Book a call
Menu

Privacy policy

Welcome to the website of Jomigo GmbH. In the following privacy information you will learn what happens to your data, the so-called personal data, and above all why. We also tell you how we protect your data, when the data is deleted and what rights data protection gives you.

First of all: We comply with data protection law and the European General Data Protection Regulation and protect your privacy as well as we can.

But we want to be completely open: the internet lives on the exchange of data and still has many security gaps. Even though your data is encrypted when you visit our website, there is always a residual risk, at the latest when data is exchanged with other websites. If you visit other websites, for example via a link on our website, please note that this privacy information does not apply to those websites. We also point out that email is an unencrypted and therefore fundamentally insecure means of communication. If you want to exchange personal data with us, please agree the transmission method with us in advance.

We do believe, however, that information and knowledge about data protection help to assess possible dangers and risks better. For this reason we have prepared this privacy information and compiled all relevant information. It was compiled to the best of our knowledge and belief and in accordance with the requirements of Article 13 GDPR, because it matters to us that your trust is respected here.

Business purpose and processing of personal data

We process personal data (hereinafter: data) of our customers, recruiters, applicants, suppliers, employees and business partners exclusively in order to provide our recruiting service in the highest quality and with the greatest reliability. Processing takes place both in automated and in non-automated form.

This includes, among other things, the following data: name and postal address as well as email address, telephone numbers (landline and mobile) and, where applicable, bank details. In addition, as part of our services, in particular in HR-related and commercial processes, special categories of data are also processed. This is always done with regard to necessity and lawfulness and in proportion to the purpose, in accordance with Article 5 GDPR.

“Processing of data” means, for example, the following operations: collecting, recording, organising, storing, using, transmitting, disseminating and erasing data (Article 4(2) General Data Protection Regulation, GDPR).

We only process data that is necessary to establish and perform our contractual services, and we point out when providing it is necessary. Data is only disclosed to external parties if this is genuinely necessary within the scope of an assignment. When processing data entrusted to us within the scope of an assignment, we act in accordance with the instructions of the client and the statutory requirements for processing on behalf under Art. 28 GDPR, and we do not process the data for any purpose other than that of the assignment.

Who can you contact?

§ 38 of the German Federal Data Protection Act (BDSG, new version) applies to our company. The controller within the meaning of data protection law, in particular the EU General Data Protection Regulation (GDPR), is:

Jomigo GmbH, Kolonnenstraße 8, 10827 Berlin, Germany

Represented by:

Jonathan Muhr

Contact: email: hello@jomigo.de or by phone: +49 30 403688 50

Controller within the meaning of data processing:

Managing Director (Geschäftsführer): Jonathan Muhr

Name and address of the data protection officer

We have appointed an external data protection officer for our company. Any data subject can contact our data protection officer directly at any time with any questions or suggestions about data protection.

Data protection officer: legal.solutions GmbH| pagestreet
Phone: +49 30 4672406 50
Email: datenschutz@pagestreet.de
Website: www.pagestreet.de

What are your rights?

You can contact us at any time if you have questions about your data protection rights or want to exercise any of the following rights:

  • Right to withdraw consent under Art. 7(3) GDPR (for example, you can contact us if you want to withdraw consent you previously gave to a newsletter)
  • Right of access under Art. 15 GDPR (for example, you can contact us if you want to know what data we have stored about you)
  • Rectification under Art. 16 GDPR (for example, you can contact us if your email address has changed and you want us to replace the old one)
  • Erasure under Art. 17 GDPR (for example, you can contact us if you want us to delete certain data we have stored about you)
  • Restriction of processing under Art. 18 GDPR (for example, you can contact us if you want us not to delete your email address but to use it only for sending strictly necessary emails)
  • Data portability under Art. 20 GDPR (for example, you can contact us to receive the data we hold about you in a compressed format, for example because you want to make it available to another website)
  • Objection under Art. 21 GDPR to processing based on Art. 6(1)(e) and (f) (for example, you can contact us if you do not agree with one of the advertising or analysis methods described here)
  • Right to lodge a complaint with the competent supervisory authority under Art. 77(1) GDPR (for example, you can also send complaints directly to the data protection supervisory authority)

The competent supervisory authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59-61
10555 Berlin, Germany
Phone: +49 (0)30 13889-0
Fax: +49 (0)30 2155050
Email: mailbox@datenschutz-berlin.de

Categories of data subjects

Visitors to and users of our online offering (below we also refer to the data subjects collectively as “users”). In addition, customers, suppliers, service providers and business partners who work with us in trust.

Purpose of processing

  • Providing the online offering, its functions and content
  • Answering contact requests and communicating with users
  • Security and protective measures

Beyond this, personal data is only processed within the scope of our business purpose, taking into account Article 6 GDPR and Article 9(2)(h) GDPR. This is always done with regard to necessity and lawfulness and in proportion to the purpose, in accordance with Article 5 GDPR.

In accordance with Art. 13 GDPR, we inform the users of our website and our customers of the legal bases of our data processing. For users within the scope of the General Data Protection Regulation (GDPR), i.e. the EU and the EEA, the following applies unless the legal basis is stated in this privacy policy:

  • the legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR;
  • the legal basis for processing to provide our services and carry out contractual measures, and to answer enquiries, is Art. 6(1)(b) GDPR;
  • the legal basis for processing to comply with our legal obligations is Art. 6(1)(c) GDPR;
  • where vital interests of the data subject or of another natural person make processing of personal data necessary, Art. 6(1)(d) GDPR is the legal basis;
  • the legal basis for processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller is Art. 6(1)(e) GDPR;
  • the legal basis for processing to protect our legitimate interests is Art. 6(1)(f) GDPR;
  • processing of data for purposes other than those for which it was collected is governed by Art. 6(4) GDPR;
  • processing of special categories of data (under Art. 9(1) GDPR) is governed by Art. 9(2) GDPR.

Deletion of data and storage period

Unless stated otherwise, we delete your data as soon as it is no longer needed, for example your email address after you unsubscribe from our newsletter. Your data is also blocked or deleted when a storage period prescribed by law expires, unless further storage is necessary to conclude or perform a contract. Certain data may have to be kept longer for legal reasons. You can of course request information at any time about the data stored and its retention periods. We review the need to keep data at least every three years; where statutory retention obligations apply, data is deleted when they expire (6 years under § 257(1) German Commercial Code (HGB), 10 years under § 147(1) German Fiscal Code (AO)).

Visiting our website

When you visit our website, SSL or TLS encryption is used to protect incoming and outgoing requests. You can recognise an encrypted connection by the browser’s address bar starting with “https://” and by the lock symbol in the browser bar. If you only want to look around our website, no personal data is collected except the data your browser transmits to make the visit possible, in particular:

  • name of the page accessed (e.g. the page that was just opened)
  • date and time of access (e.g. 11:45 on 25.05.2018)
  • amount of data transferred (e.g. 2427 bytes)
  • notification of successful access (e.g. whether an error occurred when the page was opened)
  • browser type and version (e.g. the browser used, Firefox 60.0.1)
  • the user’s operating system (e.g. MacOS 10.13.4)
  • referrer URL (the previously visited page)
  • IP address and the requesting provider (e.g. 95.91.215.example or 2a02:8109:9440:1198:bdb1:551f:example)
  • status codes (e.g. status code 200: request processed successfully)

The most relevant item for you as a visitor is the IP address, because it is data that could in theory be traced back to you as a person. The purpose of the temporary storage of this data at the start is to ensure the connection, the availability and the correct display of our website. The IP address and the technical data listed above are needed to display the website, avoid display problems for visitors and fix error messages. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR.

Collection, processing and disclosure of personal data when you engage us

When you engage our services, we collect and process personal data only to the extent necessary to fulfil and handle the order and to process the enquiry. Providing the data is necessary to conclude the contract or to carry out the assignment. If the data is not provided, no contract can be concluded. Processing is based on Art. 6(1)(b) GDPR and is necessary to perform the contract with you. Your data is only disclosed where there is a legal obligation and within contractually agreed processes. In all cases we strictly observe the statutory requirements. The scope of data transfer is limited to a minimum.

Contact form

We have two areas with contact forms: the contact form on our contact page and the application form on our page for recruiters. If you send us enquiries using our contact forms, the details from the enquiry form, including the contact details you provide there, are stored by us to process the enquiry and in case of follow-up questions. We do not pass on this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry relates to the performance of a contract or is necessary to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in handling enquiries effectively (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) where this has been requested.

The data you enter in the contact forms remains with us until you ask us to delete it, withdraw your consent to storage, or the purpose for storing the data no longer applies (e.g. after your enquiry has been dealt with). Mandatory statutory provisions, in particular retention periods, remain unaffected.

Email delivery (Resend)

The details from the contact forms are sent to our inbox by email. For this we use the Resend service. The provider is Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA (hereinafter Resend). Resend processes the content of the form and the related email metadata (e.g. sender and recipient address, date and time of sending) on our behalf. Data may be transferred to the USA in the process; see the section “Transfers to third countries”. Processing is based on the same legal bases as the handling of your enquiry (Art. 6(1)(b) or (f) GDPR). For more information, see Resend’s privacy policy: https://resend.com/legal/privacy-policy

Spam protection

To protect against automated requests, our contact forms contain a field that is invisible to people and check how quickly a form is sent. We also limit the number of requests per IP address: for this, your IP address is held in the working memory of our server at Vercel for at most ten minutes when you send a form, and then discarded. Processing is based on our legitimate interest in protecting our contact forms and our inbox from automated abuse (Art. 6(1)(f) GDPR).

Spam protection (Cloudflare Turnstile)

On our contact page and our page for recruiters we also use Cloudflare’s “Turnstile” service to tell people from bots. Service provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (hereinafter Cloudflare). Turnstile runs in the background; usually you see nothing of it. To do this, Cloudflare processes your IP address, the user agent of your browser and technical connection data (TLS fingerprint), together with the site key and address of our website. Cloudflare processes this data on our behalf as a processor; according to Cloudflare, it also processes it as a controller in its own right to improve Turnstile’s bot detection. Turnstile sets no cookies. Data may be transferred to the USA in the process; Cloudflare is certified under the EU-US Data Privacy Framework (see also the section “Transfers to third countries”).

Processing is based on our legitimate interest in protecting our contact forms and our inbox from automated abuse (Art. 6(1)(f) GDPR). Where technical information is read from your browser in the process, this is strictly necessary to provide the contact form you are using (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); consent is not required for this. This website uses Cloudflare Turnstile, and Cloudflare’s Turnstile Privacy Addendum applies to its use: https://www.cloudflare.com/turnstile-privacy-policy/. For more information, see also Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/

Contacting us

When you contact us (e.g. by email, phone, the contact form or via social media), the user’s details, including all personal data arising from them (name, enquiry, email address), are processed to handle and deal with the contact request under Art. 6(1)(b) GDPR (within contractual or pre-contractual relationships) and Art. 6(1)(f) GDPR (other enquiries). Users’ details may be stored in a system-supported environment (e.g. invoicing, CRM system) or comparable applications. We delete enquiries once they are no longer needed. We review whether they are still needed every two years. Statutory archiving and retention obligations also apply. Enquiries that have no relevance or do not need to be stored are deleted. This also applies to unsolicited applications and advertising.

Online booking (Zeeg)

We use the Zeeg service to book calls. The provider is Zeeg GmbH, Friedrichstraße 155, 10117 Berlin, Germany (hereinafter Zeeg).

On our contact page, the booking calendar is hidden behind the “Show calendar” button. As long as you do not click this button, no content is loaded from Zeeg and no data is sent to Zeeg. Only when you click does your browser load the calendar from Zeeg’s servers. Zeeg then receives your IP address and technical information about your browser and device and, if you book a slot, the details you enter (e.g. name, email address and chosen time).

On all other pages, the booking buttons (e.g. “Book a call”) are plain links to our booking page at Zeeg, which opens in a new tab. No data is sent to Zeeg before you click such a link. If you book a slot on the booking page, Zeeg processes your details as described above.

Zeeg processes your booking details on our behalf so that we can hold the call with you. According to Zeeg, it runs its servers and databases in data centres in Germany and the Netherlands.

Processing is based on Art. 6(1)(b) GDPR where the booking serves to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in simple online booking (Art. 6(1)(f) GDPR). For more information, see Zeeg’s privacy policy: https://zeeg.me/en/legal/privacy

Security measures

In accordance with the statutory requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures (TOMs) to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data, as well as access to, input, disclosure, securing the availability and separation of the data. We have also set up procedures to ensure that data subjects’ rights can be exercised, data is deleted and threats to data are responded to. Furthermore, we take the protection of personal data into account when developing or selecting hardware, software and procedures, in line with the principle of data protection by design and by default. This applies in particular to our online offering and the information compiled here. System- and process-side compliance with the German principles for proper bookkeeping (GoBD) is also taken into account and applied.

Working with processors, joint controllers and third parties

Where, in the course of our processing, we disclose data to other persons and companies (processors, joint controllers or third parties), transmit it to them or otherwise give them access to the data, we do so only on the basis of a legal permission.

We make sure that cooperation with business partners and service providers is governed either by a data processing agreement or by a declaration of commitment to confidentiality and compliance with data and business secrecy.

Transfers to third countries

Where data is processed in a third country (i.e. countries outside the European Union), or this happens in the course of using third-party services (software, applications, etc.), this only takes place if it is necessary to fulfil our (pre-)contractual obligations or if we have your consent. Subject to legal or contractual permissions, we only process data in a third country, or have it processed there, if the legal requirements are met in the form of the standard contractual clauses adopted in June 2021 by the European data protection authorities. This means that processing takes place, for example, on the basis of special guarantees or in compliance with officially recognised special contractual obligations.

Cookies

This website sets no cookies and does not store any information on your device. Our analytics (see “Vercel Web Analytics”) work without cookies too. That is why we show no cookie banner. On the contact page and the page for recruiters, Cloudflare Turnstile reads technical information from your browser to protect the forms against bots; it sets no cookies either (see “Spam protection (Cloudflare Turnstile)”).

One exception may be Zeeg’s booking calendar: it only loads when you click “Show calendar” on our contact page or open a booking link. Whether Zeeg sets cookies is governed by Zeeg’s privacy policy (see “Online booking (Zeeg)”).

Note on disabling or deleting cookies

Every user can set their web browser so that cookies are generally not stored on their device, or so that they are asked each time whether they agree to cookies being set. Cookies that have already been set can be deleted by the user at any time. How this works is described in the help function of each web browser.

Please note: disabling cookies in general may limit the functions of websites.

Right to object to direct marketing

For many services, especially in the case of tracking, you can object in general to cookies used for online marketing via the US site https://www.aboutads.info/choices/ or the EU site https://www.youronlinechoices.com/. You can also prevent cookies from being stored by disabling them in your browser settings. Please note that some functions of websites may then only be usable to a limited extent.

You can configure, block and delete cookies in your browser settings. The German Federal Office for Information Security (BSI) provides helpful information and instructions for common browsers: https://www.bsi.bund.de/EN/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Cyber-Sicherheitsempfehlungen/Updates-Browser-Open-Source-Software/Der-Browser/JavaScript-Cookies-Fingerprints/javascript-cookies-fingerprints_node.html

Hosting and email delivery

The hosting services we use from our provider serve to provide the following: infrastructure and platform services, computing capacity, storage space and database services, email delivery, security services and technical maintenance, which we use to operate this online offering.

In doing so, we or our hosting provider process master data, contact data, content data, contract data, usage data, meta and communication data of customers, prospects and visitors to this online offering on the basis of our legitimate interest in providing this online offering efficiently and securely under Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement taking the standard contractual clauses into account).

Analytics tools and third-party tools

When you visit this website, your browsing behaviour may be evaluated statistically. This is done mainly with so-called analytics programs and/or tools from so-called third-party providers. We use only the following tool for this:

Vercel Web Analytics

We measure the reach of this website with Vercel Web Analytics, a service of our hosting provider Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (hereinafter Vercel). Vercel Web Analytics sets no cookies and stores no information on your device. The measurement script is loaded from our own domain; Vercel processes the measurement data on our behalf.

For each page view the following is recorded: time, page visited (URL), referring page (referrer), approximate location (country, region, city), operating system, browser and device type, each with version. To count visits, Vercel creates a hash from the incoming request, which is discarded after 24 hours. According to Vercel, measurement is anonymous, is not linked to an IP address or a person, and does not allow tracking across different websites. We only see aggregated statistics.

Processing is based on our legitimate interest in understanding how our website is used and improving it (Art. 6(1)(f) GDPR). Because no information is stored on or read from your device, we do not ask for consent for this. You can object to the processing at any time (Art. 21 GDPR); technically, you can prevent measurement by disabling JavaScript or using a content blocker. Data may also be processed in the USA in the process; Vercel is certified under the EU-US Data Privacy Framework. For more information, see https://vercel.com/docs/analytics/privacy-policy

Hosting and content delivery networks (CDN): external hosting

This website is hosted by an external service provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (hereinafter Vercel). Vercel delivers the website through its own content delivery network. The personal data collected on this website is processed on the hosting provider’s servers. This may include in particular IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access and other data generated via a website.

The hosting provider is used to perform contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR).

Our hosting provider will only process your data to the extent necessary to fulfil its service obligations and will follow our instructions regarding this data.

We use the following hosting provider: Vercel. Vercel also provides our analytics (see “Vercel Web Analytics”) and runs the server that hands our contact forms to Resend.

Data may also be processed in the USA in the process. Vercel is certified under the EU-US Data Privacy Framework. For more information, see Vercel’s privacy notice: https://vercel.com/legal/privacy-notice

Recruiter application

For interested users who want to work for us as recruiters, we have set up an application form on our page for recruiters. We use the details entered there to review the application and process them in accordance with the privacy information for the application process. You will find more detailed information under Contact form in this privacy policy.

Privacy information for the application process

We process applicant data only for the purpose and within the scope of the application process, in accordance with the statutory requirements. Applicant data is processed to fulfil our (pre-)contractual obligations in the application process within the meaning of Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR where the processing becomes necessary for us, for example in legal proceedings (in Germany, § 26 BDSG also applies).

The application process requires applicants to provide us with applicant data. The necessary applicant data follows from the job descriptions and generally includes personal details, postal and contact addresses and the documents belonging to the application, such as cover letter, CV and references. Applicants may also voluntarily provide us with additional information.

By submitting their application to us, applicants agree to the processing of their data for the purposes of the application process in the manner and to the extent set out in this privacy policy.

Where special categories of personal data within the meaning of Art. 9(1) GDPR are voluntarily provided in the application process, they are additionally processed under Art. 9(2)(b) GDPR (e.g. health data such as severe disability status, or ethnic origin). Where special categories of personal data within the meaning of Art. 9(1) GDPR are requested from applicants in the application process, they are additionally processed under Art. 9(2)(a) GDPR (e.g. health data where it is required for the job).

Applicants can send us their applications by email. Please note, however, that emails are generally not sent encrypted and applicants must take care of encryption themselves. We therefore cannot accept responsibility for the transmission path of the application between the sender and receipt on our server and recommend sending applications by post. In this context we ask that you send us attachments in PDF format only, or upload them in our application tool.

If an application is successful, the data provided by applicants may be processed further by us for the purposes of the employment relationship. Otherwise, if the application for a job offer is not successful, the applicants’ data is deleted. Applicants’ data is also deleted if an application is withdrawn, which applicants are entitled to do at any time.

Subject to a justified withdrawal by the applicant, deletion takes place after a period of six months, so that we can answer any follow-up questions about the application and meet our obligations to provide evidence under the German General Equal Treatment Act (AGG). Invoices for any reimbursement of travel expenses are archived in accordance with tax law requirements.

Automated decision-making

As a responsible company, we do not use automated decision-making or profiling.

Objection to advertising emails

We hereby object to the use of the contact details published under our legal notice obligation for sending unsolicited advertising and information material. As the operator of these pages, we expressly reserve the right to take legal action in the event of unsolicited advertising, for example by spam emails.

Changes and updates to this privacy policy

We reserve the right to amend this privacy policy so that it always meets current legal requirements, or to reflect changes to our services in the privacy policy, for example when introducing new services. The new privacy policy then applies to your next visit.

As of 10/2026

The German version of this privacy policy is at /de/datenschutz.