Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

SUNNY HR Services GmbH
Carl Reuther Straße 1
D-68305 Mannheim-Waldhof, Germany
Phone: +49 (0) 621 72966395
Email: info@sunny-hr.com

Further details can be found in our Legal Notice.

2. Your Rights as a Data Subject

You have the right, at any time and free of charge, to request information about your stored personal data, its origin and recipients, and the purpose of the data processing (Art. 15 GDPR), as well as a right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). You also have the right to object to the processing of your personal data under certain conditions (Art. 21 GDPR).

For these matters and any further questions about data protection, you can contact us at any time via the email address above. You also have the right to lodge a complaint with the competent supervisory authority — for our registered office in Baden-Württemberg, this is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Königstraße 10a, 70173 Stuttgart, Germany

3. Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner. Details on data protection at Hetzner can be found at hetzner.com/en/legal/privacy-policy.

4. Contact Form

If you contact us via the form on this page, we collect the following data: your name, your chosen contact method(s) (WhatsApp, phone call and/or email — multiple selections possible), a phone number and/or email address depending on the contact method chosen, your current role, your qualification-recognition status, your German language level, and, optionally, when you are best reached and a free-text message. We additionally store the time of your request and the exact wording of your consent at the time it was given.

Purpose:to get in touch with you regarding your free, non-binding first conversation.

Legal basis:Art. 6(1)(b) GDPR (handling your request) as well as your consent under Art. 6(1)(a) GDPR, which you give by ticking the checkbox in the form.

Recipients and storage:Your details are stored on our server and forwarded by email to an internal inbox of our team; if you provided an email address, you also receive a brief confirmation of receipt. Your data is currently not passed on to an external CRM system. To be added once a CRM is connected (name, location, data processing agreement).

Retention period:Enquiry data is automatically deleted from technical storage on the server six months after receipt. Where an enquiry leads to an ongoing placement process, the data needed for it stays stored within that business context for as long as the process runs, plus any statutory retention periods under commercial and tax law that apply. The six-month period follows the same benchmark used for applicant data: two months to assert a claim under § 15(4) AGG, plus three months to file suit under § 61b(1) ArbGG, plus a safety margin. You may request deletion of your data at any time (see section 2).

Protection against automated form abuse:to stop automated programs (bots) from misusing the form, we check every submission server-side with two technical measures that are not visible to you: an additional form field that is hidden from human visitors and should therefore always stay empty, and a server-side plausibility check on the time between the form loading and being submitted. Submissions that fail either check are discarded without storing or further processing any data collected from them — you see the same confirmation as for a genuine submission in that case, so that a bot cannot tell which check it tripped. Legal basis:legitimate interest (Art. 6(1)(f) GDPR) in a functioning contact form that is not abused.

5. Sending Emails

We send the notification and confirmation emails generated by the contact form (see section 4) via an existing SMTP email mailbox with united-domains AG, Germany (our domain/hosting registrar, see united-domains.de), technically routed through their mail server smtps.udag.de.

Purpose:delivery of the internal team notification and of the confirmation email to applicants described in section 4 — united-domains AG provides purely the technical delivery and does not itself evaluate the content of your request.

Legal basis:the same as for the contact request itself (section 4) — Art. 6(1)(b) GDPR, or your consent under Art. 6(1)(a) GDPR.

Recipient:united-domains AG as a processor for the technical email delivery. Confirmation of a valid data processing agreement (Art. 28 GDPR) is still outstanding as of publication.

6. WhatsApp Contact

Several places on this page offer you the option to message us directly via WhatsApp. These buttons open WhatsApp with a pre-filled message addressed to our phone number — every WhatsApp button also states this for assistive technology. Only once you actually send the message in WhatsApp do your phone number and the message text become visible to the WhatsApp provider, WhatsApp Ireland Limited (a subsidiary of Meta Platforms, Inc.). This transmission takes place outside our website and is subject to WhatsApp's/Meta's own privacy terms, available at whatsapp.com/legal/privacy-policy.

7. Cookies

Without your consent, this website does not set any cookies for analytics, marketing, or tracking purposes, and does not embed any corresponding third-party scripts. Exactly one technically necessary cookie is set:

This cookie is only set if you actively click the accessibility toggle, and serves solely the function you requested (§ 25(2) TTDSG, the German telecommunications data protection act) — no separate consent is required for it.

For marketing cookies that are only set with your consent (Meta Pixel), see section 8.

8. Analytics Tools and Advertising

For cookieless traffic measurement, we use Umami, an open-source analytics tool. The analytics script is loaded from our instance at sunnyanalytics.sunny-hr.de. Umami processes page views and events as well as technical information such as the URL including query parameters, referrer, browser, operating system, device type, screen size, language, and the country derived from the IP address. For a session, Umami creates a unique identifier as a hash using, among other things, the IP address, user agent, and website ID; according to the Umami documentation, the IP address itself is not stored in plain text in the analytics data. In this integration, Umami sets no cookiesand loads regardless of your cookie-banner choice.

Purpose:understanding which pages and actions on this website are actually used, so we can keep improving it.

Legal basis:legitimate interest (Art. 6(1)(f) GDPR) in privacy-friendly, cookieless usage analysis without profiling.

In addition, as part of paid campaigns, we use the Meta Pixel (Meta Platforms Ireland Limited / Meta Platforms, Inc.) — but only if you actively consent via the cookie banner. The banner is shown after its locally hosted program and style files have loaded; no prior interaction with the page is required. For this banner, we use the "Silktide Consent Manager", open-source software that we host ourselves (the banner itself makes no calls to third-party servers). Without your consent, no Meta script is loaded and no Meta cookie is set; if you decline or make no selection, the page behaves exactly as it would without the Meta Pixel.

Purpose:to measure how effectively paid ads (e.g. on Facebook/Instagram) lead to visits to this page, and to optimise those ads.

Legal basis:your consent via the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TTDSG). The "Accept" and "Reject" buttons are presented with equal visual weight — declining is exactly as easy as consenting. You can withdraw your consent at any time with effect for the future, via the "Cookie settings" link in this page's footer or via the small round icon in the bottom-right corner of the screen (appears once you have made a choice).

What happens technically:once you consent, the Meta Pixel sets the _fbpcookie and, where applicable, _fbc, and transmits technical information about your visit (e.g. the page visited, the time, browser and device information, a pseudonymous identifier) to Meta Platforms Ireland Ltd., based in Dublin, Ireland — this data is partly transferred to, and processed in, the United States. Meta states that it relies on the EU-US Data Privacy Framework and/or on EU Standard Contractual Clauses (Art. 46 GDPR) as a safeguard for an adequate level of data protection for this transfer. Details on how Meta processes this data and the safeguards in place for transfers to the US can be found in Meta's data policy at facebook.com/privacy/policy.

Withdrawal:click "Cookie settings" in the footer (or the small round icon in the bottom-right corner) and select "Reject" — future visits will then no longer be transmitted to Meta, and we actively delete the Meta cookies we set from your browser. We do not store your choice itself as a cookie, but in the local-storage entries stcm.consent.meta (your consent or rejection for Meta) and stcm.hasConsented (whether a choice has already been made) in your browser. These entries have no automatic expiry and remain stored until you reset or change your choice through the cookie settings or clear the website data in your browser. They are read exclusively by this site and are not transmitted to us.

Beyond the tools described above (Umami, Meta Pixel), no Google Analytics, no TikTok Pixel, and no other analytics or advertising tools are currently in use. Should this change, we will update this section accordingly.

9. Fonts

We use Google Fonts (Inter, Outfit), which are embedded locally when the website is built. When you visit this page, no connection is made to Google's servers and no IP address is transmitted to Google.

10. SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content — such as requests you send to us as the site operator — this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser's address bar changing from "http://" to "https://" and by the lock symbol in your browser's address bar.

11. Changes to This Privacy Policy

We will update this privacy policy as soon as the data processing activities described above change — for example, once a hosting provider, CRM system, or analytics tool is added. The version of this page current at the time of your visit applies.