Privacy policy

1. Controller

EGO Management & Marketing GmbH (operator of the HYRR platform)
Basdorferstraße 33, 16348 Wandlitz, Germany
Authorised representative: André Kramer
Commercial register: District Court Frankfurt (Oder), HRB 16158 FF
VAT ID: DE310889057
Phone: +49 151 70051242
Email: support@hyrr.online

2. Overview of processed data categories

Depending on how you use the platform, we process the following categories of data:

Account data: email address, name, password hash, role (candidate / company / admin), language, registration date, verification status.
Candidate profiles: full name, job title, location (optional), CV file, certifications, skills, availability, salary expectations, contact-sharing settings.
Application data: name, email, phone, cover letter, CV file, source (tracking channel), timestamp, status in the application process, internal notes from the company.
Company data: company name, logo, industry, job descriptions, contact persons, billing address, credit balance, transaction history.
Payment data: processed via Stripe Inc. (see § 6). We do not store full payment-instrument details.
Technical access data: posting ID, source, campaign, referrer, landing URL, hashed IP address, user agent, timestamp.
OAuth identities: provider (e.g. Google), provider user ID, email address, display name, last login timestamp.
Communication: email messages (notifications, offers), internal messages between candidates and companies.

3. Purposes and legal bases of processing

3.1 Operating the platform

Processing serves to operate the recruiting platform, manage accounts, jobs, applications and candidate communications, and to ensure technical operations. Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in secure platform operations).

3.2 Candidate profile and application form

When you apply to a job through a HYRR application form, your data is transmitted to the respective company and stored for processing your application. You may then optionally create a free candidate profile to track applications and be discovered by additional companies. Profile creation only happens upon your explicit request. Legal basis: Art. 6(1)(b) GDPR and, where applicable, Art. 6(1)(a) GDPR (consent).

3.3 Company account and job management

Companies use HYRR to create and manage job postings, manage incoming applications, use the candidate pool, and purchase and spend credits. Legal basis: Art. 6(1)(b) GDPR.

3.4 Tracking and performance analytics

For companies, HYRR records the channels (e.g. LinkedIn, Indeed, direct) through which applications arrive. For this purpose, posting IDs, campaign parameters and referrer data are processed. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

3.5 Email communication

We send transactional emails (confirmations, password links, application receipts, notifications). These are technically necessary for platform operation. Legal basis: Art. 6(1)(b) GDPR.

3.6 Security and abuse prevention

To detect and prevent abuse, we process technical access data such as hashed IP addresses and timestamps. Legal basis: Art. 6(1)(f) GDPR.

4. Candidate profile – details

A candidate profile can be created in two ways:

Explicit registration: you create your profile deliberately – via the application form (modal after a successful application) or directly at /candidate.
Internal profile created by a company: companies may create internal candidates manually. These profiles are not public and not linked to a login unless an invitation is sent.

Newly created candidate profiles are by default public and searchable, provided you agreed to this when creating the profile. You can change visibility and searchability at any time in your profile settings.

You can fully delete your profile at any time. All associated data (profile, applications, documents) will then be irreversibly removed.

5. Companies – applicant data and candidate contact

Companies receive access to applicant data exclusively for the purpose of the application process for specific positions. Use of the data for other purposes is prohibited. Each company is itself responsible for the GDPR-compliant processing of applicant data.

Active contact with a candidate (via the offer / request feature) requires the use of credits and prior consent from the candidate. Companies are required to comply with the requirements of employee data protection (§ 26 BDSG, German Federal Data Protection Act) and any other applicable regulations.

6. Credits and payment processing via Stripe

For certain features (e.g. active candidate contact, increased job-posting visibility), companies can purchase credits. Payment processing is handled by Stripe Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA (European seat: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland).

During payment, payment data (card number, expiration date, CVV) is transmitted directly to Stripe and processed there. We do not store full payment-instrument details. From Stripe we only receive a transaction ID, the amount, the status and possibly the last four digits of the card used.

Stripe may process data in the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). More information: stripe.com/privacy. Legal basis: Art. 6(1)(b) GDPR.

7. Google OAuth / Single Sign-On

HYRR offers a sign-in option via Google OAuth 2.0. When you sign in with Google, Google transmits to HYRR: your Google user ID, email address, display name and verification status. We store this data in our database to identify you on future logins. HYRR does not receive access to your Google password or any further Google account data.

Use of Google OAuth is subject to Google's privacy policy: policies.google.com/privacy. Legal basis: Art. 6(1)(b) GDPR.

8. Cookies, local storage and conversion tracking

8.1 Strictly necessary session cookies

HYRR uses strictly necessary session cookies to maintain login state. These cookies do not directly contain personal data, but a randomly generated session ID linked server-side to your account. They are deleted when the browser is closed or you log out. Legal basis: § 25(2) TTDSG in conjunction with Art. 6(1)(f) GDPR (legitimate interest in secure platform operation).

8.2 Local storage of consent status

On our landing pages that embed third-party tracking (see 8.3), we store your cookie decision locally in your browser (localStorage) for a maximum of 365 days. We store only the status ("accepted" or "declined") and the timestamp of the decision. This information does not leave your browser and is strictly required for the consent feature to operate. Legal basis: § 25(2) No. 2 TTDSG (strictly necessary).

8.3 Google Ads conversion tracking (only on advertising landing pages)

On specific landing pages (e.g. /werkstoffpruefer/) that we set up specifically for Google Ads campaigns, we use Google Ads conversion tracking (gtag.js) to measure the effectiveness of our advertising. No third-party tracking is performed in any other area of hyrr.online.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA).

Data categories: click IDs (Google Click ID / GCLID), IP address (truncated by Google), user agent, referrer, visited landing URL, timestamp, and where applicable a conversion event (e.g. profile creation).
Purpose: measuring the effectiveness of our online advertising and optimising campaigns; HYRR receives only aggregated evaluations and does not build profiles of individual persons.
Legal basis: § 25(1) TTDSG in conjunction with Art. 6(1)(a) GDPR (consent). The tracking script is loaded only after your explicit consent via the cookie banner.
Storage period: conversion cookies are stored in your browser for up to 90 days. Aggregated conversion data is retained at Google according to its retention policy (typically 13 months).
International transfer: Google may transfer data to the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and supplementary safeguards.

8.4 Withdrawal and objection

You may withdraw your consent at any time with effect for the future:

On the landing page: use the "Cookie settings" link in the footer of the respective landing page. The stored status is reset and the cookie banner appears again.
Browser settings: cookies can be deleted in your browser, or tracking scripts blocked (e.g. via browser add-ons).
Directly with Google: deactivate personalised advertising at adssettings.google.com.

Further information on Google's data protection: policies.google.com/privacy. Specific information on Google Ads / conversion tracking: policies.google.com/technologies/ads.

9. Storage periods

Application data: deleted at the end of the respective application process or upon withdrawal/deletion by the user, at the latest after 6 months unless a statutory retention obligation applies.
Candidate profiles: stored permanently as long as the account is active. Deleted immediately and completely on request or upon account deletion.
Company accounts: during the contract term and after termination in accordance with commercial and tax retention obligations (typically 10 years for invoice data).
Payment data (Stripe): transaction records are retained for 10 years pursuant to § 257 HGB and § 147 AO (German commercial and tax law).
Session and security data: technical logs are deleted after no more than 30 days.
Password reset tokens: automatically invalidated after use or after expiry (7 days).

10. Recipients and processors

We use the following categories of service providers:

Hosting / servers: operation of web servers and databases (EU-based).
Email delivery (SMTP): for transactional emails (confirmations, password links, notifications).
Payment processing: Stripe Inc. / Stripe Payments Europe, Ltd. (see § 6).
Sign-in (Single Sign-On): Google Ireland Limited – only if you actively sign in via Google OAuth (see § 7).
Conversion tracking on landing pages (only with consent): Google Ireland Limited (Google Ads) – see § 8.3.

All providers are engaged on the basis of data processing agreements pursuant to Art. 28 GDPR, where they process personal data on our behalf. For international transfers (USA), the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

11. Your rights as a data subject

You have the following rights against us as the controller:

Right of access (Art. 15 GDPR): you can request information about the data stored about you.
Rectification (Art. 16 GDPR): you can request the correction of inaccurate data.
Erasure (Art. 17 GDPR): you can request the deletion of your data, provided no statutory retention obligation prevents this. In the candidate area, you can delete your account including all data directly from your profile.
Restriction of processing (Art. 18 GDPR).
Data portability (Art. 20 GDPR): you can request your data in a commonly used format.
Objection (Art. 21 GDPR): you may object to processing based on legitimate interest.
Withdrawal of consent (Art. 7(3) GDPR): where processing is based on consent, you can withdraw it at any time with effect for the future.

To exercise your rights, please contact: support@hyrr.online

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
(State Commissioner for Data Protection and the Right to Access Files Brandenburg)
Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany
www.lda.brandenburg.de

13. Changes to this privacy policy

We reserve the right to update this privacy policy in case of changes to the platform or to applicable law. The current version is available at hyrr.online/privacy.html. We will notify logged-in users by email about material changes.