Privacy Policy 

DastN GmbH ("DastN", "we", "us") takes the protection of personal data very seriously. This Privacy

Policy explains how we process personal data in accordance with Regulation (EU) 2016/679 (General

Data Protection Regulation – GDPR), the German Federal Data Protection Act (BDSG), and the German

Telecommunications Digital Services Data Protection Act (TDDDG).

This Privacy Policy applies to all processing of personal data carried out by DastN in connection with:

• the use of our website (www.dastn.com),

• the use of our ERP- and portal-based systems (including Odoo-based platforms),

• international relocation and immigration services,

• recruitment and candidate placement services,

• digital transformation, IT, ERP, and advisory services,

• marketing, referral, affiliate, and business development activities,

• all communications with interested parties, clients, candidates, partners, and other stakeholders.

All interested parties initially interact with DastN through digital channels, in particular via our website and

ERP systems. This Privacy Policy therefore covers all entry points into our services.

The data controller within the meaning of Article 4(7) GDPR is:

DastN GmbH

Kurfürstendamm 194

10707 Berlin, Germany

Commercial Register: HRB 230821 B (Amtsgericht Charlottenburg)

Email: info@dastn.com

Phone: +49 30 466901111

DastN has not appointed a formal Data Protection Officer within the meaning of Article 37 GDPR.

However, we have designated an internal contact point for data protection matters.

For all questions regarding this Privacy Policy or the exercise of your rights, please contact:

Data Protection Contact – DastN GmbH

Email: privacy@dastn.com

We regularly review whether the appointment of a Data Protection Officer becomes mandatory due to the

nature, scope, or scale of our processing activities.

We process personal data relating to the following categories of data subjects:

1. Website visitors and users of online services

2. Prospective clients and business contacts

3. Clients and corporate customers (and their representatives)

4. Job applicants and candidates

5. Relocation candidates and their family members or dependants

6. Employees and former employees

7. Contractors, consultants, and external service providers

8. Affiliates, referrers, agents, and influencers

9. Users of ERP portals and digital platforms

10. Representatives and staff of partner organizations and employer clients

An individual may fall into more than one category simultaneously (e.g. a candidate who is also a website user or an affiliate).

Depending on the context, we may process the following categories of personal data:

• Identification data (name, date of birth, nationality)

• Contact data (email address, telephone number, address)

• Professional and employment data (CVs, qualifications, work history)

• Immigration and relocation data (passport copies, residence permits, visa information, work

permits)

• Family-related data (information on spouses, children, or dependants where required for

relocation)

• Contractual and commercial data

• Communication data (emails, messages, call notes)

• Usage and technical data (IP address, log files, device information)

• Marketing and interaction data

• Portal and account data

Personal data is collected:

• directly from you,

• via our website and digital portals,

• through ERP systems (including Odoo),

• via email communication (including where documents are submitted by users and uploaded by our staff on their behalf),

• from employer clients, partners, or authorized third parties,

• from public or professional sources where legally permitted.

We process personal data for the following purposes and on the following legal bases:

7.1 Contract Performance and Pre-contractual Measures

Processing necessary to provide relocation, recruitment, consulting, IT, and ERP services.

Legal basis: Article 6(1)(b) GDPR.

7.2 Communication and Relationship Management

Responding to inquiries, managing business relationships, and providing support.

Legal basis: Article 6(1)(b) and Article 6(1)(f) GDPR.

7.3 Recruitment and Relocation Services

Evaluation of candidates, placement with employer clients, immigration processing, and coordination with

authorities and partners.

Legal basis: Article 6(1)(b) GDPR; where required, Article 6(1)(a) GDPR (consent).

7.4 Processing of Special Categories of Data

Where immigration, relocation, or legal requirements necessitate the processing of sensitive or highly

confidential data, appropriate safeguards are applied.

Legal basis: Article 9(2)(a), (b), or (f) GDPR, in conjunction with Article 6 GDPR.

7.5 Marketing, Analytics, and Business Development

Marketing communications, lead management, analytics, and service improvement.

Legal basis: Article 6(1)(a) GDPR (consent) and Article 6(1)(f) GDPR (legitimate interests).

7.6 Legal Obligations

Compliance with statutory obligations under German and EU law.

Legal basis: Article 6(1)(c) GDPR.

7.7 Security and Fraud Prevention

Ensuring IT security and preventing misuse.

Legal basis: Article 6(1)(f) GDPR.

We may use automated tools for organizational, analytical, or marketing purposes (e.g. lead

categorization or campaign evaluation). These activities do not produce legal effects or similarly

significant effects on data subjects.

No decisions producing legal effects are made solely on automated processing within the meaning of

Article 22 GDPR.

We use ERP and portal systems (including Odoo-based solutions) to manage services and interactions.

Access is role-based and limited to authorized users. Personal data may be uploaded directly by users

or, where necessary, by authorized staff acting on behalf of users.

We do not sell personal data. Data may be shared with:

• processors acting on our instructions (Article 28 GDPR),

• employer clients and partners involved in recruitment or relocation,

• public authorities where legally required,

• professional advisors and service providers.

Where personal data is transferred outside the EU/EEA, appropriate safeguards pursuant to Articles 44–46 GDPR are applied, including Standard Contractual Clauses.

Personal data is retained only as long as necessary for the respective purposes or statutory retention obligations. Thereafter, data is deleted or anonymized.

We implement appropriate technical and organizational measures pursuant to Article 32 GDPR to protect personal data. 

14.1 Your choice (cookie banner). When you first visit our website, a cookie banner asks for your choice. With “Only essentials” we only use technologies that are strictly necessary to provide the website (§ 25(2) no. 2 TDDDG). The analytics and marketing tools in 14.5 to 14.10 are loaded only after you click “I agree” (§ 25(1) TDDDG, Article 6(1)(a) GDPR). Your choice is stored for up to 12 months. You can change or withdraw your consent at any time with effect for the future via the “Cookie settings” link at the bottom of every page, or by deleting the cookies in your browser.

14.2 Hosting and content delivery. Our website runs on Odoo Online (Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium) as our processor (Article 28 GDPR). Static files such as images, scripts and fonts are delivered on behalf of Odoo via the content delivery network KeyCDN (proinity LLC, Switzerland). Your IP address and technical request data are processed to deliver the website securely and quickly. Switzerland has an EU adequacy decision. Legal basis: Article 6(1)(f) GDPR; no consent is required (§ 25(2) no. 2 TDDDG). Fonts are served from our own server; no data is sent to Google Fonts.

14.3 Privacy-friendly visitor statistics (Plausible Analytics). We use Plausible Analytics (Plausible Insights OÜ, Tartu, Estonia; servers in the EU) to count visits and form submissions anonymously. Plausible sets no cookies and stores nothing on your device. IP addresses are not stored; visitors are counted only through a daily changing value that cannot be traced back to you. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in privacy-friendly statistics).

14.4 Spam protection on forms (Google reCAPTCHA). To protect our forms against spam and abuse, we use Google reCAPTCHA (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) on pages with forms. reCAPTCHA checks whether a form is filled in by a person and processes, among other things, your IP address and information about your browser and your use of the page. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. Legal basis: Article 6(1)(f) GDPR (protection of our forms against abuse).

14.5 Google Tag Manager. With your consent we use Google Tag Manager (Google Ireland Limited) to load the tools in 14.6 to 14.10. Tag Manager itself does not create user profiles, but processes your IP address when loading. Legal basis: Article 6(1)(a) GDPR, § 25(1) TDDDG.

14.6 Google Analytics 4 and Google Ads. With your consent we use Google Analytics 4 (Google Ireland Limited) to understand how our website is used (pages viewed, time on page, device and browser type, approximate location, form submissions). Google Signals and the transfer of user-provided data are switched off, and analytics data is kept for 14 months. Google Analytics is linked to our Google Ads account so that we can see whether our ads lead to enquiries and show ads to people who visited our website (remarketing). Without your consent, no Analytics or Ads cookies are set (Google Consent Mode). Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework (Article 45 GDPR). Legal basis: Article 6(1)(a) GDPR, § 25(1) TDDDG. More information: https://policies.google.com/privacy

14.7 Meta Pixel (Facebook and Instagram). With your consent we use the Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) to measure the results of our Facebook and Instagram ads and to show ads to visitors of our website. Automatic advanced matching is switched off. We are jointly responsible with Meta for collecting and transmitting the data (Article 26 GDPR; https://www.facebook.com/legal/controller_addendum); Meta is responsible for the further processing. Data may be transferred to Meta Platforms, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework. Legal basis: Article 6(1)(a) GDPR, § 25(1) TDDDG. More information: https://www.facebook.com/privacy/policy

14.8 TikTok Pixel. With your consent we use the TikTok Pixel (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland) to measure the results of our TikTok ads and to show ads to visitors of our website. Data may be transferred to countries outside the EU/EEA; TikTok uses EU Standard Contractual Clauses (Article 46(2)(c) GDPR). Legal basis: Article 6(1)(a) GDPR, § 25(1) TDDDG. More information: https://www.tiktok.com/legal/privacy-policy-eea

14.9 LinkedIn Insight Tag. With your consent we use the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland) to measure the results of our LinkedIn ads and to show ads to visitors of our website. Data may be transferred to LinkedIn Corporation in the USA, which is certified under the EU-U.S. Data Privacy Framework. Legal basis: Article 6(1)(a) GDPR, § 25(1) TDDDG. More information: https://www.linkedin.com/legal/privacy-policy

14.10 Microsoft Clarity. With your consent we use Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) to understand how visitors use our pages, through heatmaps and session recordings (mouse movements, clicks, scrolling). Text you type into forms is masked and not transmitted. We use these insights only to make our website easier to use. Data may be transferred to Microsoft Corporation in the USA, which is certified under the EU-U.S. Data Privacy Framework. Legal basis: Article 6(1)(a) GDPR, § 25(1) TDDDG. More information: https://privacy.microsoft.com/privacystatement

14.11 How long cookies are stored. Analytics and marketing cookies are stored for at most 13 months (Google and TikTok up to 13 months, LinkedIn and Microsoft Clarity up to 12 months, Meta up to 90 days), unless you delete them earlier or withdraw your consent.

14.12 Sign-in with Google, Facebook or Microsoft. You can create an account or sign in on our website with your Google, Facebook (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) or Microsoft account. This is voluntary; you can also register with e-mail and password. The sign-in buttons are plain links to the provider's login page: no data is sent to the provider until you click one. After you click, the provider is responsible for its own processing under its own privacy policy.

If you use it, the provider sends us your name, your e-mail address and a user ID. We store the user ID and a technical sign-in token; we do not receive your password, we do not store your profile picture and we never post on your behalf. We use these data only to create and run your account and to contact you about your request. Legal basis: Article 6(1)(b) GDPR for the account you request and Article 6(1)(f) GDPR for secure and convenient sign-in and fraud prevention (our legitimate interest); you may object at any time (Article 21 GDPR).

Recipients are our hosting and IT providers (processors under Article 28 GDPR) and the provider you choose; transfers to Meta Platforms Inc. and Google LLC (USA) rely on the EU-US Data Privacy Framework (see section 11). We keep account data until you ask us to delete it or the account has been inactive for 24 months, subject to statutory retention periods (see section 12). You can remove our access at any time in your provider account settings. How to have your data deleted: Data deletion.

Data subjects have the rights set out in Articles 12–22 GDPR, including access, rectification, erasure, restriction, data portability, and objection.

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence or place of work.