Privacy notice

1. Controller

Tom Benedikt Buch, trading name honeycomb. Personalvermittlung, Klettenberggürtel 5, 50939 Köln, Germany. Email: [email protected] · Phone: +49 1522 8459714. Use these details to exercise your privacy rights. The trading name is not a separate legal entity.

2. Website hosting

Cloudflare Pages hosts this website. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Page requests involve your IP address, requested URL, time and technical browser, HTTP and connection data to deliver the pages and protect the service against faults and misuse. Infrastructure security and error logs may be processed for these purposes. Navigation and page preloading also generate technical requests.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in secure, reliable website delivery. Technical data is processed for delivery and, where necessary, to detect and handle security incidents, errors or statutory duties. Duration follows those purposes and the service's applicable security and logging conditions. We do not create an additional visitor history.

3. Disabled contact forms

Candidate and employer forms are currently unavailable. Input fields are disabled and no form submission takes place. The technical endpoint rejects requests without processing form contents or sending notifications. There are no file uploads, applicant database or automatic confirmation emails. Cloudflare Turnstile is not loaded in this version of the website.

Please do not send CVs or other application documents before the recruitment service opens. Relevant privacy information will be provided before any later form activation.

4. Cookies, browser storage and resources

Our own website code sets no cookies and uses no localStorage, sessionStorage, IndexedDB or service worker. The page URL determines the language. No analytics, advertising or marketing services are embedded. No cookie-consent banner is planned for this configuration. Necessary technical hosting-security functions are distinct from optional tracking.

Fonts, the portrait and design assets are served as website files. External information links access the linked website only when clicked. Browsers may cache resources or use their own restoration features; these are not visitor-profiling features introduced by us.

5. Direct contact

A direct message or call involves the contact details, content and necessary message or connection data you provide so we can answer your enquiry. Article 6(1)(f) GDPR applies to appropriate general correspondence; Article 6(1)(b) applies where necessary steps towards your own contract or its performance are requested by you. There is no general statutory duty to contact us. Without contact details needed for a reply, we may be unable to answer.

OVH GmbH, Oskar-Jäger-Straße 173/K6, 50825 Köln, Germany, provides the [email protected] business mailbox through Zimbra Starter. OVHcloud describes mailbox-content storage in European datacentres. Email contents and metadata are processed for sending, receiving and security checks. Mailto and telephone links only open your application; they do not automatically send a message or place a call. At the outset, the mailbox is used through webmail only. We have not configured Gmail forwarding or an external email application.

Transport encryption does not make email end-to-end encrypted. Please do not send unnecessary health, identity-document or criminal-offence information, or confidential details about others. The website performs no applicant scoring or solely automated decisions with legal or similarly significant effects.

6. Recipients and international processing

Cloudflare processes data for hosting; OVHcloud provides the business mailbox. Their applicable data-processing terms govern the services. Providers may use authorised subprocessors. OVHcloud describes European group companies and, where applicable, access from the United Kingdom and Canada. European storage does not exclude every remote access from outside Europe. Providers' security or legally required processing in their own capacity is distinct.

Cloudflare may process data in the USA and other countries. Its processing terms include transfer mechanisms, including standard contractual clauses, for their respective applicable scope. The OVHcloud DPA also contains standard contractual clauses for the transfers it specifies. Adequacy decisions or contractual safeguards apply only within their actual scope. The terms and subprocessor information linked below explain the arrangements; you can also request information about applicable safeguards using our contact details.

7. Retention and deletion

Direct correspondence is deleted when the specific enquiry is resolved and no other valid purpose remains. Where a statutory duty or protection of specific legal claims requires limited retention, only necessary information is kept for that restricted purpose until its basis expires. There is no candidate pool or retention for unspecified future placements. Due deletion also covers sent items, drafts, other mailbox folders and trash. Technical provider copies are distinct from visible mailbox deletion.

OVHcloud checks incoming and outgoing messages for spam and malware. The Zimbra terms provide retention of detected outgoing malware or unsolicited messages for up to one year or twelve months in the specified circumstances. This is not a blanket one-year period for all messages. Your own spam or false-positive reports may share contents and metadata with analysis partners. The terms provide 15 days of content retention after service termination; this is not an ordinary deleted-message or recovery period. Technical backups support service operation and are not a guaranteed personal backup.

8. Your rights

Subject to statutory conditions, you have rights of access, rectification, erasure, restriction and portability under Articles 15–20 GDPR. Any consent may be withdrawn for the future; earlier lawful processing remains unaffected. Under Article 77, you can complain to a supervisory authority, particularly where you live, work or believe an infringement occurred. For Cologne, one contact is LDI NRW: Postfach 20 04 44, 40102 Düsseldorf, Germany, [email protected]; www.ldi.nrw.de.

9. Objection under Article 21 GDPR

You may object on grounds relating to your particular situation to processing based on Article 6(1)(f) GDPR. It then stops unless overriding compelling legitimate grounds or necessary legal claims justify it. Send objections using the contact details above. No direct marketing is conducted.