Privacy notice / Datenschutz

1. Who is responsible?

The controller is Replayboys GmbH, Theodorstraße 41P, 22761 Hamburg, Germany. Contact us about data protection at office@replayboys.de or by post at this address. Our Impressum provides the company and contact details.

2. A voluntary, private talent pool

Teambox helps Replayboys find and contact freelancers for its own projects. Joining is voluntary and does not guarantee a project or create an employment relationship. Your profile is not published, sold, used for advertising or automatically shared with clients.

You can save a private draft without joining the talent pool. Drafts are excluded from the staffing directory and admin profile pages. When you opt in, authorised Replayboys team members can review your information, record internal suitability notes and ratings, and contact you about relevant work. A human makes staffing decisions. We do not make solely automated decisions with legal or similarly significant effects.

3. Information we process

• Account information: email address, password hash if you choose email login, account status, sessions, reset requests and sign-in dates.
• If you choose Google: a stable Google account identifier and verified email address. We do not store Google access or refresh tokens.
• Your name, phone number, city, country, selected roles, experience, role answers, day rate, availability and working preference.
• Optional portfolio links, notes, billing address, workstation, internet and technical software information that you provide.
• For opted-in profiles, internal project-fit notes and ratings entered by the Replayboys team. These are not public.
• The wording, version and time of your talent-pool consent, and limited security/audit data such as IP address, browser information, server request details and relevant account events.

Please provide only information relevant to freelance work. Do not enter health details, identity documents, confidential client material or information about other people that you are not entitled to share.

4. Purposes and legal bases

We process account information and private drafts to provide the account and profile functions you request, under Article 6(1)(b) GDPR. We use opted-in talent-pool profiles, role information and internal suitability assessments for future freelance staffing and project contact on the basis of your consent under Article 6(1)(a) GDPR.

We process necessary security and audit information to protect accounts, prevent misuse and investigate incidents, based on our legitimate interests under Article 6(1)(f) GDPR. Where processing is required by law, Article 6(1)(c) GDPR applies. Information needed for an actual project agreement may be processed under Article 6(1)(b); any project contract and its statutory records are separate from the voluntary pool.

The form identifies required information. Account credentials, shared essentials and answers for selected roles are needed to create a usable profile. Optional fields can be skipped. Pool consent is not required to save a draft; without it, your draft is excluded from staffing searches.

5. Access, services and transfers

Pool profiles are accessible only to authorised Replayboys staff for internal staffing. Service providers handling hosting, database operation, maintenance, backups and transactional email may process data for the service. Password-recovery email uses Resend when email delivery is configured; it receives the email address and message content, not your role questionnaires.

Google sign-in is optional. A redirect to Google starts only when you choose it. Google processes the sign-in interaction under its own privacy policy. The email/password path remains available.

For the internal location map, the server can send city and country to OpenStreetMap’s Nominatim geocoder. Street address and postal code are not sent. Map tiles are loaded from OpenStreetMap when an admin opens the map, which exposes that admin’s connection data to the tile service. Freelancer names, notes and contact details are not sent in map requests. See the OpenStreetMap Foundation privacy policy.

Providers may process data outside the EU/EEA. Where required, international transfers must use an applicable adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses. Contact office@replayboys.de for information about the safeguards applicable to the services used for your data.

6. Retention and withdrawal

Your opted-in profile stays in the talent pool until you withdraw. There is no automatic renewal deadline. Drafts remain in your requested account until you delete them or the account. We keep consent evidence while the account exists to demonstrate the consent given.

To withdraw, use Withdraw consent and delete account on your profile, or write to office@replayboys.de. Self-service deletion removes the active account, profile, role answers, software capabilities, internal notes, consent records and sessions. Withdrawal does not affect the lawfulness of processing before withdrawal.

Routine application-database audit records are scheduled for removal after 90 days. Deleted information can remain in isolated backups until scheduled rotation; it is not used for staffing, and deletion requests must be reapplied before restored data is put back into use. Records separately required by law or necessary for a specific legal claim may be retained for that obligation or claim, rather than for talent-pool use.

7. Cookies and local storage

Teambox uses a strictly necessary, HTTP-only session cookie (teambox_session, up to 30 days) after signing in. Starting Google sign-in sets an HTTP-only state cookie (teambox_google_flow, up to 10 minutes). The chosen light/dark theme is stored locally as teambox-theme until you change it or clear browser storage. These support the functions you request; necessary storage is used under § 25(2) TDDDG. We use no analytics, advertising pixels or marketing cookies. Fonts are served by Teambox.

8. Your rights

Subject to the GDPR’s conditions, you can request access, correction, erasure, restriction and data portability. You can withdraw consent at any time. You can object to processing based on legitimate interests for reasons relating to your situation. You can download your submitted profile from your account; contact us for a complete access request, including information you cannot see directly.

Contact office@replayboys.de to exercise these rights. You may complain to a supervisory authority, including the Hamburg Commissioner for Data Protection and Freedom of Information, or the authority where you live or work.