Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:

SilentHire
Owner: Tahir Velovic
Schulstraße 125
24536 Neumünster
Germany

Email: info@silenthire.de

2. What data we process

We process in particular the following categories of personal data:

• Master data: email address, name if applicable, company name, roles (recruiter / company).
• Applicant/candidate data (to the extent submitted by users): e.g. name, contact details, professional qualifications, CV, salary expectations, and other information submitted as part of candidate proposals.
• Usage and log data: logins, job postings created, candidate proposals submitted, status changes, as well as technical usage data (e.g. IP address, date and time of access, browser type, operating system).
• Communication data: message content, notes on requests, system notifications and enquiries to us via the contact form or e-mail (see section 12).
• Payment-related data (recruiters): for paid services (e.g. subscriptions) we process billing-relevant data; payment data is generally processed directly by the payment service provider used (e.g. Stripe, see below).
• Teams (companies): e-mail addresses of invited colleagues and the time of invitation and joining (Art. 6(1)(b) GDPR). Team members act on behalf of the company; their actions are logged under their own address. They receive the email notifications about the company's jobs and proposals and can turn them off in their account at any time.
• Teams (recruitment agencies): e-mail addresses of invited consultants and the time of invitation and joining (Art. 6(1)(b) GDPR). The agency owner sees the name and e-mail address of their team members, but not their requests or candidate profiles. We only pass the number of team seats to the payment provider.
• Agreement to the terms: version of the terms, time and way of your agreement (at registration, in your account or by reply e-mail) as proof of which contract terms apply to you (Art. 6(1)(b) GDPR).
• Proof (recruiters offering temporary staffing): permit under § 1 AÜG and its expiry date. We review it before temporary staffing jobs are unlocked (Art. 6(1)(f) GDPR); it is only visible to our review team.
• Contact persons at companies (direct approach): name, role, business contact details and notes on the contact (see section 6).

3. Purposes and Legal Bases of Processing

We process your data in order to:

• provide the Platform and manage user accounts,
• bring companies and recruiters together to fill specific positions,
• enable payment and billing processes (e.g. for recruiter subscriptions),
• ensure the security and stability of the Platform (e.g. log files, abuse detection),
• tell companies with open positions about SilentHire (section 6),
• communicate with you for support or contractual purposes.

The legal bases are in particular:

• Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures),
• Art. 6(1)(c) GDPR (compliance with a legal obligation, e.g. tax record-keeping obligations),
• Art. 6(1)(f) GDPR (legitimate interest in the operation, security, and further development of the Platform).

Where in individual cases we rely on your consent (e.g. for certain marketing emails), processing is based on Art. 6(1)(a) GDPR. Any consent given can be withdrawn at any time with effect for the future.

4. Registration and Use of the Platform

Use of SilentHire generally requires registration as a recruiter or company. The mandatory information requested during registration is required to set up and use your user account.

During registration you may optionally tell us how you heard about SilentHire (e.g. LinkedIn, Google or a recommendation). We store this with your account and use it only to see which channels bring users to us (Art. 6(1)(f) GDPR). Not answering has no disadvantage for you; it is deleted together with your account.

In the course of using the Platform, we process the job postings, candidate proposals, notes, and other content you submit in order to enable SilentHire to function. Recruiters and companies are responsible for ensuring that they only transmit personal data (in particular of candidates) in compliance with data protection requirements.

5. Information for Candidates (Art. 14 GDPR)

Recruiters can use SilentHire to submit candidate profiles to companies that have advertised a suitable position. We do not receive this data from you directly but from the recruiter who proposes you.

• Which data: CV and other documents, optional key facts (years of experience, notice period, salary expectation) and a note from the recruiter. The documents must not contain contact details and are checked for them automatically before the company sees them. The company only receives your name and contact details after it has accepted the proposal and the contact details have been released.
• Purpose and legal basis: placement for the specific position you are proposed for (Art. 6(1)(f) GDPR; legitimate interest in carrying out the placement).
• Recipients: the company that advertised the position and our technical service providers (sections 10 to 12).
• Retention: see section 15.

You can contact us (info@silenthire.de) or the recruiter who proposed you with any request concerning your data. You have the rights set out in section 16, in particular the right to object to the processing (Art. 21 GDPR).

7. Candidate Profiles, Anonymity and Duplicate Check

Before the company sees a submission, the platform checks whether file names or file contents contain contact details (e.g. e-mail addresses, phone numbers or links). For this purpose, the text of PDF and Word files is read automatically on our servers, and images and scanned pages are read with automatic text recognition (OCR) that also runs on our servers; the documents are not passed to any other service for this. The extracted text is not stored. If contact details are found, the submission is not sent and the uploaded files are deleted. In addition, the recruiter confirms with every submission that the candidate has agreed to be presented anonymously and has been informed about the data processing; we store the time of this confirmation as evidence. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the promised anonymity until contact details are released). Stored files receive neutral names; the original file name is not kept.

To detect duplicate submissions, our servers calculate a cryptographic fingerprint (SHA-256) of every uploaded file. If the same recruiter submits identical documents again for the same position, the new submission is not delivered; if another recruiter submits identical documents, this is only noted internally. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in avoiding duplicate proposals and resulting fee disputes).

Recruiters can save profiles in their own candidate library to reuse them for other positions. These profiles are only visible to the respective recruiter and can be deleted by them at any time. Profiles that have not been used for 12 months (not edited, renamed, selected in a proposal or explicitly kept) are deleted automatically; we point this out in the overview 30 days in advance.

In the “My candidate profiles” area, recruiters can read a CV and create an anonymous candidate profile as a Word file. Reading, editing and creating the file happen exclusively in the browser on the recruiter's device; the CV is not transmitted to us and is not stored. Only if the recruiter explicitly saves the finished profile to their candidate library do we store the details of this anonymized profile (not the CV) in their account, so that they can edit it later and use it for further proposals; what is said about the candidate library applies. If they select such a profile in a proposal, the Word file is created in their browser and transmitted like any other file of the proposal.

When a company opens the CV of a proposal for the first time, we store this point in time and show it to the submitting recruiter ("Opened by the company on …"). We also derive a company's typical response time over the last six months from the times at which it reacts to requests (accepting, declining, availability request). It is shown on the company's anonymous job postings only as a rough level (e.g. "Usually responds within 24 hrs") and only once there are enough requests; recruiters do not see individual timestamps. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a reliable and transparent process for both sides).

Recruiters can indicate on a job that they are actively sourcing candidates for it ("I'm sourcing for this job"). For this we store the job, the account, the agency and when the indication started, expires and ended. It is valid for 14 days and is extended with every proposal for this job. The company only sees how many verified recruiters are currently sourcing, not who; as soon as the first recruiter is sourcing, it receives a one-time email without names. The legal basis is Art. 6(1)(b) GDPR (providing the platform feature).

Until contact details are released, companies and recruiters remain anonymous to each other. Once they are released, both sides receive the other side's contact details – by email and in the request: from the company the company name, contact person and their role, email address, phone number, postal address and website; from the recruiter the name, agency, email address, phone number, postal address, website and LinkedIn profile, in each case as far as stored in the profile. This is necessary so that both sides can continue the placement with each other (Art. 6(1)(b) GDPR). Candidate profiles (CV and documents) are not sent by email; they remain available in the request.

After contact details have been released, we ask the company whether the position was filled – when the position is closed or by email (at most three emails). The answer buttons in this email lead to a confirmation page with a personal link valid for 60 days; nothing is saved until the answer is confirmed on that page. We store the result, the time and who reported it. Recruiters whose contact details were released for this position only learn the result from their own perspective (e.g. "Your candidate was hired" or "The position was filled with another candidate"); other candidates or recruiters are never named. If a recruiter reports that their candidate was hired, we also store this statement with its time; if it differs from the company's statement, we review the case. If a result turns out to be wrong (e.g. after a mix-up), we correct it; the recruiters affected then receive a correction notice. So that recruiters only see current positions, we also check automatically every day whether there is a sign of life for an open position: answers to our questions and the time of the last sign-in or session in the company account (owner and team members). If a question remains unanswered or the account has not been active for 60 days, we ask by email and pause the position if there is no reply; it can be reactivated with one click at any time, and nothing is deleted. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a transparent conclusion of every placement and in avoiding fee disputes).

8. Messages on Proposals

Companies and recruiters can exchange messages about a specific proposal. We store the content, the time and the role of the sender to enable this exchange. Messages are only visible to the two parties involved. We also store for your account when you last viewed the messages on a proposal, so that the notice about new messages is correct on all your devices; the other party cannot see this information. The legal basis is Art. 6(1)(b) GDPR.

9. Cookies and Similar Technologies

We use technically necessary cookies or similar technologies on our Platform to enable basic functions (e.g. login, session management, security functions).

The legal basis for the use of technically necessary cookies is § 25(2) TDDDG (formerly TTDSG) in conjunction with Art. 6(1)(f) GDPR (legitimate interest in secure and functional operation of the Platform).

Should we use optional cookies or comparable technologies in the future (e.g. for statistics or marketing), we will inform you separately and, where legally required, obtain your consent in advance.

10. Supabase (Hosting and Database)

For hosting, authentication, and data management we use Supabase, a service provided by Supabase Inc. (USA). Your data, including uploaded files, is stored in the eu-central-1 region in Frankfurt am Main, Germany. Supabase processes the data exclusively on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR.

It cannot be ruled out that, in the context of support or maintenance services, data may be transferred to third countries (in particular the USA). In such cases, processing takes place on the basis of appropriate safeguards within the meaning of Art. 46 GDPR (e.g. EU standard contractual clauses). Supabase is contractually obligated to comply with European data protection law.

Further information can be found in Supabase's privacy policy: https://supabase.com/privacy

11. Vercel (Hosting and Analytics)

Our platform is hosted and delivered via the infrastructure of Vercel Inc. (USA). In doing so, Vercel processes technical access data (including IP address, requested URL, time of access, browser and device information) in order to provide the platform.

The platform’s server functions run in Frankfurt am Main (region fra1). Static content is delivered via Vercel’s global network; requests first reach a nearby network node.

We additionally use Vercel Analytics, an analytics service that records page views in an aggregated, anonymized way, without setting cookies or identifying individual users across devices.

Vercel is certified under the EU-US Data Privacy Framework (DPF). To the extent any data transfer to the USA nonetheless occurs outside the DPF, it is based on EU standard contractual clauses pursuant to Art. 46 GDPR.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a reliable, secure, and performant operation of the platform). Further information can be found in Vercel's privacy policy: https://vercel.com/legal/privacy-policy

12. E-mail Delivery (Resend) and Enquiries to Us

For e-mails sent by the platform (e.g. confirmations, notifications about new proposals, reminders, password resets) we use the service Resend of Resend, Inc., USA. Your e-mail address and the content of the respective e-mail are processed.

Resend informs us about the delivery status (e.g. delivered, undeliverable, reported as spam). For each e-mail sent we store the recipient, subject, type of message and delivery status in order to detect delivery problems. We do not track opens or clicks.

The legal basis is Art. 6(1)(b) GDPR (e-mails for using the platform) and Art. 6(1)(f) GDPR (monitoring delivery). The transfer to the USA is based on EU standard contractual clauses (Art. 46(2)(c) GDPR) or, where the provider is certified under the EU-US Data Privacy Framework, on the European Commission’s adequacy decision (Art. 45 GDPR). More information: https://resend.com/legal/privacy-policy

Contact form and e-mail enquiries

When you write to us via the contact form or by e-mail, we process your name, your e-mail address and your message in order to answer your enquiry. Messages from the contact form are forwarded via Resend (see above) to our mailbox info@silenthire.de. This mailbox is operated for us by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, as a processor; e-mails you send us directly and our replies are also stored there. No other recipients receive your enquiry.

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns the use of the platform or a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). No consent is required for this. How long we keep enquiries is set out in section 15.

13. Location Search and Password Protection

Location search: When you enter a place or postcode (e.g. for positions or job alerts), our servers request the matching coordinates from the Nominatim service of the OpenStreetMap Foundation. Only the search term is transmitted; your IP address and account data are not passed on.

Check for known passwords: During registration we check whether a chosen password has already appeared in known data breaches. To do so, a hash value is derived from the password; only its first five characters are transmitted via our servers to the Pwned Passwords service (haveibeenpwned.com). The password itself, your IP address and your account data are not transmitted. The legal basis is Art. 6(1)(f) GDPR (protecting your account).

14. Payment Processing with Stripe

For paid services (e.g. recruiter subscriptions), the payment service provider Stripe may be used. In this case, payment data (e.g. credit card details, bank details) is processed directly by Stripe; we do not receive complete credit card data.

The responsible provider within the EU is:

Stripe Payments Europe, Ltd.
1 Grand Canal Street Lower
Grand Canal Dock
Dublin
Ireland

Stripe may, within the scope of its global infrastructure, also transfer data to third countries (in particular the USA). This takes place on the basis of appropriate safeguards (e.g. EU standard contractual clauses) pursuant to Art. 46 GDPR.

Information on data protection at Stripe can be found at: https://stripe.com/privacy

The legal basis for processing personal data in connection with payment processing is Art. 6(1)(b) GDPR (performance of a contract) and, where applicable, Art. 6(1)(f) GDPR (legitimate interest in secure and efficient payment processing).

15. Retention Period

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods.

Specifically, the following applies in particular:

• User account and profile data: until the account is deleted. You can delete your account yourself at any time in the account settings.
• CVs and documents for proposals: 6 months after the decision for declined or withdrawn proposals, 12 months after the contact details were released for accepted proposals. They are kept as long as a proposal is open. The proposal itself remains afterwards without documents.
• Files without assignment (e.g. after aborted uploads): deleted after 7 days at the latest.
• Candidate library: until the recruiter deletes the profile or their account, at the latest 12 months after it was last used.
• "I'm sourcing for this job": 12 months after the indication expires or is stopped; immediately when the recruiter's account is deleted.
• Team memberships: until removal from the team or deletion of the company; unaccepted invitations 30 days after expiry (invitations are valid for 14 days).
• Temporary staffing permit: until it is replaced by a new proof or the account is deleted.
• Messages on proposals: until the proposal is deleted or the recruiter deletes their account.
• Chat read status: at the latest until the proposal or your account is deleted.
• Proposals after a company account is deleted: the jobs are closed and anonymized; proposals already submitted remain available to the recruiter without the company's personal data (proof of introduction, Art. 6(1)(f) GDPR). The retention periods above apply to the documents.
• Proof of account deletion (e-mail address, name, role, time and the voluntarily stated reason): 12 months, after which the e-mail address and name are removed (Art. 6(1)(c) and (f) GDPR in conjunction with Art. 5(2) GDPR, proof of deletion).
• Account suspension: If we suspend an account (e.g. for a breach of the terms and conditions), we store the e-mail address, role, time and reason of the suspension in order to enforce it and to prevent a new registration with the same address (Art. 6(1)(f) GDPR). The details are kept for as long as the suspension lasts and are deleted 24 months after it has been lifted.
• Activity log (e.g. submitted, accepted, contacts released): 24 months. When you delete your account, your e-mail address is removed from the entries.
• Log of sent e-mails: 12 months. When you delete your account, your e-mail address is removed from the entries.
• Enquiries via the contact form or e-mail: until your enquiry has been fully dealt with; we then delete it unless statutory retention obligations apply (e.g. usually 6 years for business correspondence).
• Technical operation and security logs: 90 days.
• Abuse prevention counters (rate limiting): without IP address or e-mail address in plain text; deleted no later than 24 hours after the time window has expired.
• Direct approach to companies: without a reply no longer than six months after the last contact; after an objection only the note that no contact is wanted (see section 6).
• Billing-relevant documents: statutory retention periods of generally 6 to 10 years.

Once the purpose of processing no longer applies or statutory retention periods expire, the data is deleted or anonymized.

16. Your Rights

Under the applicable data protection provisions, you have in particular the following rights against us:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to certain processing (Art. 21 GDPR)

You can object to the processing of your data for direct marketing at any time; we will then no longer process it for this purpose (Art. 21(2) and (3) GDPR).

In your account settings you can download a copy of the data we store about you at any time (machine-readable JSON; Art. 15 and 20 GDPR) and delete your account yourself. The export also contains internal notes we have created about your account. Details of the other party to a proposal are only included once the contact details have been released.

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data (Art. 77 GDPR). Generally, the competent authority is that of your habitual residence, workplace, or our company's registered office.

To exercise your rights, you can contact us at any time: info@silenthire.de

17. Data Security

We use technical and organizational security measures to protect your data against loss, manipulation, destruction, and unauthorized access. These include, among others, storage in data centres in Frankfurt am Main, encrypted connections (HTTPS), access rules at database level (each party only sees its own data), non-public file storage with time-limited download links, limits on requests to prevent abuse, a browser security policy (Content Security Policy) and administrative access restricted to a few accounts.

Our security measures are continuously improved in line with technological developments.