Privacy Policy
This policy explains which personal data we process when you visit this website, when you contact us, when we contact you by email as a business and when you visit our profiles on Instagram and Facebook, for what purposes and on what legal basis.
1. Controller
The controller responsible for the data processing described in this policy is:
Nebil Zeleke · Talent-Works
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany
Phone: +49 155 65105610
Email: info@talent-works.de
2. Principles
We serve fonts and code libraries ourselves. We do not embed third-party content such as Google Fonts, maps, videos or social media buttons.
On this website, we do not collect any data for analytics or advertising purposes without your consent. In that case, the only thing stored on your device is your choice in the consent dialog. This is necessary so that your choice is respected; it contains no identifier that could recognise you and is not analysed.
No automated decision-making, including profiling (Art. 22 GDPR), takes place.
3. Hosting and delivery
This website is delivered through the network of Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). With every request, Cloudflare processes technical access data: your IP address, the date and time of access, the address requested, the amount of data transferred and information about your browser and operating system. This is necessary to deliver the pages to you and to protect the website against attacks; without this data, the website cannot be accessed.
The legal basis is our legitimate interest in providing the website securely and quickly (Art. 6(1)(f) GDPR).
How long Cloudflare stores this data is determined by Cloudflare; under the contract, it is deleted as soon as it is no longer needed for these purposes. We do not keep access logs of our own. Cloudflare also derives security information from the traffic under its own responsibility, such as assessments of IP addresses to fend off attacks.
We have concluded a data processing agreement with Cloudflare under Art. 28 GDPR. Cloudflare operates a global network, so access data may also be processed in data centres outside the EU. For transfers to the USA, Cloudflare is certified under the EU-US Data Privacy Framework; for transfers to other third countries, the European Commission’s standard contractual clauses have been agreed.
4. Consent and cookie settings
On your first visit, a notice asks whether you agree to services that are not required to run the website. None of these services is preselected; none of them is loaded without your explicit consent. Declining is just as easy as accepting.
We store your decision for 182 days in a cookie named talentworks-consent. It contains only which services you have accepted and which you have declined. This storage does not require consent because it is strictly necessary to carry out your choice (Section 25(2) no. 2 TDDDG, the German law on data protection in telecommunications and digital services).
You can withdraw your consent at any time with effect for the future, via the “Cookie settings” link in the footer of every page. On withdrawal, tracking stops, and the analytics cookies and the related entries in your browser’s storage are deleted. All that remains is your stored choice and a note without any identifier in your browser’s local storage that analytics was declined; it prevents tracking from starting again by itself.
Consent management is based on the open-source software Klaro. It is served by this website itself; no data is sent to its developer.
5. Visitor analytics (PostHog)
If you consent, we analyse how this website is used in order to improve its content and usability. For this we use PostHog (PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA). The data is processed in the service’s European instance, in a data centre in Frankfurt am Main, Germany.
We record the pages viewed and the time spent on them, the buttons and links clicked, the page you came from, screen size, information about your browser and operating system, your IP address and the approximate location derived from it (country, region, city, postal code, approximate coordinates and time zone), and the course of your visit (mouse movements, clicks, scrolling) as a session recording. It shows us where the website is unclear. Input in form fields is masked automatically and not transmitted.
To recognise your browser, PostHog stores a randomly generated identifier: in a cookie named ph_…_posthog that expires after 365 days, and in entries in your browser’s local storage that remain until you withdraw your consent. There are also entries in session storage that expire when the tab is closed.
The sole legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG). Consent is voluntary; you can use the website without restriction without it. Without your consent, the software is not loaded and no data is transmitted to PostHog.
We have concluded a data processing agreement with PostHog under Art. 28 GDPR. As the provider is based in the USA, access from the USA, for example in the course of support, cannot be ruled out. PostHog is certified under the EU-US Data Privacy Framework for this; the European Commission’s standard contractual clauses have also been agreed.
Session recordings are deleted automatically after 30 days. Under the plan currently in use, PostHog keeps the other usage data for at least one year; after that, we can no longer retrieve it, and PostHog may delete it permanently. A shorter retention period cannot be set in PostHog.
6. Contacting us
When you contact us by email, by phone or through the contact form, we process the details you provide, such as your name, company, email address, phone number, your message and the modules you select, in order to handle your enquiry.
Details from the contact form are transmitted in encrypted form to Cloudflare (see “Hosting and delivery”), passed on from there to our own server in Germany (host: netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany) and sent by that server as an email to our mailbox at Google Workspace. They are stored only there; neither the website nor the server keeps them. To protect against mass submissions, Cloudflare briefly counts the submissions per IP address.
The legal basis is Art. 6(1)(b) GDPR insofar as you wish to enter into, or have entered into, a contract with us. If you write to us on behalf of a company, or if it is any other kind of enquiry, the legal basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Providing your data is required neither by law nor by contract; without it, however, we cannot answer your enquiry.
For email we use Google Workspace (Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland); your messages are stored there. We have concluded a data processing agreement with Google under Art. 28 GDPR. Access by Google LLC in the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework for this, and the European Commission’s standard contractual clauses also apply.
We delete your enquiry once it has been dealt with. Where statutory retention obligations apply, for example six years from the end of the calendar year for business letters under Section 147 of the German Fiscal Code (Abgabenordnung), we keep the documents until these periods expire (Art. 6(1)(c) GDPR) and then delete them.
7. Business outreach by email
We occasionally contact people at companies by email, without prior contact, to introduce our services, where the law at the recipient’s location permits this. For this purpose we process your name, your business email address, your job title, the name and website of your company and the history of our correspondence, meaning the messages sent, your replies and any objection.
The data comes from publicly accessible sources, such as your company’s website or professional networks, and from providers of business contact data.
The legal basis is our legitimate interest in making companies aware of our services (Art. 6(1)(f) GDPR; direct marketing within the meaning of Recital 47 GDPR).
For sending, we use email services that act on our behalf and with which data processing agreements under Art. 28 GDPR are in place. Where such a service is located outside the EU, the transfer is based on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on the European Commission’s standard contractual clauses. We do not track whether or when you open an email.
If you do not reply, we delete your data no later than twelve months after our last message. If you object, we add your email address to a suppression list so that you are not contacted again; we then store no further data (Art. 6(1)(c) and (f) GDPR).
You can object to this processing at any time without giving reasons (Art. 21(2) GDPR), for example with a short reply to our email or a message to info@talent-works.de. We will then not contact you again.
8. Our profiles on Instagram and Facebook
We maintain profiles on Instagram and Facebook. For users in the EU, the provider of these services is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). No content or buttons from Meta are embedded on this website itself; no data is transferred to Meta when you visit this website.
When you visit our profiles, Meta processes data about your use, usually with the help of cookies, even if you are not logged in there. Which data this is and what Meta uses it for is described by Meta in its privacy policy. We have no influence on this processing.
For the page statistics (“Insights”) that Meta provides to us in aggregated form, we are joint controllers together with Meta (Art. 26 GDPR). The division of obligations is governed by the Page Insights Controller Addendum. It expressly refers to Facebook Pages; for our Instagram profile, we assume the same division. Under it, Meta fulfils the obligations under the GDPR for this processing, in particular providing information and handling your requests. You can also contact us with your request, however; we will then forward it to Meta.
We use the profiles to provide information about our company, to get in touch with interested parties and to see from the statistics which posts attract interest. The legal basis is our legitimate interest in doing so (Art. 6(1)(f) GDPR). We process messages you send us there as described under “Contacting us”.
Meta also transfers data to the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework; Meta also uses the European Commission’s standard contractual clauses.
9. Your rights
You have the following rights:
- access to the data stored about you (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR) and
- withdrawal of any consent you have given, with effect for the future (Art. 7(3) GDPR).
An informal message to info@talent-works.de is enough.
Right to object
Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. In the United Kingdom, you can also contact the Information Commissioner’s Office (ICO).
10. Changes
We update this policy as soon as the data processing it describes changes, for example when services are added. The version published here applies.