Privacy Policy

We have not appointed a data protection officer. The statutory requirements for an obligation to appoint one do not apply to us (Art. 37(1) GDPR, Section 38(1) BDSG (German Federal Data Protection Act)).

For all questions concerning data protection and the exercise of your rights, please contact us directly:

Email for data protection enquiries: info@personalagentur-sam.de

When you access this website, your browser automatically sends technical data that is required to deliver the page. This data is recorded in the connection logs of the systems involved. The following is transmitted:

• Date and time of access
• IP address of the requesting device
• Host name of the accessing computer
• Website from which the access is made (referrer)
• the pages and files accessed
• Status message indicating whether the request was successful
• the volume of data transferred in each case
• browser type used and its version
• operating system used

This data is technically necessary so that the page can be delivered to your browser and displayed there correctly. Beyond that, it serves the stability and security of our system, in particular the detection and prevention of attacks as well as troubleshooting.

No evaluation for marketing or analytics purposes takes place. The log data is not merged with other data sources and is not used to draw conclusions about you personally.

The legal basis is Art. 6(1) sentence 1 (f) GDPR. Our legitimate interest lies in providing the website in a technically flawless manner and protecting it against misuse.

The log data is generated at our hoster and in the upstream security and delivery network; both are described in more detail under no. 3. These providers process the data as processors exclusively on our behalf and in accordance with our instructions.

No disclosure beyond this takes place. This does not apply to disclosure to law enforcement or other authorities, insofar as we are legally obliged to do so or insofar as this becomes necessary for legal prosecution in the event of attacks on our infrastructure.

No permanent access logs containing IP addresses are kept on our own server. Only technical operating messages of the application are generated there (such as start-up and error messages). These do not contain any visitor IP addresses and are overwritten automatically as soon as a defined storage limit is reached.

The connection data transmitted when the page is accessed is, by contrast, generated in the upstream security and delivery network (see no. 3 b) and is deleted there in accordance with the provider's retention periods. We do not evaluate these logs for analytics or marketing purposes.

This website is hosted with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers used are located in a data centre in Germany (Nuremberg).

Hetzner processes the log data referred to under no. 2 as well as all other data arising in connection with the operation of this website exclusively on our behalf and in accordance with our instructions. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Hetzner. The legal basis for the use is Art. 6(1) sentence 1 (f) GDPR – our legitimate interest in the professional, secure operation of the website.

Hetzner's privacy policy

All data traffic of this website runs via the delivery and security network (content delivery network) of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; represented in Germany by Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C, 81671 München.

Cloudflare is thus technically interposed between your browser and our server and in doing so inevitably processes your IP address as well as the technical details of your request. The purpose is the fast and reliable delivery of the page content, the encryption of the connection and protection against overload and other attacks (e.g. DDoS).

The legal basis is Art. 6(1) sentence 1 (f) GDPR. Our legitimate interest lies in the secure, available and trouble-free operation of the website.

Cloudflare is a company based in the USA; processing of data outside the EU or the EEA can therefore not be ruled out. The basis for the transfer are the standard contractual clauses of the EU Commission pursuant to Art. 46(2)(c) GDPR, which form part of the data processing agreement (Data Processing Addendum) concluded with Cloudflare. Despite these safeguards, it cannot be entirely ruled out that US authorities may access the data.

Cloudflare's privacy policy

Our domain is registered with IONOS SE, Elgendorfer Str. 57, 56410 Montabaur; our email mailbox is also operated there. Messages that you send us via one of the forms or directly by email arrive in this mailbox and are stored there.

In this respect, IONOS acts for us as a processor pursuant to Art. 28 GDPR. The legal basis for the use is Art. 6(1) sentence 1 (f) GDPR.

IONOS's privacy policy

This website can only be accessed via a TLS-encrypted connection; unencrypted requests are automatically redirected to the encrypted address. The certificate used is issued by Let’s Encrypt.

You can recognise an encrypted connection by the fact that your browser's address bar begins with “https://” and displays a padlock symbol. As long as the encryption is active, the data you transmit to us cannot readily be read by third parties.

The following is collected:

• First name and last name
• Email address
• Phone number (voluntary)
• Your message

Purpose: processing and answering your enquiry.

Legal basis: if your enquiry is aimed at the conclusion or performance of a contract, this is Art. 6(1) sentence 1 (b) GDPR. In all other cases we base the processing on Art. 6(1) sentence 1 (f) GDPR – our legitimate interest lies in being able to respond to matters brought to our attention.

Storage period: we store your enquiry for as long as this is necessary to process it and then delete it, at the latest once the underlying matter has been concluded. This applies unless statutory retention obligations prevent deletion – in particular the commercial and tax law periods pursuant to Section 257 HGB (German Commercial Code) and Section 147 AO (German Fiscal Code).

The following is collected:

• Name of the company
• Name of the contact person
• Email address
• Phone number (voluntary)
• Industry or area (warehouse & logistics, production & manufacturing, trades & industry, office & administration or other)
• Type of requirement (temporary staffing, recruitment, contract for work or not yet clear)
• Your message

Purpose: review and processing of your staffing requirements as well as the preparation of a quotation.

Legal basis: Art. 6(1) sentence 1 (b) GDPR, as the processing is necessary in order to carry out pre-contractual measures at your request. Insofar as this concerns contact data of employees of the enquiring company, we additionally base the processing on Art. 6(1) sentence 1 (f) GDPR (interest in functioning business communication).

Storage period: as under letter a. If a collaboration comes about, the statutory retention periods of up to ten years apply to the contract and billing documents.

The following is collected:

• First name and last name
• Email address and phone number
• Place of residence and postcode (voluntary)
• earliest possible starting date or the indication “immediately”
• desired area or desired position
• desired working model (full-time, part-time, shift work, mini-job or flexible)
• driving licence classes held and forklift licence
• Your message
• Your consent to the processing for the purpose of the application

In addition, you can upload application documents: up to five files in PDF, JPG, PNG or Word format, each no larger than 5 MB and no more than 7 MB in total. These files are not stored on our web server. They are only checked in the main memory and delivered directly to our mailbox as an attachment to the application email.

Please note: you decide for yourself which documents you upload. We ask you to refrain from providing information that is not necessary for the application – in particular special categories of personal data pursuant to Art. 9 GDPR such as health data, religious affiliation or trade union membership. If you nevertheless transmit such data, we will only process it insofar as this is necessary for the decision on your application (Section 26(3) BDSG) or you have expressly consented.

Purpose: conducting the application procedure and – where a suitable opportunity arises – your placement with or assignment to a client company (see no. 8).

Legal basis: Art. 6(1) sentence 1 (b) GDPR in conjunction with Section 26(1) sentence 1 BDSG. The processing is necessary for the decision on the establishment of an employment relationship. Insofar as you voluntarily provide us with further information, the legal basis is your consent pursuant to Art. 6(1) sentence 1 (a) GDPR, which you can withdraw at any time with effect for the future.

Storage period: if no collaboration comes about, we generally delete your application documents six months after the conclusion of the application procedure. This period is based on the periods for asserting claims under the General Equal Treatment Act (Section 15(4) AGG, Section 61b(1) ArbGG (German Labour Court Act)) plus a safety margin. If you would like us to keep your documents beyond that for future positions (applicant pool), we will ask you separately for your consent; this too can be withdrawn at any time. If an employment relationship comes about, your data is transferred to the personnel file.

All three forms are additionally protected by technical means:

• An additional field that is invisible to you (“honeypot”) is only filled in by automated programs. If it is filled in, we discard the submission without any email being sent.
• A limit on the number of submission attempts per IP address – no more than eight submissions within ten minutes – prevents mass flooding of our mailbox. For this purpose your IP address is held exclusively transiently in the main memory of the server instance and is discarded once the time window has elapsed, at the latest upon the next restart. No permanent storage or merging with other data takes place.
• The bot protection Cloudflare Turnstile described under no. 6.

The legal basis in each case is Art. 6(1) sentence 1 (f) GDPR; our legitimate interest is protection against abusive and automated use of our forms.

For the technical dispatch of the emails we use the service Brevo of Brevo GmbH, Köpenicker Str. 126, 10179 Berlin (parent company: Brevo SAS, Paris, France). In doing so, Brevo processes the contents of the respective form including the uploaded application documents exclusively for the purpose of delivering this message to us. no-reply@personalagentur-sam.de is used as the sender address.

Brevo acts for us as a processor pursuant to Art. 28 GDPR. The legal basis for the use is Art. 6(1) sentence 1 (f) GDPR – our legitimate interest in the reliable and traceable receipt of your message.

After sending, you will receive an automatic confirmation of receipt at the address you provided; this is also sent via Brevo.

The messages are delivered to our email mailbox at IONOS (see no. 3 c). There they are stored until the matter has been finally processed and until any statutory retention periods have expired.

Brevo's privacy policy