Privacy policy
This is a translation for your convenience. The German version is the binding one. Read the German version
Last updated: 22 October 2026
1. Controller and contact
The controller responsible for processing your personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Husam Noaman, Sole proprietorship
Heinrich-Heine-Ring 132a, 76199 Karlsruhe, Germany
Email: husam.noaman@husamsieg.com
We have not appointed a data protection officer. For questions about data protection you can reach us at the email address above.
2. Which part applies to whom
This text is organised by the people who give us data. Read the part that fits you, and sections 3 and 10 to 15, which apply to everyone.
- Visitors to the website: section 4.
- Job seekers (quiz, application, talent pool): section 5.
- Companies and other employers: section 6.
- Customers of consultation appointments: section 7.
- Members of the Heroes community: section 8.
- Anyone who writes to us or calls us: section 9.
3. General
3.1 Legal bases
We process personal data only where a legal basis exists: your consent (Art. 6(1)(a) GDPR), performance of a contract or pre-contractual steps at your request (Art. 6(1)(b) GDPR), a legal obligation, for example to keep accounting records (Art. 6(1)(c) GDPR), or our legitimate interest, for example in operating the website securely (Art. 6(1)(f) GDPR). Where you consent to processing, you can withdraw your consent at any time with effect for the future. Processing up to the withdrawal remains lawful.
3.2 Who can see your data
The data from forms, applications, bookings and member accounts is seen by Husam Noaman and by the people to whom he has expressly given rights in our protected administration area, each only for their own area of work. For operation and maintenance of the website, Technical service provider also has technical access to the administration area. Technical service provider processes the data only on our behalf and on our instructions (Art. 28 GDPR). Access to the administration area is protected by a password and a second factor.
3.3 Obligation to provide data, no automated decisions
We mark in the forms which details are mandatory. Without the mandatory details we cannot provide the respective service. We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. The result of the quiz is a suggestion based on fixed rules, calculated in your browser; after that, a person decides. The search in the talent pool by profession and German level is a filter, not an assessment procedure.
4. Visitors to the website
4.1 Hosting and server logs
The website is operated by Vercel Inc. (USA); the server functions run in Frankfurt am Main. When you open a page, Vercel processes your IP address and technical details of the request (for example the page requested, time, browser details) to deliver the page and operate it securely. This is our legitimate interest (Art. 6(1)(f) GDPR). Vercel is our processor. How long these logs are kept is decided by Vercel; the provider names no fixed period.
The database with the data described below is hosted by Neon, Inc. in Frankfurt am Main. Neon is also our processor.
4.2 Cookies, local storage and your choice
On your first visit a notice asks whether you allow optional functions. With "Essential only", nothing optional is loaded. With "Accept" you allow (1) our own visit measurement and (2) external content, namely YouTube videos. You can change or withdraw your choice at any time via "Cookie settings" in the footer. The legal basis for everything optional is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Your choice is stored only in your browser.
The website places these entries in your browser:
| Name | Type | When set | Purpose | Duration |
|---|---|---|---|---|
| hs-consent | Local storage | when you make a choice in the notice | remember your choice (visit measurement, external content) | until you delete it |
| hs-lang | Cookie | when you choose the language (language switch) | remember the language | one year |
| hs-audience | Cookie and local storage | when you choose your side on the home page (job seekers or employers) or open the page for job seekers or for employers | remember the side you chose | 400 days, renewed at each visit |
| hs-theme | Local storage | when you switch between light and dark | remember the appearance | until you delete it |
| hs-notrack | Local storage | when you choose "Stop measuring my visits" | remember your refusal | until you delete it |
| Campaign tags | Session storage | only with your consent to measurement | keep the tag of a link for the length of the visit | until you close the tab |
Storing your choice and the settings you pick yourself (language, appearance, chosen side) is strictly necessary for the service you asked for to work and, under § 25(2) no. 2 TDDDG, needs no consent. For signed-in members and the team the website also sets sign-in cookies (section 8); they exist only for signing in.
4.3 Visit measurement
Only if you choose "Accept" do we measure visits with a small tool of our own. It sets no cookies and sends nothing to advertising or analytics companies. The data is kept in our database. Without your consent the tool does not start and nothing is sent. If your browser sends "Do Not Track" or "Global Privacy Control", we do not measure, even if you have accepted.
For each visit we record: the pages viewed and their order, the page you came from, the time spent on each page, the scroll depth, whether you changed the language, whether you clicked a link to email, telephone, calendar or a profile on a social network or started a video, and that a step in the booking calendar took place (never what you entered). Added to this are your approximate location (country, region, city and a map position rounded to about 10 km, derived from the IP address) and device type, browser, operating system and language.
We do not store your IP address for this. To tell which page views belong to one visit, we form a one-way code from the IP address and browser details that changes every day and can neither be reversed nor linked from one day to the next. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We delete visit data automatically after 180 days.
4.4 Campaign tags and personal links
Links from our Instagram page, from videos or messages can contain tags such as "utm_source=instagram" or a personal code ("?v="). A personal link is created for a specific person and is stored in the administration area under the name we gave the link (this can be the name of the person it was made for). With your consent to measurement we keep the tag for the length of your visit and record which tagged link was opened and which pages were viewed. If you send us a request, we store the tag of the link you came through with the request so that we know where you found us. Without your consent to measurement we read the tags only from the address of the page you are on and only when you send a request. The legal basis is your consent or, for the request, our legitimate interest in evaluating our channels (Art. 6(1)(f) GDPR).
4.5 YouTube videos
Videos load only after you have clicked play and allowed external content, in YouTube's extended privacy mode (Google). Until then nothing is requested from YouTube; the preview picture is on this website. After you agree, YouTube can process your IP address and set cookies. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google may transfer data to the USA (section 11).
4.6 Fonts, blog and links to other sites
The fonts and pictures of this website are delivered by the website itself; nothing is loaded from a font provider. The blog displays articles and has no comment function. Links to Instagram, Facebook, YouTube, WhatsApp, Telegram and other sites are ordinary links: nothing is loaded from there until you click, and afterwards the provider's own privacy notices apply.
5. Job seekers
The quiz, the application and the talent pool are free of charge for job seekers, and we do not charge them any fee for placement. Consultations (section 7) and the Heroes community (section 8) are separate paid offers.
5.1 Quiz and forms
The quiz runs entirely in your browser. Your answers and the result are not sent to us and not stored; we do not ask for your name or your email address there. If you have agreed to measuring (section 4.3), we count, without your name, that the quiz was started and finished. After the result you can book a consultation (section 7), send your application (section 5.2) or join the Heroes group (section 8); the rules of those sections apply to these steps. Earlier quiz requests that arrived through a form that has since been removed are deleted after 12 months at the latest.
To protect against abuse, the forms contain a hidden field and a timing check; a short-lived code from your network address limits how often a form can be sent. This code cannot be converted back into your IP address (legitimate interest, Art. 6(1)(f) GDPR). When a new request arrives, we notify the team by Telegram and email with the key details of the request (section 10).
5.2 Application with CV (talent pool)
When you apply through the application form, we store your entries and files: name, email address, telephone number (optional), country and place of residence, nationality and residence status (optional), profession, work experience, education, language skills, availability, a short text about you and your files (CV, certificates and diplomas). The files are kept in private storage at Vercel (Vercel Blob). Please do not include details about religion, health or marital status or any ID or passport numbers in your documents; we do not ask for them.
We review your application and, if it is accepted, add you to our talent pool so that we can suggest you to German companies. For this we keep internal notes, processing statuses, follow-up dates and lists, and filter the talent pool by keyword and German level when a company asks for a position. A person decides. The legal basis is your consent (Art. 6(1)(a) GDPR, § 298(1) SGB III), which you give before sending by a separate checkbox. You can withdraw it at any time with the link in your confirmation email.
We first confirm your email address. We delete unconfirmed applications after 48 hours. If we have to block someone for abuse, we store only a salted hash of the email address so that this person cannot apply again (legitimate interest, Art. 6(1)(f) GDPR).
5.3 Passing your profile to companies
We pass your application or profile to a company only if you have separately and expressly consented, in each case for the named company. This consent is independent of the consent to storage and can be withdrawn at any time. The company may use your data only for the selection procedure for which it was passed on (§ 298(1) sentence 3 SGB III) and is itself responsible for it within the meaning of the GDPR. An employment contract is concluded solely between you and the company. We ask you before passing anything on, for example by email.
5.4 Special categories of personal data
CVs and other documents can contain details that belong to special categories (for example about origin, religion or health). We do not ask for such details. If you send them voluntarily, we process them only on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give separately in the application form.
5.5 Information before an employment contract with a company
Before you conclude an employment contract with a company we placed you with, we inform you in writing in a language you understand about employer, start, place of work, duties, working time, pay, leave, notice periods, applicable collective agreements and advice centres (§ 299 SGB III).
5.6 Retention and return
Documents you provided to us we return without delay after the placement activity has ended, or delete them. Other business records on placement we keep for three years after completion and delete them afterwards (§ 298(2) SGB III). Applications we keep (new or in the talent pool) we delete 12 months after receipt or after our last confirmation that they are still current, unless you delete them or withdraw earlier. After your deletion or ours, copies remain for a short time in the provider's backups. Removed applications sit for 3 days in a recycle bin before they are deleted for good. With the link in our emails you can view, download, correct or delete your application at any time; deletion takes effect immediately.
6. Companies and other employers
6.1 Request form
When you send a request as a company, we store: company, contact person, email address, telephone number, the position sought, place of work, number of people, start date, German level, your message, the language of the page, the time of your consent and the campaign tags from section 4.4. We use the details to answer your request and prepare suitable candidates. The legal basis is pre-contractual steps at your request (Art. 6(1)(b) GDPR) and our legitimate interest in initiating business (Art. 6(1)(f) GDPR). We delete the request after 12 months at the latest if no contract is concluded.
6.2 Applicant data you receive from us
When we give you data of applicants, this happens only with their consent (section 5.3). You are then yourself responsible for the further processing. You may use the data only for the selection procedure, may not pass it to third parties and must delete it when the procedure has ended or the person withdraws consent.
6.3 Contract and invoice
For contracts, invoices and payments we process the company's name and address, contact person, email address, where applicable VAT ID, and service and payment data (Art. 6(1)(b) and (c) GDPR). We keep accounting vouchers for eight years, books and annual accounts for ten years and other tax-relevant documents for six years (§ 147(3) AO).
7. Consultation appointments
For a booking we store: name, email address, telephone number (optional), country (optional), whether you are in Iraq or abroad, your message (optional), the language of the page, your time zone, the appointment, the payment status, payment provider, reference and amount, and the video link. The legal basis is the contract for the appointment (Art. 6(1)(b) GDPR). We keep the data as long as it is needed for the appointment and afterwards for as long as the law requires accounting records to be kept. When you complete the booking we also store that you took note of the General Terms and Conditions and this privacy notice, with time, language and version of the texts (Art. 6(1)(c) and (f) GDPR, proof under Art. 7(1) GDPR); we do not store an IP address for this.
Payment is made through Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA) or, for payments in Iraq, through Wayl (Iraq). We receive the date, amount and status of the payment and references; we never see your card or wallet data. To Wayl we send only a reference number, the amount, the name of the appointment and the return address through which you come back to us after paying; Wayl collects the payer's details itself. We create the video link with Zoom (Zoom Video Communications, Inc., USA). The appointment is entered in the Google calendar (Google, Ireland/USA) with your name, your message and your email address as a participant. If set up, we also enter the booking data in a Google spreadsheet. Confirmation and reminder emails are sent by our email provider Resend (Resend, Inc., USA). The booking page loads nothing from these providers until you press the payment button. With the link in your confirmation email you can change or cancel the booking.
If you send us documents for a consultation (for example by email or WhatsApp), we process them only for the appointment. Please send copies of ID documents only if we expressly ask you to.
8. Heroes community
When you join the Heroes community, you sign in with Telegram. From Telegram we receive your account number, name and username. You enter everything else voluntarily on your account page and can change or delete it there at any time: email address, telephone number, country, city, occupation, your goals and a short text about you. Instead of a photo you choose a picture symbol. The team sees this profile, other members do not. The legal basis for the voluntary profile is your consent (Art. 6(1)(a) GDPR), which you give with a checkbox on the account page.
For the membership we store payment provider, reference, period, amount, currency and status of payments, for Stripe the customer and subscription number, and reminders. The legal basis is the membership contract (Art. 6(1)(b) GDPR) and, for payment records, the statutory retention duty (Art. 6(1)(c) GDPR). When the paid period and the grace period of 3 days are over, our bot removes you from the Telegram group. We send messages about the membership (confirmations, reminders) through Telegram and, if you gave an address, by email.
Messages you write in the group are visible to all members. Telegram is responsible for processing on Telegram; for members in the European Economic Area this is Telegram Messenger Inc. Its privacy notices apply. Our bot is part of our website; the data it processes is processed by us.
We store your member data as long as you are a member and delete it when you delete your account yourself (on the account page) or ask us to; payment records we keep as long as the law requires. When you conclude the membership we also store that you took note of the General Terms and Conditions, the withdrawal instruction and this privacy notice and agreed to early performance, with time, language and version of the texts (proof under Art. 7(1) GDPR). A termination or withdrawal you declare with the buttons on the website we store with time and confirmation email.
Our paid offers (consultations and the Heroes community) are for people aged 18 or older. Before an order you confirm this with a tick box, and we keep that confirmation as proof that the contract was concluded properly. The application form is for people aged 16 or older. If we learn that a child has sent us data, we delete it.
9. Contact by email, telephone and messenger
When you write to us or call us or send us a message through Instagram, Facebook, WhatsApp or Telegram, we process your details to reply to you and, where applicable, to prepare a placement (Art. 6(1)(b) and (f) GDPR). Messages in social networks and messengers are also processed by the respective providers under their own privacy notices. We delete the correspondence when it is no longer needed for the purpose and no statutory retention duty applies.
10. Recipients and processors
We pass on data only where this is necessary for the purposes described or the law requires it. We have contracts with our processors under Art. 28 GDPR.
| Provider | What for | Role | Seat |
|---|---|---|---|
| Vercel Inc. | hosting, server functions, private file storage for application documents, scheduled tasks | processor | USA; server functions in Frankfurt am Main |
| Neon, Inc. | database | processor | USA; database in Frankfurt am Main |
| Resend, Inc. | email delivery (confirmations, reminders, notifications to the team) | processor | USA |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | card payments and subscriptions outside Iraq | processor; independent controller for its own purposes (fraud prevention, obligations) | Ireland, USA |
| Wayl | payments in Iraq (dinar) | independent controller for the payer's data | Iraq |
| Telegram Messenger Inc. | sign-in, community group, messages to members, notifications to the team | independent controller | see section 11 |
| Zoom Video Communications, Inc. | video links for consultation appointments | processor | USA |
| Google (Google Ireland Ltd., Google LLC) | calendar, spreadsheets, mailbox; YouTube after your consent | processor; independent controller for YouTube | Ireland, USA |
| Technical service provider | technical development, operation and maintenance of the website | processor | Germany |
The team receives a notification by Telegram and email for every new request, application and booking with the key details (for example name, company, country, type of request) and an overview once a day. We give data to authorities and courts where we are legally obliged to do so.
11. Transfers outside the EU
Some of the providers named have their seat in the USA or process data there. The transfer relies on the European Commission's adequacy decision on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can get a copy of the safeguards on request at husam.noaman@husamsieg.com.
Iraq has no adequacy decision from the European Commission. If you pay through Wayl, you enter your payment details directly with Wayl; Wayl has its seat in Baghdad. Sending Wayl the reference, the amount, the name of the appointment and the return address is necessary for performing the contract with you (Art. 49(1)(b) GDPR). Without an adequacy decision and without agreed safeguards, the level of protection in Iraq can be lower than in the EU. If you contact us from Iraq, your data also travels from there to us.
Telegram Messenger Inc. has its seat outside the EU and has appointed a representative in the EU for users in the European Economic Area. According to Telegram, the data of users in the European Economic Area is kept in data centres in the Netherlands; transfers to Telegram group companies outside the EU take place on the basis of standard contractual clauses. If you use Telegram, you decide this yourself; it is a prerequisite of community membership (Art. 49(1)(b) GDPR).
12. Storage periods
| Data | Period |
|---|---|
| Server logs at Vercel | decided by the provider; no fixed period stated |
| Visit data (only with consent) | 180 days |
| Requests from companies (and quiz requests sent earlier) | 12 months at the latest |
| Applications: not confirmed | 48 hours |
| Applications: removed (recycle bin) | 3 days |
| Applications: new or in the talent pool | 12 months after receipt or after our last confirmation that they are still current, or earlier on deletion or withdrawal |
| Placement records | three years after the placement activity ends |
| Bookings, payments, invoices | accounting vouchers eight years, books and annual accounts ten years, other tax-relevant documents six years |
| Member account | as long as you are a member; deletion on request; payment records for the periods above |
| Proof of your consent or acknowledgement (version, time) | as long as the consent or contract applies, afterwards up to three years to defend against claims |
13. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR). You can withdraw a consent you gave at any time (Art. 7(3) GDPR), for example through "Cookie settings", the link in our emails or by email to husam.noaman@husamsieg.com. For all requests, contact husam.noaman@husamsieg.com.
Right to object under Art. 21 GDPR: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
14. Complaint to a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, www.baden-wuerttemberg.datenschutz.de. You can also contact the supervisory authority at your place of residence.
15. Security and changes
The connection to the website is encrypted. Application documents are kept in private storage. Access to the administration area is protected by a password and a second factor, and rights are given by task. If our processing changes, we adjust this notice; the date of the last change is shown under the title.