Privacy Policy

The controller responsible for processing your personal data under the GDPR is:

• NileCon Recruitment UG (haftungsbeschränkt), Goethestraße 7, 38440 Wolfsburg, Germany
• Managing director: Omar El-Rayes
• Commercial register: Amtsgericht Braunschweig, HRB 213074
• Email: info@iince.com

iince is a brand of NileCon Recruitment UG (haftungsbeschränkt). In this policy, “we” and “iince” mean that company. Further details are in our legal notice.

Our website is hosted by Vercel. Whenever a page is requested, Vercel’s servers process the data your browser sends automatically: your IP address, the date and time, the page requested, the page you came from and your browser and operating system (user agent). Vercel keeps short-lived server logs of these requests, which we use only to run the site, keep it secure and find errors.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is delivering the website to you and keeping it stable and secure, including against attacks and spam.

The site uses only the cookies and browser storage it needs to work, and no analytics, advertising or tracking tools. Its fonts are served from our own domain, so your browser does not contact Google or any other third party for them. Details are in our Cookie Policy.

When you apply through our application form, we process:

• your name, your email address and, if you give them, your phone and WhatsApp numbers;
• your country, your city (optional) and your time zone (suggested by your browser);
• the languages you work in, the roles you apply for and, where applicable, the opening you apply to;
• your years of experience, links to your portfolio and LinkedIn (optional), your rate (optional), your availability and the text you write about yourself;
• the language of the site you used, the time you accepted our Terms of Service, and your IP address and browser (user agent) when you sent the application.

Your progress is saved only in your own browser until you send the form; we receive nothing before that. The site has no file upload. If you email us documents such as a CV, we process them for the same purposes.

We use this data to review your application, match you with suitable clients and openings, introduce you to them and stay in touch with you about it. We also send you a confirmation email. In our admin area we keep the status of your application and internal notes about it.

Legal basis: Art. 6(1)(b) GDPR, that is, the steps you ask us to take before and within our agency relationship, which you enter by accepting our Terms of Service. For the IP address and user agent: Art. 6(1)(f) GDPR; our legitimate interest is preventing misuse of the form and being able to show when and how the terms were accepted.

If you give us a WhatsApp number, we may contact you on WhatsApp. WhatsApp is a service of WhatsApp Ireland Limited; its own privacy policy applies to messages sent through it.

Depending on the roles you choose, you take short skill tests (for example typing, data entry, attention to detail, customer messages and English). We store the result: the score, whether the pass mark was reached, a short summary, measurements such as speed, accuracy and the number of correct answers, the attempt number, the language of the test and when it started and ended. Each test can be taken up to three times.

The tests are scored automatically against a fixed pass mark, and you see your result straight away. The score only informs our review: whether we accept your application and whom we introduce you to is decided by a person at iince. There is no decision based solely on automated processing within the meaning of Art. 22 GDPR.

Legal basis: Art. 6(1)(b) GDPR.

An account is optional. For an account we process your email address, your password (stored only as a secure hash, never in readable form), whether your email address has been confirmed, the time of your last sign-in and your preferred language, together with a profile copied from your application that you can edit at any time. We use your profile and latest test results to prefill later applications, and tests you retake in your account are stored as described above.

To keep you signed in we set a session cookie; see the Cookie Policy. When you ask for them, we email you links to set up your account or reset your password.

Legal basis: Art. 6(1)(b) GDPR (providing the account you asked for).

When you use the hiring form, we process your name, your email address, the name of your company or store (optional), the roles you are hiring for, what you need, budget and timeline (optional), your message, the language of the site, the page you sent the form from and your IP address. You receive a confirmation email, and we receive a notification with your request.

We use this data to answer your request, find suitable freelancers and introduce them to you, and handle the business relationship that may follow, including the finder’s fee.

Legal basis: Art. 6(1)(b) GDPR where the request concerns a contract with you; otherwise Art. 6(1)(f) GDPR, our legitimate interest being to answer business enquiries and run our agency, including when you act on behalf of a company. For the IP address: Art. 6(1)(f) GDPR, to prevent misuse of the form.

If you write to info@iince.com, we process your email address, the content of your message and any attachments in order to answer you. Legal basis: Art. 6(1)(b) GDPR where your message concerns an application, a hiring request or an existing relationship; otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).

Besides this agency site, we run a job board at iince.com where people can apply to individual job ads. When we review a freelancer in our admin area, we check whether the same email address has also applied there, and we see those applications, their status and our assessment of them. For this check, the email address is compared with the job board’s database.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is having a complete picture of a candidate across both iince services and not handling the same person twice.

We process personal data only where the GDPR allows it:

• Contract and pre-contractual steps (Art. 6(1)(b) GDPR): applications, skill tests, accounts, introductions to clients and hiring requests, as described above.
• Legal obligations (Art. 6(1)(c) GDPR): keeping business records such as commercial correspondence and invoices for the periods set by German commercial and tax law, answering lawful requests from authorities, and handling your data protection requests.
• Legitimate interests (Art. 6(1)(f) GDPR): a secure, stable website and its server logs; protecting our forms against spam and misuse; documenting the acceptance of our terms; the job board check described above; and establishing, exercising or defending legal claims, for example about a finder’s fee.
• Consent (Art. 6(1)(a) GDPR): we do not currently base any of the processing described here on consent. If we ever ask for your consent, we will tell you at that point, and you can withdraw it at any time with effect for the future.

Clients (employers): we share information about a freelancer only when we introduce that freelancer to a specific client, and only what is relevant to that introduction. Clients may be located outside the EU (see below).

Processors: we use the following service providers, who process data on our behalf under data processing agreements (Art. 28 GDPR) and only on our instructions:

• Vercel Inc., USA: hosting of the website and its server functions, server logs;
• Neon, LLC (a Databricks company), USA: our database, stored on Amazon Web Services servers in Frankfurt, Germany;
• Plus Five Five, Inc. (Resend), USA: sending our emails, such as confirmations and account links;
• IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany: receiving and processing the email you send to our @iince.com addresses;
• Supabase Pte. Ltd., Singapore: hosting of the job board database used for the check described above.

Authorities: where we are legally required to, for example to a court or a public authority.

We do not sell your data and do not pass it on to advertisers or data brokers.

Some of our service providers are based in the USA or in Singapore, and Vercel may process requests on servers outside the EU, including in the USA. Such transfers take place only with the safeguards of Chapter V GDPR:

• At the time of writing, Vercel Inc., Plus Five Five, Inc. (Resend) and Neon, LLC are certified under the EU–US Data Privacy Framework. For certified companies, the European Commission’s adequacy decision of 10 July 2023 applies (Art. 45 GDPR). You can check the current status at dataprivacyframework.gov.
• Where a provider or one of its sub-processors is not certified, or a certification lapses, the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). This applies in particular to Supabase Pte. Ltd. in Singapore.

If we introduce you as a freelancer to a client outside the EU/EEA, the transfer is necessary for the agency relationship you asked us for (Art. 49(1)(b) GDPR). Where the client’s country has an EU adequacy decision, that decision applies instead.

You can ask us for a copy of these safeguards at info@iince.com.

We do not delete data automatically after fixed periods. We keep it for as long as it is needed for the purpose it was collected for, using these criteria:

• Applications, test results and profiles: as long as you are part of our freelancer network and we may introduce you to clients, or until you ask us to delete them.
• Accounts: until you ask us to delete your account.
• Hiring requests: as long as needed to answer them and to handle the business relationship that may follow.
• Business records: correspondence and documents that German commercial and tax law requires us to keep (for example under § 257 of the German Commercial Code, HGB, and § 147 of the German Fiscal Code, AO) are kept for the periods set there; during that time we restrict their use to that purpose.
• Legal claims: data we need to establish, exercise or defend legal claims, for example about a finder’s fee, is kept until the claim is settled or time-barred.
• Server logs and browser storage: Vercel keeps server logs for a short time under its log retention. What is stored in your browser stays there until it expires or you delete it; see the Cookie Policy.

When you ask us to delete your data, we delete it unless a legal obligation requires us to keep it; in that case we restrict its processing to that purpose. Deleted data can remain in our database provider’s backups for a limited time until they are overwritten.

You are not required by law or by contract to give us any data. However, to process an application we need the fields that are not marked as optional and the skill tests for the roles you choose; to answer a hiring request we need your name, your email address, what you need and your message; and for an account we need an email address and a password. Fields marked as optional are up to you. Without the data your browser sends automatically, the website cannot be shown.

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15 GDPR);
• have incorrect data corrected (Art. 16 GDPR);
• have your data erased (Art. 17 GDPR);
• restrict its processing (Art. 18 GDPR);
• data portability: receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR; see below);
• withdraw any consent you have given, at any time and with effect for the future (Art. 7(3) GDPR).

To exercise any of these rights, email info@iince.com. We answer within one month (Art. 12(3) GDPR). If you have an account, you can also correct your profile yourself in your account area.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

• Der Landesbeauftragte für den Datenschutz Niedersachsen (the State Commissioner for Data Protection of Lower Saxony)
• Prinzenstraße 5, 30159 Hannover, Germany (postal address: Postfach 221, 30002 Hannover)
• Website: www.lfd.niedersachsen.de

You can also turn to any other supervisory authority in the EU, in particular the one in the member state where you live or work or where you believe the infringement took place.

The website is served only over an encrypted connection (HTTPS). Passwords are stored only as a secure hash, the session cookie is signed and cannot be read by scripts on the page, and our admin area is password-protected.

Which cookies and browser storage the website uses, and why, is explained in our Cookie Policy.

We update this policy when our processing changes, for example when we start using a new service provider. The date at the top shows the current version.

Questions about this policy or about your data? Email info@iince.com or write to NileCon Recruitment UG (haftungsbeschränkt), Goethestraße 7, 38440 Wolfsburg, Germany.