Privacy Policy

Nomado24 UG (haftungsbeschränkt), Donnersbergweg 1, 67059 Ludwigshafen am Rhein, Germany. Email: anton.petuchow@nomado24.de, phone: +49 176 38445436.

No data protection officer has been appointed, as the legal requirements of Art. 37 GDPR do not apply to us.

When you register, we process: name, email address, password (stored as a bcrypt hash, unreadable to us) and user role (job seeker or company). To confirm your email address we send a confirmation email (double opt-in).

Legal basis: Art. 6(1)(b) GDPR (provision of the user account).

Storage period: until you delete your account (see section 23).

Necessity: Without this information we cannot provide a user account. The public areas (job search, coworking overview) can be used without an account.

You can voluntarily add details to your profile, such as job title, professional experience, skills, languages, location, work-location preference, salary expectation, availability and a short bio. We use this information to suggest suitable jobs to you and to provide the features you request.

Legal basis: Art. 6(1)(b) GDPR. All profile details are voluntary; without them, only the profile-based features (e.g. job recommendations) are unavailable or limited.

Storage period: until you change them or delete your account.

When you apply for a job via nomado24, we process your application documents (CV as PDF, cover letter, application date) and transmit them to the company you are applying to.

Important: From the moment of transmission, the respective company is an independent controller for the further processing of your application data. Its own privacy notices then apply in addition. For access or deletion requests concerning the company, please contact it directly; your rights towards us (section 22) remain unaffected.

Special categories of data: Please only upload information that is necessary for your application. If your CV or cover letter voluntarily contains special categories of personal data (e.g. health data, disability, religious beliefs, a photo), we process them exclusively to transmit your application, based on your explicit consent (Art. 9(2)(a) GDPR), which you give by submitting the application with this content and can withdraw at any time with effect for the future.

Legal basis: Art. 6(1)(b) GDPR (carrying out the application).

Storage period: We store your application data until you delete it or your account. Note: companies may retain transmitted applications to fulfil their own legal obligations (e.g. to preserve evidence under the German AGG, usually up to six months).

We provide a messaging feature for communication around applications. We process the content and metadata (sender, recipient, time) of these messages in order to deliver them and display your inbox.

Legal basis: Art. 6(1)(b) GDPR.

Storage period: until the conversation or your account is deleted.

To suggest suitable jobs, we convert selected profile details (job title, up to 12 skills, work-location preference and the first 400 characters of your bio) into mathematical representations (so-called embeddings). For this we use the Azure OpenAI service of Microsoft Ireland Operations Ltd. as a processor; processing takes place in an EU region. Your CV files are not used for this and are not transmitted to Azure OpenAI.

Legal basis: Art. 6(1)(b) GDPR (provision of the recommendation feature).

Storage period: The embeddings are updated when you change your profile and deleted with your account.

No automated decision-making: We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). In particular, we do not rank or score applicants for companies; the recommendation features merely suggest jobs to you, and you alone decide about your application.

For the AI-powered career assistant we also use Azure OpenAI (Microsoft) as a processor, with processing in an EU region. When you use the AI Advisor, your chat messages and, if present in your profile, details such as job title, professional experience, skills, languages, location, work-location preference, salary expectation, availability, as well as the titles and companies of applications you submitted via nomado24, are transmitted to Azure OpenAI to answer your request.

Your inputs are not used by Microsoft to train AI models. For abuse monitoring, Microsoft may store inputs for up to 30 days (legal basis in this respect: Art. 6(1)(f) GDPR; legitimate interest in providing the service securely and free of abuse).

Quality review, stage 1 (automatic, without the wording): For an answered question we automatically derive two pieces of information, a topic keyword from a fixed list (for example application, salary, visa) and an assessment of whether your question was answered. In this automatic review we store only these two, never the wording of your question or of the answer; if you rate an answer yourself with thumbs up or thumbs down, the next paragraph applies. The purpose is to improve the quality of the advisor: we want to see which topics it answers poorly. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in improving the service. You can object to this processing at any time with effect for the future (Art. 21(1) GDPR), for example by email to the address given above.

Rating individual answers (thumbs up or thumbs down): If you rate an individual answer in the chat, we do store the wording as well, unlike in stage 1. We store your rating, the answer you rated, the question asked immediately before it, a reason you optionally type in, as well as the identifier of the chat, the identifier of your account and the point in time. The purpose is quality assurance: only the wording shows why an answer was poor. A rating is recorded only when you trigger it yourself, it is voluntary, and without a rating none of this is stored. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in improving the service. You can object to this processing at any time with effect for the future (Art. 21(1) GDPR).

Quality review, stage 2 (only with your consent): Without your explicit consent, nobody at nomado24 reads your conversations with the advisor. In your account settings you can separately consent to nomado24 staff viewing the wording of your conversations in order to improve the advisor. This consent is off by default, it applies to this one purpose only, and you can withdraw it at any time in your account settings with effect for the future; the lawfulness of processing carried out before the withdrawal remains unaffected. Legal basis: Art. 6(1)(a) GDPR.

Please do not enter special categories of personal data (e.g. health data) in the chat if you do not want them to be processed.

Legal basis: Art. 6(1)(b) GDPR for using the assistant itself. For the quality review, the legal bases stated above apply: Art. 6(1)(f) GDPR for stage 1 and for the rating of individual answers, and Art. 6(1)(a) GDPR for stage 2.

Storage period: We store your chat histories until you delete them. You can remove individual chats in your account at any time; when you delete your account, all chat histories are deleted. The topic keyword and the answer assessment from stage 1 are stored for at most 24 months; if you delete your account they remain as an anonymous figure with no reference to you. Conversations you released via the stage 2 consent are viewed for that purpose for at most 24 months after the conversation. Question and answer pairs that you rated are stored for 180 days after the rating; after that we remove the question, the answer and the optional reason and detach them from your account. Only the rating, the identifier of the chat and the point in time remain, as anonymous statistics. If you delete your account before then, we remove them immediately.

You can subscribe to job alerts (email notifications about matching jobs) and our newsletter, also without a user account. For this we process your email address and your search criteria. The subscription only becomes active after confirmation via the link in our confirmation email (double opt-in). To prove your sign-up, we log the time of registration and confirmation.

Every email contains an unsubscribe link; you can also end your subscription at any time in the settings. Emails are sent via our processor Resend (see section 20).

Legal basis: Art. 6(1)(a) GDPR (consent); withdrawal takes effect for the future.

Storage period: until you unsubscribe; beyond that, we store the sign-up proof data for up to three years after unsubscribing in order to demonstrate the given consent (Art. 7(1) GDPR).

When you book a coworking space via nomado24, we process your booking data (name, email, booked period, space) and transmit it to the operator of the space so that it can fulfil the booking. The operator is an independent controller for its further processing. Payment processing is described in section 11.

If you publish a review, it is displayed publicly on the space's page together with your username. You can delete your reviews at any time; they are also removed when you delete your account.

Legal basis: bookings Art. 6(1)(b) GDPR; publication of reviews Art. 6(1)(b) GDPR (a feature you requested).

Storage period: booking records are subject to statutory retention obligations (section 11); reviews until you delete them.

In the community you can publish posts and comments. They are publicly visible together with your username. We reserve the right to moderate content that violates our guidelines.

Legal basis: Art. 6(1)(b) GDPR (provision of the feature); moderation based on Art. 6(1)(f) GDPR (legitimate interest in a safe, lawful platform).

Storage period: until deleted by you or together with your account.

Paid services (Pro subscription, Founding Member, coworking bookings) are processed via our payment provider Stripe Payments Europe, Ltd. (Ireland). Your full payment and card data are processed exclusively by Stripe and are not stored by us. To fulfil its own legal obligations (e.g. anti-money-laundering and fraud prevention), Stripe may also act as an independent controller; see Stripe's privacy policy for details.

We ourselves store: subscription status, chosen plan or purchased service, billing period, Stripe customer and subscription identifiers, and the time the contract was concluded.

Legal basis: Art. 6(1)(b) GDPR; for the retention of billing data Art. 6(1)(c) GDPR.

Storage period: We retain billing and contract data to fulfil tax and commercial law obligations (Sec. 147 AO, Sec. 257 HGB; usually 6 to 10 years). This retention continues after account deletion; the data is separated from the account for this purpose.

Companies can invite team members to their company account. If your company invites you, we receive your name and email address from the inviting person (data not collected from you, Art. 14 GDPR). We use this data exclusively to deliver the invitation and set up your account; you receive the information under this privacy policy at the latest with the invitation email. If you do not accept the invitation, we delete the data when the invitation expires.

Externally collected (aggregated) job ads may contain contact details of contact persons at the advertising companies. These originate from the public sources of the respective ad (Art. 14 GDPR); we process them exclusively to display the ad and remove them when it expires.

Legal basis: Art. 6(1)(b) GDPR (invitation/account), Art. 6(1)(f) GDPR (display of aggregated ads; legitimate interest in a comprehensive job offering).

When you contact us via the contact form or by email, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR). We store requests until they have been fully handled, and beyond that only where legal obligations require it.

For customer communication and marketing we use HubSpot (HubSpot Ireland Ltd.; parent company HubSpot Inc., USA). HubSpot does not set cookies and does not track visitors on our website. We transmit personal data to HubSpot exclusively with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future:

• At registration and onboarding: Only if you have expressly agreed to marketing communication do we synchronise contact details and your onboarding information with HubSpot.
• Contact form and newsletter: Transmission to HubSpot for handling or sending, based on your respective consent.

We approach employers on our own initiative to offer them the option of publishing their vacancy on nomado24 themselves. For this we keep an internal list of possible contacts. This data does not come from the data subject but from public sources, which is why we provide the information required by Art. 14 GDPR here.

Source: Publicly accessible job postings in the job search of the German Federal Employment Agency (Bundesagentur für Arbeit) and publicly accessible information published by the company itself, in particular its legal notice and website. We do not republish these third-party postings and do not add them to our own job search. They serve solely to approach the employer.

Categories of data: Company name (with very small businesses often also the name of a natural person), job title, location, link to the source posting, publication date and a machine assessment of the work arrangement. In addition, where researched by us or recorded during a call: name and phone number of the contact person, contact channel, processing status and notes on the conversation.

Purpose: Direct B2B outreach for placement purposes: we want to offer the company the option of filling its vacancy through nomado24. The notes also serve as evidence under § 7 UWG (German unfair competition law) of the occasion for each call and of the point from which no further calls are made.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is initiating a business relationship with a company that is demonstrably hiring. We process business contact data only and no special categories of personal data. We do not send cold acquisition emails; we make contact by phone or through a professional network.

Storage periods:

• Leads never worked on: 6 months after the underlying job posting stops appearing in the source. We then delete the record in full and automatically.
• Leads worked on: 24 months after the last activity, meaning once contact has been made or notes of our own exist. We then delete the record in full and automatically.
• Business relationship established: according to the periods for contract and billing data, see section 11.
• Suppression record after an objection: If a company does not wish to be contacted again, we keep exactly the information needed to avoid calling it again. We do not delete this suppression record automatically, because it is what allows us to honour the objection permanently.

Right to object: You may object to this processing at any time (Art. 21 GDPR) by informal message to anton.petuchow@nomado24.de. Where the objection concerns outreach for marketing purposes, no reasons are required and we stop the outreach immediately and permanently. Rights of access and erasure apply as set out in section 22.

We use two clearly separated methods:

a) Cookieless audience measurement (Umami, self-hosted)

For statistical audience measurement (page views, referrers, device type, country of origin, features used including search queries) we use the self-hosted analytics software Umami. It runs entirely on our own infrastructure at Microsoft Azure in the EU; no data is transmitted to third parties. Umami sets no cookies and stores no information on your device; consent under Sec. 25 TDDDG is therefore not required. Your IP address is not stored permanently, but only processed briefly to derive the country of origin and a time-limited identifier that cannot be traced back to you.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in audience measurement and improving the service; measurement is purely statistical and involves no profiling of individuals). You can object to this processing at any time with effect for the future (Art. 21(1) GDPR), e.g. by email to the address above.

b) Product usage analytics in our own systems (first-party)

• Account-related events: If you are logged in, we attribute certain events to your account (e.g. registration, login, application submission, bookings, CV uploads, use of the AI Advisor). Legal basis: Art. 6(1)(b) GDPR where the event is part of providing the requested feature, otherwise Art. 6(1)(f) GDPR (analysis and improvement of the service). These events are deliberately stored without IP address and without browser identifier. For the AI advisor these also include copying an answer, regenerating an answer, an abort or a technical error during an answer, as well as showing and answering a single follow-up question about quality; we likewise record when a free trial phase for the advisor starts and ends.
• Advisor message counter: If you use the AI advisor without a paid subscription, we store one timestamped entry per accepted message so that a weekly limit and a time-boxed trial phase can be applied at all. This counter contains only your account identifier and the point in time, no reference to a chat and no text, and we do not use it to analyse your behaviour. The start and end of your trial phase are also stored on your account. Legal basis: Art. 6(1)(b) GDPR, because applying the agreed scope of service is part of performing the contract. Unlike the usage events above, these entries are not anonymised after 13 months but deleted together with your account; they are part of the data export in your account settings.
• Events with consent (analytics identifiers): Only with your cookie consent do we additionally store a random local identifier (n24_anon_id) and a session identifier (n24_session) to analyse usage behaviour across multiple page views. Legal basis: Art. 6(1)(a) GDPR in conjunction with Sec. 25(1) TDDDG. Upon withdrawal, the local identifiers are deleted and collection stops. If you consented before logging in, events collected this way may be attributed to your account upon a later login; the attribution happens via a separate event entry at the time of login.

Storage period and deletion (for b): We store usage events for 13 months; after that they are irreversibly anonymised (account, device and session identifiers as well as truncated search terms are removed). When you delete your account, attributed events are anonymised immediately. Your account-related usage events are part of the data export in your account settings.

Usage data is not transmitted to third parties for advertising purposes.

We use technically necessary storage, as well as functional storage that solely saves your settings for features you use (e.g. appearance, remembered search filters), without consent (Sec. 25(2) no. 2 TDDDG). Analytics cookies and identifiers are only set with your consent, which we collect either through our own cookie banner or, where active, through Google's consent message (Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via "Cookie settings" in the footer.

Google Maps (two-click solution): Maps on the coworking pages and the Google address search in forms only load after you have expressly agreed to loading Google Maps. Only with your click is a connection to Google established and your IP address transmitted to Google (Google Ireland Ltd.; processing also by Google LLC, USA). Google is independently responsible for this processing. We remember your consent locally (mapsConsent) and you can withdraw it at any time via the cookie settings. Legal basis: Art. 6(1)(a) GDPR in conjunction with Sec. 25(1) TDDDG.

Geocoding (Nominatim/OpenStreetMap): To convert addresses of coworking listings into map coordinates, we use the Nominatim service of the OpenStreetMap Foundation (United Kingdom; EU Commission adequacy decision) on the server side. Only the listing's address data is transmitted, no user identifiers. Legal basis: Art. 6(1)(b) GDPR (provision of the listing).

Our website and databases are operated at Microsoft Azure (Microsoft Ireland Operations Ltd.) in data centres within the EU; delivery happens via Azure Front Door (CDN) with an upstream web application firewall. When you visit the website, we automatically process IP address, browser type and version, operating system and time of access, insofar as this is necessary to deliver the page and ensure IT security (e.g. defence against attacks, rate limiting). Our application itself does not store IP addresses permanently; the infrastructure's access and firewall logs are automatically deleted after 30 days.

Security measures include TLS encryption, password hashing (bcrypt), access controls and regular security updates.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the website securely and reliably).

Some job ads from external partners contain affiliate links: if you apply via such a link, nomado24 may receive a commission. There are no additional costs for you. For billing and reach measurement we count such clicks exclusively anonymously, without IP address and without personal data; the GDPR does not apply to this anonymous count data.

We only share personal data as described in this policy: with companies when you apply (section 4), with space operators for bookings (section 9), with authorities where legally required (Art. 6(1)(c) GDPR), and with the following service providers, which (unless described otherwise) act for us as processors under Art. 28 GDPR:

Where data is transferred to the USA or other third countries, this happens on the basis of an EU Commission adequacy decision (Art. 45 GDPR, in particular the EU-US Data Privacy Framework for certified providers) or on the basis of EU standard contractual clauses (Art. 46(2)(c) GDPR), supplemented by technical and organisational safeguards. You can request a copy of the respective safeguards via the contact details above.

You have the following rights towards us regarding your personal data:

• Access (Art. 15 GDPR): supplemented by the data export in your account settings
• Rectification (Art. 16 GDPR): correction of inaccurate data
• Erasure (Art. 17 GDPR): "right to be forgotten"
• Restriction of processing (Art. 18 GDPR): temporary blocking instead of deletion
• Data portability (Art. 20 GDPR): receiving your data in a structured, machine-readable format
• Withdrawal of given consent (Art. 7(3) GDPR): at any time with effect for the future; the lawfulness of processing carried out before withdrawal remains unaffected

Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where your data is processed for direct marketing, you have the right to object to this processing at any time and without giving reasons; after the objection, your data will no longer be used for direct marketing purposes.

To exercise your rights, an informal message to anton.petuchow@nomado24.de is sufficient.

Right to lodge a complaint (Art. 77 GDPR): You can complain to a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.

You can delete your account at any time in the settings. Deletion is carried out immediately: account, profile, application and message data as well as uploaded files (CVs, cover letters) are deleted, AI Advisor chats removed, usage events anonymised, and any HubSpot contact as well as newsletter and alert subscriptions deleted or ended.

Exceptions to immediate deletion:

Our service is directed at persons aged 16 or older.

Nomado24 may ask you for voluntary feedback: through a feedback widget (bug, idea, other, missing listing) and through a short research survey that can appear on job detail pages and that you can also open yourself on a dedicated survey page, for example via a link on the home page. Both are voluntary. Closing the survey or not using the widget has no consequences for your use of Nomado24.

What is stored: For the survey: your answers to the multiple-choice questions, your free text if you enter any, the language, the path of the page the survey appeared on, the identifier of the job posting, and your checkboxes on whether we may write to you with follow-up questions and whether you are open to a short call. For the feedback widget: category, your text, the page path, the language, browser and window size, and, when you report a missing listing, your search parameters. If you are logged in, the entry is linked to your account.

Email address: Both forms ask optionally for an email address. In the survey you decide via checkboxes what we may use it for: follow-up questions about your answers, arranging a voluntary short call about your job search, or both. If you tick neither box, we do not store an email address. If you agree to a call, you receive a €10 voucher as a thank-you afterwards; that voucher is also sent via this address. In the feedback widget the address serves the follow-up only. We do nothing else with it: no newsletter, no advertising, no sharing.

Legal basis: For the answers and the feedback itself, Art. 6(1)(f) GDPR, our legitimate interest in improving our service on the basis of real feedback and in finding bugs. For an email address you volunteer, Art. 6(1)(a) GDPR, your consent, which you can withdraw at any time.

Purpose: Product development and bug fixing. We use the answers to understand where the job search fails you and which features are worth building. We do not use them to target advertising at you and we do not build a profile about you from them.

Retention: We keep the entries for as long as we need them for the evaluation, and we delete free text and email addresses once that purpose is met. From completed evaluations we keep only figures with no personal reference. If you delete your account, we immediately remove the free text, email address, page path and your contact consents from your entries; the anonymous counters remain, because they can no longer be related to you (see section 23).

Recipients: Nobody but us. There is no transfer to third parties, apart from our hosting providers and processors who operate the database (see section 20).

Local storage: So that the same survey is not shown to you repeatedly, your browser records in local storage that you answered or closed it, and for the lifetime of the tab that it has already appeared. Nothing is transmitted to us and no cookie is set. The entries are listed in the table in section 16.

On selected pages (category pages, calculators, guides and the job search at /jobs) we show advertising via Google AdSense. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

What happens: Google's ad script is only loaded after you have consented to the Marketing category. Without that consent no Google ad script is loaded on these pages and no advertising cookies are set or read. Personalised advertising additionally requires your agreement in Google's certified consent message under the IAB Transparency and Consent Framework (TCF). If you do not agree there, at most non-personalised ads are delivered.

Data processed: IP address, device and browser data (including device type, operating system, browser, language setting), cookies and similar identifiers, the page viewed and your approximate location (derived from the IP address). Google uses this data to deliver ads, cap their frequency, detect click fraud and measure ad performance.

Legal basis: Art. 6(1)(a) GDPR (consent) and § 25(1) TDDDG for storing and reading information on your device.

Third-country transfer: A transfer to the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses under Art. 46(2)(c) GDPR apply in addition.

Storage period: The lifetimes of the individual cookies are listed in our cookie policy. According to Google they are up to 13 months.

Withdrawal: You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer. You can also switch off the personalisation of Google advertising at adssettings.google.com.

We obtain your consent for advertising through Google's certified Consent Management Platform under the IAB Transparency and Consent Framework; the operator is Google Ireland Limited. The same dialog also asks about our own purposes, namely functional storage and our own product usage analytics. Your decision is stored in the FCCDCF and FCNEC cookies (up to 13 months according to Google) and in our own consent record. You can withdraw it at any time via the "Cookie settings" link in the footer. If the dialog cannot be loaded, our own cookie banner asks for the same categories.

You will find more information in Google's privacy policy at policies.google.com/privacy.

We run ads on Google Ads that lead to our pages for companies. Google appends a click identifier to the link of such an ad (the gclid, gbraid or wbraid parameter in the address bar). We do not use any Google script or cookie on our site for this.

What is processed: Only if you reach us through such an ad and then create a company account do we store this click identifier together with the company account. The identifier is passed from the ad landing page to the registration form solely via the address bar; nothing is stored on your device for it. Our own reach measurement removes click identifiers from the recorded page addresses before they are stored. If you leave the site or do not create an account, we store the identifier nowhere.

Purpose: We report back to Google Ads that the ad click resulted in a registration. Only the click identifier, the time and the name of the conversion goal are transmitted. Company name, email address or other account data are not sent to Google. Google may link the identifier to its own user account; see Google's privacy policy for details.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is measuring the effectiveness of paid ads without deploying tracking scripts on the website. You can object by writing to us at the address given in the legal notice; the identifier will then be deleted from your company account.

Retention: The click identifier is removed from the company account in our monthly deletion run once it is older than 90 days, i.e. no later than roughly four months after registration. The registration itself is unaffected.

We adapt this privacy policy when our services or the legal requirements change. The current version can always be found on this page. In the case of material changes affecting processing based on consent, we will ask for your consent again.