Calmaroi Bewerberportal
Back to the Applicant Portal

Calmaroi Applicant Portal

Data Protection Information for Applicants

Information pursuant to Art. 13 and, where applicable, Art. 14 GDPR on the processing of personal data in the registration, application and placement process.

German source — not the publication date of this translation

Last updated: 21 August 2026 · Version 1.0 · Effective date: 22 August 2026

Read the German version

§ 1 Controller

The controller for the processing of personal data in connection with the operation of the Applicant Portal and the registration, application and placement process is:

Calmaroi GmbH
Römerstraße 15
63450 Hanau
Telephone: +49 69 870046466
E-mail: info@calmaroi.de

§ 2 Data Protection Officer

The Data Protection Officer of Calmaroi GmbH can be contacted at:

Die Auditoren GmbH
Mercatorstraße 2
40545 Düsseldorf
E-mail: datenschutzprofi_17@die-auditoren.de

§ 3 Purposes of Processing and Legal Bases

We process personal data of applicants for the following purposes:

  • carrying out the registration and application process (Art. 6(1)(b) GDPR – pre-contractual measures),
  • reviewing application documents and placement with prospective employers (Art. 6(1)(b), (f) GDPR),
  • communication in the course of the placement process, e.g. status notifications and queries (Art. 6(1)(b) GDPR),
  • compliance with legal obligations, in particular documentation and retention obligations (Art. 6(1)(c) GDPR),
  • ensuring the operation and security of the platform (Art. 6(1)(f) GDPR),
  • internal, pseudonymised tracking of the processing status in the placement process for the purposes of process quality, error analysis and traceability (Art. 6(1)(b), (f) GDPR); for details see the Cookie Policy,
  • where necessary, on the basis of separate consent (Art. 6(1)(a) GDPR), for example for the processing of special categories of personal data (Art. 9(2)(a) GDPR), provided the applicant voluntarily provides such data.

§ 4 Categories of Personal Data

In particular: contact and identification data, curriculum vitae, certificates, diplomas, language certificates, identity documents, proof of employment, recognition and visa documents, and other information voluntarily provided in the course of the application.

In addition, the platform processes information on personal and family circumstances, addresses, education and training, language skills, professional experience, professional preferences and additional skills, as well as application, process, communication and consent data and technical log data.

§ 5 Recipients of Data

Application documents may, where there is a legal basis for this or the applicant has given consent, be disclosed to prospective employers and to service providers engaged by Calmaroi (e.g. IT service providers acting as processors). Disclosure takes place exclusively to the extent necessary for the respective purpose.

§ 6 Transfers to Third Countries

If, in individual cases, personal data is transferred to countries outside the EU/EEA – for example by a technical service provider engaged by us or because an employer is based there – this only takes place if an adequate level of data protection is ensured, for example by an adequacy decision of the European Commission, appropriate safeguards such as EU standard contractual clauses, or on the basis of the applicant's express consent.

§ 7 Storage Period

If the placement process is not successfully completed or the applicant withdraws their application, the data will be deleted 6 months after receipt or after withdrawal; this serves in particular to answer follow-up questions and to provide proof of equal treatment.

In the event of a successful placement, the application documents will be deleted 6 months after the conclusion of the employment or vocational training contract and the start of the position, unless longer statutory retention periods (e.g. under commercial or tax law, for instance for accounting or travel expense data) prevent this.

§ 8 Rights of the Data Subject

Right of access (Art. 15 GDPR)

You have the right to obtain from us confirmation as to whether we process personal data concerning you. Where this is the case, you may request access to the following information:

  • the purposes of the processing;
  • the categories of personal data that are processed;
  • the recipients or categories of recipients to whom the personal data have been or will be disclosed, whereby, in connection with a transfer to a third country or to an international organisation, you additionally have the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR;
  • where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;
  • the existence of a right to rectification or erasure of the personal data concerning you, or to restriction of processing by us, or of a right to object to such processing;
  • the existence of a right to lodge a complaint with a supervisory authority;
  • where the personal data are not collected from you, any available information as to the source of the data;
  • the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) GDPR and – at least in those cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

We will provide you with a copy of the personal data undergoing processing within one month of receipt of your request for access. For any further copies requested by you, we may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, we will provide the information in a commonly used electronic format, unless you specify otherwise.

Right to rectification (Art. 16 GDPR)

You have the right to obtain from us without undue delay the rectification of your personal data if they are inaccurate. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure (Art. 17 GDPR)

You have the right to obtain from us the erasure of personal data concerning you without undue delay, and we are obliged to erase personal data without undue delay where one of the following grounds applies:

  • The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
  • You withdraw the consent on which the processing was based, and there is no other legal basis for the processing.
  • You object to the processing and there are no overriding legitimate grounds for the processing, or you object to the processing.
  • The personal data have been unlawfully processed.
  • The personal data have to be erased for compliance with a legal obligation under Union or Member State law.
  • The personal data have been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.

Where we have made the personal data concerning you public and are obliged to erase them, we shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copies or replications of, those personal data.

The right to erasure ("right to be forgotten") does not apply to the extent that processing is necessary:

  • for exercising the right of freedom of expression and information;
  • for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
  • for reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
  • for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) GDPR, insofar as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  • for the establishment, exercise or defence of legal claims.

Right to restriction of processing (Art. 18 GDPR)

You have the right to obtain from us restriction of processing of your personal data where one of the following conditions applies:

  • you contest the accuracy of the personal data concerning you, for a period enabling us to verify the accuracy of the personal data;
  • the processing is unlawful and you request the restriction of the use of the personal data instead of erasure;
  • we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
  • you have objected to the processing, pending the verification whether our legitimate grounds override your grounds.

Where processing has been restricted under the above conditions, such personal data shall – with the exception of storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

Where processing has been restricted under the above conditions, we will inform you before the restriction is lifted.

Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from us, where the processing is based on consent or on a contract and is carried out by automated means.

In exercising your right to data portability, you may have the personal data transmitted directly from us to another controller, where technically feasible. The exercise of the right to data portability is without prejudice to the right to erasure ("right to be forgotten"). The right to data portability does not apply to processing necessary for the performance of a task entrusted to us which is carried out in the public interest or in the exercise of official authority.

Right to object (Art. 21 GDPR)

Any consent given may be withdrawn at any time with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal.

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data will no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding the ePrivacy Directive, you may exercise your right to object by automated means using technical specifications.

§ 9 Right to Lodge a Complaint with a Supervisory Authority

Applicants have the right to lodge a complaint with a data protection supervisory authority regarding the processing of their personal data, e.g. with the Hessischer Beauftragter für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information).

§ 10 Obligation to Provide Data

The provision of certain data is necessary for carrying out the application and placement process. Without this data, the application cannot be processed, or can only be processed to a limited extent.

§ 11 Automated Decision-Making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

§ 12 Changes to this Privacy Policy

Calmaroi reserves the right to amend this Privacy Policy in the event of changes to the legal situation or to the processing operations. The current version published on the platform applies.