Privacy policy

Controller

The controller for the processing of personal data on this website is:

No data protection officer has been appointed. The conditions of § 38 BDSG (the German Federal Data Protection Act) are not met, because fewer than twenty people are permanently engaged in the automated processing of personal data.

When you open this page

When you open the website, your browser transmits technically necessary data to our host. This includes the address requested, the date and time, the volume of data transferred, the browser and operating system you use, and your IP address. These entries occur in the server logs and serve solely to operate and secure the site.

The legal basis is our legitimate interest in stable and secure operation under Art. 6 (1) (f) GDPR. This data is not combined with other sources.

Fonts are served from our own server. Opening this page establishes no connection to Google Fonts or any other external provider.

Introducing yourself through the form

When you introduce yourself through the form, we process your email address, the address of your LinkedIn profile, the type of role you are looking for, the time horizon you give for a move, and the channel through which you reached us.

We additionally store the time and IP address of your sign-up and of your confirmation. This serves only as proof that the consent actually came from you.

The purpose is to contact you, to assess which roles suit you, and to introduce you to suitable companies.

We use a confirmation link. Your sign-up only takes effect once you click that link. Without this step we would send you no messages.

The legal basis is your consent under Art. 6 (1) (a) GDPR. For the proof-of-consent data we additionally rely on Art. 6 (1) (c) and (f) GDPR.

Contact form

You can send us a message through the contact pages. In doing so we process your name, your email address and the content of your message. The message is not stored in a database, it is forwarded to us as an email.

The purpose is to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR where the enquiry concerns the initiation of a contract, and otherwise our legitimate interest in answering enquiries under Art. 6 (1) (f) GDPR.

An enquiry through the contact form does not count as an introduction. Those are two separate things.

Guide by email

On the guide pages you can enter your email address to receive a guide as a PDF. In doing so we process your email address, the guide you chose, the language of the page, the channel through which you reached us, and the time and IP address of your sign-up and confirmation as proof of consent.

Here too we use a confirmation link. The guide is only sent after you click it. If you additionally opt in to occasional notes from the market, that is a separate, voluntary consent; you can withdraw it at any time, and every such email contains an unsubscribe link.

The legal basis is your consent under Art. 6 (1) (a) GDPR. Signing up for a guide does not count as an introduction; those are two separate things.

Booking a call via Cal.com

The “Book a call” page embeds a calendar from Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. It loads as soon as you open the page. Cal.com then receives your IP address and technical details about your browser, and Cloudflare, Cal.com’s network provider, sets a cookie that protects against automated access (“__cf_bm”). If you book a call, Cal.com also processes the details you enter (name, email address, notes). Cal.com processes the data in the United States; the transfer is based on Standard Contractual Clauses or the EU-US Data Privacy Framework.

We embed the calendar directly so you can book without switching to another site. The legal basis for loading it is our legitimate interest in doing so (Art. 6 (1) (f) GDPR); the cookie is required for the calendar to work (Section 25 (2) no. 2 TDDDG). The appointment details end up in our calendar and serve solely to prepare and hold the conversation. The legal basis for that is Art. 6 (1) (b) GDPR (initiation of a contract). If you would rather not book through Cal.com, you can write to us through the form on the same page or by email.

Faktor Signal browser extension

Faktor Signal is an extension for Chrome. On a startup’s website it shows you which jobs are open there right now. To do that, it sends requests straight from your browser to the company’s website and to the system the company uses to manage applications, such as Personio, Greenhouse or Ashby. If the website doesn’t link to such a system, the extension asks Greenhouse, Ashby, Lever, Personio and Recruitee whether they have an account under the company’s name, but only when you click its icon or check a list of companies. As with any page visit, these providers see your IP address and the time. The extension doesn’t send cookies.

None of this reaches us. The extension has no account and doesn’t measure usage. We don’t learn which pages you visit or what a check finds, unless you report an error or send feedback yourself (see below). The company’s website and the providers named above only see the single request sent to them.

Everything the extension stores stays in your browser: your settings (level, categories, automatic checks on or off), the last list of companies you checked and the results of your checks. A result is valid for 24 hours. The extension deletes results older than seven days the next time the browser starts. In the extension’s settings you can clear all results and the company list at once. If you remove the extension, everything is gone.

If you turn on “Automatisch prüfen” (check automatically), the extension reads links, headings, the page title, embedded job postings and the addresses of embedded scripts on the pages you open, to find a careers page. It never checks search engines, social networks, job boards or large news sites. Without automatic checks it only checks the page where you click its icon and the companies on a list you paste in yourself.

On the extension’s welcome page you can send us feedback. When you submit the form, the extension sends your text and its version number, plus a website and your email address if you enter them. The recipient is a function at Supabase that forwards everything via Brevo as an email to info@faktortalent.com. There is no database for feedback; afterwards the message only sits in our inbox. To stop anyone from flooding the form, we also keep a hash of your IP address for 24 hours, never the address itself. The purpose is to improve the extension and to reply to you if you give us an address. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. We delete the email once your request is dealt with, at the latest after twelve months. For Supabase and Brevo, the section “Processors and transfers to third countries” applies. If sending fails, the form offers to send the message through your own email program instead.

If a result is wrong, you can send it to us with “Fehler melden” (report an error) in the extension’s window. Before you send, it shows what goes with it: the domain of the website you just checked (for example forto.com, without the subpage), the result of the check (such as “no careers page found” or the number of jobs and the system they come from), the reason you pick, your comment if you write one, and the version number. We don’t ask for an email address there, so we can’t reply to you. Delivery, rate limiting, legal basis and retention are the same as for feedback above. The purpose is to find and fix errors of the extension for that company.

If you click a link to Faktor Talent in the extension, our website opens. The link tells us that you came from the extension. If you then introduce yourself, we store that as the channel, as described under “Introducing yourself through the form”.

Passing your data to companies

When we see a role that suits you, we introduce you to the company in question. That is the core of what we do.

Beforehand we ask you every single time, naming the company and the role. Nothing goes out without your consent in the individual case. You can decline without giving a reason, and declining has no consequences for you.

Only what is necessary for the assessment is passed on. Your data is not passed to third parties for advertising purposes, and we do not sell data.

Processors and transfers to third countries

We use the following service providers. A data processing agreement under Art. 28 GDPR is in place with all three; in each case it forms part of their terms of use.

• Website hosting: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Deutschland. The servers are located in Germany.
• Database and server functions: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapur 049513. Our project runs in the Frankfurt am Main region, so the data is held in the EU.
• Email delivery: Sendinblue SAS (Marke „Brevo“), 9-17 rue Salneuve, 75017 Paris, Frankreich. Delivery takes place from within the EU.

In the case of Supabase, the contracting party is a company based in Singapore. Even though the data itself is stored in Frankfurt, access from a third country in the course of administration and support cannot be ruled out. For that case the Standard Contractual Clauses adopted by the European Commission apply, which form part of the Supabase Data Processing Addendum (Art. 46 (2) (c) GDPR).

How long we keep your data

• If you do not confirm your sign-up, we delete the unconfirmed entry after 30 days.
• Your details remain stored for as long as you are registered with us. If we hear nothing from you for two years, we delete the entry.
• If you withdraw your consent, we delete your data within 30 days.
• The IP addresses held as proof of consent are deleted after 14 months at the latest.
• Messages from the contact form are deleted once the enquiry has been dealt with, after twelve months at the latest. Statutory retention obligations remain unaffected.
• Unconfirmed guide sign-ups are deleted after 30 days. Confirmed entries are kept for as long as the consent stands, and at most two years after the last email from us.

Your rights

You have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21 GDPR).

You can withdraw your consent at any time with effect for the future. An informal email to info@faktortalent.com is enough. The lawfulness of the processing carried out up to that point is not affected.

You can also lodge a complaint with a supervisory authority. The authority responsible for us is the data protection commissioner of the German state of Rhineland-Palatinate:

Consent, cookies and analytics

The first time you open this site, a banner asks whether we may load services from other providers. Until you click something there, none of them is loaded and no request goes out to them. If you click “None of it”, it stays that way.

Regardless of your answer, the site remembers your choice in your browser’s local storage. It is the only entry we set without your consent, and § 25 (2) no. 2 TDDDG permits it: without it we would have to ask you again on every visit. It holds nothing but your choice, the version of the banner text and the time, no identifier that could be used to recognise you. “Cookies” at the foot of every page takes you to the button that deletes it, see “Withdrawing consent”.

Audience measurement

If you allow this category, we load Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Irland. It sets cookies and shows us which pages get opened and which channel someone arrived through. Google only evaluates your IP address to derive a rough location from it and does not store it. We have additionally switched off Google signals, which would otherwise tie a visit to a signed in Google account, switched off ad personalisation, and limited retention to 14 months.

Advertising

If you allow this category, we load the Meta pixel, the TikTok pixel and the LinkedIn Insight Tag. These services set cookies, recognise your browser on a later visit and let us measure whether an ad led to someone introducing themselves. They also make it possible to show ads to people who have opened this site before. The providers are:

• Meta pixel: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland
• TikTok pixel: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Irland
• LinkedIn Insight Tag: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Irland

What we report to these services are events without a name: that a page was opened, a form started, submitted, or a signup confirmed by email. We do not pass on your email address or your LinkedIn profile. For the Meta pixel, automatic advanced matching, which reads form fields, is explicitly switched off.

Joint controllership with Meta

For the collection of data by the Meta pixel and its transmission to Meta, Meta Platforms Ireland Limited and we are joint controllers under Art. 26 GDPR. The split is governed by the controller addendum provided by Meta. We are responsible for the information you are reading right now, Meta for upholding your rights regarding the data held at Meta. You can therefore exercise your rights directly with Meta as well. For everything Meta does with the data afterwards, Meta is solely responsible.

Transfer to the United States

All four services belong to groups based in the United States, and data may end up there. The basis for this is the European Commission’s adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, under which all four are certified. The United States does not offer legal protection against access by public authorities equivalent to European rules. If you would rather not have this, decline in the banner; the site works fully without these services.

Withdrawing consent

The legal basis is your consent alone, under Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. You can withdraw your choice at any time, with effect for the future.

One click deletes your stored choice and reloads the page. The banner then asks you again, and until you choose something there, none of the services named above is loaded.

Change consent

Changes to this policy

If something changes in the way we work, this text changes with it. The version in force is dated at the top under “Last updated”.