Privacy policy

Last updated: 25 October 2026

This privacy policy explains which personal data we process when you use dasauge, why we need it, and which rights you have.

Controller

Das Auge Kreativnetzwerk UG (haftungsbeschränkt)

Geusenstr. 9, 10317 Berlin, Germany

Email: hallo@dasauge.de

Further contact details are available in our imprint.

Service delivery, logs and security

When you access the website, technically necessary connection data is processed. This may include your IP address, date and time, requested URL, referrer, browser and operating system, device information, and request and error identifiers. We need this data to deliver the website, diagnose errors, and prevent attacks or abuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the service, including detecting abuse and reconstructing security incidents. The application and database are hosted by Hetzner in Germany. Cloudflare supports DNS, delivery and security. Request and container logs are deleted after no more than 90 days. Recorded error issues, including their individual occurrences, are deleted 90 days after the last occurrence. Legal obligations or investigation of a specific security incident may require longer retention in individual cases.

Accounts and public content

When you create or manage an account, we process in particular your name, email address, username, language preferences, password hash, and confirmation, login and recovery data. For profiles, portfolios, job postings and workspace listings, we process the texts, categories, links, locations and uploaded media you provide. Published content is visible on the internet and may be indexed by search engines.

Processing is necessary to perform our agreement with you under Article 6(1)(b) GDPR. Security and abuse-prevention measures are additionally based on Article 6(1)(f) GDPR. Required fields are marked as such; without them we cannot provide the relevant function.

If you request account deletion, we immediately disable access and hide public content. We can reactivate the account on request within 30 days. Afterwards, we anonymise the account and delete content we no longer need. Invoices and evidence subject to statutory retention periods or required to defend claims remain for the applicable period.

Account recovery

If you no longer have access to your account's email address, you can request its recovery through a form. We then process your name, the new email address, the details about your existing account that you choose to provide (for example a previous email address, profile address, company, website or invoice numbers), your explanation and any documents you upload as proof. We do not store the documents publicly. We review the request personally, match it to an account where possible and send our decision to the new email address. If we recover an account, we change its email address and also notify the previous address.

The legal basis is Article 6(1)(b) GDPR; verifying your identity and protecting accounts against takeover are additionally based on Article 6(1)(f) GDPR. We delete uploaded documents and voluntary details 30 days after the decision. We keep your name, the new email address, the matched account and the decision with its reason for accountability and to defend against claims.

Bookmarks, search alerts and notifications

We store the records you bookmark. Without an account, up to ten records are stored for one year in a signed cookie. With an account, bookmarks are associated with your account. For search alerts, we store the query, filters, location, radius, countries, the website on which you created the search alert, and the interval, and send matching new listings to your confirmed email address. We store which listings we have already sent you for six months, so you don't receive any listing twice. Search alerts remain stored until you delete them or your account.

The legal basis is Article 6(1)(b) GDPR. You can delete bookmarks and search alerts or unsubscribe at any time.

Contact between members

When you contact another member, we store sender and recipient, sender name and email address, the relevant profile, message, language and delivery information. The message is delivered by email and your email address is used as the reply-to address. Messages that have not been reported are deleted after one year.

Delivery is based on Article 6(1)(b) GDPR. Abuse prevention and delivery traceability are additionally based on Article 6(1)(f) GDPR.

Reports, moderation and restrictions

When you submit a report, we process your identity and contact details, reason and explanation, and a snapshot of the reported profile, job posting, workspace listing or message. For reported messages, the message content and sender/recipient data may also be stored, and the sender may be restricted pending review. We use Todoist for restricted internal handling tasks.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are protecting members, investigating abuse, and establishing, exercising or defending legal claims. Completed member-message reports and the associated message are deleted after three years. Other contact requests and reports are deleted one year after handling is completed; open matters are retained until completion.

Newsletter and other email

We send the newsletter only after your consent and confirmation of your email address through double opt-in. We store the email address, status, timestamps and evidence of the request, confirmation and withdrawal. Evidence may include the version of the consent language, IP address, user-agent, host, language and source. Sending is based on Article 6(1)(a) GDPR; we retain evidence to comply with legal duties and defend claims under Article 6(1)(c) and (f) GDPR. Once the documented lifecycle ends, evidence is retained through the end of the third following calendar year. You may withdraw consent for the future at any time through the link in every message.

We also send necessary account, security, contact and search-alert messages. Depending on the message, the legal basis is Article 6(1)(b), (c) or (f) GDPR. We use Postmark and our configured email infrastructure for delivery. Recipient, content and technical delivery information are processed. We delete message content after 30 days and the remaining delivery record after one year. For unsent or rejected messages, these periods run from creation.

Billing

For paid services, we process contact and billing address, tax and invoice data, the purchased service, payment status and legally required records. The legal bases are Article 6(1)(b) and (c) GDPR. Recipients may include payment and invoicing providers, tax advisers and authorities to the extent required by law. We retain tax and commercial records for the statutory periods.

Cookies and similar technologies

We use technically necessary cookies and browser storage for sessions and login, language, security functions, anonymous bookmarks and consent preferences. They are required to provide the functions you request (section 25(2) TDDDG); subsequent processing is based on Article 6(1)(b) or (f) GDPR.

Optional technologies are activated only after your consent (section 25(1) TDDDG and Article 6(1)(a) GDPR). We store your choice for six months; accepting and rejecting have the same duration. Following a material revision of this policy, we ask again earlier. You can change or withdraw your choice at any time through “Cookie settings” in the footer. This does not affect processing before withdrawal.

Audience measurement with Plausible

After consent, we use Plausible Analytics to understand website use and audience reach. The requested page, referrer, time, browser, operating system, device and a coarse region derived from the IP address may be processed. We do not use this data for personalised advertising or a cross-site user profile. The integration is served through our domain.

The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. We measure public pages only and do not send user identifiers or custom event properties. Analytics data is deleted after 24 months.

Google Places

For location fields, we may use Google Places autocomplete after your consent. Only after the service is activated are entered location text and technical connection/device data transferred to Google. We store the selected result with your search or listing. The legal basis is Article 6(1)(a) GDPR and section 25(1) TDDDG; storing the selected location for the requested feature is based on Article 6(1)(b) GDPR.

Cloudflare Turnstile

We protect certain forms against automated abuse with Cloudflare Turnstile. In particular, IP address, browser and device data, interaction data and the context of the form request may be transferred to Cloudflare. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting the website, our members and communication channels against spam and attacks.

Recipients, processors and international transfers

We engage service providers only where necessary for the purposes described above. They include Hetzner for hosting; Cloudflare for delivery, security, Turnstile and file storage; Postmark for email delivery; Plausible for optional audience measurement; Google for optional place suggestions and operational integrations; and Todoist for restricted internal handling tasks. Tax advisers, payment and invoicing providers, authorities or legal advisers may also receive data where required by law or necessary for contract performance or legal claims.

Some providers process data outside the European Union or European Economic Area, particularly in the United States. In such cases, we rely on an adequacy decision, valid certification under the EU-US Data Privacy Framework, or Standard Contractual Clauses and additional safeguards where required. You may request further information and a copy of the relevant safeguards.

Retention

Where no specific period is stated above, we keep personal data only for as long as necessary for the relevant purpose. We then delete or anonymise it unless statutory retention duties, ongoing contracts, security incidents, or the establishment, exercise or defence of legal claims require further retention. Backups are overwritten as part of their backup cycle; until then, data contained in them is used only for restoration.

Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR. You may withdraw consent for the future at any time.

To exercise your rights, contact hallo@dasauge.de. You also have the right to lodge a complaint with a data protection supervisory authority. Our competent authority is the Berlin Commissioner for Data Protection and Freedom of Information.

No automated individual decisions

We do not make decisions producing legal or similarly significant effects based solely on automated processing within the meaning of Article 22 GDPR.

Changes

We update this policy when our processing, service providers or the law changes. The current version is always available on this page.