Privacy Policy

3.1 Controller

The controller responsible for data processing is:
Frelani GmbH i.G.
Marcus Granzow
Borstelmannsweg 38
20537 Hamburg, Germany
Email: [email protected]

3.2 Data Protection Officer

Where required by law or voluntarily appointed, the data protection officer can be reached at:
Email: [email protected]
Borstelmannsweg 38, 20537 Hamburg

3.3 General Information on Data Processing

We process personal data only insofar as this is necessary for providing the platform, carrying out pre-contractual measures, performing contracts, fulfilling legal obligations, based on legitimate interests, or on the basis of consent.

3.4 Accessing the Website / App

When accessing our platform, we process technically required connection and log data, including:

• IP address,
• Date and time of access,
• Requested content,
• Referrer URL,
• Browser type and version,
• Operating system,
• Language settings,
• Device information,
• Log data and server status information.

Purposes: Provision of the platform, stability, security, error analysis, abuse prevention.

Legal basis: Art. 6(1)(f) GDPR.

3.5 Registration and User Account

During registration and account usage, we process in particular:

• Name,
• Business contact details,
• Email address,
• Password hash,
• Company data,
• Role information,
• Verification status,
• Settings,
• Communication and usage history.

Purposes: Setting up and managing the user account, authentication, support, contract processing, fraud prevention.

Legal bases: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR.

3.6 Company Profiles and Project Listings

When companies or recruiters create project listings or company profiles, we process the information entered, including:

• Company name,
• Contact person,
• Industry,
• Locations,
• Project description,
• Requirements,
• Tags, categories, and other metadata,
• Uploaded documents and media.

Purposes: Publication, searchability, matching, communication, abuse control.

Legal bases: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR.

3.7 Freelancer Profiles, CV Uploads, and Applications

When freelancers create profiles, upload CVs, or apply for projects, we process in particular:

• Master data,
• Contact data,
• Professional qualifications,
• Skills, seniority, availability,
• Work experience, project history, references,
• Daily rate or compensation details,
• Regional preferences, language skills,
• Application documents,
• Communication content.

Purposes: Profile display, application and matching functions, contact facilitation, quality and abuse control, usability improvement.

Legal bases: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR.

3.8 Technically Assisted Structuring and Pre-filling

Where we provide functions that extract, structure, summarise, categorise content from uploaded documents or pre-fill form fields, we process the information uploaded or entered by the user.

Purposes: Simplifying data entry, improving user-friendliness, faster creation of structured profiles and listings.

Legal bases: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR.

Automatically generated suggestions are generally reviewed by the user before publication or can be corrected by them.

3.9 Search, Ranking, and Matching Functions

We also process data to enable search results, sorting, relevance displays, and matching suggestions.

This may involve processing and technically weighting information on skills, roles, industries, seniority, availability, location relevance, activity, completeness, and recency of profiles or listings.

Purposes: More relevant search results, better placement probability, abuse reduction, improvement of platform usability.

Legal basis: Art. 6(1)(f) GDPR; insofar as processing is necessary for the provision of contractually owed platform functions, additionally Art. 6(1)(b) GDPR.

3.10 Communication Between Users

We process messages, applications, replies, attachments, and system-related communication data insofar as this is necessary for providing the communication functions.

Purposes: Delivery, system security, abuse prevention, support, traceability.

Legal bases: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR.

3.11 Contact Enquiries and Support

When you contact us, we process your information to handle the enquiry.

Legal bases: Art. 6(1)(b) GDPR, insofar as the enquiry is contract-related; otherwise Art. 6(1)(f) GDPR.

3.12 Newsletter and Direct Communication

Where we send newsletters or comparable information, we process in particular email address, consent status, subscription and unsubscription data, and — where permissible — usage data for performance measurement.

Legal basis: Art. 6(1)(a) GDPR for consent; where applicable Art. 6(1)(f) GDPR or relevant competition law provisions for existing customer advertising.

Consent given may be revoked at any time with effect for the future.

3.13 Payment and Billing Data

Where paid services are offered, we process billing-related data, including:

• Invoice data,
• Company and tax information,
• Booked services,
• Payment status,
• Transaction references.

Payments may be processed through external payment service providers.

Legal bases: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR; Art. 6(1)(f) GDPR.

3.14 Verification, Fraud Prevention, and Security

We process data for the detection and prevention of fraud, spam, abusive use, duplicate accounts, security incidents, and legal violations.

This may include plausibility data, technical identifiers, log data, risk signals, verification information, and third-party reports.

Legal bases: Art. 6(1)(f) GDPR; Art. 6(1)(c) GDPR, insofar as legal obligations exist.

3.15 DSA-Related Processing

Insofar as frelani is subject to DSA obligations as a hosting service or online platform, we also process personal data for handling reports, content moderation, reasoning of moderation decisions, complaint processing, and fulfilment of statutory transparency and documentation obligations.

Legal bases: Art. 6(1)(c) GDPR; Art. 6(1)(f) GDPR.

3.16 Recipients of Data

We only transfer personal data insofar as this is necessary. Recipients may include:

• Hosting and infrastructure providers,
• Email and communication service providers,
• Support and CRM service providers,
• Payment service providers,
• Consent management and analytics providers,
• Security and anti-fraud service providers,
• Legal, tax, and audit advisors,
• Authorities and courts where legally required.

We conclude data processing agreements with processors where required.

3.17 Third-Country Transfers

Where service providers outside the EU/EEA are used or a third-country connection cannot be excluded, transfers are made only in compliance with legal requirements, in particular on the basis of an adequacy decision or appropriate safeguards such as standard contractual clauses.

3.18 Retention Period

We store personal data only for as long as necessary for the respective purposes or as long as statutory retention obligations apply.

Key criteria include:

• Duration of the user relationship,
• Ongoing contract initiation or performance,
• Statutory retention periods,
• Limitation periods,
• Documentation and evidence interests,
• Security and abuse prevention.

3.19 Obligation to Provide Data

Where data is required for registration, contract conclusion, or essential platform functions, its provision is mandatory. Without such data, we may not be able to provide certain services or only to a limited extent.

3.20 Data Subject Rights

Data subjects have the following rights, subject to legal requirements:

• Access,
• Rectification,
• Erasure,
• Restriction of processing,
• Data portability,
• Objection,
• Withdrawal of consent with effect for the future,
• Complaint to a data protection supervisory authority.

3.21 Right to Object

Where we process data on the basis of legitimate interests, you have the right to object to the processing on grounds relating to your particular situation.

Where data is processed for direct marketing purposes, you may object at any time.

3.22 Cookies and Similar Technologies

We use cookies and similar technologies.

We use technically required technologies to provide the platform securely and functionally.

Non-technically required technologies — in particular for analytics, reach measurement, conversion measurement, or marketing — are only used where effective consent has been given or another valid legal basis exists.

Consent can be revoked or adjusted at any time via the privacy settings.

3.23 Automated Decisions

Unless otherwise stated, no exclusively automated decision-making with legal effect or similarly significant impact within the meaning of Art. 22 GDPR takes place.

3.24 Changes to This Privacy Policy

We reserve the right to adapt this privacy policy with effect for the future, in particular in the event of changes to the legal situation, platform functions, or service providers used.