Hospitly Elite is in an open test phase (beta). Availability and features may change; uninterrupted, error-free use is not guaranteed in this phase. Details in our terms of use

Hospitly Elite

Privacy policy

Information pursuant to Art. 13 GDPR · As of: 2026-07-16

1. Controller

Enrico Kaldasch for Enrico Kaldasch & Pornvilai Kaldasch GbR, Ackerstraße 19, 04910 Elsterwerda, Deutschland, info@hospitly.de.

2. Data protection officer

A data protection officer is not legally required (micro-enterprise) and has not been appointed.

3. Hosting, auth & backend

Database, authentication and storage via Supabase (region eu-central-1, Frankfurt/EU) under a data-processing agreement (Art. 28 GDPR). System emails (sign-up confirmation, password reset) are sent via the SMTP service of our mailbox provider Strato as a processor. An encrypted backup copy of the data is additionally kept on a server operated by us (Strato VPS, Germany). Server logs are processed for operational security (Art. 6(1)(f) GDPR). Images are served locally (source: Pexels).

4. Third-country transfer

The backend is in the EU; there is no planned transfer to third countries. As the provider (Supabase) belongs to a US parent company, a residual access path to the US cannot be fully excluded; the EU Standard Contractual Clauses serve as a safeguard (Art. 46 GDPR). If you apply for a placed position with a household outside the EU (e.g. Gulf states), your application data is transferred there — only after your explicit consent at the application step (Art. 49(1)(a) GDPR).

5. What data & legal bases

Registration/login (Art. 6(1)(b)), profile/CV/usage data of candidates (b, optionally a), applications/saved jobs (b), system emails (b). For invoicing the placement fee to clients, additionally tax retention (c). We do not process special categories of personal data (Art. 9 GDPR, e.g. health data); please do not include such information in your profile or CV.

6. Retention

Account data until account deletion; backups expire on a rolling basis. Invoice/tax data up to 10 years (§ 147 AO, § 257 HGB). Server logs are deleted after 7 days at the latest.

7. Your rights & supervisory authority

Access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR); consents can be withdrawn at any time with future effect. You can delete your account and personal data yourself at any time in the “My area” section; there you can also export a machine-readable copy of your data (JSON) via “Download my data”, or request it informally by email to info@hospitly.de. Right to lodge a complaint with the competent supervisory authority: the Data Protection Commissioner of Brandenburg (LDA Brandenburg).

8. Cookies & tracking

We do not use tracking, analytics or advertising cookies; only technically necessary session/login cookies (§ 25(2) TDDDG). No automated decision-making within the meaning of Art. 22 GDPR takes place.