Privacy Policy

This Privacy Policy describes how Remotely.de GmbH processes personal data when you visit our website at outofoffice.jobs, contact us, or use our B2B employer portal at solutions.outofoffice.jobs. Separate privacy statements apply on our candidate-facing properties (remotely.de, remoteo.es, leremote.fr, byebyeoffice.com).

1. Controller

The controller for the processing described below, within the meaning of Art. 4 No. 7 GDPR, is:

A Data Protection Officer has not been appointed as the statutory thresholds of § 38 BDSG are not met. For data protection questions, write to the address above.

2. Personal data we process

a) Visitor data

When you visit our website we process: IP address (truncated or hashed for analytics), user-agent, pages viewed, referrer, approximate country. Purpose: operation and security of the website, traffic measurement. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functional, secure website).

b) Contact form

If you use the contact form we process: name, work email, company, topic, your message, and any additional data you include. Purpose: responding to your enquiry, and where applicable taking pre-contractual steps. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and/or Art. 6(1)(f) GDPR (legitimate interest in replying).

c) Customer account and job posting data

If you register an account and purchase a listing we process: account email, password hash, company name and billing address, VAT ID where applicable, payment-method metadata (we never store full card numbers), invoice data, and the contents of your listing (which may include an application email address or contact name you choose to include). Purpose: performing the contract for the sale of the listing, invoicing, accounting. Legal basis: Art. 6(1)(b) GDPR and, for retention of accounting records, Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB.

d) Communications

If you contact us by email or through our support channels we process the contents of those communications. Purpose: support, service delivery, record-keeping. Legal basis: Art. 6(1)(b) or (f) GDPR.

3. Server logs

Our hosting provider automatically records technical data in server logs: IP address, timestamp, URL requested, HTTP status, referrer, user-agent. Logs are used for security, fraud prevention and operational stability. Logs are kept for no longer than fourteen (14) days and are then deleted or anonymised. Legal basis: Art. 6(1)(f) GDPR.

4. Analytics (Plausible)

We use Plausible Analytics, a privacy-friendly, cookieless analytics tool operated by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible does not set cookies, does not track users across sites and does not collect personal identifiers. Data is processed within the EU. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in traffic measurement). For details see Plausible's data policy.

5. Cookies

Our public marketing website does not set advertising or tracking cookies. Our employer portal at solutions.outofoffice.jobs uses strictly necessary cookies for authentication and session management. These cookies are required for the Service to function and are therefore not subject to consent under § 25(2) no. 2 TTDSG.

6. Payment processing

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. The payment provider receives and processes the card or bank data you enter; we receive only limited metadata (transaction ID, last 4 digits of card, status, amount). Full card details are never stored in our systems. Legal basis: Art. 6(1)(b) GDPR. See the payment provider's own privacy notice for details.

7. Recipients and processors

We use the following processors (Art. 28 GDPR) to deliver the Service. Each is contractually bound to process personal data only on our instructions.

An up-to-date list of processors is available on request.

8. Publication across the network

When you purchase a job listing, its content is published on one or more of our Network Sites. Where your listing includes personal data of a named contact (for example a recruiter email or hiring-manager name), that data becomes publicly accessible for the duration of the listing and may be indexed by search engines. You are responsible for ensuring you have the authority and a lawful basis to include that data.

9. International transfers

Some processors (notably Cloudflare) are based in the United States or may transfer data outside the EEA. Where this is the case we rely on the EU Standard Contractual Clauses (Art. 46 GDPR) and, where applicable, the EU-US Data Privacy Framework, together with additional safeguards such as encryption in transit.

10. Retention

We retain personal data only for as long as necessary for the purposes set out above or as required by law:

• server logs: up to 14 days;
• contact form submissions: up to 24 months after our last contact with you, unless a contract results;
• customer account and contract data: for the duration of the relationship and thereafter for the German statutory retention periods (generally 6 years under § 257 HGB and 10 years under § 147 AO for invoices and accounting records);
• published job listings: until de-publication; residual copies may remain in backup for up to 90 days thereafter.

11. Your rights

Under the GDPR you have the right to:

• request access to your personal data (Art. 15);
• have inaccurate data rectified (Art. 16);
• have data erased where one of the grounds in Art. 17 applies;
• request restriction of processing (Art. 18);
• receive a portable copy of data you provided (Art. 20);
• object to processing based on Art. 6(1)(f), on grounds relating to your particular situation (Art. 21);
• withdraw consent at any time where processing is based on consent (Art. 7(3)), without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, write to hello@outofoffice.jobs. We will respond within one month.

12. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. Our competent authority is:

13. Automated decision-making

We do not use the data described above for any automated decision-making or profiling that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR.

14. Changes

We may update this Privacy Policy to reflect changes in our practices or applicable law. The version in force is the one dated at the top of this page. Material changes will be communicated by email where we have an ongoing relationship with you.

15. Contact

For all data-protection questions, write to hello@outofoffice.jobs.