Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

SUNNY HR Services GmbH
Carl Reuther Straße 1
D-68305 Mannheim-Waldhof, Germany
Phone: +49 (0) 621 72966395
Email: info@sunny-hr.de

Further details can be found in our Legal Notice.

2. Your Rights as a Data Subject

You have the right, at any time and free of charge, to request information about your stored personal data, its origin and recipients, and the purpose of the data processing (Art. 15 GDPR), as well as a right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). You also have the right to object to the processing of your personal data under certain conditions (Art. 21 GDPR).

For these matters and any further questions about data protection, you can contact us at any time via the email address above. You also have the right to lodge a complaint with the competent supervisory authority — for our registered office in Baden-Württemberg, this is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Königstraße 10a, 70173 Stuttgart, Germany

3. Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner. Details on data protection at Hetzner can be found at hetzner.com/en/legal/privacy-policy.

4. Contact Form

If you contact us via the form on this page, we collect the following data: your name, your chosen contact method(s) (WhatsApp, phone call and/or email — multiple selections possible), a phone number and/or email address depending on the contact method chosen, your current role, your qualification-recognition status, your German language level, and, optionally, when you are best reached and a free-text message. We additionally store the time of your request and the exact wording of your consent at the time it was given.

Purpose: to get in touch with you regarding your free, non-binding first conversation.

Legal basis: Art. 6(1)(b) GDPR (handling your request) as well as your consent under Art. 6(1)(a) GDPR, which you give by ticking the checkbox in the form.

Recipients and storage: Your details are stored on our server and forwarded by email to an internal inbox of our team; if you provided an email address, you also receive a brief confirmation of receipt. Your data is currently not passed on to an external CRM system. To be added once a CRM is connected (name, location, data processing agreement).

Retention period: No automated deletion period is currently in place for request data. You may request deletion of your data at any time (see section 2).

5. Sending Emails

We send the notification and confirmation emails generated by the contact form via an existing SMTP email mailbox with united-domains AG, Germany (our domain/hosting registrar, see united-domains.de). Confirmation of a valid data processing agreement (Art. 28 GDPR) is still outstanding as of publication.

6. WhatsApp Contact

Several places on this page offer you the option to message us directly via WhatsApp. These buttons open WhatsApp with a pre-filled message addressed to our phone number — every WhatsApp button also states this for assistive technology. Only once you actually send the message in WhatsApp do your phone number and the message text become visible to the WhatsApp provider, WhatsApp Ireland Limited (a subsidiary of Meta Platforms, Inc.). This transmission takes place outside our website and is subject to WhatsApp's/Meta's own privacy terms, available at whatsapp.com/legal/privacy-policy.

7. Cookies

Without your consent, this website does not set any cookies for analytics, marketing, or tracking purposes, and does not embed any corresponding third-party scripts. Exactly one technically necessary cookie is set:

This cookie is only set if you actively click the accessibility toggle, and serves solely the function you requested (§ 25(2) TTDSG, the German telecommunications data protection act) — no separate consent is required for it.

For marketing cookies that are only set with your consent (Meta Pixel), see section 8.

8. Analytics Tools and Advertising

On our server, we exclusively record anonymous, non-personal event counters (e.g. which button was clicked), without cookies or the ability to recognise individual visitors.

In addition, as part of paid campaigns, we use the Meta Pixel (Meta Platforms Ireland Limited / Meta Platforms, Inc.) — but only if you actively consent via the cookie banner. This banner appears once you first interact with the page (e.g. by scrolling or clicking), not immediately on page load. For this banner, we use the "Silktide Consent Manager", open-source software that we host ourselves (the banner itself makes no calls to third-party servers). Without your consent, no Meta script is loaded and no Meta cookie is set; if you decline or make no selection, the page behaves exactly as it would without the Meta Pixel.

Purpose: to measure how effectively paid ads (e.g. on Facebook/Instagram) lead to visits to this page, and to optimise those ads.

Legal basis: your consent via the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TTDSG). The "Accept" and "Reject" buttons are presented with equal visual weight — declining is exactly as easy as consenting. You can withdraw your consent at any time with effect for the future, via the "Cookie settings" link in this page's footer or via the small round icon in the bottom-right corner of the screen (appears once you have made a choice).

What happens technically: once you consent, the Meta Pixel sets the _fbp cookie and, where applicable, _fbc, and transmits technical information about your visit (e.g. the page visited, the time, browser and device information, a pseudonymous identifier) to Meta. Meta processes some of this data in the United States. Details on how Meta processes this data and the safeguards in place for transfers to the US can be found in Meta's data policy at facebook.com/privacy/policy.

Withdrawal: click "Cookie settings" in the footer (or the small round icon in the bottom-right corner) and select "Reject" — future visits will then no longer be transmitted to Meta, and we actively delete the Meta cookies we set from your browser. We do not store your choice itself as a cookie, but in your browser's local storage — this entry is read exclusively by this site and is never transmitted anywhere.

No Google Analytics, no TikTok Pixel, and no other analytics or advertising tools are currently in use. Should this change, we will update this section accordingly.

9. Fonts

We use Google Fonts (Inter, Outfit), which are embedded locally when the website is built. When you visit this page, no connection is made to Google's servers and no IP address is transmitted to Google.

10. SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content — such as requests you send to us as the site operator — this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser's address bar changing from "http://" to "https://" and by the lock symbol in your browser's address bar.

11. Changes to This Privacy Policy

We will update this privacy policy as soon as the data processing activities described above change — for example, once a hosting provider, CRM system, or analytics tool is added. The version of this page current at the time of your visit applies.