Privacy Policy

Privacy Policy (GDPR / DSG 2018)

15.1 Data Controller

Salearis GmbH · Albrechtsberg, Austria · datenschutz@salearis.de · salearis.de / salearis.at / salearis.com

15.2 Legal Basis

Salearis processes personal data based on: Art. 6(1)(b) GDPR (contract performance), (c) (legal obligations), (f) (legitimate interests) and (a) (consent, e.g. marketing cookies).

15.3 Categories of Processed Data

15.4 Performance Data of Freelancers

Performance data is entered by companies about freelancers and constitutes personal data of the respective freelancers. Salearis acts as the data controller. Freelancers are informed about the type, scope, and purpose of the processing of their performance data by accepting these Terms upon registration; a separate document is not required, provided that an explicit consent checkbox referencing the Terms and Privacy Policy is included during registration.

Personal performance raw data will not be shared with third parties. In the event of an exit, only anonymized aggregate data may be transferred without restriction.

15.5 Data Processors

Salearis uses data processors in the following categories, with whom contracts pursuant to Art. 28 GDPR are in place: Cloud hosting and infrastructure (EU/EEA), email delivery services (transactional emails), payment processing via Stripe Inc. (Standard Contractual Clauses pursuant to Art. 46 GDPR), and with consent, analytics tools. A current list of data processors is available upon request.

15.5a CRM and Marketing Automation (HubSpot)

Salearis uses HubSpot (HubSpot, Inc., Cambridge, MA, USA) as a CRM system and for marketing automation. HubSpot processes personal data of users who submit an inquiry or give their consent to be contacted via contact forms, meeting bookings, or newsletter registrations on salearis.de / salearis.at / salearis.com.

Processed data categories: Name, email address, phone number, company, communication history, and technical metadata (IP address, timestamp, device information).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures / contract performance) and Art. 6(1)(f) GDPR (legitimate interest in efficient CRM operations). For marketing emails and newsletters, Art. 6(1)(a) GDPR (consent) applies.

As HubSpot, Inc. is a US company, data transfer to the USA is based on EU Standard Contractual Clauses pursuant to Art. 46 GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with HubSpot.

Further information on data protection at HubSpot is available at legal.hubspot.com/privacy-policy.

Users may object to the use of their data for marketing purposes at any time at: datenschutz@salearis.de.

15.6 International Data Transfers

To the extent data is processed outside the EEA (particularly through Stripe), Salearis ensures an adequate level of protection through EU Standard Contractual Clauses (SCCs) or adequacy decisions of the EU Commission.

15.7 Rights of Data Subjects

All data subjects have the following rights, to be exercised at datenschutz@salearis.de (response within 30 days):

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction (Art. 18 GDPR)
• Data Portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of Consent (Art. 7(3) GDPR)
• Complaint to the Austrian Data Protection Authority (www.dsb.gv.at)

15.8 Automated Decision-Making

The matching algorithm contains automated components without binding legal or economic decision-making effect. The final decision regarding a collaboration is always made by a human. Art. 22 GDPR does not apply.

15.9 Cookies

Technically necessary cookies are set without consent. Analytical or marketing cookies only after explicit, revocable consent. No cookies for advertising purposes or sharing with advertising networks.

15.9a Web Analytics

Salearis uses web analytics tools to understand user behavior on the platform and improve the offering. The use of analytical tools is exclusively based on explicit consent of the users (Art. 6(1)(a) GDPR), which can be revoked at any time.

The following data is collected in particular: Page views, time on site, click paths, entry and exit pages, device type, operating system, and roughly anonymized IP address (IP masking active). Identification of individual persons is not intended.

Analytics services used and their data protection documentation are disclosed in the current data processor list upon request.

To the extent data is processed in third countries, Salearis ensures an adequate level of protection through EU Standard Contractual Clauses.

Consent can be revoked at any time via the cookie settings on the platform. Upon revocation, no further analytics data will be collected; already collected data will be deleted or fully anonymized within 90 days at the latest.

15.10 Data Security

Salearis implements state-of-the-art measures: SSL/TLS encryption, encrypted data storage in EU data centers, role-based access rights, regular security audits, and backup procedures.

15.11 Data Breaches

In the event of a data breach with a probable risk to the rights and freedoms of natural persons, Salearis notifies the supervisory authority within 72 hours (Art. 33 GDPR) and affected users without undue delay by email (Art. 34 GDPR).

15.12 Data Protection Officer

Salearis continuously reviews the necessity of appointing a Data Protection Officer pursuant to Art. 37 GDPR. In the meantime, datenschutz@salearis.de is available for all data protection-related inquiries.

15.13 Changes to the Privacy Policy

In the event of material changes, users will be notified by email. The current version is always available on the platform with the date of the last update.