Privacy Policy

1. Who is responsible?

Global Consult Nicki Jost
Schmollerstr. 160a, 70378 Stuttgart, Germany
Email: info@service-globalconsult.de

Global Consult is a sole proprietorship. We have not appointed a data protection officer because we are not required to do so. If you have questions about data protection, please write to the email address above.

2. Overview

Global Consult places skilled workers, apprentices and seasonal workers with employers in Germany and helps with CVs, work permits and visas. This policy explains which personal data we process: when you visit this website, through our forms (contact forms, application, CV service, refund) and when you are in contact with us by email, WhatsApp, Telegram or video call.

3. Hosting and error logs

This website, the forms and our customer portal run on a server provided by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre in Germany. Hetzner processes the data as a processor on our instructions (Art. 28 GDPR).

We do not keep access statistics and do not use any analytics or advertising tools. If a technical error occurs when a page is requested, the web server writes an error entry with the IP address, time, requested address and browser identifier. These entries are used for troubleshooting and for the security of our systems (Art. 6(1)(f) GDPR; our legitimate interest is secure and uninterrupted operation). They are overwritten automatically once the storage space reserved for them is full; at present this happens after about eight weeks.

4. Fonts, third-party content, cookies and browser storage

We deliver fonts and images from our own server. On its own, the website does not load content from third-party servers and does not set cookies. It only loads a YouTube video if you start it yourself (next paragraph).

YouTube videos: On our home page (currently in the German and English versions) we show a video about Global Consult that is hosted on YouTube. Until you click play, you only see a preview image from our own server, and no data is sent to YouTube or Google. Only your click loads the video player in YouTube’s privacy-enhanced mode (youtube-nocookie.com). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then receives, among other things, your IP address, information about your device and browser, the address of our website and information about how you play the video. YouTube may also store or read information on your device, for example cookies or browser storage. Google processes this data under its own privacy policy, including at Google LLC in the USA (Section 12). The legal basis is your consent, which you give by clicking play (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It only applies to this page view: if you reload the page, you will again see only the preview image. More information is available in the Google Privacy Policy. Links to YouTube, such as the link to our YouTube channel in the footer, are ordinary links: data only goes to YouTube when you click one of them and open the YouTube page.

The language of this website is determined by the URL you open and is not stored in your browser. The separate CV service may continue to save its language selection locally in the browser (localStorage). This setting stays on your device, is not sent to us and can be deleted at any time in your browser settings (Section 25(2) no. 2 TDDDG).

The exception is the application overview for placement customers (Section 6a): there, after you enter your date of birth, we set a strictly necessary cookie so that your device stays signed in (§ 25(2) No. 2 TDDDG).

5. Contact forms for employers and job seekers

Through the forms on this website we receive the information you enter, for example name, company, email address, phone number, staffing needs, period, number of people, nationality, education, German skills and your message. We store the request in our customer portal and process it there.

The purpose is to answer your request and, where applicable, to prepare a placement agreement (Art. 6(1)(b) GDPR). In addition, we store the IP address the request came from and limit the number of requests per IP address to prevent misuse and mass spam (Art. 6(1)(f) GDPR).

6. Application for placement

In the application form we ask for your full name as in your passport, the type of work and field you want, your profession or training, work experience, date of birth, marital status, German skills, whether you have a passport, and your WhatsApp number. We need your marital status because the German visa application requires it.

When you apply for a holiday job, we also ask for your address, your email address, your studies, the dates of your semester break, earlier stays abroad, the field you want to work in and your language skills, and we ask for a copy of your passport. Marital status is optional there. We also contact you about it by email.

We use this information to place you in a job, an apprenticeship or a holiday job in Germany and to contact you about it via WhatsApp (Art. 6(1)(b) GDPR). If we propose you for a specific position, the employer receives the information needed for it. For the work permit and visa, we send the necessary information and documents to the Federal Employment Agency (Bundesagentur für Arbeit), the competent immigration office and the German embassy or consulate. We also store documents for these applications in Microsoft OneDrive (Section 10).

6a. Application overview for placement customers

If we apply to employers on your behalf as part of a placement package, you receive a personal link to your application overview. For each application it shows the date, the employer, the job with a link to the job ad, the beginning of the recipient address (at most five characters, the rest hidden), and whether and on which day the employer replied. The overview also shows the steps we have completed for you, such as when your CV was finished and when we prepared you for a job interview. Full recipient addresses, contact persons and the employers' reply texts are not shown there.

The link alone only shows a locked page. The overview opens only with your date of birth. For this purpose we store the link and the date of birth only as an encrypted check value. We store every sign-in attempt with its time, its result and a shortened, encrypted check value of your IP address. After five wrong attempts the link is locked for one hour, after ten wrong attempts permanently. After the correct entry we set a strictly necessary cookie so that your device stays signed in for 30 days (§ 25(2) No. 2 TDDDG). You can sign out on the page at any time.

Whether an employer has replied is determined automatically: a program reads only the header lines of incoming emails (sender, subject, date and the reference to earlier emails) in the Global Consult mailbox from which the application was sent, and thereby recognises replies to exactly this application. The program does not read the text of the replies.

The legal basis is our contract with you (Art. 6(1)(b) GDPR); for protecting the access also our legitimate interest in the security of your data (Art. 6(1)(f), Art. 32 GDPR). The link is valid for at most six months and can be locked at any time. We keep the sign-in log as long as your other placement data (Section 13).

7. CV service

In the CV service form we collect first name, last name, date of birth, phone number, email address, your CV, application photos, further documents if you wish, and your answers about the programme, marital status, field of work, passport and career history. If information is missing, we send you a link for follow-up questions that is valid for 14 days.

We use the data to create or revise your CV and application documents, to clarify questions and to send you the result by email (Art. 6(1)(b) GDPR). We read and check the documents with the help of AI services (Section 11). If you then use the documents for a placement through us, Section 6 applies.

When you order the paid CV service, your chosen payment provider, Stripe or PayPal, receives the data required to process the payment. Further information can be found in the privacy notices of Stripe and PayPal.

When you submit the form, we also store your IP address and browser identifier in order to detect misuse and to be able to prove the submission in the event of a dispute (Art. 6(1)(f) GDPR).

8. Refund

In the refund form we collect the name of the account holder, BIC/SWIFT, IBAN or account number, invoice number, reason and amount. We check the request and transfer the amount to the account you provide (Art. 6(1)(b) GDPR). For this, our bank or the payment service provider Wise receives the account details. Because a refund is an accounting transaction, we keep the records as required by commercial and tax law and present them to the tax office in the event of a tax audit (Art. 6(1)(c) GDPR).

9. Email, WhatsApp, Telegram and video calls

Email: Our mailboxes are operated by IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) in Germany, as a processor on our instructions (Art. 28 GDPR).

WhatsApp and Telegram: We also communicate with applicants and customers via WhatsApp and Telegram, especially if you give us your number for this or write to us there. Messages are handled by WhatsApp Ireland Limited (Merrion Road, Dublin 4, Ireland; data is also processed by Meta Platforms, Inc. in the USA) and by Telegram (Telegram Group Inc., British Virgin Islands, together with Telegram FZ-LLC, Dubai). These providers also process data for their own purposes under their own privacy policies. We additionally store the message history on our server in Germany so that we can follow your request. The legal basis is Art. 6(1)(b) GDPR where your request or order is concerned, otherwise Art. 6(1)(f) GDPR (our interest in fast communication through the channel you use yourself). If you do not want to be contacted via a messenger, just tell us and we will write to you by email.

Video calls: We use Microsoft Teams for calls. Microsoft processes your name, image and sound as well as technical connection data, also in the USA. The legal basis is Art. 6(1)(b) GDPR where the call concerns your request or order, otherwise Art. 6(1)(f) GDPR.

10. Who else receives your data

• Employees of Global Consult, to the extent they handle your matter.
• Providers whose technology we use: Hetzner (servers, Germany), IONOS (email, Germany), Microsoft Ireland Operations Limited (video calls with Teams and file storage in OneDrive; data is also processed in the USA) and the AI services listed in Section 11.
• Employers in Germany to whom we propose you.
• Authorities in the placement and visa procedure: Federal Employment Agency, immigration offices, German embassies and consulates.
• For payments and refunds: our bank, the payment service provider Wise and, in the event of a tax audit, the tax office.
• For the paid CV service: Stripe or PayPal as your chosen payment provider (Section 7).
• WhatsApp and Telegram, when we communicate through these services.
• Google (YouTube), if you play a video on our website (Section 4).

Beyond this, we only pass on your data if we are legally obliged to do so. We do not sell data.

11. Use of AI services

To read documents, draft texts and handle requests faster, we use AI language models. Content from forms, documents and messages may be transferred to these providers. Depending on the task, these are Anthropic (Claude; Anthropic Ireland, Limited, Dublin), OpenAI (OpenAI Ireland Limited, Dublin) and, for functions in our email area, Groq LLC (USA). The legal basis is Art. 6(1)(b) GDPR where we use them to carry out your order, otherwise Art. 6(1)(f) GDPR (our interest in prompt processing). The results are checked by people. We do not make decisions based solely on automated processing that have legal effects on you (Art. 22 GDPR).

12. Transfers to countries outside the EU

• Meta Platforms, Inc. (WhatsApp), Microsoft Corporation and Google LLC (YouTube) are certified under the EU-US Data Privacy Framework. For certified companies, the European Commission has found an adequate level of data protection (Art. 45 GDPR).
• Anthropic and OpenAI pass data from their Irish companies to the USA and, according to their own statements, rely on the EU Standard Contractual Clauses for this (Art. 46(2)(c) GDPR). According to its own statements, Groq relies on contractual clauses recognised by the EU.
• Telegram processes data at companies in the British Virgin Islands and in Dubai, for which there is no adequacy decision, and according to its own statements relies on the EU Standard Contractual Clauses. We only use Telegram if you choose this channel to communicate with us (Art. 49(1)(b) GDPR).

You can obtain a copy of the Standard Contractual Clauses from the respective providers or from us on request.

13. How long we store data

• Requests, applications and CV service orders: three years after our last contact with you. Claims arising from our cooperation can still be asserted during this time (regular limitation period under Sections 195 and 199 of the German Civil Code); after that we delete the data.
• Invoices and other accounting records, including those for payments and refunds: eight years from the end of the calendar year (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code).
• Web server error logs: until they are overwritten, at present about eight weeks (Section 3).

If you ask for deletion earlier, we delete everything we are not required to keep by law.

14. Do you have to provide your data?

You are not obliged by law or contract to give us data. However, we need the mandatory fields marked with * to process your request, application, order or refund. Without them this is not possible.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)). To do so, simply write to info@service-globalconsult.de.

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

Right to lodge a complaint: You can complain to any data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart, Germany, poststelle@lfdi.bwl.de.

16. Language versions and changes

This policy is available in German, English, Russian and Uzbek. The German version is authoritative. We update the policy when our processes or the law change.

Last updated: 4 November 2026