Website: https://www.europecareers.de
Organisation: Europe Careers
Privacy Contact: info@europecareers.de
Effective Date: 10 October 2026
Last Updated: 10 October 2026

1. Purpose of This Policy

Europe Careers is committed to protecting personal data and maintaining responsible data-protection practices across its website, recruitment activities, career counselling, German language training, Ausbildung programmes, study-abroad services, and related operations.

This GDPR Compliance and Data Protection Policy describes the organisational principles, procedures, responsibilities, and safeguards intended to support compliance with applicable data-protection laws, including the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and applicable German rules governing cookies and electronic communications.

This policy complements our Privacy Policy, Cookie Policy, Terms and Conditions, and relevant contractual agreements.

The purpose of this policy is to:

  • Protect the confidentiality, integrity, and availability of personal data.
  • Establish clear responsibilities for handling personal information.
  • Ensure personal data is collected and used for specified, lawful purposes.
  • Reduce the risk of unauthorised access, disclosure, loss, or misuse.
  • Establish procedures for privacy requests, complaints, and security incidents.
  • Support appropriate oversight of employees, contractors, and service providers.
  • Maintain records and evidence of compliance where required by law.

This document describes the intended compliance framework. Actual implementation, verification, and ongoing review are necessary to establish compliance in practice.

2. Scope of Application

This policy applies to personal data processed in connection with Europe Careers’ relevant website and business activities, to the extent that applicable data-protection law covers that processing.

It covers information relating to:

  • Website visitors.
  • Prospective and registered candidates.
  • Job applicants and recruitment candidates.
  • Healthcare professionals and skilled workers.
  • Students and prospective students.
  • German language learners.
  • Ausbildung applicants.
  • Customers and business contacts.
  • Employers and recruitment partners.
  • Educational institutions and training partners.
  • Employees, contractors, and other authorised personnel, where applicable.

The policy applies to personal data processed electronically and, where relevant, in structured paper records.

It also establishes expectations for third-party service providers who process personal data on behalf of Europe Careers.

3. Responsible Organisation and Accountability

The organisation that determines the purposes and means of processing personal data is generally the data controller for that processing under the GDPR.

Organisation: Europe Careers
Website: www.europecareers.de
Privacy Contact: info@europecareers.de

Registered legal entity: Must be completed with the verified legal name of the company operating the website.

Registered address: Must be completed with the verified registered address.

The responsible legal entity must determine and document its actual controller and processor roles for the relevant activities.

Where Europe Careers processes personal data on behalf of another organisation, it may act as a processor for that activity. Where it determines the purposes and means of processing, it may act as a controller. Responsibilities must be allocated according to the actual arrangements, not merely the terminology used in a contract.

Europe Careers will seek to demonstrate compliance through appropriate policies, procedures, records, contractual safeguards, and operational controls.

Where a Data Protection Officer is legally required or has been appointed, the relevant contact information must be published or made available as required by law.

4. Principles of Personal Data Processing

Europe Careers intends to apply the data-protection principles set out in Article 5 of the GDPR.

4.1 Lawfulness, Fairness, and Transparency

Personal data must be processed lawfully, fairly, and transparently.

Individuals should receive clear information about the purposes of processing, relevant legal bases, recipients, retention periods, and their rights.

4.2 Purpose Limitation

Personal data must be collected for specified, explicit, and legitimate purposes.

It must not subsequently be processed in a manner incompatible with those purposes, subject to applicable legal provisions.

4.3 Data Minimisation

Only personal data that is adequate, relevant, and necessary for the intended purpose should be collected.

For example, a general website enquiry should not automatically require a candidate to submit a passport copy or complete medical records.

4.4 Accuracy

Reasonable steps should be taken to keep personal data accurate and up to date.

Where inaccuracies are identified, appropriate correction procedures should be followed.

4.5 Storage Limitation

Personal data should not be retained longer than necessary for the purpose for which it is processed, subject to applicable legal retention requirements.

4.6 Integrity and Confidentiality

Appropriate technical and organisational measures should protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage.

4.7 Accountability

The responsible organisation must be able to demonstrate compliance with applicable data-protection obligations.

This may include maintaining records, reviewing procedures, documenting consent, assessing risks, and verifying that safeguards are actually implemented.

5. Lawful Basis for Processing

Europe Careers will identify an appropriate legal basis for each relevant processing activity.

Depending on the circumstances, the legal basis may include:

Consent: Where an individual has given valid consent for a specified purpose.

Contract: Where processing is necessary to perform a contract with the individual or take steps at their request before entering into a contract.

Legal obligation: Where processing is necessary to comply with a legal obligation.

Legitimate interests: Where processing is necessary for a legitimate interest pursued by the organisation or a third party, provided the individual’s interests and fundamental rights do not override those interests.

Vital interests or public interest: Where the applicable legal conditions for these grounds are met.

The appropriate basis must be determined for the particular processing activity. Consent should not be used as a blanket substitute for identifying the correct legal basis.

Where consent is relied upon, evidence of consent should be maintained where required, and withdrawal must be made possible without unnecessary difficulty.

6. Collection and Use of Personal Data

Europe Careers may process personal data for recruitment, training, education, career counselling, administration, communication, security, and other disclosed business purposes.

The categories of information collected may include:

  • Contact and identification details.
  • CVs, qualifications, and employment history.
  • Language proficiency and training records.
  • Job preferences and application status.
  • Education and admission records.
  • Relevant professional recognition documents.
  • Customer correspondence and service records.
  • Billing and transaction information, where applicable.
  • Website usage and technical information.

The information collected should be limited to what is reasonably necessary for the relevant service.

Personal data must not be used for unrelated marketing, profiling, or disclosure purposes without an appropriate legal basis and any additional safeguards required by law.

7. Special Categories of Personal Data

Certain personal data receives additional protection under Article 9 of the GDPR.

This includes, among other categories, health data and information concerning certain other protected characteristics.

Because Europe Careers may support healthcare professionals and medical recruitment candidates, some processes could involve documents containing health information or other special-category data.

Such information must not be collected or processed merely because it might be useful.

Before processing special-category data, the responsible organisation must establish both an applicable Article 6 legal basis and a valid condition under Article 9, where required.

Additional safeguards should be applied, including:

  • Restricting access to authorised personnel.
  • Avoiding unnecessary collection of medical records.
  • Using secure document-transfer methods.
  • Limiting disclosure to recipients with a legitimate need and lawful basis.
  • Applying appropriate retention and deletion rules.
  • Documenting the relevant purpose and safeguards.

Criminal-offence data, where relevant, is subject to separate legal requirements and must not be treated as ordinary personal data.

8. Privacy Information and Transparency

Europe Careers will provide privacy information in clear and accessible language.

Where required by Articles 13 and 14 of the GDPR, individuals should receive relevant information about:

  • The identity and contact details of the controller.
  • The purposes and legal bases of processing.
  • Legitimate interests, where relied upon.
  • Categories of personal data, where collected indirectly.
  • Recipients or categories of recipients.
  • International transfers and relevant safeguards.
  • Retention periods or the criteria used to determine them.
  • Applicable data-protection rights.
  • The right to withdraw consent where consent is the basis.
  • The right to lodge a complaint with a supervisory authority.
  • Whether providing data is a legal or contractual requirement.
  • Relevant automated decision-making, where applicable.

Where personal data is obtained from another source, the applicable transparency obligations must be assessed and fulfilled within the required period, subject to relevant exceptions.

The website Privacy Policy should accurately describe the actual data-processing activities rather than merely reproduce general legal language.

9. Data Subject Rights

Europe Careers will maintain a procedure for receiving, verifying, assessing, and responding to data-protection requests.

Subject to the applicable legal requirements, individuals may have the following rights.

9.1 Right of Access

Individuals may request confirmation of whether their personal data is being processed and obtain access to their personal data and relevant information about the processing.

9.2 Right to Rectification

Individuals may request correction of inaccurate data or completion of incomplete personal data.

9.3 Right to Erasure

Individuals may request deletion of personal data where the conditions under Article 17 of the GDPR are met.

Deletion is not automatic in every case. Legal retention obligations and other statutory exceptions may apply.

9.4 Right to Restriction

Individuals may request restriction of processing in circumstances recognised by Article 18 of the GDPR.

9.5 Right to Data Portability

Where Article 20 applies, individuals may request qualifying personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

9.6 Right to Object

Individuals may object to processing based on legitimate interests where the legal conditions are met.

The right to object to direct marketing is subject to specific protection under Article 21 of the GDPR.

9.7 Right to Withdraw Consent

Where processing is based on consent, individuals may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

9.8 Rights Relating to Automated Decisions

Where applicable, individuals may exercise rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

9.9 Right to Complain

Individuals may lodge a complaint with a competent data-protection supervisory authority.

Requests may be sent to:

Email: info@europecareers.de
Subject: GDPR Data Subject Request

Europe Careers should verify identity where reasonably necessary and proportionate, respond within the applicable statutory time limit, and document the handling of the request.

Under the GDPR, the standard response period is generally one month, subject to permitted extensions and notification requirements.

10. Data Security and Confidentiality

Europe Careers will implement technical and organisational measures appropriate to the nature, scope, context, and risks of its personal-data processing.

Depending on the systems and services actually used, measures may include:

  • Role-based access controls.
  • Strong authentication and secure account management.
  • Encryption in transit and, where appropriate, at rest.
  • Secure document storage and transfer.
  • Software updates and vulnerability management.
  • Security monitoring and incident reporting.
  • Backups and recovery arrangements.
  • Confidentiality commitments and staff training.
  • Secure disposal of paper and electronic records.
  • Periodic reviews of access permissions.

Access to personal data should be limited to authorised personnel who need the information to perform their responsibilities.

Confidential information should not be shared through unauthorised personal accounts, public links, or unsecured storage locations.

The effectiveness of security measures must be reviewed periodically and improved where necessary.

11. Data Breach Management

A personal-data breach may involve accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Europe Careers should maintain a documented incident-response procedure covering the following steps:

  1. Identify and report a suspected incident promptly.
  2. Contain the incident and prevent further unauthorised access where possible.
  3. Preserve relevant evidence and incident records.
  4. Assess the nature, scope, and likely consequences of the breach.
  5. Identify the affected data categories and individuals.
  6. Determine the notification obligations under applicable law.
  7. Implement remedial measures and review the cause of the incident.

Where the GDPR applies, a controller must notify the competent supervisory authority of a personal-data breach unless the breach is unlikely to result in a risk to individuals’ rights and freedoms.

Where required, notification must be made without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

If a breach is likely to result in a high risk to individuals’ rights and freedoms, affected individuals must also be informed without undue delay unless a legal exception applies.

Processors must notify the relevant controller without undue delay after becoming aware of a personal-data breach, as required by Article 33.

All personal-data breaches must be documented as required by law, including relevant facts, effects, and remedial action.

12. Employees, Contractors, and Authorised Personnel

Personnel who access personal data as part of their responsibilities must follow applicable privacy, confidentiality, and information-security requirements.

Europe Careers should ensure that personnel:

  • Access only information necessary for their role.
  • Use authorised systems and accounts.
  • Do not disclose candidate information without permission or another lawful basis.
  • Follow document-handling and retention procedures.
  • Report suspected data breaches promptly.
  • Complete appropriate privacy and security training.
  • Return or securely delete information when access or responsibilities end, subject to legal retention requirements.

Confidentiality obligations should continue after employment or engagement ends where required by law or contract.

Access rights should be removed promptly when no longer required.

13. Third-Party Processors and Service Providers

Europe Careers may use external providers for hosting, email, recruitment management, customer relationship management, cloud storage, document handling, website analytics, security, and other operational functions.

Before appointing a processor, the responsible organisation should assess the provider’s suitability and relevant security safeguards.

Where Article 28 of the GDPR applies, the processing relationship must be governed by an appropriate binding contract or other legal act.

Relevant contractual requirements include:

  • Processing only on documented instructions.
  • Confidentiality obligations.
  • Appropriate technical and organisational measures.
  • Rules for engaging subprocessors.
  • Assistance with data-subject requests where required.
  • Assistance with security incidents and compliance obligations.
  • Deletion or return of personal data at the end of the service, subject to legal requirements.
  • Information and audit provisions necessary to demonstrate compliance.

Contracts and operational practices should reflect the actual roles of each party.

14. International Data Transfers

Europe Careers may coordinate applications and services involving employers, educational institutions, training providers, or other recipients outside the European Economic Area.

If personal data is transferred to a country outside the EEA, the responsible organisation must determine whether Chapter V of the GDPR applies and establish a valid transfer mechanism where required.

Depending on the circumstances, this may involve:

  • An applicable European Commission adequacy decision.
  • Appropriate Standard Contractual Clauses.
  • Binding Corporate Rules where applicable.
  • Another transfer mechanism permitted under the GDPR.

Where necessary, the organisation must assess the transfer circumstances, implement supplementary safeguards, and provide relevant transparency information.

Transfers must not be justified solely by the fact that a candidate has applied for an international opportunity.

Where data is shared with an employer or institution in another country, the recipient, purpose, and applicable safeguards should be identified and documented as appropriate.

15. Cookies and Electronic Tracking

Europe Careers will assess its website cookies, pixels, analytics tools, advertising technologies, and similar tracking mechanisms.

Under applicable EU and German law, storing information on or accessing information from a visitor’s device may require consent unless a recognised legal exception applies.

The German Telecommunications-Digital Services Data Protection Act (TDDDG), including Section 25, must be considered where applicable.

Where consent is required, the website should:

  • Explain the relevant cookie categories and purposes.
  • Provide an accessible consent mechanism.
  • Offer a genuine choice for non-essential technologies.
  • Avoid activating consent-requiring technologies before valid consent.
  • Allow users to withdraw or change consent.
  • Maintain appropriate records of consent decisions.
  • Ensure that cookie settings reflect the technologies actually deployed.

Essential cookies should not be used as a justification for unrelated tracking.

The Cookie Policy and cookie consent mechanism must correspond to the website’s actual configuration.

16. Data Protection by Design and Default

Europe Careers should consider privacy and data protection from the planning stage of new systems, services, and processing activities.

This includes:

  • Collecting only necessary information.
  • Restricting default access to personal data.
  • Using privacy-conscious system settings.
  • Separating information where appropriate.
  • Applying secure development and configuration practices.
  • Avoiding unnecessary duplication of documents.
  • Setting retention and deletion rules.
  • Evaluating the impact of new tools and integrations.

Where appropriate, privacy considerations should be included in the procurement and implementation of customer relationship management systems, recruitment platforms, online forms, analytics tools, and document-management systems.

17. Data Protection Impact Assessments

Where a type of processing is likely to result in a high risk to individuals’ rights and freedoms, Europe Careers must assess whether a Data Protection Impact Assessment (DPIA) is required under Article 35 of the GDPR.

A DPIA may be relevant where proposed processing involves, for example, certain forms of large-scale sensitive-data processing, systematic evaluation, or other high-risk activities.

The assessment should identify:

  • The processing operations and purposes.
  • The necessity and proportionality of the processing.
  • Potential risks to individuals.
  • Measures to address those risks.
  • Security and privacy safeguards.
  • Any residual risks requiring further action.

Where the legal conditions for prior consultation with a supervisory authority are met, Article 36 must also be considered.

A DPIA is not automatically required for every website or every recruitment activity; the actual processing and associated risks must be assessed.

18. Records of Processing Activities

Where required by Article 30 of the GDPR, Europe Careers will maintain records of relevant processing activities.

Depending on the organisation’s role, these records may include:

  • The name and contact details of the controller, representatives, and DPO where applicable.
  • The purposes of processing.
  • Categories of individuals and personal data.
  • Categories of recipients.
  • International transfers and applicable safeguards.
  • Retention periods where possible.
  • A general description of technical and organisational security measures.

The GDPR provides limited exceptions to the record-keeping obligation for certain organisations with fewer than 250 employees. Those exceptions are conditional and may not apply where processing is likely to create a risk, is not occasional, or includes certain special categories of personal data or criminal-offence data.

The applicability of any exception must therefore be assessed rather than assumed.

19. Retention and Secure Deletion

Personal data must be retained only as long as necessary for its documented purpose, subject to applicable statutory obligations.

Europe Careers should establish retention periods or criteria for relevant data categories, including:

  • General enquiries.
  • Recruitment applications.
  • Candidate documents.
  • Training and education records.
  • Customer and contractual records.
  • Financial and accounting information.
  • Marketing preferences and consent records.
  • Security and server logs.

When information is no longer required, it should be deleted or anonymised securely unless continued retention is legally required or otherwise permitted.

Deletion procedures should address copies held in systems, shared folders, exports, backups, and third-party services where appropriate and technically feasible.

A deletion request must be assessed against applicable rights and legal retention requirements.

20. Recruitment and Candidate Data Protection

Recruitment and international placement activities may involve CVs, qualification certificates, professional licences, language results, employment histories, and application correspondence.

Europe Careers should ensure that candidate information is processed for clear and appropriate purposes.

Candidate data must not be distributed indiscriminately to employers or other recruitment organisations.

Before sharing application documents, the responsible organisation should determine the appropriate legal basis, inform candidates as required, and ensure that the disclosure is consistent with the stated recruitment purpose.

Additional care is required when documents contain health information or other special-category data.

Recruitment records should be retained in accordance with defined retention rules and deleted when no longer necessary, subject to legal requirements.

Candidates must receive accurate information about how their documents are used and with whom they may be shared.

21. Automated Decision-Making and Profiling

Europe Careers may use digital systems to organise enquiries, manage applications, or support internal workflows.

Where automated processing is used, the responsible organisation must assess whether it constitutes profiling or decision-making covered by Article 22 of the GDPR.

Where a decision is based solely on automated processing and produces legal or similarly significant effects, additional legal conditions and safeguards apply.

Where required, individuals must receive meaningful information about the logic involved, the significance, and the envisaged consequences.

Human review, opportunities to express a point of view, and procedures to contest decisions must be provided where required by law.

Automated tools should not be used to make high-impact decisions about candidates without first assessing the applicable legal requirements and risks.

22. Children and Vulnerable Individuals

Europe Careers’ services are primarily intended for individuals seeking employment, vocational training, language education, and higher education.

Where personal data relating to children or other vulnerable individuals is processed, additional care should be taken to ensure that the processing is lawful, fair, and appropriate.

Where consent is relied upon and the GDPR’s rules for children’s consent to information society services apply, the relevant age and parental-authorisation requirements must be assessed.

Where a programme involves minors, the organisation should establish the appropriate safeguards and authorisations before processing their personal data.

23. Complaints and Internal Escalation

Individuals may raise privacy concerns or exercise their rights by contacting:

Email: info@europecareers.de
Subject: GDPR Complaint or Data Protection Request

Europe Careers should maintain a process for recording, reviewing, and responding to complaints.

Complaints should be assessed fairly, relevant facts should be investigated, and appropriate corrective action should be documented.

Individuals retain the right to lodge a complaint with a competent supervisory authority under Article 77 of the GDPR.

Where applicable, individuals may also have access to judicial remedies and other rights under Articles 78 and 79.

Internal complaint procedures do not replace statutory rights or restrict access to a supervisory authority.

24. Supervisory Authorities and Regulatory Cooperation

Where the GDPR applies, the competent supervisory authority depends on the relevant circumstances, including the organisation’s establishment and the nature of its processing activities.

Europe Careers should identify the competent authority where necessary and cooperate with lawful regulatory enquiries.

A lead supervisory authority may be relevant for certain cross-border processing activities, but it is not automatically the same authority for every organisation.

The organisation must not claim that a particular authority has approved or certified its practices unless that statement is factually correct and supported by the relevant evidence.

25. Business Continuity and Operational Resilience

Europe Careers should maintain reasonable arrangements to protect personal data during system failures, service interruptions, cyber incidents, or other operational disruptions.

Depending on the scale and nature of the processing, these arrangements may include:

  • Secure backups.
  • Recovery procedures.
  • Restricted emergency access.
  • Incident escalation contacts.
  • Supplier continuity arrangements.
  • Procedures for restoring essential systems.
  • Testing of recovery arrangements.

Continuity measures should preserve appropriate security and confidentiality rather than creating uncontrolled copies of personal data.

26. Policy Review and Compliance Monitoring

This policy should be reviewed periodically and when significant changes occur in the organisation’s services, systems, data flows, suppliers, or legal obligations.

Reviews should consider:

  • Changes in applicable law.
  • New website forms or tracking technologies.
  • New recruitment or customer-management systems.
  • New international data transfers.
  • Changes to data retention practices.
  • Security incidents and audit findings.
  • Complaints and requests from individuals.
  • Changes in the organisation’s legal structure.

Any identified gaps should be recorded, assigned to a responsible person, and addressed within an appropriate timeframe.

The existence of this policy alone does not establish compliance. The organisation must implement, maintain, and periodically verify the procedures it describes.

27. Responsibilities and Enforcement

Personnel and service providers who handle personal data must follow the applicable instructions, policies, and contractual requirements.

Suspected violations should be reported promptly through the organisation’s designated internal reporting process.

Where a breach of policy occurs, Europe Careers should assess the circumstances and take proportionate corrective action, consistent with employment law, contractual obligations, and other applicable legal requirements.

No provision in this policy authorises unlawful surveillance, retaliation against lawful complaints, or interference with statutory data-protection rights.

28. Relationship with Other Policies

This GDPR Compliance and Data Protection Policy should be read together with:

  • Privacy Policy.
  • Cookie Policy.
  • Terms and Conditions.
  • Applicable service and recruitment agreements.
  • Confidentiality and information-security procedures.
  • Data retention and deletion procedures.
  • Incident-response procedures.
  • Data-processing agreements with service providers.

If any document appears inconsistent with mandatory law, the applicable legal requirements prevail.

Where a service-specific contract governs a particular processing activity, the relevant responsibilities should be interpreted consistently with applicable data-protection law.

29. Contact Information

For questions concerning GDPR compliance, data protection, privacy rights, or personal-data handling, contact:

Europe Careers

Website: https://www.europecareers.de

Email: info@europecareers.de

Subject: GDPR Compliance Enquiry

Please do not include unnecessary sensitive personal information in your initial email. If identity verification or additional documents are required, an appropriate submission method should be arranged.

30. Important Legal Notice

This policy describes the data-protection framework intended for Europe Careers. It is a general compliance document and does not, by itself, guarantee GDPR compliance, prevent regulatory investigations, or eliminate legal liability.

Compliance depends on the actual processing activities, lawful bases, notices, contracts, technical and organisational safeguards, staff practices, record keeping, and timely handling of data-subject rights and security incidents.

The final version should be reviewed against the verified legal entity, registered address, website technology, recruitment operations, service providers, international data flows, and actual retention practices before publication.