Privacy Policy

This translation is provided for information purposes only. The German version is legally binding.

This privacy policy informs you about how we process personal data when you visit www.ahoira.com or www.jobahoi.com, use the JobAhoi app for iOS and Android or the web app app.jobahoi.com ("JobAhoi") or visit our presences on social networks.

1. Controller

AHOIRA UG (haftungsbeschränkt)
Rotmoosweg 7a, 94469 Deggendorf, Germany
Email: info@ahoira.com

At this address, you can reach us for all questions about data protection and your rights.

2. General information

2.1 Legal bases

For each processing operation, we state the legal basis under the General Data Protection Regulation (GDPR): contract or steps prior to entering into a contract (Art. 6(1)(b)), legal obligation (point (c)), legitimate interest (point (f); you can object to this, Section 7) or consent (point (a); can be withdrawn at any time with effect for the future).

We store or read on your device only what is strictly necessary for the respective service (§ 25(2) no. 2 TDDDG), or we obtain your consent. An exception is audience measurement on www.ahoira.com and www.jobahoi.com; we explain what is read out there in Section 4.1. We do not set cookies.

2.2 Recipients

We use service providers that process data on our behalf and in accordance with our instructions (Art. 28 GDPR); we have concluded data processing agreements with them. Where a recipient receives data as a controller in its own right, this is stated in each case. Beyond that, we only pass on data if you initiate it, for example with an application, or if we are legally obliged to do so.

2.3 Transfers to countries outside the EU

Some service providers process data outside the EU or the EEA, in particular in the USA. This only takes place on the basis of the EU-US Data Privacy Framework, to the extent the recipient is certified (list: www.dataprivacyframework.gov/list), or of the standard contractual clauses of the European Commission (eur-lex.europa.eu/eli/dec_impl/2021/914/oj). You can obtain a copy of the clauses agreed in each case at info@ahoira.com. We state the country and the basis for each service provider; for applications to employers outside the EU, see Section 5.3.

2.4 Storage period

We erase or anonymise data as soon as we no longer need it for the purpose. Statutory retention obligations take precedence: invoices and accounting vouchers eight years, books and records ten years, in each case from the end of the calendar year (§ 147(3) AO, § 257(4) HGB). Specific periods are stated for the individual processing operations.

2.5 Mandatory information and automated decisions

You do not have to provide any data to visit our websites; however, technically necessary connection data is generated. For an account, we need your email address and your first name; everything else is voluntary. For an application, your first and last name, telephone number, nationality, residential address, your current position with its start date and the date from which you are available are additionally required; without this information, an application is not possible. Employers need a company name and billing details for job advertisements.

We do not take any decision based solely on automated processing within the meaning of Art. 22 GDPR; for AhoiCheck, see Section 5.4.

3. Hosting and technical operation

3.1 Websites and web app (Netlify)

www.ahoira.com, www.jobahoi.com and the web app are hosted by Netlify, Inc., San Francisco, USA, as processor. With each request, Netlify processes connection data such as your IP address, your browser and the page requested.

Legal basis: legitimate interest in secure and functional delivery (Art. 6(1)(f) GDPR). Transfer to the USA: Data Privacy Framework, alternatively the standard contractual clauses. Storage period: only for as long as necessary for delivery, troubleshooting and defence against attacks.

3.2 Database and storage (Supabase)

We store the data of the app and the web app with Supabase Pte. Ltd., Singapore, our processor, in Frankfurt am Main. For support and maintenance, Supabase and its sub-processors may also process data in Singapore and the USA; the basis is the standard contractual clauses. Connection data such as your IP address is kept in logs for no more than seven days, and backups are overwritten after no more than seven days.

Legal basis: contract and legitimate interest in secure operation (Art. 6(1)(b) and (f) GDPR).

4. Visiting our websites

4.1 Audience measurement on our websites (Plausible)

On www.ahoira.com and www.jobahoi.com, we use Plausible Analytics (Plausible Insights OÜ, Tartu, Estonia) to count how the websites are used. For this purpose, your browser loads a script that transmits the page requested and the previously visited page, the screen width as well as, where applicable, clicks on links and selected buttons; from the connection data, Plausible derives the browser, operating system, device type and the approximate location (country, region, city). The location is determined from the IP address; the IP address itself is not stored. Nothing is stored on your device. To distinguish between visitors, Plausible generates from the IP address and browser information an identifier that cannot be reversed and that is discarded after 24 hours.

Legal basis: legitimate interest in a data-minimising measurement of reach (Art. 6(1)(f) GDPR). We do not obtain consent because nothing is stored on your device and no usage profile is created. You can object (Section 7). Plausible is our processor; processing takes place exclusively in the EU.

4.2 Email, support form and reports

If you send us an email, use the support form (www.jobahoi.com/support) or report content (www.jobahoi.com/report), we process your name, your email address, your message and, where applicable, the category selected in order to deal with your enquiry. Forms are received by Netlify (Section 3.1), which forwards them to us by email; for spam protection, Netlify checks submissions with the Akismet service of Automattic Inc., USA, as a sub-processor of Netlify; the basis for the transfer is Netlify's agreements (Data Privacy Framework or standard contractual clauses). We process enquiries and reports in the Zoho Desk help desk of Zoho Corporation B.V., Utrecht, Netherlands, as processor; the data is held in data centres in the EU. For technical support, employees of Zoho Corporation Private Limited, India, may access it in individual cases; the basis is the standard contractual clauses. Our mailboxes are operated by IONOS SE, Montabaur, as processor in the EU.

Legal basis: if your enquiry concerns an account or a contract, Art. 6(1)(b) GDPR, otherwise our legitimate interest in answering it and in protection against spam (point (f)); for notices of illegal content, additionally our obligations under the Digital Services Act (point (c)).

Storage period: until your enquiry has been dealt with, unless there is a retention obligation. We retain notices under the Digital Services Act and our decision on them for six months after completion so that we can prove the decision and examine objections.

4.3 Our presences on social networks

AHOIRA and JobAhoi are present on Facebook, Instagram and LinkedIn. If you visit these presences, the respective operator processes your data under its own responsibility, also in the USA. For the page statistics ("Insights"), we are jointly responsible with the operator (Art. 26 GDPR): Meta Platforms Ireland Limited for Facebook and Instagram, LinkedIn Ireland Unlimited Company for LinkedIn. We only receive aggregated statistics without reference to individual persons. The legal basis is our legitimate interest in evaluating our presences (Art. 6(1)(f) GDPR). The agreements: facebook.com/legal/terms/page_controller_addendum and legal.linkedin.com/pages-joint-controller-addendum. You can exercise your rights with the operator or with us. We treat messages that you send us there like emails (Section 4.2).

5. Use of JobAhoi

5.1 Account and login

For your account, we process your email address, your preferred language and your first name. You log in without a password, with a link or a one-time code by email. To keep you logged in, a login key is stored on your device; this is strictly necessary (§ 25(2) no. 2 TDDDG). For each login session, we store the IP address and the identifier of your device or browser in order to detect misuse.

Legal basis: contract (Art. 6(1)(b) GDPR), for the session data our legitimate interest in the security of accounts (point (f)). Storage period: account data until your account is deleted (Section 5.12), session data for the duration of the session.

5.2 Crew profile and saved list

As a crew member, you can create a profile, for example with contact details, date of birth, gender, nationalities, residential address, profile picture, position and professional background, navigation areas, vessel types, licences and qualifications, language skills, availability and salary expectations. We do not ask for special categories of data under Art. 9 GDPR, such as health data. A profile picture may allow conclusions to be drawn about, for example, origin or religion; please only upload a picture that employers may see. Employers and other users cannot see your profile; employers only receive information from it with an application (Section 5.3). If you save job advertisements, gauges, locks or ports, we store this in your account.

Legal basis: contract (Art. 6(1)(b) GDPR). Storage period: until you remove the information or delete your account.

5.3 Applications

When you tap "Apply", we create a PDF from your profile and transmit the application to the company that published the job advertisement. It finds the application in its JobAhoi application inbox and receives an email with a link to the PDF; you receive a confirmation with the same link. The link works for 180 days without login; therefore, do not pass it on.

Always included are your name, email address, residential address, nationalities, your qualifications, experience, vessel types and navigation areas, where provided, as well as the result of AhoiCheck (Section 5.4). Gender, telephone number, professional background and availability are preselected for inclusion, profile picture, date of birth and salary expectations are not; before submitting, you can select or deselect each of these items. Gender is preselected because it is often of importance for salutation and accommodation on board, for example the allocation of cabins. The employer does not receive deselected information.

Legal basis: contract (Art. 6(1)(b) GDPR), at your initiative. Upon receipt, the employer is itself the controller of your application data; you can exercise your rights against the employer directly with them.

Employers outside the EU or the EEA: We transfer your application there because you initiate this with your click (Art. 49(1)(b) GDPR). An adequacy decision of the EU does not exist for every country; it does exist, for example, for Switzerland and the United Kingdom, but not for Serbia or Ukraine; there, equivalent protection is not guaranteed. You can see the employer's country in the job advertisement.

Storage period with us: six months from submission, at most until your account is deleted, so that we can prove the transmission (Art. 6(1)(f) GDPR). We then anonymise the application and delete the PDF; the link will then no longer work.

5.4 AhoiCheck

AhoiCheck compares your profile with the requirements of a job advertisement, such as licences, qualifications, vessel types, navigation areas or salary. For each requirement, it shows whether your profile meets it, and counts those that are met. It shows neither you nor the employer an overall score, does not take any decision and does not influence the order of job advertisements. You see the result before you apply; in the application PDF, the employer also sees it, without requirements relating to deselected information. A human at the employer decides on your application. If you consider a result to be wrong, write to us; we will look into it.

Legal basis: contract (Art. 6(1)(b) GDPR). Storage period: together with the application (Section 5.3); without an application, the result is only calculated for display.

5.5 Employer account and job advertisements

For employers, we process the company name, company size, logo, address, website, name, position and telephone number of the contact person as well as the email address for applications. We receive the information on contact persons from the employer. The company name, logo and application address are visible in the job advertisements; expired advertisements remain in the employer's archive.

Legal basis: contract (Art. 6(1)(b) GDPR), where the employer is a natural person; for contact persons and employees of the employer, our legitimate interest in performing the contract (point (f)). Storage period: until the account is deleted; for billing data, see Section 5.6.

5.6 Payment and invoices (Stripe)

Employers pay for job advertisements via Stripe. For this purpose, we transmit the name or company name, the telephone number of the contact person, the email address for invoices, the billing address, preferred language, where applicable the VAT identification number and an internal account identifier. You enter your payment details directly on Stripe's payment page; we only receive the invoice and the payment status.

Legal basis: contract and statutory obligations regarding invoicing and retention (Art. 6(1)(b) and (c) GDPR). Our contractual partner is Stripe Payments Europe, Limited, Dublin, Ireland, for payment processing as our processor; for its own purposes such as fraud and money laundering prevention and for the data on its payment page, Stripe is itself the controller (stripe.com/de/privacy). Stripe transfers data to Stripe, LLC, USA, on the basis of the Data Privacy Framework, alternatively the standard contractual clauses.

Storage period: see Section 2.4. If an account is deleted, we separate the billing address, Stripe customer number and orders from the account, restrict their processing and use them only for our retention obligations (§ 147 AO, Art. 17(3)(b) and Art. 18 GDPR). Ten years after the end of the year of deletion, we erase them automatically.

5.7 Translation of job advertisements

We send employers' own job titles and descriptions for translation into the languages of JobAhoi to the translation service DeepL of DeepL SE, Cologne. These texts must not contain any personal data, such as names or contact details of contact persons; there are separate fields for this which are not translated (Terms and Conditions § 12 paragraph 5).

Legal basis: contract with the employer (Art. 6(1)(b) GDPR). Storage period with us: together with the advertisement.

5.8 Emails and newsletter

We send emails via Postmark for login and changes of email address, regarding applications, the conclusion of contracts, withdrawal and account deletion. Your email address and the information required for the respective email, such as name, advertisement title or company name, are processed. Postmark is operated by AC PM LLC, Chicago, USA, as processor; transfer to the USA on the basis of the Data Privacy Framework, alternatively the standard contractual clauses.

Legal basis: contract (Art. 6(1)(b) GDPR). Storage period at Postmark: 45 days; delivery failures and spam complaints without time limit so that nothing more is sent to these addresses.

Newsletter: If you have given your consent, we send you news about JobAhoi to your email address, in the language you have selected. We use an email service provider as processor for sending it. Legal basis: consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time by email to info@ahoira.com or, as a crew member, in your account. Storage period: until you withdraw your consent; we keep the record of your consent in accordance with Section 5.12.

5.9 Location

If you wish, JobAhoi shows gauges, locks and ports near you. For this we ask for your consent beforehand; in addition, your operating system asks for permission. As long as you have given consent, we store your most recently determined location with the time in your account and update it when you open the app. We do not store a history, and nobody except you can see your location.

Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time in the app settings; we then delete the stored location.

5.10 Maps (OpenFreeMap)

JobAhoi loads map tiles, fonts and symbols from OpenFreeMap, a service of Hyperknot Software Kft., Hungary, delivered via Cloudflare, Inc., USA (certified under the Data Privacy Framework). In the process, the operator receives your IP address, information about your device and the map section displayed. We are responsible for this transmission, the operator itself for the further processing (openfreemap.org/privacy).

Legal basis: legitimate interest in a functional map display without our own map servers (Art. 6(1)(f) GDPR).

5.11 Error reports (Sentry)

In the event of crashes and errors, JobAhoi sends reports to Sentry, operated by Functional Software, Inc., San Francisco, USA, as processor. The reports contain the error message, device, operating system, app version and the most recently accessed areas of the app, in individual cases also parts of entered data; we also measure loading times. They are not assigned to any account; we do not store IP addresses. We remove a random installation identifier of the error module on your device from the reports; only reports on crashes in the system-level part of the app may still contain it. The reports are stored in Frankfurt am Main, data relating to our team's account in the USA (Data Privacy Framework, alternatively the standard contractual clauses).

Legal basis: legitimate interest in a stable and secure app (Art. 6(1)(f) GDPR); storing the identifier on the device is strictly necessary for this (§ 25(2) no. 2 TDDDG). Storage period: 30 days.

5.12 Deletion of your account, records and logs

You can delete your account in the app or request deletion without the app at app.jobahoi.com/delete-account; you confirm the request via a link to your email address. To protect this form against misuse, we store pseudonymised check values for one day (Art. 6(1)(f) GDPR). After 30 days, during which you can revoke the deletion, we block the account, end active job advertisements and erase or anonymise your information. Only anonymous statistics, employers' job advertisements in the archive without a contact address, for employers the restricted billing data (Section 5.6) as well as the following records are kept:

We store as proof when you took note of which version of this privacy policy and agreed to the Terms and Conditions and which consents you have given (Art. 6(1)(b), (c) and (f), Art. 7(1) GDPR). We log important events in your account, such as a deletion request or a data export, for traceability and security (point (f)). After a deletion, only the type and time remain; we erase them at the end of the third year after the year of deletion. We retain the proof of a contract withdrawal until the end of the third year after its receipt.

6. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20) as well as the right to withdraw consent at any time with effect for the future (Art. 7(3)). To do so, write to info@ahoira.com; as a crew member, you can also retrieve a copy of your data in the app settings.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is the Bayerisches Landesamt für Datenschutzaufsicht (www.lda.bayern.de).

7. Your right to object under Art. 21 GDPR

Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal email to info@ahoira.com is sufficient.