Privacy policy

The controller responsible for data processing on this website is:

For all questions about data protection and to exercise your rights, contact us at: amin@nekorpartners.com

This website provides information about our placement of IT freelancers. We process personal data in three situations: when you visit the website, when you write to us via the contact form, and when you register as a freelancer with your CV.

We do not use cookies, analytics or tracking tools, or social media plugins. Fonts are loaded from our own server, not from Google or other third parties. The website language is part of the address; nothing is stored on your device for it.

The website runs on Cloudflare Workers, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit, Cloudflare processes technically necessary data: your IP address, date and time, the requested address, the amount of data transferred, and browser and system information. Without this data the website cannot be delivered or protected against attacks.

In our own logs we have switched off the automatic recording of page requests. Only technical errors and rejected uploads are logged, without names, email addresses or file contents. Instead of the IP address, these entries contain at most a non-reversible hash value. Cloudflare deletes these logs automatically after seven days at the latest.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website. A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46 GDPR).

When you write to us via the contact form, we process your name, your email address, optionally your company, and the content of your message in order to answer your enquiry.

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract, and otherwise Art. 6(1)(f) GDPR (interest in answering enquiries).

The message is not stored on our web server but forwarded directly by email to our mailbox (see section 6). To prevent abuse, your IP address is converted into a hash value when you submit the form and kept in memory for at most one hour to limit the number of requests per sender.

We delete your enquiry once it has been dealt with, at the latest six months after the last contact. If it results in an engagement, the statutory retention obligations for business correspondence apply (§ 257 HGB, § 147 AO).

When you register as a freelancer, we process your first and last name, email address, optionally your phone number and company, your focus areas, your availability, optionally your day rate and a message, as well as your CV as a PDF. The purpose is to suggest suitable projects to you.

The legal basis is your consent under Art. 6(1)(a) GDPR. If your CV contains special categories of personal data, such as information on health or religion, your consent also covers this under Art. 9(2)(a) GDPR. We do not need such information; please leave it out where possible. You can withdraw your consent at any time with effect for the future; an informal email is sufficient. The lawfulness of processing carried out until then remains unaffected.

How the CV is processed: the file is transmitted in encrypted form (TLS). Our server automatically checks that it really is a PDF without active content such as scripts or embedded files, and calculates a checksum. No content is extracted or stored in the process, and no automated assessment of you takes place. The file exists on the server only in memory during this check; no copy and no temporary file is created. It is then forwarded as an email attachment to our mailbox (see section 6).

We only pass your profile on to clients if you have separately agreed to this beforehand for the specific client and the specific project.

We keep your details and CV for six months from receipt and then delete them unless you give us renewed consent. After a withdrawal we delete them without undue delay.

To deliver the forms we use the email service Resend of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. According to Resend, sent messages including attachments are stored for up to 30 days and then deleted automatically. A data processing agreement is in place with Resend. Resend is certified under the EU-US Data Privacy Framework; transfers to the USA are based on Art. 45 GDPR and additionally on standard contractual clauses.

Messages are delivered to our business mailbox, which an email hosting provider operates for us as a processor. Only the founders of Nekor Partners have access. The deletion periods from sections 4 and 5 apply there. Backup copies of the mailbox are overwritten within the provider's retention periods.

If you email us directly, we process your address and the content of the message to handle your request. Legal bases and deletion periods correspond to section 4.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time (Art. 7(3)).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

Providing your data is voluntary and not required by law or contract. Without the details marked as required, however, we cannot process your enquiry or registration. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.