Privacy Policy

15.2Legal Basis

Salearis processes personal data based on: Art. 6(1)(b) GDPR (contract performance), (c) (legal obligations), (f) (legitimate interests) and (a) (consent, e.g. marketing cookies).

15.3Categories of Processed Data

15.4Performance Data of Freelancers

Performance data is entered by companies about freelancers and constitutes personal data of the respective freelancers. Salearis acts as the data controller. Freelancers are informed about the type, scope, and purpose of the processing of their performance data by accepting these Terms upon registration; a separate document is not required, provided that an explicit consent checkbox referencing the Terms and Privacy Policy is included during registration.

Personal performance raw data will not be shared with third parties. In the event of an exit, only anonymized aggregate data may be transferred without restriction.

15.4aReview of Messages by Salearis

Messages exchanged between companies and freelancers on the platform are stored by Salearis. Authorised Salearis administrators may review these messages to prevent abuse and fraud (such as circumventing the platform by sharing contact details), to provide support and to ensure the quality of matching – for example to spot conversations that have stalled and to help the parties involved. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning platform).

Access is limited to administrators and is logged. Salearis does not write in conversations between users; any contact is made solely through support. Users may object to this processing on grounds relating to their particular situation under Art. 21 GDPR at datenschutz@salearis.de.

15.5Data Processors

Salearis engages processors in the following categories, with contracts in place pursuant to Art. 28 GDPR: cloud hosting and infrastructure (EU/EEA), email delivery services (transactional mail), payment processing via Stripe Inc. (Standard Contractual Clauses pursuant to Art. 46 GDPR), delivery of push notifications and crash diagnostics for the mobile application via Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; sub-processing by Google LLC, USA, on the basis of the EU Standard Contractual Clauses pursuant to Art. 46 GDPR - see 15.14), and, subject to consent, analytics tools. A current list of processors is made available on request.

15.5aCRM and Marketing Automation (HubSpot)

Salearis uses HubSpot (HubSpot, Inc., Cambridge, MA, USA) as a CRM system and for marketing automation. HubSpot processes personal data of users who submit an inquiry or give their consent to be contacted via contact forms, meeting bookings, or newsletter registrations on salearis.de / salearis.at / salearis.com.

Processed data categories: Name, email address, phone number, company, communication history, and technical metadata (IP address, timestamp, device information).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures / contract performance) and Art. 6(1)(f) GDPR (legitimate interest in efficient CRM operations). For marketing emails and newsletters, Art. 6(1)(a) GDPR (consent) applies.

As HubSpot, Inc. is a US company, data transfer to the USA is based on EU Standard Contractual Clauses pursuant to Art. 46 GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with HubSpot.

Further information on data protection at HubSpot is available at legal.hubspot.com/privacy-policy.

Users may object to the use of their data for marketing purposes at any time at: datenschutz@salearis.de.

15.6International Data Transfers

To the extent data is processed outside the EEA (particularly through Stripe), Salearis ensures an adequate level of protection through EU Standard Contractual Clauses (SCCs) or adequacy decisions of the EU Commission.

15.7Rights of Data Subjects

All data subjects have the following rights, to be exercised at datenschutz@salearis.de (response within 30 days):

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction (Art. 18 GDPR)
• Data Portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of Consent (Art. 7(3) GDPR)
• Complaint to the Austrian Data Protection Authority (www.dsb.gv.at)

15.7aDeletion of the Account and of Data

The right to erasure under Art. 17 GDPR can be exercised directly at any time; no reason needs to be given and no contact with support is required.

In the mobile app: Settings → Account → “Delete account”. A six-digit code is sent to the registered email address for confirmation. Once it is entered, deletion is carried out immediately.

On the website: after signing in, under “Delete account” in the account settings, using the same confirmation code sent by email.

Without access to the account: an informal message to datenschutz@salearis.de. In that case deletion takes place within 30 days (Art. 12(3) GDPR).

Scope of deletion: upon confirmation, all access tokens are invalidated immediately and the user account is removed together with all associated records - profile and application data, message histories, device registrations for push notifications, the campaign attribution of the registration, and personal performance assessments. The stored files - CV, introduction video and profile picture - are removed from the servers as well, not merely the references to them. Recovery is not possible afterwards.

Excluded from deletion: invoicing and accounting records, which Salearis is required to retain for seven years under § 132 BAO and § 212 UGB, and anonymised aggregate and benchmark data that can no longer be attributed to any person (see 15.3 and 15.4). Retained invoicing data is processed solely to fulfil that statutory obligation and for no other purpose.

15.8Automated Decision-Making

The matching algorithm contains automated components without binding legal or economic decision-making effect. The final decision regarding a collaboration is always made by a human. Art. 22 GDPR does not apply.

15.9Cookies

Technically necessary cookies are set without consent. Analytical or marketing cookies only after explicit, revocable consent. No cookies for advertising purposes or sharing with advertising networks.

15.9aWeb Analytics

Salearis uses web analytics tools to understand user behavior on the platform and improve the offering. The use of analytical tools is exclusively based on explicit consent of the users (Art. 6(1)(a) GDPR), which can be revoked at any time.

The following data is collected in particular: Page views, time on site, click paths, entry and exit pages, device type, operating system, and roughly anonymized IP address (IP masking active). Identification of individual persons is not intended.

Analytics services used and their data protection documentation are disclosed in the current data processor list upon request.

To the extent data is processed in third countries, Salearis ensures an adequate level of protection through EU Standard Contractual Clauses.

Consent can be revoked at any time via the cookie settings on the platform. Upon revocation, no further analytics data will be collected; already collected data will be deleted or fully anonymized within 90 days at the latest.

15.10Data Security

Salearis implements state-of-the-art measures: SSL/TLS encryption, encrypted data storage in EU data centers, role-based access rights, regular security audits, and backup procedures.

15.11Data Breaches

In the event of a data breach with a probable risk to the rights and freedoms of natural persons, Salearis notifies the supervisory authority within 72 hours (Art. 33 GDPR) and affected users without undue delay by email (Art. 34 GDPR).

15.12Data Protection Officer

Salearis continuously reviews the necessity of appointing a Data Protection Officer pursuant to Art. 37 GDPR. In the meantime, datenschutz@salearis.de is available for all data protection-related inquiries.

15.13Changes to the Privacy Policy

In the event of material changes, users will be notified by email. The current version is always available on the platform with the date of the last update.

15.14Mobile Application (Android and iOS)

Salearis also offers the platform as a mobile application. In addition to the provisions above, the following applies to its use. The app contains no advertising SDKs and passes no data to advertising networks.

a) Push notifications (Firebase Cloud Messaging). Salearis uses Firebase Cloud Messaging (FCM) to deliver notifications. When notifications are enabled, the device operating system generates a push identifier (token), which Salearis stores together with the platform, app and operating system version, device name and language setting in order to deliver a message to the right device and in the right language. Only that identifier, along with the title, short text and the target within the app, is transmitted to Google for delivery; message content, application documents and contract data are never part of a notification. The legal basis is Art. 6(1)(b) GDPR for contract-related messages and Art. 6(1)(a) GDPR for all other notification types, each of which can be switched off individually in the app's notification settings. A device registration ends on sign-out, when notifications are switched off, and automatically after 90 days without use; deleting the account removes all device registrations.

b) Crash and error diagnostics (Firebase Crashlytics). If the app crashes or a serious error occurs, an error report may be transmitted to Firebase Crashlytics. Such a report contains the time of the error, the program state at that moment (stack trace), device model, operating system and app version, memory and battery level, and a randomly assigned installation identifier. It contains no account content, no messages and no application documents. Transmission takes place only with prior consent (Art. 6(1)(a) GDPR), which is requested on first launch of the app and can be withdrawn at any time with future effect in the app settings. Without consent, no error report is generated. Error reports are deleted after 90 days.

c) Install attribution (Google Play Install Referrer). If the app is installed via a campaign or referral link, Google Play makes the campaign parameters contained in that link available to the app (utm_source, utm_medium, utm_campaign, utm_content, utm_term). The app passes these values to Salearis once, during registration, where they are attached to the newly created account in order to identify which campaign or referral led to the registration. There is no cross-device tracking, no profiling and no disclosure to advertising networks. The legal basis is Art. 6(1)(a) GDPR (consent), requested on first launch of the app and revocable at any time; without consent the identifier is not read and registration takes place without campaign attribution. The attribution is removed when the account is deleted.

d) Access to the device calendar. For scheduled appointments, Salearis provides a calendar file in iCalendar (.ics) format. If an appointment is to be added directly to the device calendar, the app requests the system permission required for this. It is used solely to create and update the appointment in question. Existing calendar entries are not read and are not transmitted to Salearis; the appointment data remains on the device. The legal basis is Art. 6(1)(a) GDPR. The permission is optional, can be withdrawn at any time in the device system settings, and is not required for the rest of the app.

e) Access to camera and media. For the profile picture, the video introduction and uploading a CV, the app requests access to the device camera, photo library or file storage. Access takes place only upon an explicit action by the user and is limited to the file actually captured or selected; no other recordings or files are read, and nothing is ever recorded in the background. The selected file is transmitted encrypted, is not stored publicly, and is made accessible to companies only according to the visibility settings chosen in the app. The legal basis is Art. 6(1)(a) GDPR. These permissions are optional and can be withdrawn at any time in the system settings; without them only the corresponding features are unavailable.

Withdrawal of consent. The consents referred to under b), c), d) and e) can be withdrawn at any time in the app's privacy settings or in the device system settings. Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out until then. Diagnostic data already transmitted is deleted after 90 days at the latest.