Privacy Policy

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with legal data protection regulations and this privacy policy.

Responsible Party

What Data Do We Collect?

Purpose of Data Processing

• Provision and operation of the job board platform
• Management of user accounts
• Matching applicants with companies
• Communication between applicants and companies
• Improvement of our services
• Ensuring IT security

Legal Basis

The processing of your personal data is based on the GDPR:

• Art. 6 para. 1 lit. b GDPR: Processing for contract fulfillment (e.g., use of the platform)
• Art. 6 para. 1 lit. a GDPR: Consent (e.g., newsletter subscription)
• Art. 6 para. 1 lit. f GDPR: Legitimate interests (e.g., IT security)

Data Storage and Security

Data Sharing

We only share your personal data in the following cases:

• To Companies: When you apply for a position, your application documents (name, CV, cover letter) are transmitted to the respective company
• To Service Providers (processors under Art. 28 GDPR): To provide our service we use carefully selected providers: Microsoft Azure (hosting of website and backend, delivery/CDN via Azure Front Door, and database, EU region), Google Analytics (audience measurement), Google Maps (map display), Stripe (payment processing for coworking bookings), and Resend (sending transactional emails). These providers process data on our behalf and are contractually obligated to comply with the GDPR (processing under Art. 28 GDPR). In addition, we use HubSpot as a CRM and marketing platform for our customer communication and prospect management (including contact requests, the newsletter, and contact/lead data from sign-ups). Your data is only transferred to HubSpot on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.
• Legal Obligations: For official requests when we are legally obligated to do so

Some of these services are operated by providers based in the USA, so personal data may be transferred to the USA. Such transfers take place on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR) or — where the provider is certified — the EU-US Data Privacy Framework. Analytics and advertising cookies are only set with your consent.

Payment Data / Subscription

When you take out a paid subscription (Pro or Founding Member), payment is processed via our payment service provider Stripe Payments Europe, Ltd. as a processor. In this context we store the following data:

• your subscription status (e.g. active, cancelled)
• the selected plan or purchased service
• the respective billing period
• your Stripe customer and subscription identifiers (customer/subscription ID)
• the time your contract was concluded

Your full payment and card details are processed exclusively by Stripe and are not stored by us.

Legal basis: Art. 6(1)(b) GDPR (performance of the subscription or purchase contract concluded with you).

Retention period: Billing and contract data are stored to fulfil statutory tax- and commercial-law retention obligations (in particular § 147 AO and § 257 HGB; generally 6 to 10 years).

Affiliate links / partner links

Some job listings from external partners contain affiliate links: if you apply via such a link, Nomado24 may receive a commission — at no extra cost to you. For billing and reach measurement we record these clicks in anonymized form only (no IP address and no personal data). The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

AI Career Advisor (AI Advisor)

For the AI-powered career advisor (AI Advisor), we use Microsoft's Azure OpenAI service as a data processor (Art. 28 GDPR). When you use the AI Advisor, your chat messages are transmitted to Azure OpenAI to answer your request, along with — where present in your profile — details such as your job title, years of experience, skills, languages, location, work-location preference, salary expectation, availability, and the titles and companies of applications you've submitted through nomado24. Processing takes place in an EU region. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Your inputs are not used by Microsoft to train AI models; for abuse monitoring, Microsoft may retain inputs for up to 30 days. We store your chat histories until you delete them — you can remove individual chats from your account at any time, and deleting your account deletes all chat histories.

Product Usage Analytics (Our Own, First-Party)

We record events about the use of our service (for example search queries, views of job and coworking pages, saving jobs, use of individual features) in our own systems. We do not transmit this data to third parties for advertising purposes. We distinguish three categories of collection.

• Account-Linked Collection (Logged-In Users): If you are logged in, we associate certain usage events with your account, for example registration, login, submitting an application, bookings, resume uploads, and use of the AI Advisor. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) where the event is directly part of delivering the feature you requested, and otherwise Art. 6(1)(f) GDPR (legitimate interest in analyzing and improving our service).
• Anonymous Statistical Collection: For users who are not logged in, we record certain events (for example search queries or page views) without any identifier and without a cookie. This data cannot be attributed to a person. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in statistical analysis).
• Consent-Based Collection (Analytics Cookies): Only if you have consented to the use of analytics cookies do we additionally store a random identifier held locally in your browser (n24_anon_id) as well as a session identifier, to analyze your usage behavior across multiple page views (for example page views, click paths, load times). The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TTDSG. You can withdraw your consent at any time via the cookie settings; in that case, the locally stored identifiers are deleted and no further events are recorded on this basis. Events already recorded remain in place until the retention period expires or until deletion.

Cookieless audience measurement (Umami): For statistical audience measurement (for example page views, referrers, device type, country of origin) we additionally use the self-hosted analytics software Umami. It runs entirely on our own infrastructure on Microsoft Azure in the EU; no data is shared with third parties. Umami works without cookies and does not store any information on your device, so no consent under Section 25 TTDSG is required. Your IP address is not stored permanently; it is only processed briefly to derive coarse geo information (country) and a time-limited identifier that cannot be traced back to you. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in audience measurement and in improving our services). You may object to this processing at any time with effect for the future (Art. 21 GDPR), for example by emailing the address given in the legal notice.

Linking to Your Account: If you consented to analytics collection before logging in, the events recorded that way can be linked to your account when you later log in. Events already stored are not retroactively altered; the linkage is recorded as a separate event at the time of login.

Retention Period and Deletion: We store usage events for 13 months. After that, they are irreversibly anonymized, meaning account, device, and session identifiers as well as any shortened search terms are removed. If you delete your account, your associated events are anonymized accordingly. Your account-linked usage events are included in the data export you can request from your account.

Cookies

Our website uses technically necessary cookies to ensure functionality:

• Session Cookies: To maintain the login session
• Authentication Token: JWT token in LocalStorage for secure authentication

Analytics cookies (Google Analytics, HubSpot) are only set with your prior consent, which you give via our cookie banner and can withdraw at any time using the "Cookie settings" link in the footer.

Your Rights

You have the following rights regarding your personal data:

To exercise your rights, please contact us at: anton.petuchow@nomado24.de

Right to Complain

You have the right to file a complaint with a data protection supervisory authority regarding the processing of your personal data by us.

Data Protection Officer: We have not appointed a Data Protection Officer, as the statutory requirements of Art. 37 GDPR for doing so are not met.

Changes to Privacy Policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy. The new privacy policy will then apply for your next visit.