safeguards Azure transfers with Standard Contractual Clauses and supplementary measures. Our Azure AI deployments are global; inputs and outputs may be processed outside the EU. Under its terms Microsoft does not train base models on them without permission; security and abuse checks remain possible. Resend (Plus Five Five, Inc.) processes email data in the US; its DPA includes Standard Contractual Clauses. Google advertising services, Stripe and HubSpot provide for the EU-US Data Privacy Framework for covered US transfers and Standard Contractual Clauses for other covered transfers. Careerjet in the UK is covered by the adequacy decision. Request details and a copy of applicable safeguards from us.

MicrosoftResendGoogleStripeHubSpot

Subject to legal conditions you have rights of access, correction, erasure, restriction and data portability. Withdraw consent at any time for the future; earlier lawful processing is unaffected. IMPORTANT: You may object to legitimate-interest processing for reasons relating to your particular situation. You may object to direct marketing at any time without giving reasons. Contact: anton.petuchow@nomado24.de. You may complain to a supervisory authority, including the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate (www.datenschutz.rlp.de). We request identity evidence only as needed to handle a request safely.

We erase or separate data when its purpose ends and no retention or evidence duty remains. Account, chat, application and profile deletion is available through the respective functions or our contact. File and external-service deletion tasks are tracked and retried on failure. Data needed for legal obligations or specific legal claims remains restricted to those purposes. Business content of an ongoing company account and other people’s data is not removed solely because a team member deletes an account. Backups are overwritten in the normal backup cycle; deletions must be reapplied after restoration. Deletion at Nomado24 does not erase independent copies held by other controllers.

Our service is intended for people aged 16 and over. Do not send us personal data of younger children. If we learn of unlawfully collected minors’ data, we review removal and necessary safeguards.

Optional feedback and surveys improve our service (Article 6(1)(f) GDPR). Do not enter unnecessary personal or specially protected data. Free text and contact/device links are removed in monthly cleanup after 24 months; limited response categories may remain for statistics. If you expressly request a reply or permit research contact, we use the supplied address for that purpose with your consent, which you can withdraw at any time.

We use Google AdSense from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on selected pages, including job lists and job details. For consent-based advertising, Google and the partners named in the consent dialog process IP/device data, identifiers, page views and ad interactions for delivery, measurement and, depending on your choice, personalisation (Article 6(1)(a) GDPR, TDDDG section 25(1)).

Once Google’s consent platform has provided information about providers and purposes, Limited Ads may appear without advertising consent. This includes before a decision and after refusal or withdrawal of advertising consent. Limited Ads do not use personalisation based on your previous behaviour. Your consent choices for other purposes remain unchanged.

For Limited Ads, Google still processes the IP address for ad transmission. Google may use cookies, local browser storage and the Shared Storage API exclusively to detect invalid ad traffic and prevent fraud. Scripts and ads may be cached in the browser. Limited Ads are therefore not storage-free. Demand comes from Google and authorised ad buyers. Provider, controller and retention information is accessible through the vendor list in Google’s consent dialog and the linked Google information. Cookie lifetimes for consent-based advertising are not blanket lifetimes for this fraud-prevention storage. Sections 20 and 21 also apply to recipients and international transfers.

For processing to transmit Limited Ads and prevent fraud, we rely on legitimate interests under Article 6(1)(f) GDPR: financing our free job search and protecting Nomado24, advertisers and users against automated or fraudulent ad traffic. For device security access strictly required for these purposes, we rely on TDDDG section 25(2)(2). This access is not used for profiling or personalised advertising.

In “Cookie settings” you can refuse or withdraw consent and use the objection options offered by providers. Section 22 explains your Article 21 GDPR objection rights and how to contact us. We do not request Limited Ads when Global Privacy Control or Do Not Track is enabled. With separate advertising consent, non-personalised ads may still be requested in that case. Google’s consent platform loads before ads; if it fails, our own dialog is available and does not enable Limited Ads. Location options in a partner list do not mean Nomado24 requests your GPS data.

Google: Limited Ads and fraud prevention

During employer registration we separately ask whether we may send an available Google ad-click identifier (GCLID, GBRAID or WBRAID) and registration time to Google Ireland to attribute registrations to our advertising (Article 6(1)(a) GDPR; TDDDG section 25(1) where applicable). Without this optional consent there is no new storage or reporting. Older identifiers without matching consent evidence are excluded from exports. Identifiers are removed in monthly cleanup after 90 days. Withdrawal through the function below or by email prevents further exports; it does not retrospectively invalidate earlier processing. We assist with access/erasure requests for already transferred data.

Job search no longer retrieves additional Careerjet listings. Previously, after explicit consent, search terms, IP address, browser identifier and the general search-page address were sent to Careerjet Ltd., United Kingdom (Article 6(1)(a) GDPR). You can remove a choice still saved in this browser below. Details of previous processing by Careerjet are available at www.careerjet.de/privacy-policy. Returned partner listings were not permanently stored in our job index.

We update this notice when processing changes. Publishing a new notice does not replace required consent or automatically amend existing contracts.

AI CV review, profile autofill and the “Prepare application” feature send text extracted from your file to Microsoft Azure OpenAI. They require separate explicit consent (Article 6(1)(a) GDPR, additionally Article 9(2)(a) for included special data). Applications and ordinary profile storage work without AI analysis. Withdraw in your profile to block further analysis and remove stored analysis content. Consent evidence records time and text version. The CV file and submitted applications are managed separately. Sections 20/21 explain recipients and international processing; exclusively European processing is not promised.

For “Prepare application” we additionally process the selected job ad, your profile details (for example languages, country of residence and preferred way of working) and any notes you choose to enter. From these we create a fit check and drafts of your CV and cover letter. The fit check is not a prediction of whether you will be invited, and we do not use it to make any decision about you. We keep fit checks and drafts in your account until you delete the application or your account, or withdraw your consent. On withdrawal we delete fit checks and drafts; your entries in the application overview remain. To apply the usage limits of free and Pro accounts we additionally store only the time at which you created documents, without any content, also after you delete an application or withdraw your consent, until you delete your account (Art. 6(1)(b) GDPR). PDF and Word files are generated anew for each download and are not stored. We do not pass your documents on to employers; you decide whether and where to use them.

We offer a free, read-only public jobs API (https://api.nomado24.de/api/public/v1/jobs and /api/public/v2/jobs) and a public MCP server (Model Context Protocol) at https://api.nomado24.de/api/public/v1/mcp. Developers and AI assistants such as ChatGPT use them to search published job listings and to retrieve individual jobs and job market statistics. Both work without an account, login or API key, and neither sets nor reads cookies.

Connection data: the API and MCP server use the IP address of the calling device or server only in server memory, to limit requests per address (rate limiting, 15-minute windows). It is not written to our database in the process.

Request content: we use search terms, filters and tool arguments (for example a job ID), as well as the name and version of the client software that the calling application sends, only to answer the request. We do not store them in our database and do not link them to any person or user account.

Usage statistics: we count daily how often each interface and each tool was called. For this we store the day, the name of the tool or interface (for example search_jobs), the count, and the program name that the calling client itself states in its User-Agent header, shortened to a single word (for example chatgpt-user). Because a caller can set this header freely, it can contain arbitrary text. We do not store the full user agent, IP addresses or search terms for this, and the counts are not linked to any IP address or account.

Technical logs: like every request to our servers, calls can appear in Azure technical and error logs with time, request path including search parameters, IP/connection data and status. Section 18 applies to these logs.

The purposes are providing the interfaces, protecting them against misuse and overload, troubleshooting, and measuring which interfaces and tools are used. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in operating a free public interface securely and stably and in measuring its use. You can object on grounds relating to your particular situation (section 22).

If you use nomado24 through an AI assistant (for example ChatGPT by OpenAI), the provider of that assistant is a separate, independent controller for everything you enter there, for your account with it and for your chat history; its own privacy policy applies. The assistant decides which tool arguments it sends to our server. We receive only these arguments and the technical request data described above, not your conversation, your name or your assistant account. Our interfaces need no personal data; please do not include any in search terms.

Answering a request involves no AI service and no other external provider: the search runs on our own database at Microsoft Azure (recipients and international transfers: sections 20 and 21). Apart from our hosting provider Microsoft acting as processor, we do not pass on data from these interfaces and do not use it for advertising or profiling. IP addresses are held only in the server's working memory for rate limiting and are discarded automatically, typically within 30 minutes; logs follow the retention in section 18; the daily usage counts are kept without a fixed deletion period for as long as we need them for usage statistics. Results contain published job listings with links to nomado24.com and aggregate statistics about the jobs on nomado24. If you open such a link, the remaining sections of this policy apply to that visit.