Privacy policy
Última actualización: 11 November 2026
1. Controller and scope
The controller is Dee Empire, Forststraße 6, 96264 Altenkunstadt, Germany (provider details in the legal notice at role365.de/impressum). E-mail: privacy@dee-empire.com. Data protection officer: dpo@dee-empire.com. Phone: +49 9572 8744123. This policy describes the processing on the website role365.de (sections 2 to 9) and in the Role365 app at app.role365.de and the mobile apps (sections 10 to 21). The employer portal has its own notice.
2. Hosting and storage locations
The website and the Role365 app run on Google Cloud in Frankfurt am Main, together with our database, uploaded documents and backups. Google Cloud (Google Ireland Limited) processes this data as our processor. Some service providers process data outside Germany, for example for AI features, payments and phone notifications. They are named in sections 14 to 20, each with the basis for a transfer to third countries. The server location does not determine the location of recipients you choose yourself, such as an employer or your e-mail provider. The website's cookie choice is not consent to share applications.
3. Technical operation and abuse prevention
To load a page, your browser and our server must process connection data, in particular your IP address, the requested address and technical request information. We cannot deliver the website without it. We do not keep a continuous record of all website access. Technical error and operational messages use size-limited, rotating logs; older files are overwritten when the limit is reached. To protect forms against abuse, we check an invisible form field and the time taken to complete the form. Short-lived counters based on a hash of the IP address remain in memory for at most 20 minutes; the IP address itself is not persistently stored for this purpose. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in secure operation and protection against automated abuse.
5. Optional website statistics
Only after you consent does your browser send events such as a page view, a click or a successful form submission to our own server. We store only totals per event, page or feature and day. Form contents, email addresses, cookie IDs and individual browsing histories are not included. Transmission technically involves an IP address; it is not saved in the statistical records. With the same consent, your browser also measures how fast the page loads and responds to input (the measures LCP, INP, CLS, FCP and TTFB) and reports script errors (error type, message, code location). These values go, together with the page address and the device type (phone, tablet or computer), to the Role365 app server (app.role365.de), again without an identifier and without a cookie. There, numbers and email addresses are removed from error messages; individual values are deleted after 30 days, after which only daily figures remain. The legal basis for this optional processing is Art. 6(1)(a) GDPR. Withdrawing consent stops further optional events being sent. Withdrawal does not affect the lawfulness of processing before withdrawal. Aggregated counters cannot be attributed to an individual and therefore cannot be deleted for a particular person.
6. Enquiries and access requests
Depending on the form, we process your name, email address, topic and message, plus optional details such as phone number, organisation, vacancies or professional interests. An access request also records your preferred plan. Required fields are marked; we cannot handle the relevant request without them. An access request does not create an app account or trigger a payment. We use the details to handle and answer your request or contact you about the access you requested. There is no automatic newsletter subscription. Acknowledging the privacy policy in a form does not consent to advertising or optional statistics. The legal basis is Art. 6(1)(b) GDPR for pre-contractual enquiries or Art. 6(1)(f) GDPR for other enquiries, with the legitimate interest of answering them. We retain enquiries while handling them and any necessary follow-up questions. Further retention depends on legal obligations or the need to resolve specific legal claims. Access requests are retained for the requested contact about access; you can withdraw a request and ask for deletion at any time via privacy@dee-empire.com. Mandatory legal retention is unaffected.
7. Recipients, fonts, videos and external links
Enquiries are accessible to the people at Dee Empire responsible for handling them. Google Cloud provides our hosting. Email replies involve the participating email services. Automatic forwarding of website forms to an external notification service is not enabled. Fonts, images and videos are loaded from our own website server. We embed no advertising networks, social-media trackers or external video players. Clicking an external link takes you away from our website; the destination’s privacy information applies there. We do not sell your form data.
8. Your rights and withdrawal
Subject to the legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing relies on legitimate interests, you can object on grounds relating to your particular situation. You can object to processing for direct marketing at any time. You can withdraw consent at any time for the future. For website statistics, use “Cookie settings” in the footer. For other privacy requests, contact privacy@dee-empire.com. Where necessary to handle the request, we may ask for information to verify your entitlement.
9. Right to complain
You can complain to a data protection supervisory authority, particularly where you live, work or believe an infringement occurred. The Bavarian Data Protection Authority (BayLDA) supervises private businesses based in Bavaria. Postal address: Postfach 1349, 91504 Ansbach, Germany. Visitor address: Promenade 18, 91522 Ansbach. Website and online complaints: https://www.lda.bayern.de
10. The Role365 app: account and sign-in
For your account we process your name, e-mail address, your password in irreversibly encrypted form (hash), your language and when you accepted the terms. When you sign in we store a session (browser: cookie "oa_session", 7 days; phone: 90 days) with the device type and last use. To protect against attacks we keep sign-in attempts with the IP address for 2 days. In the browser the app keeps language and appearance in local storage. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); protection against misuse rests on our legitimate interest in a secure service (Art. 6(1)(f) GDPR).
11. Profile, CV and documents
You can upload your CV and other documents. Role365 extracts your career details from them as "facts" you can confirm or change. Add to that your search preferences and application rules and an optional profile photo, which only you see and which is never sent to employers. If you are looking for an apprenticeship, your job wishes say whether you look for a job, an apprenticeship or both, and – if you choose – your highest school-leaving certificate. We use this to show you matching apprenticeships and to compare your certificate with the one a company asks for – only as a note for you, never to exclude you. A certificate you upload under “Documents” goes to a company only if you explicitly choose it in your application. CVs can contain special categories of personal data (for example on health or religion). Only include them if you want to use them for your applications; by uploading you consent to Role365 processing them for your applications (Art. 9(2)(a) GDPR). Otherwise the legal basis is Art. 6(1)(b) GDPR.
12. Jobs and applications
Role365 shows you only jobs from employers who published them on Role365 themselves. We do not search other job boards and send no data about you for that. Role365 rates automatically how well a job fits your profile; the rating is a recommendation. When you search for jobs within a distance, we use a postcode or a town. If you tap “Use my location”, your device asks for permission first; the position is sent rounded to about 100 metres, only converted into the nearest postcode, and neither stored nor logged. If you save a home postcode and a search radius in your job wishes, we keep only that postcode and the radius until you change them or delete your account. Role365 calculates distances itself, without a map service; the postcode data comes from GeoNames (geonames.org, licence CC BY 4.0). An application goes out only after your approval and only to the employer of the job, in its Role365 inbox. It receives exactly the documents and answers you approved, and your contact details only if you chose so. From then on the employer is responsible for its copy. That copy is deleted 180 days after the employer's final decision, and at once if you withdraw the application. The legal basis is Art. 6(1)(b) GDPR.
13. Messages and dates with employers
You exchange status, messages and interview dates about your application with the employer inside Role365. We store them with the application so both sides see them. Connecting a mailbox is optional. If you connect one, Role365 signs in with the app password you gave (stored encrypted), sends an e-mail only when you press send, and shows your mail live when you open it, without keeping a copy. Whether Role365 may also read your mailbox is your choice, and your consent is the legal basis: "nothing"; "only mail about my applications", where your mail server is asked only for mail carrying our reference or coming from, or naming, a company you applied to; or "an address only for applications", where new mail is looked at and only what belongs to an application is kept. Nothing that arrived before your choice is read. What is kept is a short excerpt, which you can see and delete in Settings. It is deleted automatically after the period in force at the time, and with your account. Mail is passed to an AI only when you ask about one message or, if you switch on "let the AI read replies about my applications", for the kept e-mails about your applications from that moment on: to prepare a reply that is sent only when you approve it, and to enter interview invitations in your interviews. Both need your consent to AI, and you can switch it off at any time. When a company's form e-mails a code to confirm that a person is applying and you let Role365 read your mailbox, that code is taken from the e-mail and entered on the form; the e-mail is not kept. E-mail applications carry a short reference and are filed, with their replies, in a "Role365" folder in your mailbox. You can withdraw your choice at any time, as easily as you gave it; this does not affect reading done before. Disconnecting deletes the access. What you tell us about a company's answer stays between you and Role365. Where a company takes applications on its own online form, Role365's own browser fills in that form with your application and sends it after you approve it, or within your autopilot rules. If the form asks something your CV and your earlier answers do not cover, you are asked once and your answer is kept in your Answer Library for later forms; you can see and delete it there. Some companies only take applications through an account on their site. Role365 then creates that account with your e-mail address and a password it generates, stores the password encrypted, and shows it to you in Settings so the account stays yours. With that account it later signs in to the company's site to read what became of your application; it only reads there. A check that a person is present (CAPTCHA) is never bypassed: you pass it yourself in the live browser. Screens of the form are kept with the application as proof of what was sent, and are deleted with it. An AI model (Google Gemini, as processor) sees the form's pages and your application's answers while it fills the form; it never sees a password. The legal basis for messages with employers is Art. 6(1)(b) GDPR.
14. AI features (Google Gemini) – only with your consent
Some features use artificial intelligence from Google: the assistant Nia (text and voice), reading your CV and documents, the CV builder, cover letters and application texts, interview preparation, and rating how well jobs fit you. For this we send the content needed in each case to Google's Gemini API (recipients: Google Ireland Limited, Ireland, and Google LLC, USA): your profile (name, experience, skills, education), your CV and documents, your job wishes, your application texts and cover letters, and your messages and voice to Nia. What for: only to give you these features – reading documents, writing drafts you check yourself, preparing you for interviews and showing how well jobs fit. This happens only with your consent: after you sign in, the app and the website ask you once, explicitly, what goes to whom. Without consent you use Role365 as before; only the AI features stay off, and in the help chat a person answers you. You can withdraw your consent at any time with effect for the future in Settings under “Privacy”; after that we send nothing of yours to Google. We store when you gave and withdrew it. Google processes the data on our behalf under Google's data processing terms (Art. 28 GDPR) and so protects it to the same standard as we do. We use the paid Gemini API; Google does not use the content sent to improve its products. Google may also process data in the USA, based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Google LLC is certified, and on standard contractual clauses. Nia does not search the web. For AI requests we keep technical details (feature, duration, volume) for 90 days. Results of AI requests are cached so the same request is not made twice and expire after at most 30 days, depending on the feature. The legal basis is your consent (Art. 6(1)(a) GDPR); where your documents contain special categories of personal data, Art. 9(2)(a) GDPR.
15. Voice assistant Nia
The microphone is only used while you talk to Nia and after you have agreed to it. Your voice is sent to Google Gemini for the duration of the conversation and processed there (see section 14). We do not store audio recordings. You decide in the Nia settings what Nia should remember, and you can delete what it stored there. The legal basis is your consent (Art. 6(1)(a) GDPR, see section 14).
16. Notifications
We send service e-mails (such as confirmations and messages about your applications and the Startbonus) from the mailbox info@role365.de at IONOS SE (Germany) as our processor. Phone notifications go through the Expo service (650 Industries, Inc., USA) and from there through Apple or Google. A device identifier and the text of the notification are transmitted; whether details appear in the text is set in your notification settings. Transfers to the USA are based on standard contractual clauses. You can switch phone notifications off at any time. The legal basis is Art. 6(1)(b) GDPR.
17. Payments
Role365 is free for job seekers; we process no payment details of yours. Section 22 covers the Startbonus.
18. Termination and withdrawal
We store terminations and withdrawals with the details given and the time they arrived, to carry them out, confirm them and prove them. We keep this evidence for three years from the end of the contract. The legal bases are Art. 6(1)(b) and (c) GDPR.
19. Storage period and deletion
Your data is kept as long as your account exists. Some data is deleted earlier automatically: sign-in attempts after 2 days, technical details of AI requests and processes after 90 days, logs of important actions after 730 days; the employer's copy of an application as in section 12. If you delete your account, we delete all its content. We keep only what the law requires (such as the evidence in section 18 and booking records of the Startbonus), then without a link to your account. Deleted data disappears from backups within 30 days at the latest.
20. Recipients and processors
Data is received only by: Google Cloud (operation and backups in Frankfurt), Google Gemini (AI features and help chat), IONOS (service e-mails), Expo, Apple and Google (phone notifications), our bank (paying out the Startbonus) and the employers you apply to. We have contracts under Art. 28 GDPR with our processors. We do not sell data and do not use your content for advertising.
21. Automated decisions
Role365 rates jobs automatically by how well they fit your profile and prepares applications with you. These are aids for your job search, not decisions about you with legal or similarly significant effect within the meaning of Art. 22 GDPR. Only what you approve is sent; the employer decides on an application. Role365 does not rate, sort or filter applicants for employers.
22. Startbonus
If you apply through Role365 for a job with a Startbonus, we store the job, the company, amount and waiting time, your first working day, the state of the Startbonus and – once you claim it – account holder and IBAN. The IBAN is stored encrypted, decrypted only to create the transfer, and erased 30 days after payment or cancellation; the last four digits remain for reference. The employer learns that you confirmed you still work there, so that they can report an earlier end; they never learn your bank details. Our bank carries out the transfer. The legal basis is Art. 6(1)(b) GDPR (keeping the Startbonus promise); for booking records Art. 6(1)(c) GDPR with § 147 AO and § 257 HGB, which we keep for up to ten years.
23. Help chat
In the Role365 app, the employer portal and at app.role365.de/hilfe you can write to the Role365 help assistant, an AI. It answers from our help articles and – when you are signed in – from details of your own account (for example the state of an application or a job). It cannot change anything in your account. For this, your messages and any screenshots you attach go to Google Gemini (see section 14). Passwords, card numbers, IBANs and dates of birth written recognisably as such are removed first; screenshots are saved again without metadata such as location or camera. A conversation the assistant solved is deleted after 24 hours; a small random share (about 5 %) is kept for up to 7 days so we can check the quality of the answers. If you send a request to our team, we store the conversation, a short summary, the account details the assistant read and your contact details until 12 months after it is solved. Without an account you first confirm your e-mail address. To prevent misuse we count messages per IP address for one day. The legal basis is Art. 6(1)(b) GDPR (your request about our service); without an account and for preventing misuse, our legitimate interest in answering requests and running the service securely (Art. 6(1)(f) GDPR). The assistant's answers are not decisions about you within the meaning of Art. 22 GDPR.
24. Jobs with applications on the company's site
For some jobs you do not apply in Role365 but on the company's website or in its applicant tracking system. Such jobs are labelled "Apply on the company's site". When you click the link, our server forwards you there. We pass on no data about you – no name, no e-mail address, no documents; we only add a note to the link that you come from Role365 (utm_source=role365). So that the company can see how many people come through Role365, we count clicks per job, day and source (job board, app, careers widget) and whether the person was signed in to Role365. To count repeated clicks only once, we form an encrypted check value from your IP address and the job with a key that changes daily, and delete it after 48 hours. We do not store the IP address itself. We set no cookie for this and read nothing from your device. Clicks from search engines and other programs are recognised by their browser identifier and not counted. Only the numbers are kept, without reference to a person. If you are signed in to Role365, you can record in your account that you applied. This record belongs to your account and stays there; the company only sees the number of such records, and only from a minimum number, so that nobody can be identified. The legal basis for counting is our legitimate interest in showing companies the reach of their ads (Art. 6(1)(f) GDPR); for the record in your account Art. 6(1)(b) GDPR. On the company's site the company itself is responsible; its privacy notice applies there.
25. Where a sign-up came from
In ads, posts, letters and material for partners we use links with a short tag, for example role365.de/?src=li-october. If you come to us through such a link and create an account – as a job seeker or as a company – we store the tag with your account. This shows us which way brings people to Role365 and which advertising is worth it. The tag describes only the link (channel and campaign), not you. Until you sign up, the website and the app keep it only while the page is open: we set no cookie for this, store nothing on your device and use no tracking pixels. If you reload a page without the tag, it is forgotten. It is evaluated only as numbers: how many accounts were created through a link, how many of them completed their profile and – for companies – how many of them pay and how much. Only the Role365 team sees these numbers; our AI-assisted budget planner also receives only them, without details of individual people. The tag stays with your account until you delete it. The legal basis is our legitimate interest in planning our advertising economically and measuring its success (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR), for example by e-mail to support@dee-empire.com; we will then remove the tag from your account.
26. Short questions in the app
After certain steps (for example after your first application) we occasionally ask you with a tip how it went, and you can add a sentence. Answering is voluntary. We store your answer with your account so that we do not ask twice, and evaluate answers only in summary and without your name, to improve Role365 (Art. 6(1)(f) GDPR). You can switch the questions off in the settings under “Notifications”. Your answers are deleted with your account.
27. Recommendations and opinions (companies)
If a company registers through your referral link, we store that it came through your link and show you only the number. We store your opinion of Role365 with your name and role. It is published only if you expressly allow it (Art. 6(1)(a) GDPR); you can withdraw your permission at any time with effect for the future.
28. The CV check on the website
At role365.global/cv-check you can have your CV checked without an account. For this we process the file you upload (PDF or Word) and what it contains: your name, your contact details, your career, your education and your skills. Purpose: to show you how your CV reads, what we understood and which open jobs on Role365 fit you. Role365 works out the match itself, without AI, from your role, your skills and your experience. An AI reads the text of your CV: we send it to Google's Gemini API (Google Ireland Limited, Ireland, and Google LLC, USA), which processes it on our behalf (Art. 28 GDPR) and does not use it to improve its products. Transfers to the USA rely on the adequacy decision for the EU-US Data Privacy Framework and standard contractual clauses (see section 14). Results of this request are not cached. We keep the file and the result in temporary storage for 24 hours, so you can look at the jobs in another country and create an account with your CV; after that they are deleted automatically. If you create an account with the result within that time, they are kept until you confirm your e-mail address, for at most 7 days. On confirmation your CV becomes the CV in your account (section 11) and the temporary copy is deleted. To limit the number of checks per visitor we briefly process your IP address; it is not stored with the CV. The legal basis is the consent you give explicitly before uploading (Art. 6(1)(a) GDPR; if your CV contains special categories of personal data, Art. 9(2)(a) GDPR). You can withdraw it at any time by writing to privacy@dee-empire.com; we then delete the temporary copy at once. Limiting checks per IP address is our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR). This is a translation for your convenience. Only the German version is legally binding.