Privacy Policy

Last updated: 19 August 2026. This English version is provided for convenience. In the event of any discrepancy between the English and German versions, the German version shall prevail.

1. Controller

The controller responsible for data processing on this website is:

Joseph, Siby, trading as Fliyon
Hausmann Straße 17
14776 Brandenburg an der Havel, Germany
Telephone: +49 160 60 444 55
E-mail: kontakt@fliyon.de

We have not appointed a Data Protection Officer (DPO), as we are not currently legally required to appoint one. If you have any questions about this Privacy Policy or the processing of your personal data, please contact us using the contact details provided above.

2. Scope and Principles

This Privacy Policy explains how we process personal data when you visit our website, contact us, apply through us as a nurse, or when we act as a recruitment intermediary (Personalvermittlung) between nurses and healthcare employers in Germany.

We process personal data only where permitted under applicable data protection law. Depending on the specific processing activity, the legal basis may include your consent (Art. 6(1)(a) GDPR), the performance of a contract or taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR), compliance with a legal obligation (Art. 6(1)(c) GDPR), or our legitimate interests (Art. 6(1)(f) GDPR). Where we process special categories of personal data, such as health data, additional requirements under Art. 9 GDPR apply.

We process personal data only for specified and legitimate purposes, limit the data we collect to what is necessary for those purposes, and keep personal data only for as long as necessary for the relevant purpose or as required by law (Art. 5(1)(e) GDPR); see Section 15.

3. Hosting and Content Delivery

Our website and its database are hosted on servers located in Frankfurt, Germany, provided by Hostinger. Personal data submitted through the website, including contact and application data, is stored on our hosting infrastructure within the European Union.

We use Cloudflare as a content delivery and security service. When you access our website, Cloudflare processes technical connection data, including your IP address, in order to deliver content efficiently, maintain website security and protect the website against attacks. This processing is based on our legitimate interest in operating a secure, reliable and performant website (Art. 6(1)(f) GDPR). Cloudflare operates a global network, and certain processing may take place outside the European Union; where this occurs, the safeguards described in Section 12 apply.

Hostinger and Cloudflare may process personal data on our behalf as service providers. We have appropriate data processing arrangements in place with the relevant providers in accordance with Art. 28 GDPR.

4. Server Log Files

When you visit the website, technical information is automatically collected in server log files. This may include your IP address, the date and time of access, the page requested, the referring page, and information about your browser and operating system.

We process this data to operate, secure, maintain and troubleshoot the website. The legal basis is our legitimate interest in providing a secure and reliable website (Art. 6(1)(f) GDPR). Server log data is normally retained for 7 days and then deleted. Longer retention may apply where necessary to investigate, document or respond to a security incident, technical malfunction, or other unlawful activity.

5. Cookies and Consent

We use cookies and similar technologies that are strictly necessary for the operation and security of the website. These technologies do not require consent where they fall within the exceptions provided by Section 25(2) TDDDG. Where the processing of personal data is involved, the applicable legal basis under the GDPR is also observed.

We use analytics technologies, including Google Analytics and Microsoft Clarity, to understand how visitors use our website and to improve its performance and user experience. These analytics technologies are not strictly necessary and are activated only after you have given your consent through our cookie banner (Art. 6(1)(a) GDPR). Until you provide consent, Google Analytics and Microsoft Clarity remain disabled. You may withdraw your consent at any time with effect for the future; withdrawal must be as easy as giving consent. Further information is provided in Section 11.

6. Contacting Us

You can contact us through three separate contact forms (for nurses, for employers, and for general enquiries), by email, by telephone, or via WhatsApp. Enquiry emails are handled through Google Workspace.

When you contact us, we process the personal data you provide, such as your name, contact details and the content of your message, in order to respond to your enquiry and handle your request. Where your enquiry relates to a possible or existing recruitment relationship, the legal basis is Art. 6(1)(b) GDPR. For general enquiries, the legal basis is our legitimate interest in responding to and managing your enquiry (Art. 6(1)(f) GDPR). Form and message data is stored in our Hostinger database in Frankfurt, Germany. Retention periods are described in Section 15.

7. The Application Process

When you apply as a nurse, whether through the application page, by email, or via WhatsApp, we process the personal data and documents you provide. Depending on the case, this may include your name and contact details, CV, nursing qualifications, professional experience, language qualifications, identity documents, professional registration details, recognition-related documents, and photographs.

We process this data to review your application, assess your suitability, present you to potential employers, arrange interviews, and, where you ask us to, guide you through the recognition, visa, and relocation process. The legal basis may be the taking of steps at your request prior to a possible placement or the performance of services requested by you (Art. 6(1)(b) GDPR), as well as your consent where required for sharing your profile with employers (Section 8).

Providing application data is not a legal requirement; however, without the necessary information we may not be able to process your application or provide the requested services. Application data and uploaded documents are stored in our Hostinger database and server in Frankfurt, Germany. We do not intentionally request special categories of personal data unless necessary for a specific service or legal/administrative process. Please do not provide health data or other special-category data unless we specifically request it. Where special-category data is processed, we will do so only where an applicable condition under Art. 9 GDPR permits it. Retention is set out in Section 15.

8. The Candidate Dossier and Sharing with Employers

The Candidate Dossier may contain information and documents that are relevant and necessary for a potential employer to assess your suitability for a specific nursing position — such as your professional CV, name and relevant contact details, professional photograph, nursing qualifications and certificates, professional registration details, professional experience, language qualifications or level, recognition status or relevant recognition documents, availability, and other information relating to your suitability.

We share only information that is relevant and necessary for the particular recruitment process. We do not routinely include documents such as passport copies, visa application documents, bank details or health information unless specifically necessary, lawful and appropriate.

Consent to sharing with prospective employers. You consent to Fliyon sharing your Candidate Dossier with prospective healthcare employers for the purpose of recruitment and employment opportunities. You may withdraw your consent at any time with effect for the future; withdrawal does not affect the lawfulness of any sharing carried out before your withdrawal.

9. Recipients of Your Data

Depending on the service you request and the stage of the process, your personal data may be shared with or accessed by: prospective healthcare employers in Germany (where you have consented, per Section 8); competent German recognition authorities (where you authorise us to assist with your recognition application); a Germany-based CV specialist (who prepares a professional German CV and cover letter for accepted candidates on our behalf); translation service providers; hosting, infrastructure and security providers (including Hostinger and Cloudflare); email and communication service providers (including Google Workspace and WhatsApp); and authorities, professional advisers or other recipients where necessary to comply with a legal obligation or protect our legal rights.

Where external service providers process personal data on our behalf, we require appropriate data protection arrangements. You submit your own visa and immigration application to the competent authority; we provide guidance but do not submit your visa application or transfer your data to the immigration authority on your behalf. We do not sell personal data and do not share personal data with third parties for their own direct marketing purposes.

10. Processors

We use service providers who may process personal data on our behalf in connection with the operation of our website and business. Where required, we have appropriate data processing agreements (Auftragsverarbeitungsverträge) in place. These providers include:

• Hostinger — website hosting and database storage (servers in Frankfurt, Germany);
• Google (Google Workspace) — business email and related communication services;
• Cloudflare — content delivery, website security and related technical services; and
• Google Analytics and Microsoft Clarity — website analytics, only where you have provided the required consent (Section 11).

11. Web Analytics

We use the following analytics tools only after you have given your consent through our cookie-consent mechanism (Art. 6(1)(a) GDPR). Google Analytics (Google) helps us understand how visitors use the website and may process information such as pages viewed, approximate location, and device/browser information. Microsoft Clarity (Microsoft) provides usage statistics and session-replay functionality and may record interactions such as mouse movement, scrolling and clicks; we configure Clarity to mask text input. Both tools may involve processing outside the EU, including in the United States (see Section 12). You may withdraw your consent at any time with effect for the future.

12. Transfers to Third Countries

Your core application and document data is hosted and processed within the European Union, including on our Hostinger infrastructure in Frankfurt, Germany. Some of our service providers may process personal data outside the EEA, including in the United States (such as Google, Cloudflare, Microsoft and WhatsApp). Where personal data is transferred to a third country, we rely on an applicable transfer mechanism under Chapter V GDPR — an adequacy decision (including the EU–U.S. Data Privacy Framework where applicable), or appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs), with supplementary measures where required.

13. Communication via WhatsApp

We use the WhatsApp Business app to communicate with nurses, healthcare employers, persons making referrals, business partners and others who choose this channel. WhatsApp is provided by Meta. When you communicate with us through WhatsApp, we process the personal data you provide (telephone number, name, profile information and message content) to respond to your enquiry and, where applicable, manage recruitment, referral, partnership or other business activities. The legal basis is Art. 6(1)(b) GDPR where processing is necessary for steps at your request, otherwise our legitimate interest (Art. 6(1)(f) GDPR). Meta may process personal data under its own terms, potentially outside the EEA (see Section 12). We recommend using our application page for submitting documents; where you send documents through WhatsApp, we process them for the relevant purpose in accordance with this Policy.

14. Testimonials

Where we publish a testimonial, we do so only with your consent (Art. 6(1)(a) GDPR). A published testimonial may include your first name, photograph and the content of your testimonial. We do not publish your employer’s name unless you have separately authorised us to do so. You may withdraw your consent at any time with effect for the future by contacting us.

15. Data Retention and Deletion

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by law. Key periods:

• Website and technical data. Server log data normally retained for 7 days (Section 4); analytics data per the applicable settings (Section 11).
• General enquiries. Normally deleted once resolved and no later than 6 months after the enquiry, unless a longer period is necessary for a subsequent relationship, legal obligation or legal claims.
• Nurse applications that do not lead to a placement. Normally deleted within 6 months after the process ends. Where you consent to us retaining your profile for future opportunities, we may retain it for up to 24 months.
• Identity documents. Normally deleted as soon as they have served their purpose, and no later than 3 months after the relevant step, unless a longer period is required by law or for legal claims.
• Nurses who are placed. Relevant recruitment and support documents normally retained until 6 months after employment starts, then deleted unless a specific matter, legal obligation or claim requires longer retention.
• Limited data retained after placement. After detailed documents are deleted, limited data may be retained to document the placement, administer placement fees and Welcome Support, administer the referral programme, and establish/exercise/defend legal claims.
• Employers. May request correction, update or removal of their profile at any time; removal actioned normally within 7 days where no legal reason requires retention.
• Statutory retention. Certain business, accounting and tax records must be retained for statutory periods (German law may require 10, 8 or 6 years — e.g. § 147 AO, § 257 HGB).
• Deletion requests. You may request deletion under Art. 17 GDPR; we respond without undue delay and, in principle, within one month, subject to legal exceptions.
• Backups. Deleted data may remain temporarily in routine backups until overwritten in our normal backup cycle.

16. Your Rights

You have the right to request access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), and data portability (Art. 20). Where processing is based on your consent, you may withdraw it at any time with effect for the future. Under Art. 21 GDPR you have the right to object to processing based on legitimate interests on grounds relating to your particular situation. To exercise any of these rights, contact us using the details in Section 1.

17. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for our business is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow, Germany

You may also lodge a complaint with the authority in your country of habitual residence, place of work, or the place of the alleged infringement.

18. Data Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access — including encrypted transmission (TLS) and appropriate access controls. Access is limited to persons and providers who require it. No transmission over the internet can be guaranteed completely secure.

19. Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects within the meaning of Art. 22 GDPR. Applications and candidate suitability are reviewed by a person.

20. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is the one published on our website, identified by the “Last updated” date. Changes become effective when published, unless a different effective date is stated.