Privacy Notice

A. Controller within the meaning of the GDPR

B. General information on data processing

We process personal data exclusively within the limits of applicable law (GDPR, German Federal Data Protection Act). Our website can be used without entering personal data; no contact form is offered on this website. You can contact us only by email via the email addresses provided (mailto links) or by phone.

C. Hosting and provision of the website

This website is provided via the Lovable platform. According to the provider's current public documentation, the platform operator acting as our processor is:

The contact address stated for the provider's data protection officer is Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden.

For content delivery, the provider uses Cloudflare as a sub-processor for edge routing, DNS and worker execution. When the website is accessed, technically necessary connection and server log data (in particular IP address, date and time, URL requested, referrer, user agent) are processed in order to deliver the website and to ensure its stability and security. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the secure and performant provision of the website).

D. Processing in third countries

The service providers used to provide this website operate globally. Processing of personal data — in particular connection data — in third countries outside the EU/EEA, notably in the USA, takes place or cannot be excluded. No assurance is given that processing takes place exclusively or predominantly within the EU.

Page content is delivered via a global content delivery network; requests from Europe are regularly served from locations within the EU/EEA. This is not an assurance, however: providers domiciled in the USA (Lovable Labs Incorporated, Cloudflare, Inc.) may also access data from third countries in the course of operation, support, security and logging.

Where appropriate safeguards pursuant to Art. 46 GDPR (in particular EU standard contractual clauses) have been agreed in the applicable data processing agreement, these serve as the basis for such transfers. Information on the applicable data processing agreement and the safeguards agreed is available on request at info@dcd-services.de. The providers' publicly available information can be found at lovable.dev/privacy and cloudflare.com/privacypolicy.

The information above concerns the provision of this website. Information about Microsoft's processing of application emails is available in Section K.

E. Cookies and storage technologies

Access to information stored on your device is governed by Sec. 25 TDDDG; the subsequent processing of that data is governed by Art. 6 GDPR. Both levels are assessed separately.

Sec. 25 (2) no. 2 TDDDG: When the website is accessed, the hosting and edge infrastructure sets the following strictly necessary cookies; no consent is required for these:

• __dpl (hosting platform): assignment of the deployed version so that all parts of the page originate from the same program version.
• __cf_bm (Cloudflare, domain .lovable.app, lifetime 30 minutes): bot detection and mitigation of automated access to protect the availability and security of the website.

According to our review, no further cookies are set. No entries are created in local storage, session storage or IndexedDB.

Art. 6 (1) (f) GDPR: The data processed in connection with these cookies is based on our legitimate interest in a technically faultless, available website that is protected against misuse.

No analytics, tracking or marketing cookies are used. Should consent-requiring technologies be used in future, this will only occur after your explicit consent via a consent banner (Sec. 25 (1) TDDDG, Art. 6 (1) (a) GDPR); consent can be withdrawn at any time with effect for the future.

F. Communication by email

If you contact us using an email link provided on this website, your email application will open. We process the information you send, particularly your name, email address, and message content, to handle your inquiry and communicate with you. The website itself does not receive messages or attachments.

If your inquiry relates to entering into or performing a contract with you, the legal basis is Art. 6 (1) (b) GDPR. For other inquiries, processing is based on Art. 6 (1) (f) GDPR; our legitimate interest is the appropriate handling of and response to your inquiry.

Applications are subject to the specific provisions in Section K.

G. Recipients and categories of recipients

• Hosting and platform provider (Lovable Labs Incorporated) as processor
• Content delivery and edge infrastructure (Cloudflare) as sub-processor
• Microsoft as the service provider for our email communications; the information in Section K also applies to application data.
• Advisors, auditors and public authorities, where legally required or necessary for legal proceedings

H. Storage periods

• Server log data: deleted or anonymized by the infrastructure providers after a short period; the respective provider's specifications apply.
• Deployment cookie __dpl: stored only for as long as required for consistent delivery of the version.
• Bot management cookie __cf_bm: 30 minutes from being set or last refreshed.
• General email correspondence: deleted once the data is no longer required for its respective purpose, unless statutory retention obligations or retention required for the establishment, exercise, or defense of legal claims apply. Statutory retention obligations depend on the content and legal classification of the respective document.

Application documents and related correspondence are subject to the specific retention and deletion provisions in Section K. General commercial or tax retention periods are not applied across the board to application documents.

The criteria for determining storage periods are fulfillment of purpose, statutory retention obligations and the necessity for the establishment, exercise or defense of legal claims.

I. Your rights

As a data subject you have the following rights, subject to the respective statutory requirements:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

You also have the right to lodge a complaint with a supervisory authority:

J. Third-party content

This website does not embed services such as Google Maps, YouTube or Google Fonts. The fonts used are served locally; no connection to Google servers is established.

Should further external services be integrated in future and require consent, they will only be used after your explicit consent (Sec. 25 (1) TDDDG, Art. 6 (1) (a) GDPR).

K. Data protection in the application process

Controller and scope

The DCD Services GmbH identified in Section A is responsible for processing your application data. The following information applies to applications for advertised positions and speculative applications submitted to us by email. If you have questions about the processing of your data, contact us at info@dcd-services.de.

Purposes and categories of data

We process your personal data to the extent required to assess your suitability, conduct the application process, communicate with you, and decide whether to establish an employment relationship.

This includes, in particular, your contact information, cover letter, résumé, qualifications, and references, as well as any information you provide regarding availability and salary expectations. It also includes necessary correspondence and position-related interview notes and assessments. Listing these categories does not mean that all such information is required for every application.

Legal bases

Processing required to decide whether to establish an employment relationship is based on Sec. 26 (1) sentence 1 of the German Federal Data Protection Act (BDSG).

Where we process data for the establishment, exercise, or defense of legal claims, the legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is protecting our rights and demonstrating that the application process was conducted properly.

Please do not provide sensitive information that is not required for your application. We process special categories of personal data, particularly health data, only where a corresponding legal basis applies. This includes, in particular, the necessary exercise of employment-law rights and obligations under Art. 9 (2) (b) GDPR in conjunction with Sec. 26 (3) BDSG and the necessary establishment, exercise, or defense of legal claims under Art. 9 (2) (f) GDPR. We do not infer explicit consent merely from the submission of such information.

Recipients

Within our company, access to your application data is limited to the individuals who need it to process your application and make a hiring decision. These include the responsible HR personnel, participating managers, and executive management.

Service providers required to operate and support our IT may also process application data within the scope of their respective responsibilities. This includes Microsoft as the provider of our email infrastructure.

Microsoft and data storage

Applications are accepted by email. The website itself does not provide an upload function for application documents. Emails and their attachments are received, stored, and processed through our Microsoft email infrastructure.

Mailbox content at rest, including email content and attachments, is stored in German data centers. This statement concerns the storage location of mailbox content and does not mean that all related processing takes place exclusively in Germany.

Additional data may be processed in connection with the provision, security, and support of Microsoft services. Transfers to countries outside the European Union or European Economic Area may also occur. Microsoft describes corresponding exceptions within its EU Data Boundary.

Microsoft's processing is governed by the contractual terms of the Microsoft Data Protection Addendum. For third-country transfers covered by it, the Addendum provides, in particular, for the incorporation of the EU Standard Contractual Clauses. You may request information about the applicable safeguards and a copy of the relevant contractual provisions at info@dcd-services.de.

Additional information:

• Microsoft Data Protection Addendum
• Microsoft EU Data Boundary

Retention and deletion

We retain your application data for the duration of the application process. Following a rejection or withdrawal of your application, documents required for a potential legal defense are generally retained for no more than six months from notice of rejection or receipt of the withdrawal and are then deleted. Data not required for this purpose is deleted sooner.

Data is retained for a longer period only where specific data continues to be required in an individual case for the establishment, exercise, or defense of legal claims. This data is also deleted once that purpose no longer applies.

If an employment relationship is established, we continue to process the data required to establish and administer that relationship.

Any additional retention for consideration in future recruitment requires separate notice and your voluntary consent for a defined retention period. You may withdraw your consent at any time with future effect.

Provision of your data

Submitting an application is voluntary and is not required by law. However, the information necessary to assess your application is required to make a hiring decision. If this information is missing, your application may not be considered.

Your rights

The rights described in Section I also apply to the processing of your application data. Where processing is based on Art. 6 (1) (f) GDPR, you may object on grounds relating to your particular situation. To exercise your rights, contact info@dcd-services.de. You also have the right to lodge a complaint with a data protection supervisory authority.

This English version is a convenience translation. In case of discrepancies, the German version prevails.