Privacy Policy

This English version is provided as a courtesy translation. The German version is the legally authoritative one.

1. Controller

Controller within the meaning of the GDPR:

Loránt Máté
Lerchenfeldstr. 10
79199 Kirchzarten, Germany
E-Mail: kontakt@allesklargermany.de

A data protection officer is not legally required and has not been appointed.

2. Overview

This policy explains which personal data we process when you use AllesKlarGermany (website and resume builder), for which purposes, on which legal basis, and which rights you have.

Core principles of our service:

  • No advertising cookies, no tracking. We only use strictly necessary browser storage (Section 5); that is why this website needs no cookie banner.
  • Encryption: resume data and email addresses are stored encrypted in our database (AES-256-GCM).

3. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may withdraw any consent at any time with effect for the future (Art. 7(3)).

Registered users can export a complete copy of their data and permanently delete their account, including all data, at any time under "My Account". For anything else, an email to kontakt@allesklargermany.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Section 12).

4. Hosting and server logs

Our website is hosted by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany (server location: Nuremberg, Germany). When you visit the site, the server automatically processes technical data: IP address, date and time, requested page, browser type and operating system (server log files). This is required to operate and secure the website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation). Log files are deleted after 14 days. A data processing agreement (Art. 28 GDPR) is in place with the hosting provider.

5. Local browser storage and analytics (no cookie banner required)

We use your browser's localStorage exclusively for strictly necessary purposes within the meaning of Section 25(2) TDDDG, in particular:

  • settings — e.g. language and display mode (light/dark), so the interface stays the way you chose;
  • login — the login token (JWT) and related account details, to keep you signed in;
  • local resume data and selections — if you use the builder without an account, your input stays in your browser only and is not transmitted to us; we may also remember a selection you made (e.g. a chosen plan).

No tracking or advertising cookies are set, and no third-party content (fonts, images, scripts) is loaded from external servers; we serve all resources ourselves.

Analytics with Umami (cookieless). To understand how our website is used and to improve it, we use the open-source analytics tool "Umami". Umami runs on our own server (netcup, Germany) — no data is transferred to third parties. Measurement works without cookies; nothing is stored on your device and no information stored there is read out. No consent under Section 25 TDDDG is therefore required.

Only pseudonymised data that cannot be traced back to you as a person is processed: the pages you visit, the page you came from (referrer), approximate location at country level (derived from your IP address, which is not stored), and your browser, operating system and device type. There is no cross-site tracking and no user profiles are created.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the needs-based, secure provision and continuous improvement of our website). You may object to this processing under Art. 21 GDPR; you can also fully prevent measurement using a script or ad blocker in your browser.

6. Registration, account and resume data

When you register, we process your email address and your password (stored as a cryptographic hash). Registration becomes active only after confirmation via an email link (double opt-in).

If you save resumes in your account, we process the content you enter (e.g. name, contact details, work experience, education, photo, signature). This content and your email address are stored encrypted in the database (AES-256-GCM).

Purpose: providing the service (creating, storing, editing and exporting your application documents). Legal basis: Art. 6(1)(b) GDPR (performance of contract). Storage period: until you delete your account (Section 10).

PDFs are generated on our own server; no data is transferred to third parties for this.

7. Transactional emails and contacting us

We send system emails required for the service: registration confirmation (double opt-in), password reset and similar account-related messages, via our email provider netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, as our processor.

Legal basis: Art. 6(1)(b) GDPR.

Contacting us: If you contact us by email, we process your email address and the content of your message to handle your request. Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). The correspondence is deleted once your request has been fully resolved and no statutory retention duties apply.

8. Newsletter and deal alerts

We offer two separate email categories, each of which you receive only after an individual, explicit sign-up confirmed by email (double opt-in):

  • Newsletter: job-market tips and product news.
  • Deal alerts: rare savings tips (about 10 times a year), e.g. on bank bonuses or mobile plans. These alerts are advertising and may refer to partner offers for which we may receive a commission.

For this we process your email address, the categories you selected, the time of sign-up and confirmation per category, the IP address used, and the version of the consent text shown (as proof of consent, Art. 7(1) GDPR).

Legal basis: Art. 6(1)(a) GDPR (consent). You can unsubscribe from each category individually, or from all emails at once, at any time via the link in every email; consent then ends for the future for the category you deselected. Sending is handled by the email provider named in Section 7.

9. Abuse prevention (rate limiting)

To protect against automated abuse (e.g. mass registrations or excessive use of individual features), we briefly process IP addresses and per-account usage counters.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in securing the service and limiting abuse costs).

10. Storage periods

  • Account and content data: until you delete your account (instantly available under "My Account").
  • Newsletter data: until withdrawal; proof-of-consent records up to 3 years after unsubscribing (limitation periods).
  • Server logs: 14 days.

11. No automated decision-making

There is no automated decision-making within the meaning of Art. 22 GDPR and no profiling.

12. Right to complain to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence or of the alleged infringement. The authority responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

13. Data security

All transmissions are TLS-encrypted. Resume content and email addresses are stored in the database encrypted with AES-256-GCM; keys are managed separately from the database.

14. Changes to this policy

We will update this policy when the service or the legal situation changes. The version published here applies.

Last updated: 18.07.2026