1. Controller and contact
The provider named in the operator details on this page and in the Impressum is the controller for the personal data processing described here. Please use the contact details there for privacy questions and requests to exercise your rights. These notices cover Uverna's website, workspace, registration and contact functions.
2. Website access and security
Accessing the service involves processing your IP address, access time, requested address and browser or device information as needed to deliver the website and protect it against misuse. Security and operational records help investigate errors and protect accounts. Their purpose is not to store the contents of your career materials.
Processing necessary to provide a service you request is based on Art. 6(1)(b) GDPR. Website security, abuse prevention and necessary diagnostics are based on Art. 6(1)(f) GDPR; our legitimate interests are a functioning, secure service and protection of users and their accounts.
3. Registration, accounts and invitations
We process your email address, protected password verification values, account settings, access status, invitation or access-code information, historical trial dates and records of the legal document versions you have accepted or acknowledged. We also record the status and withdrawal of your separate AI processing authorization. These data support account setup and administration under Art. 6(1)(b) GDPR and necessary security evidence under Art. 6(1)(f) GDPR.
Required registration and security details are necessary for account access. You are not legally obliged to register, but we cannot provide that access without the required details. When email verification is required, an unverified registration remains pending and does not receive a signed-in session. Erasure of an unconfirmed account is initiated seven days after registration.
If an invitation uses an address supplied by another person, that address and the invitation information are used to administer the invitation. Optional profile details are supplied by you; missing details may limit the requested function.
4. Profiles, CVs, documents and applications
Your workspace can contain contact details, employment and education history, skills, languages, approved facts, CV files and photos, document versions, saved proposals, conversations, public vacancies, application drafts, contacts, notes and application status. We process these data to import, edit, display and export your materials and organize your applications under Art. 6(1)(b) GDPR.
Uploaded files are scanned before use. Clean files may be stored in object storage; unsafe files remain blocked or are removed through the applicable deletion process. This security processing is based on Art. 6(1)(f) GDPR. Text and contact information can be extracted on our servers for your workspace. Server-side processing is separate from disclosure to an AI service and does not mean that processing takes place only in your browser.
Do not upload identity or residence documents, health records, payment-card details, passwords or other secrets. Avoid sensitive information such as health, religion or political beliefs. Filters cannot reliably exclude every unintended occurrence; contact us if you have accidentally supplied such data.
5. AI functions and separate authorization
AI assists with extracting, drafting, translating and reviewing career materials and with career conversations. The selected function may send permitted career content, permitted conversation content and public vacancy information to an external AI service. Career information can remain personal data even after names are removed. Processing necessary to provide a contractual function you request uses Art. 6(1)(b) GDPR. The separate AI agreement controls whether the application permits AI processing; it is not itself a data protection legal basis. Acknowledging that you have read this Privacy Notice does not itself authorize every AI request.
Current registration requires acceptance of the Terms and AI Processing Terms and a separate acknowledgement that you have read the Privacy Notice. After registration, you can review and withdraw your AI authorization in Settings. An existing member asked to review a missing, withdrawn or outdated AI agreement can continue without AI; functions requiring the current authorization remain unavailable. This later choice does not make the initial registration acceptance optional.
For CV import, contact, identity, sensitive and residence-authorization sections are excluded from AI input, and additional detected identifiers and sensitive information are filtered. These controls reduce disclosure and do not guarantee anonymity. Withdrawal applies to future processing dependent on the authorization. It does not automatically erase stored results or undo a transmission that has already occurred. Use the available deletion controls or contact us about erasure; an earlier transmission does not authorize unlimited further processing.
6. Public vacancy search and external sources
Requested vacancy search uses permitted professional search terms derived from your profile and public vacancy information under Art. 6(1)(b) GDPR. Public search providers receive these derived terms and public vacancy metadata, rather than raw CV text, unapproved facts, contact details or private and restricted profile sections. Derived terms may still be personal data.
Public vacancies may include professional contact details published by employers or vacancy sources. We process these to display the vacancy and its source under Art. 6(1)(f) GDPR, based on our interest in providing traceable public opportunities. Contact us to correct such details or object to their processing.
An external employer or vacancy website processes data under its own notice when you open it. Opening a source does not submit an application.
7. Contact, support and email
For an enquiry we process the contact details, message and information needed to respond. Contract-related enquiries are handled under Art. 6(1)(b) GDPR; other enquiries under Art. 6(1)(f) GDPR, based on our interest in answering incoming requests. Anonymous enquiries are not automatically linked to an account merely because the email address matches. Authorized support personnel may access enquiry content as needed for their role.
Account verification, password recovery and deletion notices are service messages when email delivery is enabled. Optional product notifications require a separate opt-in and can be turned off in Settings; creating an account does not grant permission for advertising. Provide only the information needed for your enquiry and avoid sending restricted documents or secrets.
8. Recipients and international processing
Recipients can include service providers for hosting, databases, document storage and backups, email transport and support mailboxes, external AI processing, and public vacancy search. They receive the technical data, account content, message or selected search and AI input needed for their task. Authorized personnel can access data as necessary to operate and support the service. If you choose an available external sign-in, messaging or payment integration, its provider also receives the data needed for that integration; the relevant information is provided with that function.
A provider acting on our instructions requires the safeguards applicable to processors under Art. 28 GDPR. A provider's independent processing is governed by its own responsibilities and notice. An EU endpoint alone does not establish that every processing step or support access remains inside the European Economic Area.
Where processing or access outside the EEA occurs, an applicable transfer basis is required. Depending on the recipient and circumstances, this can be an adequacy decision or appropriate safeguards such as EU standard contractual clauses. Please use the privacy contact for information about the actual recipients, processing locations and applicable transfer safeguards, and a copy of relevant safeguards where available, with necessary redactions to protect others.
9. Cookies and browser storage
Uverna uses cookies and browser storage for sessions, security, requested account steps and interface state. Storage or access strictly necessary for a service you expressly request falls under § 25(2) no. 2 TDDDG. Other storage or access requiring consent falls under § 25(1) TDDDG; a preference or integration is not automatically necessary merely because the application uses it. Personal data processing remains subject to the GDPR bases described above.
The first-party cookies ecc_session and ecc_csrf last up to 30 days for sign-in and protection against unauthorized requests. ecc_locale lasts for the browser session. ecc_admission lasts up to 10 minutes for access-code handoff. If the corresponding function is enabled, ecc_oauth_state, ecc_oauth_verifier and ecc_oauth_context protect external sign-in for up to 10 minutes; ecc_link_challenge supports requested account linking for up to 10 minutes. The optional Telegram cookies ecc_telegram and ecc_telegram_link_browser last up to 30 days and 10 minutes respectively.
Local storage keys uverna-appearance, ecc.cv-library.view, cv-unplaced-notice:* and ecc.cv.language-notice.* retain appearance, view and dismissed-notice preferences without an application expiry; they remain until overwritten or cleared. Session storage ecc:conversation-thread:* stores messages, replies, turns and context and can contain career content. It is tied to the browser-tab session, whose restoration depends on your browser. ecc.verify.returnTo stores a safe verification return destination until consumed or the tab session ends.
You can clear cookies and local or session storage through your browser. This may sign you out, reset preferences or remove a locally saved conversation. Clearing browser storage does not delete server records, and account deletion does not itself guarantee that your browser's stored copies have been cleared.
Storage duration
Free membership, including invitation and access-code accounts, has no upgrade deadline. We do not initiate account deletion solely because you remain on Free. Unconfirmed registrations retain the separate seven-day erasure rule described above. Manual deletion requests and erasure that has already started continue. An unstarted deletion request recorded as automatically generated solely by the retired trial policy is superseded; its original record is preserved. This is not a promise of indefinite storage.
For active accounts, workspace data remains while the account is active until you request deletion, subject to the requested function, the deletion process, applicable retention duties or necessary preservation of specific legal claims. The retention rule for public contact enquiries without sign-in provides for erasure of contact and message details 90 days after closure; reopening before erasure removes that closure deadline. This rule does not apply to all account support records. The operational backup window is 14 days, so live-system erasure does not immediately remove those copies.
You can request export or account deletion in Settings. Deletion revokes sessions, cancels work and erases product data and stored objects. Some account, subscription and audit structures remain with identifiers removed or changed. This does not establish that every residual record is fully anonymous, legally required or may be kept indefinitely. Retention of those records must remain limited to its applicable purpose and legal basis. Browser copies and data you exported or sent independently are separate from live account erasure.
Your access and portability rights are not limited to the contents of the product export. Please contact us for information about retention of a specific record or to exercise your statutory rights.
11. Your rights and complaints
Where the statutory conditions apply, you have rights of access, rectification, erasure, restriction and data portability. You can withdraw any consent given under data protection law for the future; this does not affect the lawfulness of processing before withdrawal. Please use the privacy contact in the operator details. We may request information necessary to verify that a request concerns your data. Requests are generally answered within one month; any legally permitted extension must be explained within that period.
You can object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR. You can object to processing for direct marketing, including associated profiling, at any time without giving those grounds.
You can complain to a supervisory authority, particularly where you live or work or where you believe an infringement occurred. For Baden-Württemberg, the Landesbeauftragte für den Datenschutz und die Informationsfreiheit provides contact and complaint information at https://www.baden-wuerttemberg.datenschutz.de/kontakt-aufnehmen/.
12. Automated support and your decisions
Uverna provides automated suggestions and matches to support your own application work. It does not decide on recruitment for an employer or automatically submit applications. These features are not exclusively automated decisions with legal or similarly significant effects within the described candidate-facing scope. Suggestions and matches may still involve personal data. AI output can be incorrect, incomplete or unsuitable; review it before use.
13. Changes and document versions
We update this notice when processing or relevant requirements change. The version is shown on this page; earlier published text is preserved to identify accepted or acknowledged versions. Material changes are communicated as appropriate. Changing a notice does not by itself authorize a new purpose or replace a separate authorization or consent required for processing.