Privacy Policy

Gemploy GmbH, as of 7 October 2026

This is a non-binding reading aid. The German version of this privacy policy is the only binding one. In case of any discrepancy, the German text prevails.

Are you an employee of a company that uses Gemploy?

Then your employer is the controller of your personnel data, not Gemploy. We process that data solely on their behalf and on their instructions.

Please address requests for access, rectification, erasure or restriction to your employer. We are not permitted to answer such requests ourselves; we forward them to your employer without undue delay.

What we additionally process within the application under our own responsibility is described in the Privacy Notice for the Application, which you will find in Gemploy after signing in.

This policy covers our website and our business contacts.

1 Controller

Gemploy GmbH
Borselstraße 3
22765 Hamburg, Germany

Commercial register: Amtsgericht Hamburg, HRB 194703
Managing directors: Frank Heindörfer, Philip Chinery

Email: [email protected]

No data protection officer has been appointed. For data protection enquiries, please use the address above.

2 Visiting our website

When you access gemploy.com, we process the connection data technically required to deliver the page: IP address, date and time of access, the page requested, the volume of data transferred, and information about your browser and operating system. The site cannot be delivered without this processing.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is providing and securing our website.

Retention: 30 days

We use no third-party tools for analytics or reach measurement on this website. The only measurement is on the fit-check page, on our own servers and per token (see “Fit-check”). Fonts and other assets are served from our own servers. There is exactly one piece of third-party content: the spam protection on the contact form, which loads only once you select one of its fields (see section 3).

What we store on your device

Two settings you choose yourself are kept on your device, so that the site looks the way you left it when you come back:

Name	Content	Stored as	Duration
`pref_locale`	the language you selected, `de` or `en`	cookie	one year
`gm-theme`	the appearance you selected, light or dark	your browser’s local storage	until you clear the site data

Neither exists until you click the setting in question. They contain no identifier that could recognise a person, and we do not evaluate them. For technical reasons the language choice is sent with every page request to our delivery provider (see “Hosting and delivery”), because the redirect to your chosen language happens there.

Legal basis: section 25(2) no. 2 TDDDG. The storage is necessary to provide a service you have explicitly requested, namely the language and appearance you chose. No consent is required for it. You can remove both at any time by clearing this site’s data in your browser.

Hosting and delivery

Our website is delivered via Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes the connection data described above on our behalf and also operates the DNS resolution for our domains. This may involve a transfer to the United States.

Basis for the transfer: the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR, agreed in the Cloudflare Data Processing Addendum. To the extent that Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, the transfer is additionally based on the European Commission’s adequacy decision under Art. 45 GDPR.

Traffic of our application is not routed through Cloudflare.

Fit-check

The page gemploy.com/fit-check is a short self-assessment with four questions. We point to it in a letter, by QR code. The link in the letter contains a token: ten random characters that we assign to a company, not to a person. Anyone who opens the page without a token gets a new one with the first answer, written into the page’s address. From then on that visit is treated like a letter.

For each token we store on our servers:

the answers to the four questions, each empty or the option chosen,
the current step and phase: intro, questions or result,
the number of visits and the time of the first one,
the times at which the assessment was first started and first completed,
the time of the first click on one of the buttons that lead to the contact form: “Kontakt” in the header, “Lieber persönlich? Rückruf vereinbaren” on the start screen and on the question screens, “Ergebnis mit uns besprechen” and “Mit uns sprechen” on the result screen,
the number of times the link was shared and the time of the first. How you share the link (copy, email, WhatsApp, system menu) is not stored,
the time of the last change and the date on which the entry is deleted.

The page shows no company name. Which company a token belongs to is not in the database, only in the list our marketing keeps for sending the letters. Through the letter, a token can be traced to a company and there to a contact person. We therefore treat it as personal data.

Purposes: The assessment should carry on where you left off, including on another device. The link is enough for that, because the state is stored with us under the token. We also evaluate per letter how often the page was opened, how far the assessment was answered and whether an enquiry through the contact form resulted (see section 3).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is offering you the assessment across devices and judging the success of the mailing per letter.

On your device: We use no cookies for this and store nothing on your device. The token is part of the page’s address.

Note on the link: The state is retrieved by the token alone. Anyone who knows the link sees the stored answers and can change them. Share the link only with people you want to show your answers.

Recipients: Requests to the page pass through the provider named under “Hosting and delivery”, like every request to our website, and that provider does not cache our server’s responses to these requests. Further recipients are the providers named in section 7 for operating our servers.

Retention: 12 weeks after the last activity under the token, that is, after the last change to the assessment’s state, visit, click on a contact button or share. Every new activity extends the period to 12 weeks again. After that we delete the entry automatically. It can remain in our backups for up to 7 more days (see “Backups” in section 7).

For access, erasure or objection, please give us the token from the link you used to open the page. Without it we cannot match an entry to a person. Your rights are described in section 8.

3 Contact form and enquiries

If you contact us via the contact form or by email, we process the data you provide in order to handle your enquiry.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns the conclusion or performance of a contract, otherwise Art. 6(1)(f) GDPR with our legitimate interest in responding to enquiries.

Retention: We handle every enquiry in our ticketing system, including enquiries by email. There is no fixed period for it. If the enquiry leads to a customer relationship, the ticket data becomes part of that relationship and follows the retention periods in section 6. If it leads to no deal, we delete the ticket when we close it.

An enquiry sent through the contact form is additionally held in an intake system. That record is deleted 12 weeks after receipt, regardless of how far the handling has come. After deletion, the intake record can remain in our backups for up to 7 more days (see “Backups” in section 7).

Page address: With your enquiry we store the address of the page you sent it from. If you opened the form through one of the contact buttons in the fit-check, it contains the token from your letter (?p=…). That is how we match an enquiry to a letter. The address is part of the enquiry’s record and also appears in the ticket created from it. It is therefore deleted on the same schedule as the enquiry: in the intake system after 12 weeks, in the ticket as described above. The legal basis is the one stated above.

Spam protection on the contact form

The contact form is protected by Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. It distinguishes human input from automated input and so prevents the form being abused for bulk enquiries.

The code required for this is loaded from Cloudflare, and only at the moment you select one of the form’s fields. If you do not use the form, no connection to Cloudflare is made. Merely opening the page does not trigger it.

In doing so, Cloudflare processes your IP address, information about your browser and device, and your interaction with the form, in order to assess whether the request comes from a human. Turnstile may store and read information on your device for this purpose. That information serves abuse detection only, not advertising and not the analysis of your behaviour across websites.

When you submit the form, we transmit the verification token issued by Turnstile together with your IP address to Cloudflare to have it checked. We store neither the token nor your IP address; they are not part of the record created from your enquiry.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is preventing automated and abusive enquiries. For storing and reading information on your device we rely on § 25(2) no. 2 TDDDG: the spam protection is necessary for us to provide the form you deliberately opened.

Basis for the transfer: the same as described for Cloudflare in section 2.

Retention: No record is created on our side. How long Cloudflare retains the verification data is governed by Cloudflare’s own information.

To send our newsletter we process your email address and any further data you provide.

Subscription uses the double opt-in procedure: after you subscribe, we send you an email with a confirmation link. Only after you confirm do we add you to the distribution list. We log the subscription and the confirmation, including timestamps, in order to be able to demonstrate your consent.

Legal basis: Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time with effect for the future, for example via the unsubscribe link in every newsletter. The lawfulness of processing carried out before withdrawal remains unaffected.

Retention: Until withdrawal. Proof of consent is retained beyond that for as long as it is required to defend against claims.

Delivery uses a newsletter system we operate ourselves; for technical delivery we use the email service provider named in section 7.

When you open the sign-in page of our application, we process the same technically required connection data described in section 2, in order to deliver the page and to detect and prevent attacks against the sign-in.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the security of the sign-in process.

What happens after sign-in is described in the Privacy Notice for the Application.

6 Business contacts, customers and prospects

To initiate and perform contracts, we process the data of our customers’ and prospects’ contact persons, in particular name, role, business contact details, correspondence and billing data. For payment processing we use a payment service provider; the payment data involved is described in section 7. If an enquiry has led to a customer relationship, the ticket data is part of it (see section 3).

Legal basis: Art. 6(1)(b) GDPR; for contact persons of a company, Art. 6(1)(f) GDPR with our legitimate interest in performing the business relationship; for retaining accounting records, Art. 6(1)(c) GDPR.

Retention: For the duration of the business relationship, thereafter in line with statutory retention periods of up to 8 years.

7 Recipients

We disclose personal data only where necessary. Recipients are:

Recipient	Purpose	Location
Cloudflare, Inc., USA	Website delivery, DNS resolution, spam protection on the contact form	USA (see section 2)
Hetzner Online GmbH, Germany	Operation of our servers	Germany; server configuration backups in Finland
IONOS Cloud GmbH, Germany	Object storage	Germany (Frankfurt am Main)
Lettermint B.V., Netherlands	Email delivery	Netherlands, France, Germany
JetBrains s.r.o., Czech Republic	Ticketing system for fault reports	European Union
Microsoft Deutschland GmbH, Germany	Email, file storage and identity management	Germany, with narrowly limited exceptions (see below)
Tax advisor	Bookkeeping and accounting	Germany
Stripe Payments Europe, Limited, Ireland	Payment processing	European Union, with transfers to the USA (see below)

These recipients act as our processors and are bound by our instructions. Beyond that, we disclose data to public authorities where we are legally obliged to do so.

Microsoft: enquiries, correspondence and job applications reach us via Microsoft 365. We handle enquiries in our ticketing system (section 3). The mailbox service region is Germany. For the narrowly limited cases in which Microsoft processes data outside the European Economic Area, the Standard Contractual Clauses in the Microsoft data protection addendum apply under Art. 46(2)(c) GDPR, supplemented by the EU-US Data Privacy Framework adequacy decision under Art. 45 GDPR.

Stripe: For payment processing we use Stripe Payments Europe, Limited, Ireland. Stripe processes payment and invoicing data partly on our behalf and partly as an independent controller, in particular for fraud prevention and to meet its own regulatory obligations. For transfers to its US parent company, the Standard Contractual Clauses under Art. 46(2)(c) GDPR apply, supplemented by the EU-US Data Privacy Framework adequacy decision under Art. 45 GDPR. The Stripe data protection addendum applies in its version of 18 November 2025.

Backups: The database in which we store the state of the fit-check and the record of your enquiry is backed up regularly. We keep these backups for 7 days. An entry that we have deleted, after its period ended (see sections 2 and 3) or at your request (see section 8), can therefore remain in the backups for up to 7 more days and is gone there after that. The backups are used only to restore the database after a failure and for nothing else.

8 Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to processing of your data based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

You may withdraw any consent you have given at any time with effect for the future.

You have the right to lodge a complaint with a supervisory authority. The authority competent for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

9 No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

10 Changes to this policy

We update this policy when the processing described here or the legal situation changes. The version published on this page applies; its date is stated above.