Privacy Policy

This translation is provided for information purposes only. The German version is legally binding.

This privacy policy informs you about how we process personal data when you visit our websites or use JobAhoi. It applies to:

• the website www.ahoira.com,
• the website www.jobahoi.com,
• the JobAhoi app for iOS and Android and the web app app.jobahoi.com ("JobAhoi").

Sections 1 to 3 apply to everyone. Section 4 concerns visits to our websites, Section 5 the use of JobAhoi. Section 6 explains your rights, Section 7 your right to object.

1. Controller

AHOIRA UG (haftungsbeschränkt)
Rotmoosweg 7a
94469 Deggendorf
Germany
Email: info@ahoira.com

For all questions about data protection and the exercise of your rights, you can reach us at info@ahoira.com. We are not required to designate a data protection officer.

2. General information

2.1 Legal bases

We process personal data only where a legal basis under the General Data Protection Regulation (GDPR) permits it. We state the legal basis for each processing operation. The most important ones are:

• Contract (Art. 6(1)(b) GDPR): processing is necessary for the performance of a contract with you or for steps taken at your request prior to entering into a contract, for example for your account or your application.
• Legal obligation (Art. 6(1)(c) GDPR): we are legally obliged to process the data, for example to retain invoices.
• Legitimate interest (Art. 6(1)(f) GDPR): processing serves a legitimate interest that is not overridden by your interests, for example the secure operation of our services. You can object to this (Section 7).
• Consent (Art. 6(1)(a) GDPR): you have given your consent, for example to the use of your location. You can withdraw your consent at any time with effect for the future.

The storing of information on your device and the access to it are additionally governed by § 25 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, German Telecommunications and Digital Services Data Protection Act). We limit this to what is strictly necessary for the respective service (§ 25(2) no. 2 TDDDG) or obtain your consent. An exception is audience measurement on our websites (Section 4.1); there we explain what is read out. We do not set cookies.

2.2 Recipients and service providers

We use service providers that process data on our behalf and in accordance with our instructions (processors, Art. 28 GDPR). We have concluded data processing agreements with them. Some recipients also process data as controllers in their own right; we point this out in each case. Beyond that, we only pass on data if you initiate it (for example with an application) or if we are legally obliged to do so.

2.3 Transfers to countries outside the EU

Some service providers are established outside the European Union or the European Economic Area or use sub-processors there, in particular in the USA. A transfer only takes place if an adequate level of data protection is ensured:

• by an adequacy decision of the European Commission, for the USA the EU-US Data Privacy Framework, to the extent the recipient is certified under it; you can find the list of certified companies at www.dataprivacyframework.gov/list, or
• by the standard contractual clauses of the European Commission; you can find them at eur-lex.europa.eu/eli/dec_impl/2021/914/oj. You can obtain a copy of the version agreed with the respective service provider on request at info@ahoira.com.

For each service provider we state the country and the basis. For the transfer of applications to employers outside the EU, see Section 5.4.

2.4 Storage period

We store personal data only for as long as necessary for the respective purpose and then erase it or anonymise it in such a way that it can no longer be related to you. Statutory retention obligations remain unaffected: we retain invoices and accounting vouchers for eight years and books and records for ten years, in each case from the end of the calendar year (§ 147(3) of the Abgabenordnung (German Fiscal Code), § 257(4) of the Handelsgesetzbuch (German Commercial Code)). We state specific periods for the individual processing operations.

2.5 Mandatory information and automated decisions

You do not have to provide any personal data to visit our websites; however, technically necessary connection data is generated.

For a JobAhoi account, your email address and your first name are required. Further profile information is voluntary. To be able to apply, however, you need your first and last name, telephone number, nationality, residential address, your current position with its start date, the date from which you are available and at least one qualification. Without this information, an application is not possible. Employers need a company name and billing details for job advertisements.

We do not take any decision based solely on automated processing within the meaning of Art. 22 GDPR. For AhoiCheck, an automatic comparison of your profile with the requirements of a job advertisement, see Section 5.5.

2.6 Minimum age

JobAhoi is intended for persons aged 18 and over. By registering, you declare that you are at least 18 years old (Terms and Conditions § 4 paragraph 3).

3. Hosting and technical operation

3.1 Hosting of the websites and the web app

Our websites and the web app are provided by Netlify, Inc., San Francisco, USA. With each request, Netlify processes technically necessary connection data: IP address, date and time, the address requested, browser and operating system as well as the previously visited page. This also applies when you open an email from us that loads the JobAhoi logo from app.jobahoi.com.

• Purpose and legal basis: delivery and security of our services; legitimate interest in secure and functional operation (Art. 6(1)(f) GDPR).
• Netlify is our processor. Transfer to the USA on the basis of the EU-US Data Privacy Framework, alternatively the standard contractual clauses.
• Storage period: Netlify stores the connection data only for as long as necessary for delivery, troubleshooting and defence against attacks.

3.2 Language detection

Our websites and short addresses such as /privacy redirect you to the appropriate language version based on your browser's language setting. On www.jobahoi.com, we remember the selected language for the duration of your visit in your browser's session storage (sessionStorage); it is deleted when you close the browser.

• Purpose and legal basis: display in your language; legitimate interest in an understandable presentation (Art. 6(1)(f) GDPR). Storage in the browser is strictly necessary for this (§ 25(2) no. 2 TDDDG).

4. Visiting our websites

4.1 Audience measurement with Plausible

On www.ahoira.com and www.jobahoi.com we use Plausible Analytics of Plausible Insights OÜ, Tartu, Estonia. This allows us to count how our websites are used without storing personal data.

For this purpose, your browser loads a script from Plausible. The script reads information from your browser and transmits the page requested, the previously visited page and the screen width; from the connection data, Plausible derives the browser, operating system and country. On www.jobahoi.com, clicks on links to other websites are also counted. Nothing is stored on your device, and no cookies are set.

To distinguish between different visitors, Plausible generates an identifier from the IP address and browser information that cannot be reversed and changes daily. The IP address itself is not stored. You cannot be recognised across several days, devices or websites. The resulting statistics do not contain any personal data; we retain them for as long as we use Plausible.

• Legal basis: legitimate interest in a data-minimising measurement of the reach of our websites (Art. 6(1)(f) GDPR). We do not obtain consent because nothing is stored on your device and no usage profile is created. You can object at any time (Section 7).
• Plausible is our processor; processing takes place exclusively in the EU.

4.2 Contact by email

If you send us an email, we process your email address, your name and the content of your message in order to answer your enquiry. This also applies if you report content via the reporting form at www.jobahoi.com/report; reports are transmitted in the same way as enquiries via the support form (Section 4.3).

• Legal basis: if your enquiry concerns an account or a contract, Art. 6(1)(b) GDPR; otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). For notices of illegal content, additionally our obligations under the Digital Services Act (Art. 6(1)(c) GDPR).
• Our mailboxes are operated by IONOS SE, Montabaur, as processor; processing takes place in the EU.
• Storage period: until the enquiry has been dealt with; we then erase it unless there is a statutory retention obligation.

4.3 Support form on www.jobahoi.com

Using the support form, you can send us your name, your email address, a category and your message. This information is received, together with the language of the page, by our hosting provider Netlify (Section 3.1), which forwards it by email to our mailbox support@jobahoi.com. In the process, Netlify technically also receives your IP address and browser information.

• Legal basis: if your enquiry concerns an account or a contract, Art. 6(1)(b) GDPR; otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
• Netlify, Inc., San Francisco, USA, processes the information as processor; transfer to the USA on the basis of the EU-US Data Privacy Framework, alternatively the standard contractual clauses. The mailbox is operated by IONOS SE, Montabaur, as processor (Section 4.2).
• Storage period: until the enquiry has been dealt with; we then erase the email and the submission at Netlify unless there is a statutory retention obligation.

4.4 Links to other services

Our websites link to social networks and other websites. These are simple links: only when you click on a link is data transmitted to the respective provider, who is itself responsible for it.

5. Use of JobAhoi

5.1 Account and login

For an account, we process your email address, your preferred language and your first name. Login works without a password: we send you a link or a one-time code by email. To keep you logged in, a login key is stored on your device or in your browser. For each login session, we store the IP address and the identifier of your browser or device in order to detect misuse. In the absence of activity, you are automatically logged out after 8 hours in the web app and after 30 days in the app. If you change your email address, we send a confirmation to both the old and the new address.

• Legal basis: contract (Art. 6(1)(b) GDPR); for the session data, additionally our legitimate interest in the security of accounts (Art. 6(1)(f) GDPR). Storing the login key is strictly necessary (§ 25(2) no. 2 TDDDG).
• Storage period: account data until your account is deleted (Section 5.13); session data for as long as the login session exists.

5.2 Crew profile

As a crew member, you can create a profile. It may contain the following information: first and last name, telephone number, date of birth, gender, nationalities, residential address, profile picture, current and desired position on board, professional background, sailing time, navigation areas and preferred routes, experience with vessel types and propulsion types, largest vessel length and deadweight tonnage operated, preferred vessel types, qualifications and licences with date of issue and expiry date, language skills, availability, shift preferences, willingness to relocate, types of employment and salary expectations.

We do not ask for special categories of data under Art. 9 GDPR, such as health data. A profile picture may allow conclusions to be drawn about, for example, origin or religion; please only upload a picture that employers may see. You can deselect it for every application. We do not analyse pictures.

Only you can see your profile. Employers only receive information from your profile if you apply to them (Section 5.4).

• Purpose: job search, application and AhoiCheck (Section 5.5).
• Legal basis: contract (Art. 6(1)(b) GDPR). The information is voluntary; for the information required for applications, see Section 2.5.
• Storage period: until you change the information or delete your account.

5.3 Saved list

If you save job advertisements, gauges, locks or ports, we store this in your account so that you can find them again (Art. 6(1)(b) GDPR), until you remove the entry or delete your account.

5.4 Applications

When you tap "Apply", we transmit your application to the company that published the job advertisement. For this purpose, we create a PDF document from your profile. The employer finds the application in its JobAhoi application inbox and additionally receives an email with a link to the PDF; you receive a confirmation with the same link. The link works without login: anyone who knows it can open the PDF. Therefore, do not pass it on.

• Always included are your name, email address, residential address, nationalities, qualifications and language skills, experience with vessel types, navigation areas and preferred routes as well as the results of AhoiCheck (Section 5.5).
• You can deselect before submitting your gender, profile picture, telephone number, date of birth (the PDF will then not show an age), salary expectations, your professional background and your availability. Gender is preselected so that the employer can address you correctly; you can deselect it. The employer does not receive deselected information, neither in the PDF nor in the application inbox.
• Legal basis: performance of our user agreement with you (application function) at your initiative (Art. 6(1)(b) GDPR).
• Employer as controller: upon receipt, the company is itself the controller of your application data. We have no influence on the processing there; you exercise your rights vis-à-vis the employer against the employer. We remain the controller for the application stored by us.
• Employers outside the EU: if the employer is established outside the EU or the EEA, we transfer your application there because you initiate this with your click (Art. 49(1)(b) GDPR). For some countries, such as Switzerland or the United Kingdom, an adequacy decision exists; for others, such as Serbia or Ukraine, it does not; there, protection equivalent to EU law is not guaranteed. You can see the employer's country in the job advertisement.
• Storage period with us: we retain the application for six months from submission, at most until your account is deleted, so that it remains traceable for you and the employer and so that we can prove the transmission, for example if a dispute arises about the application (Art. 6(1)(f) GDPR). We then anonymise it and delete the PDF; the link will then no longer work. Only statistics without reference to your person are retained.

For employers, we also count how often an advertisement has been viewed, saved and opened. These figures do not contain any information about individual persons.

5.5 AhoiCheck

AhoiCheck compares the information in your profile with the requirements of a job advertisement. For each requirement, such as a licence, a qualification, experience with a vessel type, a navigation area or a salary expectation, it shows whether your profile meets it, and counts the requirements met. It does not produce an overall score and does not take any decision. Requirements relating to information deselected in the application do not appear in the result for the employer and are not counted.

You see the result yourself in the app before you apply. If you apply, it is included in the PDF for the employer. A human at the employer decides on your application. If you consider a result to be wrong, you can tell us at any time; we will look into it. AhoiCheck does not influence the order of job advertisements in the job search.

• Legal basis: contract (Art. 6(1)(b) GDPR).
• Storage period: we store the result together with the application (Section 5.4); without an application, it is only calculated for display.

5.6 Employer account and job advertisements

For employers, we process the company name, company size, company logo, address, website, name, position and telephone number of the contact person as well as the email address for applications. We receive the information on contact persons from the employer. The company name, logo and application address are visible to users in the job advertisements. We publish the content of job advertisements in the package booked; expired advertisements remain in the archive for the employer.

• Legal basis: if the employer is a natural person, contract (Art. 6(1)(b) GDPR). For data of contact persons and employees of the employer, our legitimate interest in performing the contract with the employer (Art. 6(1)(f) GDPR).
• Storage period: until the account is deleted; for job advertisements in the archive, see Section 5.13; for billing data, see Section 5.7.

5.7 Payment and invoices

Employers pay for job advertisements via Stripe. For this purpose, we transmit to Stripe the name or company name, the email address for invoices, the billing address, where applicable the VAT identification number and an internal customer number. The payment page is operated by Stripe; you enter your payment details directly there, we do not receive them. We receive the invoice and the payment status from Stripe.

• Legal basis: contract and statutory obligations regarding invoicing and retention (Art. 6(1)(b) and (c) GDPR); for contact persons, see Section 5.6.
• Our contractual partner is Stripe Payments Europe, Limited, Dublin, Ireland. Stripe processes the data for payment processing on our behalf. For its own purposes, in particular fraud prevention, risk management and compliance with legal obligations such as the prevention of money laundering, Stripe is itself the controller; this also applies to data that Stripe collects on its payment page. More information: stripe.com/de/privacy.
• Stripe transfers data to Stripe, LLC in the USA on the basis of the EU-US Data Privacy Framework, alternatively the standard contractual clauses.
• Storage period: invoices and accounting vouchers eight years, accounting data ten years (Section 2.4). If your account is deleted, we separate the billing address, Stripe customer number and orders from the account and restrict their processing: they are then accessible only internally and are used exclusively to comply with our retention obligations (§ 147 of the Abgabenordnung (German Fiscal Code), Art. 17(3)(b) and Art. 18 GDPR). Ten years after the end of the year in which your account was deleted, we erase them automatically. We delete the customer record at Stripe; Stripe retains invoices and payments as our processor in accordance with the data processing agreement (Art. 28 GDPR).

5.8 Translation of job advertisements

If an employer writes its own job title or its own description, we send these texts for translation into the languages of JobAhoi to the translation service DeepL of DeepL SE, Cologne. The job title and description must not contain any personal data, such as names or contact details of contact persons; there are separate fields for this which are not translated (Terms and Conditions § 12 paragraph 5).

• Legal basis: contract with the employer (Art. 6(1)(b) GDPR).
• Storage period: we store the translations together with the advertisement until it is deleted; advertisements in the archive keep their translations (Section 5.13).

5.9 Emails

We send emails via Postmark for login and changes of email address, regarding applications, the conclusion of and withdrawal from contracts, and deletion requests without the app. In the process, the email addresses, the information required for the respective email, such as names, advertisement title, company name or deletion date, and the respective link are processed. We do not record whether and when you open an email.

• Legal basis: contract (Art. 6(1)(b) GDPR).
• Postmark is operated by AC PM LLC, Chicago, USA, as processor; the data is processed in the USA. The basis is the EU-US Data Privacy Framework, alternatively the standard contractual clauses.
• Storage period: Postmark stores the content and sending data of emails for 45 days. Postmark stores delivery failures and spam complaints without time limit so that no further emails are sent to these addresses.

Newsletter: If you have given your consent during registration or later in your account, we send our newsletter with news about JobAhoi, tips and offers to your email address. In the process, we process your email address and the language you have selected. We use an email service provider as processor for sending it.

• Legal basis: consent (Art. 6(1)(a) GDPR). Your consent is voluntary. You can withdraw it at any time in your account or via the unsubscribe link in every newsletter.
• Storage period: until you withdraw your consent. We keep the record of your consent in accordance with Section 5.14.

5.10 Location

If you wish, JobAhoi shows gauges, locks and ports near you. For this we need your location. We ask for your consent beforehand; in addition, your operating system asks for permission. As long as you have given consent, we store your most recently determined location with the time in your account and update it when you open the app. We do not store a history. Nobody except you can see your location; employers do not receive it.

• Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
• Withdrawal: at any time in the app settings; we then delete the stored location. In addition, you can revoke the permission in your operating system's settings.

5.11 Maps

For maps, JobAhoi loads map tiles, fonts and symbols from OpenFreeMap, a service of Hyperknot Software Kft., Hungary. In the process, the operator receives your IP address, information about your device and the map section displayed. We are the controller for the transmission of this data to the operator when the maps are loaded; you can exercise your rights in relation to this transmission with us. The operator is independently responsible as controller for any further processing (privacy policy: openfreemap.org/privacy). It delivers the content via Cloudflare, Inc., USA, which is certified under the EU-US Data Privacy Framework.

According to the operator, access logs do not contain IP addresses; error logs may contain your IP address. Logs are deleted after seven days, and in the event of security incidents after no more than 30 days. More information: openfreemap.org/privacy.

• Legal basis: legitimate interest in a functional map display without our own map servers (Art. 6(1)(f) GDPR).

5.12 Error reports

So that we can detect and fix errors, JobAhoi sends reports to Sentry in the event of crashes and errors. They contain the error message and code location, device, operating system, app version as well as the most recently accessed areas of the app, including the identifiers of displayed content, such as a job advertisement. In individual cases, error messages may contain parts of entered data. We also measure the loading times of the app. The reports are not assigned to any account; we have disabled the storage of IP addresses. The error module creates a random installation identifier on your device. We remove it from the reports; only reports on crashes in the system-level part of the app may still contain it. It is not linked to any account. Until transmission, a report may be temporarily cached on your device for a short time.

• Legal basis: legitimate interest in a stable and secure app (Art. 6(1)(f) GDPR).
• Sentry is operated by Functional Software, Inc., San Francisco, USA, as processor. The error reports are stored in Frankfurt am Main; data relating to our team's account is located in the USA. The basis is the EU-US Data Privacy Framework, alternatively the standard contractual clauses.
• Storage period: 30 days.

5.13 Deletion of your account and access to your data

You can delete your account at any time in the app. Without the app, you can request deletion at app.jobahoi.com/delete-account; you confirm the request via a link that we send to the email address of your account. After a period of 30 days, during which you can still revoke the deletion, we block your account, end active job advertisements and erase your information or anonymise it in such a way that it can no longer be related to you. Only the following are kept:

• anonymous statistics and technical records without any reference to your person, so that references in the database do not break,
• for employers, the job advertisements in the archive as company content, without a contact address,
• the records and logs referred to in Section 5.14, only for the period stated there,
• for employers, the billing data that we are required to retain; its processing is restricted (Section 5.7).

To protect the form for requests without the app against misuse, we store pseudonymised check values, which we erase after one day; the legal basis is our legitimate interest in protection against misuse (Art. 6(1)(f) GDPR).

In the settings, you can also retrieve a copy of all data stored by us in connection with your account.

5.14 Records and logs

We store the fact that you have taken note of this privacy policy and accepted the Terms and Conditions together with the respective version and the time (Art. 6(1)(b) and (f) GDPR). We store consents given, for example for location, as proof (Art. 7(1), Art. 6(1)(c) GDPR).

We log important events in your account, such as the creation of qualifications, a deletion request or a data export, for traceability and security (Art. 6(1)(f) GDPR). If your account is deleted, only the type of event and the time remain in these logs; we erase content such as your email address or a reason for deletion.

After your account has been deleted, we retain these records and logs until the end of the third year after the year of deletion and then erase them.

We retain the proof of a contract withdrawal until the end of the third year after the year of its receipt, irrespective of the deletion of your account, and, after your account has been deleted, the proof of contractual notices sent until the end of the third year after the year of deletion. The legal basis in each case is our legitimate interest in being able to prove the course of the contract within the limitation period (Art. 6(1)(f) GDPR).

5.15 Storage on your device

In addition to the login key (Section 5.1), JobAhoi stores on your device which notices you have hidden, cached images such as company logos, cached map tiles, the result of the check for a new app version, the installation identifier of the error module (Section 5.12) and, until transmission, error reports. This is strictly necessary for JobAhoi to function (§ 25(2) no. 2 TDDDG); we use the installation identifier of the error module exclusively to detect and fix errors that impair the functioning of the app, not to analyse your usage. JobAhoi does not use cookies or advertising, and apart from measuring loading times for troubleshooting (Section 5.12) it does not use any analytics tools.

To check for a new app version, the app sends its version, the platform and the language set to our server; we store this information without reference to your account.

5.16 Database, storage and servers

We store the data of the JobAhoi app and the web app with Supabase. The database and the file storage are located in Frankfurt am Main. With each request, Supabase processes technically necessary connection data such as your IP address and stores it in logs for no more than seven days; backups are overwritten after no more than seven days.

• Legal basis: contract and legitimate interest in secure operation (Art. 6(1)(b) and (f) GDPR).
• Our contractual partner and processor is Supabase Pte. Ltd., Singapore. Supabase and its sub-processors may process data in Singapore and the USA, for example for support and maintenance. The basis is the standard contractual clauses.

6. Your rights

You have the right

• to obtain access to the data we hold about you (Art. 15 GDPR),
• to have inaccurate data rectified (Art. 16 GDPR),
• to request the erasure of your data (Art. 17 GDPR),
• to have processing restricted (Art. 18 GDPR),
• to receive your data in a commonly used, machine-readable format (Art. 20 GDPR),
• to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, write to us at info@ahoira.com.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht
Promenade 18
91522 Ansbach
Germany
www.lda.bayern.de

7. Your right to object under Art. 21 GDPR

Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. No particular form is required for an objection; an email to info@ahoira.com is sufficient.

8. Changes to this privacy policy

We adapt this privacy policy when our services or the legal situation change. You can find the current version at any time at www.jobahoi.com/privacy and www.ahoira.com/privacy as well as in the app. If the way we process your data changes materially, we will inform you in the app and, where necessary, ask for your consent.

Version 1.3 · 2026-11-01 · AHOIRA UG