Privacy Policy
1. Responsible Entity (Data Controller)
According to Article 4(7) GDPR and Section 5 TMG:
Search Fund Hub
Represented by: Paul Liepe
Gabelsbergerstraße 51
80333 Munich, Germany
Email: hello@searchfundhub.de
2. Data Protection Officer
As a small organization, we are not legally required to appoint a Data Protection Officer under Article 37 GDPR. For inquiries, contact the responsible entity above.
3. Categories of Personal Data We Process
3.1 Master Data
- Email address (required for authentication)
- Full name (voluntary)
- User role: job seeker or employer
- Account creation date and last login
3.2 Employer Profile Data
- Company name and legal form
- Company description and industry
- LinkedIn URL (voluntary)
- Company logo and website
- Company location and address
3.3 Job Application Data
- Resume/CV (uploaded documents)
- Cover letter text
- Application status and pipeline stage
- Application submission date
3.4 Technical Data (Log Data)
- IP address (anonymized after 7 days)
- Browser type and version
- Operating system
- Date and time of requests
4. Purposes and Legal Basis
| Purpose | Legal Basis |
|---|---|
| User authentication and account management | Art. 6(1)(b) GDPR |
| Operating job matching platform | Art. 6(1)(b) GDPR |
| Platform security and fraud prevention | Art. 6(1)(f) GDPR |
| Legal compliance | Art. 6(1)(c) GDPR |
5. Data Storage (Supabase)
Processor: Supabase Inc. (Data Processing Agreement per Art. 28 GDPR in place)
Location: EU data centers (eu-west-1, Ireland)
Encryption: AES-256 at rest, TLS 1.3 in transit
Security: Row-Level Security (RLS), ISO 27001 certified
6. Data Retention Periods
- Active Accounts: Until deletion request
- Inactive Accounts: Deleted after 24 months inactivity + 30 days notice
- Job Applications: 2 years after conclusion (German AGG requirement)
- Server Logs: 7 days (IP anonymized)
- Deleted Data: 30 days soft-delete, then permanent
7. Recipients of Personal Data
7.1 Data Processors
- Supabase Inc. (database) - DPA in place
- Vercel Inc. (hosting) - DPA in place
7.2 Employers
When applying for jobs, your data is shared with respective employers (Art. 6(1)(b) GDPR).
Note: We do not sell personal data to third parties.
8. Your GDPR Rights
Right to Access (Art. 15): Request a copy of your data
Right to Rectification (Art. 16): Correct inaccurate data
Right to Erasure (Art. 17): Delete your data (Right to be Forgotten)
Right to Restriction (Art. 18): Limit processing
Right to Portability (Art. 20): Receive data in machine-readable format
Right to Object (Art. 21): Object to processing
How to Exercise Your Rights
Contact: hello@searchfundhub.de
Response within 1 month (extendable to 3 months for complex requests)
9. Cookies and Local Storage
Essential Cookies (Strictly Necessary)
- next-auth.session-token: Authentication (HTTP-only, secure)
- next-auth.csrf-token: CSRF protection
Legal basis: Art. 6(1)(b) GDPR. No separate consent required for essential cookies.
10. Data Security Measures
- SSL/TLS 1.3 encryption for data transmission
- AES-256 encryption at rest
- Row-Level Security (RLS) in database
- Secure authentication via NextAuth.js
- Password hashing (bcrypt)
- Rate limiting and DDoS protection
- Data Processing Agreements with all processors
11. Data Breach Notification
In case of a data breach, we notify the supervisory authority within 72 hours (Art. 33 GDPR) and affected users without undue delay if high risk (Art. 34 GDPR).
12. Automated Decision-Making
We do not use automated decision-making or profiling as defined in Article 22 GDPR. All hiring decisions are made by human employers.
13. Changes to This Policy
We may update this privacy policy. Material changes will be notified via email or platform announcement.
14. Supervisory Authority
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
15. Contact
Last updated: February 12, 2026 | Version 1.0