Privacy Policy for the Expert Portal

1. Controller

decon international GmbH Berner Straße 71 60437 Frankfurt am Main Germany Email: info@decon.de

2. Data protection officer

You can reach our data protection officer at datenschutz@decon.de or by post at the address above, marked “Data Protection Officer”.

3. What the expert portal is for

DECON keeps a database of experts who may be considered for consulting projects and tenders. In the expert portal you see and maintain your profile in this database and upload your CV. Changes go into your profile only after DECON has approved them.

The portal is operated on behalf of DECON by Traeno GmbH.

4. What data we process

• Sign-in data: your email address, the one-time code we send you to sign in (only a check value is stored, not the code itself), and the time of your last sign-in.
• Profile data: name, contact details and the information in your profile, in particular professional experience, projects, education, language skills, areas of expertise, and country and regional experience.
• CVs: the files you upload and the information read from them.
• Consent: whether and when you gave or revoked your consent, with a record of it. As proof we store the time at which you requested the sign-in code and the notice shown with it.
• Technical data: when you open the portal, the server processes your IP address, date and time, the page requested and information about your browser.

5. Purposes and legal bases

• Keeping your profile in the expert database, assessing your suitability for projects and tenders, naming you in proposals and contacting you: on the basis of your consent (Art. 6(1)(a) GDPR). You give it by requesting the sign-in code; it takes effect when you sign in with the code.
• If your documents contain special categories of personal data, such as information about your health or religious beliefs, we process them only on the basis of your explicit consent (Art. 9(2)(a) GDPR). Please include such information only if it is necessary for your profile.
• Preparing and performing a contract with you, for example when we engage you for a project: Art. 6(1)(b) GDPR.
• Signing in and operating the portal securely, preventing misuse and analysing errors: on the basis of our legitimate interest in a secure and working portal (Art. 6(1)(f) GDPR).
• Proving your consent and its revocation: to meet our obligation to demonstrate consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

6. Analysis of CVs

When you upload a CV, a software service reads it with the help of an AI language model and proposes entries for your profile. You see these proposals in the portal and decide which should be adopted. A DECON employee reviews your selection before it goes into your profile.

No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place.

7. Recipients

• Traeno GmbH develops and operates the portal and the expert database as our processor (Art. 28 GDPR).
• Other technical service providers, for example for hosting, sending email and analysing CVs, process data only on our behalf, on our instructions and under a contract pursuant to Art. 28 GDPR.
• Clients and project partners, such as public contracting authorities, development banks, international organisations and consortium partners, receive your profile only in connection with specific proposals or projects for which you are being considered.

Beyond this, we pass on your data only where we are legally obliged to do so.

8. Transfers to third countries

Our service providers process data in the European Union or the European Economic Area. Where processing takes place outside it, this happens only on the basis of an adequacy decision of the European Commission (Art. 45 GDPR) or appropriate safeguards such as the EU standard contractual clauses (Art. 46(2)(c) GDPR).

If you are being considered for a project outside the EU, your profile may be transferred to a client in that country. This happens on the basis of your consent (Art. 49(1)(a) GDPR) or because it is necessary for a contract with you (Art. 49(1)(b) GDPR). The level of data protection in such countries may be lower than in the EU, and it may be harder to enforce your rights there.

9. How long we keep data

• We keep your profile and CVs for as long as your consent is in place. A consent is valid for three years; after that we ask you to renew it the next time you sign in. If you revoke your consent or do not renew it, we delete your data unless we need it for a contract with you, to meet statutory retention obligations (for example up to ten years under Section 257 of the German Commercial Code and Section 147 of the German Fiscal Code) or to defend legal claims.
• The one-time sign-in code is valid for 15 minutes and is deleted when you sign in.
• We keep the record of your consent and its revocation for as long as we need it as proof, as a rule until the statutory limitation period has expired.
• We delete server logs as soon as they are no longer needed for the security of the portal.

10. Cookies

The portal sets only cookies that are technically necessary for it to work; under Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) these do not require consent. We do not use analytics, tracking or advertising cookies.

• portal_session: keeps you signed in. The cookie is signed, cannot be read by scripts in the browser, and expires after eight hours or when you sign out.
• locale: remembers the language you chose, for one year.

11. Obligation to provide data

Providing your data is voluntary. Without an email address you cannot sign in, and without your consent you cannot use the portal or be included in our expert database.

12. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• have incorrect data rectified (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR).

You can revoke your consent at any time with effect for the future (Art. 7(3) GDPR), in the portal under “Privacy” or by email to datenschutz@decon.de. This does not affect the lawfulness of processing before the revocation.

To exercise your rights, please use the contact details above.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

13. Security

The connection to the portal is encrypted. We store sign-in codes only as a check value, and only the people who need it for the purposes above have access to your data.

14. Changes

We update this privacy policy when the portal or the legal requirements change. The version published here applies.