Effective date: [● insert date]. Version 1.0. This Privacy Policy explains how we handle personal data on the website dein-job.in and in our recruitment and placement services. It is written to meet both the EU General Data Protection Regulation (GDPR) and India’s Digital Personal Data Protection Act, 2023 (DPDP Act) with the DPDP Rules, 2025.

1. Who we are (Controller / Data Fiduciary)

NM NextMittelstand GmbH (“we”, “us”, “dein-job.in”) operates the website dein-job.in. We are the “controller” under the GDPR and the “Data Fiduciary” under the DPDP Act for the personal data described below.

  • NM NextMittelstand GmbH
  • Klosterstraße 18, 40211 Düsseldorf, Germany
  • Phone: +49 2203 97704666
  • Email: info@nextmittelstand.de
  • Managing Director: [● Geschäftsführer]
  • Commercial register / VAT ID: [● Handelsregister-Nr., Registergericht, USt-IdNr.]

Data protection contact & Grievance Officer: For any privacy matter, or to exercise your rights, contact us at [● privacy@nextmittelstand.de]. For data principals in India, this is also the contact for our Grievance Officer under the DPDP Act. [● A Data Protection Officer is appointed where legally required; insert contact if applicable.]

2. Scope & the two legal frameworks

Because we connect candidates in India and other countries with employers in Germany, we apply both regimes: the GDPR (for processing carried out in the EU and of EU data) and the DPDP Act 2023 / DPDP Rules 2025 (for the personal data of data principals located in India). Where the two differ, we apply the higher standard of protection.

3. What personal data we collect

3.1 When you visit the website

Server log data such as your IP address, browser type, date and time of access and the pages requested, plus cookie data (see Section 9). This is needed to deliver and secure the site.

3.2 When you contact us or apply for a job

  • Identity & contact: name, email address, phone number, location/country.
  • Professional data: qualification and recognition status, work experience, languages including your German level, driving licence, and the CV, certificates or documents you upload.
  • Mobility data: passport/visa status and willingness to relocate, to the extent you choose to provide it.
  • Communications: the content of your messages to us.

Please do not send us special categories of data (e.g. health, religion, ethnicity) unless strictly necessary for a specific role. If you do, you consent to its processing for your application.

4. Purposes and legal bases

  • Operating and securing the website — GDPR Art. 6(1)(f) legitimate interest; DPDP: legitimate use.
  • Responding to your enquiry — GDPR Art. 6(1)(b)/(f); DPDP: consent / legitimate use.
  • Processing your job application and matching you with employers, including sharing your profile and documents with prospective employers — GDPR Art. 6(1)(b) (steps taken at your request prior to a contract) and Art. 6(1)(a) consent; DPDP: your consent.
  • Complying with legal obligations (e.g. tax and commercial-law retention) — GDPR Art. 6(1)(c).

Where we rely on consent, you may withdraw it at any time with effect for the future; this does not affect processing carried out before withdrawal.

5. Who we share your data with

  • Prospective employers: by submitting an application you authorise us to share your profile, CV and relevant documents with suitable employers (primarily in Germany) for recruitment purposes.
  • Processors acting on our instructions: website hosting ([● Hostinger]), email and IT/support providers, bound by data-processing agreements. [● Analytics/marketing tools — confirm or remove.]
  • Public authorities where we are legally required to disclose.

We do not sell your personal data.

6. International data transfers (EU ↔ India)

Your data may be transferred between India, Germany and the wider EU/EEA. India is not covered by an EU adequacy decision. For transfers from the EU to countries without an adequacy decision, we use the EU Standard Contractual Clauses (SCCs) together with supplementary measures and a transfer impact assessment. For transfers of your data out of India, we rely on your consent and the conditions of the DPDP Act. By submitting your application you understand that your data will be processed in Germany/the EU for the purpose of placing you with an employer there.

7. How long we keep your data

  • Application data: for the duration of the recruitment process; if unsuccessful, deleted or anonymised after [● e.g. 6 months], unless you consent to remain in our talent pool ([● e.g. up to 24 months]).
  • Contractual / financial records: kept for statutory periods under German commercial and tax law (typically 6–10 years).
  • Website log data: [● short period, e.g. 7–30 days].

8. Your rights

8.1 Under the GDPR

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), to object (Art. 21), and not to be subject to a decision based solely on automated processing (Art. 22). You may withdraw consent at any time and lodge a complaint with a supervisory authority.

8.2 Under the DPDP Act 2023 (India)

You have the right to access a summary of your personal data and processing, the right to correction and erasure, the right to grievance redressal, and the right to nominate another person to exercise your rights in the event of death or incapacity. You may withdraw consent at any time.

To exercise any right, contact [● privacy@nextmittelstand.de]. We respond to GDPR requests within one month, and acknowledge DPDP grievances promptly and resolve them within 90 days. We may need to verify your identity first.

9. Cookies and tracking

We use strictly necessary cookies to operate the website and, only with your consent, [● functional/analytics cookies]. You can manage your preferences via [● the cookie banner] or your browser settings. A detailed list of cookies is available [● here].

10. Data security

We apply appropriate technical and organisational measures, including encrypted transmission (TLS), access controls, least-privilege staff access, and regular review of our processors, to protect your data against unauthorised access, loss or misuse.

11. Children

Our services are intended for adults (18+) and are not directed at children. Under the DPDP Act, processing a child’s personal data requires verifiable parental consent; we do not knowingly process such data.

12. Complaints

EU / Germany: You may complain to the competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany; phone +49 211 38424-0; poststelle@ldi.nrw.de.

India: After first contacting our Grievance Officer, you may approach the Data Protection Board of India under the DPDP Act.

13. Changes to this Privacy Policy

We may update this policy to reflect changes in our processing or the law. The current version and effective date are shown at the top of this page.

Note: This Privacy Policy reflects how dein-job.in intends to handle personal data and is provided for transparency. It should be reviewed and finalised by qualified legal counsel and aligned with your actual processing operations (processors, cookies, retention periods, DPO appointment, SCCs) before publication. All items marked [●] require your confirmation.