Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is HR Software Solutions GmbH, Adenauerplatz 1, 33602 Bielefeld, Germany, represented by its managing director Tasso Mitsarakis. Phone +49 5218 9880 20, e-mail kontakt@enoono.com.

We have not appointed a data protection officer. Please send questions about data protection to kontakt@enoono.com.

2. Overview

enoono uses no cookies, no tracking, no analytics or advertising services and no third-party content in the browser; your browser only connects to our server and to our database and authentication service Supabase (sections 3 and 16). We serve our fonts ourselves. In the browser we only store what is technically necessary for signing in and the language setting (section 17).

3. Visiting the website

Our website runs on a server of our own that we operate ourselves; it is located in an IONOS data centre in Germany (section 16). Each time the site is visited, the server processes technically necessary connection data: IP address, date and time, requested address, amount of data transferred, previously visited page (referrer), and browser and operating system (user agent). This is necessary to deliver the pages and to fend off attacks. The legal basis is our legitimate interest in secure provision (Art. 6(1)(f) GDPR). Error messages from the app contain no IP addresses. When you sign in and when data and documents are loaded, your browser also connects directly to our database and authentication service Supabase (section 16); Supabase processes the same connection data.

We do not keep access logs. The server's system logs (error messages, blocked connection attempts and logins to the server) may contain IP addresses; the server deletes them automatically after at most 14 days; we only analyse them in the event of disruptions or attacks.

4. Account and registration

For your account we process: e-mail address, password (stored only as a hash, we cannot read it), display name, country, preferred language, account type (candidate, employer or staff), version and time of your acceptance of the Terms of Use, type and time of your age confirmation (candidate and staff: at least 16, under 18 with the consent of parents or legal guardians; employer: at least 18 and acting commercially), time of registration and the progress of setting up your account.

When you sign in, our database and authentication service (Supabase, section 16) stores the sign-in sessions with their time and technical information such as IP address and browser identifier in order to manage sessions and detect misuse. Sessions end when you sign out or when the session period expires; Supabase deletes the authentication service's logs after at most 7 days.

The legal basis is the contract of use (Art. 6(1)(b) GDPR); for session data additionally our legitimate interest in account security (Art. 6(1)(f) GDPR). We keep account data until your account is deleted.

5. Candidate profile

For your candidate profile we process the information you provide: first and last name, year of birth, nationality, current country and city, short description, work authorisation (status, countries, need for visa support), driving licence and classes, desired positions, skills, languages with level, qualifications (title, issuer, year, linked document), availability periods, desired countries and regions, expected pay (amount, currency, gross or net, time unit), desired types of employment, preferences on accommodation and meals, a profile photo, and your employment history (employer, country, city, position, period, duties, optionally a document).

Your profile starts as a draft that only you can see. You can publish it once the required information is complete; if you later remove required information, it becomes a draft again. You can pause or withdraw publication at any time.

A published profile can only be found by signed-in employers with an active account, and only in anonymised form: first name and initial of the last name, current country, desired positions, skills, languages, titles of qualifications (without issuer, year and document), availability, desired countries and regions, expected pay, types of employment, preferences on accommodation and meals, a summary of your work authorisation with the countries, whether you have a driving licence, an experience level calculated from your employment history, whether a released photo exists, and the date of publication. Last name, year of birth, nationality, city, short description, e-mail address and the photo itself are not shown.

Your profile photo is kept in private storage. We currently do not show it to employers; if the setting “Show my photo to employers in search” is on, employers only learn in the search that a photo exists.

For sorting by match (§ 9 of the Terms of Use) this information is compared with the requirements of a job. The result is not stored.

The legal basis is the contract of use (Art. 6(1)(b) GDPR). We keep the information until you change or delete it, at the latest until your account is deleted.

6. Documents

You can upload documents as PDF, JPEG or PNG up to 5 MB and assign them a type (CV, employment reference, certificate, proof of work authorisation, other). They are kept in private storage; no other user has automatic access.

An employer only sees a document if you share it with them as part of an application. They see it in a preview via a link that is valid for 120 seconds; we do not offer downloads. Screenshots cannot be technically prevented. Access ends when you withdraw the share, and at the latest 30 days after the application has ended. If our moderation freezes an application, the employer's access to that application and to the candidate's employment history and documents is suspended – including access from an accepted contact request; no preview is then possible.

Documents that we are checking or have checked cannot be deleted individually, so that the result remains traceable; they are deleted together with your account.

Please do not upload special categories of personal data (§ 4(2) of the Terms of Use). If you upload them anyway, we only store them in order to make them available for viewing, on your instruction, to the employer you have chosen; you can delete them or withdraw the share at any time.

Otherwise, the legal basis is the contract of use (Art. 6(1)(b) GDPR). We keep documents until you delete them, at the latest until your account is deleted.

7. Applications

For an application we store the job, candidate, employer, status with timestamps, your message to the employer (up to 1,500 characters) and the shares. The employer sees your display name, the country given at registration, your message, your employment history with its review status and the shared documents.

While the application is ongoing, this access continues. If it is rejected, withdrawn, closed or completed, the employer's access to name, employment history and documents ends after 30 days.

The employer is itself the controller for the data it receives in the application process. The legal basis for our processing is the contract of use (Art. 6(1)(b) GDPR).

We do not currently delete application records automatically. If you delete your account, the record remains with the employer without name, message and documents as “deleted account”.

8. Contact requests

If an employer contacts you through the search, we store employer, candidate, status and timestamps. Before you respond, the employer only sees the information from the anonymised search; you see the employer's company name, country, city, type of business and verification status.

If you accept, the employer gains access to your full display name and employment history until it withdraws the request or one of the two accounts is deleted. We do not pass on your e-mail address.

The legal basis is the contract of use (Art. 6(1)(b) GDPR). We do not currently delete contact requests automatically; after an account is deleted, the record remains without a name.

9. Employers, job posts and verification

For employers we store company name, type of business, country, city, website, description and contact person, as well as the job posts. Open job posts are publicly visible; for non-anonymous posts also the employer's company name, description and website. We do not show the contact person publicly.

For verification, the employer submits its legal name, commercial register or VAT number, a confirmation of accuracy and evidence (PDF, JPEG, PNG or WebP up to 5 MB). The evidence is kept in private storage; our staff review it and record the decision and reasons. Candidates see the verification status with contact requests.

The legal basis is the contract of use with the employer (Art. 6(1)(b) GDPR); for contact persons' data and for verification, our legitimate interest in protecting candidates from fake offers (Art. 6(1)(f) GDPR). We keep the data until the employer account is deleted.

10. Checking candidate information

Our staff may check uploaded documents and employment history. To do so, they see your profile, your documents and your employment history. We record the result (verified, rejected or query) with reasons; you see the review status on the respective document or entry in your employment history. Verified information can no longer be changed afterwards.

The legal basis is our legitimate interest in reliable information on the Platform (Art. 6(1)(f) GDPR). We keep the result until your account is deleted.

11. Reviews

After completed employment, both sides can review each other (1 to 5 stars and text). We store author, reviewed party, application, rating, text, time and, where applicable, the moderation decision and reasons. Reviews are only visible to the two parties and – for moderation – to our staff.

The legal basis is the contract of use (Art. 6(1)(b) GDPR). We do not currently delete reviews automatically; after the author's account is deleted, they are kept without a link to that account.

12. Reports, support, appeals and moderation

For reports, support requests and appeals we store the submitting person, subject, category, description, status, messages and decision. For moderation measures we store the type, subject, person affected, reasons, staff member acting and timestamps; decisions and the moderation log cannot be changed afterwards.

Insofar as we fulfil obligations under the Digital Services Act (reports, statements of reasons, appeals, Art. 16, 17 and 20), the legal basis is Art. 6(1)(c) GDPR; otherwise our legitimate interest in a safe platform free of abuse (Art. 6(1)(f) GDPR).

We keep these records as long as they are needed to document our decisions, for appeals and to defend against claims. No automatic deletion is currently set up. After an account is deleted, the records are kept without a link to the account.

13. Administration log

Actions of our staff in the administration – for example moderation and review decisions, handling data protection requests, start and end of their sessions – are logged immutably with time, acting person, record concerned and reason. Content such as descriptions and review texts is not copied into the log.

The legal basis is our obligation to be able to demonstrate compliance with data protection law (Art. 5(2), Art. 24 GDPR) and our legitimate interest in traceable decisions (Art. 6(1)(f) GDPR). The log is kept even after an account is deleted; no automatic deletion is currently set up.

14. Data protection requests

Under “Account settings” you can request access to and a copy of your data, rectification, restriction or erasure (at most three within 24 hours; by e-mail at any time). We store type, description, reference number, status, deadline and proof of completion. Requests are handled by authorised staff.

We answer requests within one month (Art. 12(3) GDPR); on the Platform we show you an answer date 30 days after receipt.

The legal basis is our legal obligation (Art. 6(1)(c) in conjunction with Art. 12 to 22 GDPR). Requests are kept as evidence even after the account is deleted, without a link to the account.

15. Deleting your account

You can delete your account yourself at any time under “Account settings”; if your account is suspended, please send us an e-mail. Deletion takes effect immediately: we delete login data, profile, documents and all uploaded files (including profile photo and verification evidence), employment history, shares and notifications, and clear your messages in applications.

The following are kept, without a link to your account and shown as “deleted account”: applications and contact requests with the employer (without a name), reviews you wrote, reports, moderation cases and decisions, and data protection requests. The administration log (section 13) remains unchanged. Job posts of a deleted employer remain stored without a link to the account but are no longer publicly visible.

16. Recipients and service providers

Other users only receive data to the extent described above. Authorities only receive data if we are legally obliged to provide it.

Hosting: We operate our server ourselves; the data centre and hardware are provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Deutschland. Data centre location: Germany (Frankfurt).

Database, authentication and file storage: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. Storage location: Dublin, Ireland (eu-west-1). The data is stored in the European Union. For access from outside the EU we rely on standard contractual clauses (Art. 46(2)(c) GDPR).

Sign-in e-mails (address confirmation, password reset, staff invitations): These e-mails are sent on our behalf by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Deutschland; place of processing: Germany.

E-mail contact: Our mailbox kontakt@enoono.com is operated on our behalf by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Deutschland; place of processing: Germany.

We have concluded data processing agreements under Art. 28 GDPR with all service providers.

17. Browser storage

We do not set cookies. Your browser's local storage only holds:

• “enoono-locale”: your chosen language, until you change it
• “sb-…-auth-token”: your enoono sign-in session, until you sign out
• “enoono-admin-auth”: for staff only, the administration session
• “enoono.workspace” and “enoono.sidebar”: the workspace you last chose and whether the sidebar is expanded, until you change them
• “enoono.wishes.<account>.<phase>”: your shift wishes for a wish phase that you have not sent yet (days and choice); the draft is deleted when you send it and when you sign out
• “enoono.password-recovery” (session storage): a marker that you opened a password reset link, until the password is changed or the tab is closed

These entries are strictly necessary for the service you requested (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); no consent is required. The legal basis for the related processing is the contract of use (Art. 6(1)(b) GDPR).

18. Minors

Candidates must be at least 16 years old; between 16 and 17 only with the consent of their parents or legal guardians. Employer accounts require a minimum age of 18. We process minors' data on the basis of the contract of use (Art. 6(1)(b) GDPR), not on the basis of consent. If we learn that an account belongs to a person under 16, we delete it.

19. Obligation to provide data, no automated decision-making

We need the information given at registration for the contract of use; without it you cannot create an account. Profile information is voluntary; you only need the required information to publish a profile.

There is no automated decision-making within the meaning of Art. 22 GDPR. The match only sorts search results; people make the decisions.

20. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

You can make requests under “Account settings” or by e-mail to kontakt@enoono.com.

You can also lodge a complaint with a supervisory authority (Art. 77 GDPR), for example in the member state where you live. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

21. Right to object under Art. 21 GDPR

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

22. Language and changes

The German version of this policy is authoritative. If the processing changes, we will update this policy; the current version is always on this page.

23. Shift planning

Employers can plan shifts in enoono. For the data of its team, the respective employer is the controller; we process the data on its behalf (Art. 28 GDPR, data processing agreement that the owner accepts before first use). The employer determines the legal basis, usually the employment relationship. The employer informs you about the processing in the team (Art. 13, 14 GDPR). Questions about it are best addressed to the employer; we forward requests that reach us. For your account itself we remain the controller (section 4).

In the team we store the employer, the role (owner, planner, staff), the origin of the membership (employer account, hired via enoono, invited), the status with joining and leaving time and, optionally, the year of birth that a planner enters; it is used only for youth protection hints, which are legal guidance and not legal advice. Planners see display name, role, origin, status, this year of birth and availability, and the email address only for invited people. Your candidate profile and your documents are not used in shift planning. If an employer that has accepted the data processing agreement sets your application to “hired”, you automatically become a staff member of its team (also for hirings that already exist at acceptance); before that you do not become a member automatically. When the hiring ends, you automatically leave the team unless you are a member through an invitation or have been made a planner.

Planners can invite people by email. For this we store the address and a check value of the invitation code; we delete the address as soon as the invitation is accepted, revoked or has expired after 14 days; in the sending job of the invitation email it remains for up to 30 days after sending. An invitation can only be accepted by a candidate or staff account with the invited, confirmed email address; employer accounts cannot join a team. Through the invitation a staff account can be created (display name, email address, password, country, language, consent and age confirmation: at least 16, under 18 with the consent of the legal guardians), without a candidate profile.

For shifts we store times, break, location, position, number of people needed, note, status and who created or changed them; for assignments the person, the status and reasons; for availability the periods you enter yourself. Shifts can be cancelled but not deleted individually. Every change to shifts, assignments, team and availability is recorded unalterably in the employer's log (who, when, what, before and after); planners of the employer can view it. Shift types are templates of the employer (name, times, break, colour, staffing need, location, position) and contain no personal data.

We inform you about events in the app. Only the following are also sent by email: to the person concerned, new, changed, cancelled or removed assignments and the decision on their requests for open shifts; to team members (except the owner), new open shifts in the next 14 days (at most one email per day, only shifts that are still open when the email is sent); to planners, only new requests; to invited addresses, the invitation. Planners learn about answers to proposals, withdrawn commitments, members leaving the team and accepted invitations only in the app, without an email. The emails name the employer, time, location, position and, where applicable, the reason given by the planner or the person; the platform does not insert names of other people. They are sent via a queue, using the same email service as the sign-in emails (section 16). You can unsubscribe from emails per category under Profile → Settings (planners and owners: Settings → Email notifications); invitations cannot be unsubscribed.

We delete email sending jobs (recipient address, employer name and the details for the email) no later than 30 days after sending, final failure or cancellation, read notifications 180 days after reading, and internal markers for digest emails as soon as the shift has ended or been cancelled or the person is no longer in the team. Unread notifications remain until your account or the employer account is deleted. We store team, shifts, assignments, availability and log for as long as the employer account exists; leaving a team deletes nothing, so that the employer can prove who was scheduled when and where. If an employer deletes its account, we delete all data of its shift planning, including notifications and email sending jobs, also those not yet sent; from digest emails with shifts of several employers we remove its shifts. The app currently offers no export of shift data. You receive information about and a copy of your data in the team from the employer; we forward requests that reach us to the employer and support it in answering them.

If you delete your account, you leave all teams: future assignments are removed, your availability, notifications and sending jobs are deleted, and in shifts, in the log and in notifications to others you only appear as “deleted account”.

24. Time tracking

Employers can record the actual working time of their team in enoono. For this data, the respective employer is the controller; we process it on its behalf (Art. 28 GDPR, data processing agreement). The purposes are proof of working time, the employer's statutory recording obligations (for example § 16(2) ArbZG, § 17 MiLoG) and its payroll. The employer determines the legal basis, usually a legal obligation and the employment relationship.

We store the start, end and breaks of your working time as server time (not the time of your device), the link to the planned shift, status and markers (such as “end missing” or “unplanned”), who confirmed, approved or discarded an entry and who closed or reopened a month (each with the time), corrections with the reason and the old and new values, for a discarded entry the reason, for a resolved or declined correction request the note and for a reopened month the reason (each free text of the planner or owner), for a confirmed unplanned entry the location and position, your correction requests with your comment, the personnel number entered by a planner, and a log of exports (month, format, number of employees, provisional or not). We do not record any location or any device identifier when clocking in or out.

You see your own entries with status, corrections and correction requests, also after leaving the team. Planners and owners of the employer see all entries of the employer and export them as CSV or PDF for payroll; the exports then lie with the employer.

We inform you about time tracking events in the app. Only the following are also sent by email: to you, when the end of your working time has been marked as missing; to planners and owners, when an entry is missing its end, when a correction request comes in and when a month has been reopened. Only in the app, without an email, do you learn that an entry was corrected, added or discarded, that your correction request was resolved or declined and that a month was closed or reopened; planners learn only in the app that someone clocked in without a planned shift. The emails name the employer, date, time and a link, no names of other people. The email about a reopened month also contains the reason (free text) the owner gave when reopening it. You can unsubscribe from emails of the time tracking category under Profile → Settings (planners and owners: Settings → Email notifications); the notification in the app remains.

We automatically delete time entries together with breaks, correction requests, the month closing, the related log entries and notifications 2 years after the end of the month in which the entry starts (entries from October 2026, for example, on 1 November 2028), for closed and not closed months alike. If the employer deletes its account, we delete all time data immediately. If you delete your account, your entries remain with the employer until the end of this period and appear as “deleted account” with the personnel number. The employer fulfils longer retention obligations for payroll records with its exports.

25. Shift wishes

Employers can open a wish phase in enoono for each month in which staff and planners submit their shift wishes. The respective employer is the controller of this data; we process it on its behalf (Art. 28 GDPR, data processing agreement). The purpose is the employer's duty scheduling. The legal basis is determined by the employer, usually the employment relationship.

For each day we store your wish (one of the employer's shift types, “any” or “can't”), the time you sent it, the approval (who, when) and the resulting assignment, and for the wish phase the month, deadline and status. There is no free-text field and no reason for “can't”; wishes therefore contain no free text, and we do not collect reasons such as health information.

You can see your own wishes in the app while you belong to the team; after leaving the team you no longer see them there, and you can get access through the employer or on request. The planners and the owner of the employer can see them as well. Wishes are not binding. If a planner approves a wish, you are firmly scheduled for that shift without confirming again; you can withdraw from it like any shift.

We inform you about shift wishes in the app. Only the following are also sent by email: to staff and planners of the team when a wish phase is opened for the first time (category shift wishes, can be unsubscribed), and to you when your wishes have been approved and the shifts published (category shifts, several days in one email). The emails state the employer, month, deadline or days, shift type, the start and end times of the shifts and contain a link, but no names of other people. There is no notification for a changed deadline, a closed or reopened phase or for sending your wishes.

We delete wishes together with the wish phase, the related log entries and notifications automatically 3 months after the end of the wish month (wishes for November 2026, for example, on 1 March 2027), and immediately when your account or the employer account is deleted. Assignments that resulted from approved wishes are kept like other shift data (section 23).