Privacy policy

Controller

The controller for data processing on this website within the meaning of Article 4(7) GDPR is:

Charity Darko, c/o POSTFLEX PFX-443-274, Emsdettener Straße 10, 48268 Greven, Germany. Email: charity@builtwithcca.com.

Principle

This website is under construction. You can browse open jobs, create a free account, register for a notification and use the Opportunity Navigator. The sections below set out which personal data we process in doing so.

We set no cookies for visitors to this website, embed no analytics or tracking services, and load no fonts or scripts from third-party servers. All fonts are served from our own server, so opening the page creates no connection to anyone else. For email, see the section on sending email. We set a cookie only when you sign in: with your free account or, as a member of the Beyonddo team, in the admin area. See “Free account” and “Accounts for the Beyonddo team”.

Opportunity Navigator

The Opportunity Navigator answers questions about your route into Germany. To use it you give details such as your goal, where you live, your country of origin, your highest qualification, profession, years of experience, age, language levels, recognition status, any job offer and its salary, where in Germany you would like to be and — for the goal “Move to Germany” — whether close family already lives in Germany. No account is needed, and we ask for neither your name nor your email address.

These answers are processed solely to compute the result you asked for. The legal basis is Article 6(1)(b) GDPR: the processing happens at your request, in order to provide the service you asked for. The answers are sent by POST so that they do not appear in server logs, in your browser history, or in referrer headers.

We store a data-minimised record of the completed run so that we can understand which routes and professions are in demand. It contains no name, email address, IP address, account, cookie or session identifier. Exact age and salary are converted into bands before storage; the answer about family is not stored. Profession and desired location remain free-text answers and, together with the other answers, may still constitute personal data in an unusual combination. The legal basis for this processing is Article 6(1)(f) GDPR; our legitimate interest is in shaping the service around actual demand.

No IP address, cookie, session identifier or other marker is stored with a run. Navigator records are automatically deleted after 90 days. You may object to this processing at any time using the contact details above; because no direct identifier is retained, we may need information from you to locate a particular record.

The Navigator's result is orientation, not legal, immigration or tax advice. There is no automated decision within the meaning of Article 22 GDPR: the Navigator decides nothing, it assembles rules and official sources. Decisions on residence, recognition and funding rest with the competent authorities alone.

Contact via WhatsApp

Some pages offer a way to contact us via WhatsApp. The link only opens WhatsApp when you click it; simply visiting our pages establishes no connection to WhatsApp or Meta.

If you write to us on WhatsApp, WhatsApp Ireland Limited (Meta) processes your phone number, profile name, the content of your message and metadata under its own privacy terms; data may be transferred to the United States in the process. We see your phone number and your messages. The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a service you have asked for, and otherwise Article 6(1)(f) GDPR — our legitimate interest in a simple way to be reached on the channel you chose.

We do not transfer WhatsApp conversations into other systems, and we delete them once your enquiry is dealt with. If you prefer not to use WhatsApp, you can always reach us by email at the address in the Impressum; you will get the same answer.

Paying the referral fee through Stripe

Companies that pay Beyonddo a referral fee do so through Stripe. The payment page is operated by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Card and account details are entered there; Beyonddo does not receive them. Nothing from Stripe is loaded on our own pages in the process.

What is processed: the billing details (company name, address, email address, VAT ID where given), the payment data, and what our form asks — who was hired, as a name or a reference, and the first working day where given. These appear on the invoice and serve only to match the payment to the referral.

The legal basis is Article 6(1)(b) GDPR, the performance of the fee agreement, and for keeping invoices Article 6(1)(c) GDPR together with § 147 AO and § 257 HGB. Where the referred person's name is given, that processing rests on Article 6(1)(f) GDPR — our legitimate interest in matching a payment unambiguously. A reference instead of the name serves that purpose just as well.

Stripe may transfer data to the United States. Stripe is certified under the EU-US Data Privacy Framework and also uses Standard Contractual Clauses. Stripe processes certain data as a controller in its own right, for example to prevent fraud and meet legal obligations; Stripe's privacy policy applies to that. We keep invoices and payment records for the period the law requires (§ 147 AO, § 257 HGB).

Advice, guided support and Beyonddo Plus: payment through Stripe

When you order a 1:1 call, guided support or Beyonddo Plus and pay by card in euro, we set you up as a customer with Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) and pass on your name, email address, language and an internal identifier of your account. You enter card and account details on Stripe’s payment page; Beyonddo does not receive them.

We store which service you ordered, the price level, the amount, when you asked us to begin before the withdrawal period ends, whether and when it was paid and whether the call has been held or the guided support is complete; for Plus also the state of the subscription and the end of the month paid for. Which price level applies follows from the country in your account.

The legal basis is Art. 6(1)(b) GDPR, and for keeping invoices Art. 6(1)(c) GDPR with § 147 AO and § 257 HGB. Cancellations through “Cancel contracts here” are processed under Art. 6(1)(c) GDPR with § 312k BGB: name, email address and what you enter in the form; the confirmation goes to the address given.

For transfers to the USA and processing by Stripe under its own responsibility, the previous section applies. We delete the details of your orders with your account; invoices and payment records stay with Stripe for the period required by law.

Paying with Mobile Money through Paystack

When you pay in Ghanaian cedi — by Mobile Money or card — we use Paystack: Paystack Payments Limited, Lagos, Nigeria, a payment service provider licensed by the Central Bank of Nigeria and part of the Stripe group, which works with its affiliate Paystack Ghana Limited for payments in Ghana. We pass to Paystack your email address, the amount, an order reference, the service ordered, the price level and an internal identifier of your account. You enter your mobile number and your card or account details on Paystack’s payment page; Beyonddo does not receive them, only the result of the payment and the payment method (such as Mobile Money).

We store the order reference, the service ordered, price level, amount and currency, the payment method, whether and when it was paid, and when you asked us to begin before the withdrawal period ends. The legal basis is Article 6(1)(b) GDPR. We delete these details with your account; payment records stay with Paystack for the period required by law.

Paystack processes the data in Nigeria and Ghana and may transfer it to other countries. There is no EU adequacy decision for Nigeria or Ghana. The transfer is necessary to perform the contract when you choose this way of paying (Article 49(1)(b) GDPR); if you pay by card through Stripe instead, it does not take place.

Appointments and calls with Google

You pick the time of a 1:1 call and of the guided support calls through an appointment schedule in Google Calendar; the calls and the Plus Q&As take place on Google Meet. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When booking you give your name and email address there; during a call Google processes video, audio and the technical data of the connection. We do not record the calls.

In a Plus Q&A the other participants see the name you give in Google Meet, and your picture if you turn on your camera. You can join with a first name and without a camera.

The legal basis is Art. 6(1)(b) GDPR. Google processes this data on our behalf (Art. 28 GDPR). Google may transfer data to the USA; Google is certified under the EU-US Data Privacy Framework.

Guided support: your documents

For guided support you upload documents in your account, such as your CV, degrees and certificates, language certificates, a copy of your passport and a job or training offer. We store them encrypted (AES-256) in our database on our server at Hetzner in Nuremberg; they do not leave the European Union. They are opened only by the Beyonddo team, to provide the support, and every opening is logged. We also store the file name, file type, size and time of upload.

The legal basis is Article 6(1)(b) GDPR. Please upload only what your application or job search needs — in particular no documents about your health or religion unless they are needed for it.

You can delete any document in your account at any time. Otherwise we delete them 30 days after the support ends, at once if the order is cancelled or refunded, at the latest 13 months after upload, and with your account. They remain, still encrypted, in the nightly database backups for up to 14 days longer.

Job listings

The jobs at /jobs are entered by the Beyonddo team. They contain details an employer has intended for a job advertisement, such as the company name, location, pay and an address for applications. When you view a job, we store nothing about you.

Applications do not go through Beyonddo. The application link or email address in a listing leads directly to the employer or to the source of the listing, which is then responsible for your application.

Free account

With a free account you see the description of every job, how to apply and the source of the listing. When you sign up we process your name and email address, and when you accepted the terms and which version. You choose your password through the link in the confirmation email; we store it only as an argon2id hash.

When you set up the account we ask which country you live in now. The country your device’s time zone belongs to is suggested. This happens in your browser: the time zone is not sent to us, and your IP address is not used to locate you. Only the country you confirm is stored, and you can change it in your account at any time. We use it to plan our services by region, for example how many people from Africa or Asia use Beyonddo.

When you set up a job alert, we store the keyword and place you enter, how often you want to hear from us (daily or weekly) and when we last wrote. We send an email only when new jobs matching your search have appeared; it is sent as described in the section on sending email. Every one of these emails has a link that stops the alert without signing in, and you can remove it in your account at any time too. We delete an alert as soon as you stop it or delete your account. Which jobs you click in these emails is not linked to you (see the section on sending email).

After signing in we set a technically necessary cookie holding a random session identifier (§ 25(2) no. 2 TDDDG). It is sent only over HTTPS, cannot be read by scripts and ends after 12 hours or on signing out. For each signed-in browser we store its identifier (user agent) and the time of the last sign-in. Sign-up, confirmation, sign-ins and the deletion of an account are logged, without IP addresses. We do not store which jobs you look at.

The legal basis is Art. 6(1)(b) GDPR for providing the account and the job alerts, and Art. 6(1)(f) GDPR for securing access and the analysis by region; our legitimate interest is a secure account and a service that fits the people who use it. We keep your account until you delete it, which you can do at any time under “My account”, with immediate effect. Sign-ups whose link was never used are deleted after 30 days. Only the people authorised to run the website can access your details.

Accounts for the Beyonddo team

Members of the Beyonddo team sign in to an internal area to manage jobs and access. Accounts are created only by invitation. For this we process name, email address and role, the password only as an argon2id hash, the time of the last sign-in and, for each signed-in browser, its identifier (user agent). Sign-ins, invitations and changes to jobs are logged so that it is clear who changed what. We do not store IP addresses in the process.

After signing in we set a cookie holding a random session identifier. It is technically necessary for signing in (§ 25(2) no. 2 TDDDG), is sent only over HTTPS, cannot be read by scripts and ends after 12 hours or on signing out. Invitations and password reset links are sent by email; they are valid for 7 days and 60 minutes respectively, and work once.

The legal basis is Art. 6(1)(b) GDPR for working with Beyonddo and Art. 6(1)(f) GDPR for securing access; our legitimate interest is that only authorised people can change the content of this website. Expired sessions and links are deleted after 30 days. When the collaboration ends, we disable the account.

Hosting and server log files

The website runs at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Nuremberg. A data processing agreement under Article 28 GDPR is in place with Hetzner. The data does not leave the European Union.

When the site is opened, technically necessary access data is processed: IP address, date and time, the address requested, the volume of data transferred, the referring page, browser and operating system. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and uninterrupted operation of the website.

Email notification (double opt-in)

If you ask to be notified, we process: your email address, the language you chose, where on the site and for which area you signed up, and — if you entered them — your search term and location. We also store the wording of your consent and the moment you gave it.

After you sign up we send you an email containing a confirmation link. Only when you open that link is your address confirmed and may we write to you. If you do not confirm, you will receive no further email from us.

The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw it at any time with effect for the future. The quickest way is the unsubscribe link included in every email we send — one click is enough, and many mail programs also show their own unsubscribe button for it. Alternatively, an informal email to charity@builtwithcca.com is sufficient. The lawfulness of processing carried out before the withdrawal is unaffected.

Your IP address is not stored when you sign up. To protect against abuse it is held in memory only, for a few minutes, and then discarded.

Sending email

To send the confirmation and notification emails, and the invitations and password links for team accounts, we use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) as a processor under Article 28 GDPR. Your email address is transmitted to Brevo for that purpose and no other.

Brevo runs the servers used for sending inside the European Union, in France and Belgium. Brevo in turn engages sub-processors, some of them established outside the EU, including in the United States and India. Those transfers are safeguarded by Standard Contractual Clauses under Article 46(2)(c) GDPR and, where applicable, by the EU-US Data Privacy Framework. Brevo keeps the current list of sub-processors in Annex 2 of its Data Processing Agreement.

Brevo measures whether our emails are opened and whether the links in them are clicked. The HTML version therefore contains a small counting pixel, and links are routed through a Brevo address that redirects to the actual destination. We have set this measurement to anonymous: opens and clicks are only counted and are no longer attributed to individual recipients. Our Brevo plan does not offer the option to switch it off entirely. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is in knowing whether our emails are delivered at all. If you would rather avoid it: the confirmation link is also in the plain-text version of every email, unchanged, and if your mail program does not load images, no open is counted.

Retention

Confirmed addresses are stored until you withdraw your consent. Unconfirmed sign-ups are deleted at the latest 30 days after the confirmation link expires.

Documents for guided support are deleted 30 days after it ends, at the latest 13 months after upload (section “Guided support: your documents”).

Server log files are deleted or shortened after 14 days at the latest.

Recipients of your data

Your data is not sold and is not passed to third parties for advertising. Access is limited to the processors named above, each bound by an agreement under Article 28 GDPR, and to the people authorised to maintain the website.

Your rights

You have the right of access (Article 15 GDPR), to rectification (16), to erasure (17), to restriction of processing (18), to data portability (20) and to object (21). To exercise them, write to charity@builtwithcca.com.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence or of the alleged infringement (Article 77 GDPR).