Last updated: 26 August 2026
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Melanie Martinz, MA, trading as AlpineStaff e.U.
Gartenweg 6
6161 Natters
Austria
Company registration number: FN 683616v
Commercial register court: Regional Court of Innsbruck
Email: hello@alpinestaff.at
The controller is hereinafter uniformly referred to as “AlpineStaff”.
This Privacy Policy explains how AlpineStaff processes personal data in connection with
– the public AlpineStaff website,
– the platform at app.alpinestaff.at,
– the registration and use of candidate and employer accounts,
– recruitment and placement services,
– the verification of professional qualifications and references,
– communication with candidates and employers,
– the organisation of interviews, and
– support and business contacts.
Personal data means any information relating to an identified or identifiable natural person.
When the website is accessed, technically necessary data is transmitted by the browser to the servers and service providers used to operate and provide the website.
The following data may be processed in particular:
– IP address,
– date and time of access,
– page or file accessed,
– browser type and browser version,
– operating system,
– device information,
– referrer URL,
– technical error and security information.
Where necessary, this data is processed to ensure the secure and stable provision of the website, to analyse technical errors and to prevent abusive or harmful access.
The legal basis is Art. 6(1)(f) GDPR. AlpineStaff's legitimate interest lies in the secure, reliable and technically proper operation of its online services.
For the public website, AlpineStaff may in particular use Webflow to provide the website and Cloudflare for security, network and protection functions.
The public website may use technically necessary cookies and comparable storage technologies where these are required for the operation or security of the website or for functions expressly requested by users.
Where technically non-essential analytics or comparable technologies are used, they are activated only on the basis of the relevant consent.
In this case, processing is based on Art. 6(1)(a) GDPR in conjunction with the applicable provisions of the Austrian Telecommunications Act 2021 (TKG 2021).
Consent that has been given may be withdrawn or changed at any time with effect for the future via the relevant cookie settings.
The login and platform area at app.alpinestaff.at uses only technically necessary cookies and storage technologies required for security, authentication, session management, load balancing and the proper operation of the platform.
No analytics, marketing or other tracking technologies for advertising purposes are used in the login and platform area.
Consent is not required for the technically necessary technologies used there.
When a person contacts AlpineStaff, for example by email, via a contact form or through a function within the platform, AlpineStaff processes the data provided by that person.
This may include in particular:
– name,
– email address,
– telephone number,
– company,
– content of the enquiry,
– other information provided voluntarily.
The data is processed in order to handle and respond to the respective enquiry.
Where the enquiry relates to entering into or performing a contractual or placement relationship, processing is based on Art. 6(1)(b) GDPR.
In other cases, processing is based on Art. 6(1)(f) GDPR. The legitimate interest lies in handling incoming enquiries and maintaining orderly communication.
A user account is required in order to use certain AlpineStaff functions.
The following data may be processed in particular:
– name,
– email address,
– authentication and account data,
– user role,
– language settings,
– times of registration and use,
– technical data relating to the administration and security of the user account.
Passwords are not stored by AlpineStaff in plain text.
The data is processed for the purpose of setting up, managing and securing the user account and providing the agreed platform and recruitment and placement services.
The legal basis is Art. 6(1)(b) GDPR.
When creating and using a candidate profile, AlpineStaff processes information provided by candidates themselves or generated during the subsequent recruitment and placement process.
This may include in particular:
– personal and contact details,
– professional experience,
– previous areas of work and positions,
– education and qualification information,
– language skills,
– availability and desired employment period,
– preferred areas of work,
– information regarding work authorisation,
– employment preferences,
– uploaded application and qualification documents,
– information regarding interest in specific jobs,
– placement and interview status.
The data is processed in order to provide the candidate profile, assess possible placement opportunities and carry out the recruitment and placement service requested by the person concerned.
The legal basis is Art. 6(1)(b) GDPR.
AlpineStaff provides recruitment and placement services exclusively to persons of legal age. Confirmation that the candidate is of legal age is therefore requested during profile creation.
As part of profile creation, AlpineStaff collects information regarding work authorisation insofar as this is necessary to assess whether the requirements for a potential placement are met.
This information is generally based on candidates' own declarations. Sufficient work authorisation is a prerequisite for inclusion in specific placement processes.
Where candidates require support or guidance regarding their work authorisation, they may ask AlpineStaff for corresponding information.
The processing takes place for the purpose of providing the requested placement service on the basis of Art. 6(1)(b) GDPR.
As part of its recruitment and placement services, AlpineStaff may review information and documents necessary to assess a candidate's professional qualifications and experience in relation to potential positions.
These may include in particular:
– CVs,
– proof of education and qualifications,
– certificates,
– employment references,
– reference and recommendation letters,
– information regarding previous employment relationships and professional activities.
To verify the plausibility of the professional experience provided, AlpineStaff may also obtain references and, for this purpose, contact reference persons provided by candidates or former employers.
Such contact will only take place where it is necessary for the recruitment and placement service and has been agreed with the candidate in advance.
In this context, information may be processed regarding, in particular, the duration of employment, the position held, professional experience and qualifications, as well as professional assessments provided by the reference provider.
The purpose of the review is to verify the plausibility of information in the candidate profile, assess professional qualifications and experience and enable AlpineStaff to carry out a well-founded personal pre-selection for potential placements.
Candidate data is processed on the basis of Art. 6(1)(b) GDPR insofar as this is necessary to provide the requested recruitment and placement service. Where personal data of reference persons is processed, the processing may be based on Art. 6(1)(f) GDPR. The legitimate interest lies in the appropriate verification of professional information as part of recruitment and placement services.
As part of this qualification review, AlpineStaff does not generally request criminal record certificates, health data or similar documents.
Documents uploaded for verification are stored in a private, access-protected storage area. Selected application documents are only shared with a specific employer as part of an actual placement process in accordance with Section 11.
AlpineStaff processes information contained in candidate profiles and job postings in order to identify possible matches between candidates and open positions and to support the placement process.
This may include in particular information regarding
– professional experience,
– areas of work,
– language skills,
– availability,
– qualifications,
– work authorisation,
– place of work, and
– other job-related requirements.
To support this process, AlpineStaff uses computer-assisted assessment and prioritisation mechanisms. Based on defined criteria, these mechanisms may generate internal assessments, indications and placement suggestions.
Differences relating, for example, to availability, area of work, language skills or formal qualifications may be flagged for personal review by AlpineStaff.
These assessments and suggestions are used exclusively as internal decision-support tools for AlpineStaff. They do not independently determine whether a candidate is presented to an employer or whether a candidate is shown a particular job.
AlpineStaff personally reviews potential placements.
A specific job is made available to a candidate only after manual selection by AlpineStaff. Candidates then decide for themselves whether they are interested in that position.
If a candidate expresses interest and the necessary requirements for further placement are met, AlpineStaff also decides manually whether and when the candidate profile will be presented to a specific employer.
Employers therefore do not have access to internal candidate pools or placement suggestions generated solely by automated calculations.
Personal candidate data is only made accessible to an employer once AlpineStaff has expressly approved the candidate for that employer and the required qualification review has been completed.
In particular, the computer-assisted assessment does not automatically result in an invitation, rejection, presentation to an employer or employment decision.
Decisions regarding the selection and presentation of candidates are made personally by AlpineStaff. The decision whether to enter into an employment relationship is made exclusively by the candidate and the employer.
To the extent necessary to provide the requested recruitment and placement service, processing is based on Art. 6(1)(b) GDPR.
An employer does not automatically receive access to candidate profiles merely because AlpineStaff has internally identified a possible match with an open position.
A candidate is presented to an employer only if
– the candidate has expressed interest in the relevant position,
– the qualification review required for the placement has been completed, and
– AlpineStaff has expressly approved the candidate for the respective employer.
As part of such a specific introduction, the employer may be provided with the candidate data and application documents necessary to assess the candidate and carry out the subsequent application process.
This may include in particular:
– name,
– CV,
– information regarding professional experience and previous positions,
– language skills,
– relevant qualifications,
– employment references,
– reference or recommendation letters,
– other application information required for the relevant position.
Which data and documents are shared in an individual case depends on their relevance to the specific position and the subsequent application process.
Internal assessments, rankings, review notes, internal reference notes and other information intended solely for AlpineStaff's internal review are not disclosed to employers.
In particular, employers do not have general access to the internal document storage area or to all documents uploaded by candidates.
The data is shared for the purpose of providing the requested recruitment and placement service on the basis of Art. 6(1)(b) GDPR.
Once the data has been transmitted, the respective employer generally processes the candidate data and application documents received under its own responsibility under data protection law as part of its own application or recruitment process. The data may only be used for the respective application and hiring process and may not be disclosed to third parties without authorisation.
When an employer or business registers or uses employer functions, the following data may be processed in particular:
– company and business information,
– names and contact details of contact persons,
– email address and telephone number,
– job postings,
– requirements and conditions relating to the advertised position,
– location,
– type of employment,
– working hours,
– availability and seasonal periods,
– language and qualification requirements,
– benefits offered,
– information regarding the recruitment process,
– interview and placement data.
The data is processed for the purpose of providing employer functions, publishing and managing job postings and carrying out recruitment and placement services.
Where the data subject is personally a contractual party or pre-contractual measures are involved, processing is based on Art. 6(1)(b) GDPR.
In the case of contact persons acting on behalf of a company, processing is carried out in particular on the basis of Art. 6(1)(f) GDPR. The legitimate interest lies in carrying out and organising the business and placement relationship with the respective company.
AlpineStaff supports candidates and employers in organising interviews. AlpineStaff may in particular use Google Meet to conduct online interviews.
The following data may be processed in particular:
– name or identification of the persons involved,
– relevant position,
– date and time,
– duration,
– interview status,
– acceptances or declines,
– video or meeting link,
– organisational information,
– where applicable, internal placement-related notes.
Candidates and employers may be asked to confirm proposed interview times.
Processing takes place for the purpose of providing the placement service on the basis of Art. 6(1)(b) GDPR or, in the case of company contact persons, additionally on the basis of Art. 6(1)(f) GDPR.
Personal candidate information is displayed in an employer's interview area only if the requirements for the prior approval of the candidate profile have been met.
AlpineStaff sends necessary transactional and service-related emails in connection with the use of the platform and recruitment and placement services.
These may include in particular:
– information relating to account management and authentication, for example password resets,
– information about job opportunities personally approved by AlpineStaff,
– information regarding interviews,
– changes to appointments and confirmations,
– necessary information regarding the placement process,
– notifications regarding profile or account inactivity,
– information regarding account deletion,
– responses to support requests.
These messages are required to provide the requested platform and placement services and do not constitute marketing communications.
Processing takes place in particular on the basis of Art. 6(1)(b) GDPR or, where necessary, on the basis of Art. 6(1)(f) GDPR.
AlpineStaff may use Resend for the delivery of these emails.
In this context, the email address required for delivery as well as the respective message content and technical delivery information may be processed.
Users may contact AlpineStaff with questions or problems relating to the platform or the recruitment and placement process.
The following data may be processed in particular:
– user identification,
– type of request,
– content of the request,
– processing status,
– times of communication,
– internal processing notes.
For example, requests may be submitted where a response to a job opportunity was accidentally entered incorrectly and needs to be corrected afterwards, where support is required with questions concerning work authorisation, or where a job posting needs to be reactivated.
Processing takes place for the purpose of handling the respective request on the basis of Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
The contents of completed support requests are generally stored for up to twelve months after the request has been closed.
Where further internal clarification is required, deletion may temporarily be suspended on a case-by-case basis.
AlpineStaff may manage data relating to existing or prospective business contacts in a customer relationship management system.
The following data may be processed in particular:
– name,
– professional contact details,
– company,
– role or position,
– previous communication,
– information regarding the business relationship,
– placement-related activities.
Contact details of business contacts may also originate from publicly accessible sources, such as company websites or publicly accessible business and professional directories. Where personal data has not been obtained directly from the data subject, AlpineStaff provides the information required under Art. 14 GDPR no later than at the time of the first communication.
AlpineStaff may use HubSpot for this purpose.
The processing serves the orderly management and support of business relationships and is generally based on Art. 6(1)(f) GDPR.
Where the data subject is personally a contractual party or processing serves pre-contractual measures, Art. 6(1)(b) GDPR may apply.
AlpineStaff uses external service providers to provide the website, platform and related services.
Depending on the relevant function, these may include in particular:
Supabase
for database services, authentication, server-side functions and private file storage.
The main platform, profile and placement data is stored via Supabase in the Frankfurt am Main, Germany (eu-central-1) region.
Webflow
for providing the public website.
Lovable
for the technical provision and/or deployment of the platform frontend.
Cloudflare
for security, network, routing and protection functions, for example to prevent automated or abusive access.
Resend
for sending transactional and service-related emails.
HubSpot
for managing business and company contacts.
for conducting online interviews via Google Meet and, where Google services are used on the public website on the basis of the relevant consent, for the respective functions described there.
Where service providers process personal data on AlpineStaff's behalf, they are engaged in accordance with the applicable legal requirements, in particular Art. 28 GDPR.
AlpineStaff's main platform and profile data is stored via Supabase in Frankfurt am Main, Germany.
However, depending on the relevant service and processing activity, individual service providers used by AlpineStaff may process personal data outside the European Union or the European Economic Area.
This may apply in particular to providers such as Resend, Webflow, HubSpot, Google or Cloudflare where their respective services are used.
Any transfer of personal data to a third country takes place only in compliance with the requirements of Art. 44 et seq. GDPR.
Where an adequacy decision of the European Commission exists for the relevant third country or company, the transfer may be based on that decision. In the case of appropriately certified US companies, the EU-U.S. Data Privacy Framework may in particular be relied upon.
Otherwise, the Standard Contractual Clauses adopted by the European Commission and, where appropriate, supplementary safeguards may be used.
Resend, which AlpineStaff uses to send certain transactional emails, may process or store relevant data in the United States. Appropriate contractual and other safeguards are in place for such data transfers, in particular Standard Contractual Clauses and, where applicable, certification under the EU-U.S. Data Privacy Framework.
Further information regarding the safeguards used in each case may be requested at support@alpinestaff.at.
AlpineStaff generally stores personal data only for as long as necessary for the relevant processing purpose or for as long as statutory retention obligations apply.
The following principles apply in particular to individual categories of data:
Profile data is generally stored for the duration of the active user account or ongoing recruitment and placement service.
Candidates may initiate the deletion of their account using the function provided for this purpose.
In the event of prolonged inactivity, AlpineStaff may notify candidates in advance of an upcoming deletion. Automatic account deletion will take place no earlier than after at least six months of inactivity and after an additional warning period of at least 30 days has expired.
Renewed activity within this period prevents the planned deletion due to inactivity.
Documents uploaded for a qualification review that has not yet been completed may be deleted if the process remains incomplete for an extended period. Incomplete uploads or corresponding documents may in particular be removed after approximately 30 days.
Following completion of the qualification review, the originally uploaded qualification documents will generally be deleted after six months, unless they remain necessary for another purpose.
Detailed internal assessment information, reasoning and score components may be removed seven months after completion of a placement process, in particular following a hire or the final termination of the process.
The underlying placement record may remain in reduced or pseudonymised form where this is necessary for documenting the placement process or for other permissible purposes.
Video or meeting links are generally removed within seven days after the scheduled interview date, provided they are no longer required.
Other placement-related interview details or internal notes are generally removed no later than seven months after completion of the related placement process, unless they remain necessary for another purpose.
The contents of completed support requests are generally stored for up to twelve months after completion. Where further internal clarification is necessary, deletion may temporarily be suspended.
Technical or pseudonymised logs relating to platform notifications that have already been sent or are no longer required are generally deleted after 90 days.
Technical logs required for the proper execution and traceability of an account deletion process are generally deleted after 30 days.
Data subject to statutory retention obligations is stored for the respective legally prescribed period. This applies in particular to business records relevant for tax and corporate law purposes.
Where data is required for the establishment, exercise or defence of legal claims, it may be stored within the legally permissible scope until the expiry of the relevant limitation periods.
When a candidate account is deleted, personal profile data and private documents attributable to the account are deleted or removed from active systems.
Certain existing placement, interview or support records may continue to be retained in pseudonymised form, where necessary to preserve the integrity of existing processes or for permissible documentation purposes, for the remainder of the applicable retention period.
Following account deletion, these records no longer contain personal candidate information that can be directly retrieved through the user profile.
AlpineStaff implements appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.
These measures include in particular:
– role-based access permissions,
– access restrictions at user and administrator level,
– secure authentication,
– private storage areas for candidate documents,
– server-side access controls,
– encrypted data transmission,
– limiting access to personal data to those persons and functions that require it for their respective tasks.
However, absolute protection against all conceivable risks cannot be guaranteed when processing data electronically.
The provision of personal data is generally voluntary.
However, certain information is required in order for AlpineStaff to create a user account, provide the requested recruitment and placement service or make a specific function available.
Without the information required for recruitment and placement, AlpineStaff may not be able to assess suitable positions or carry out a placement.
In particular, only candidates who have completed the profile information required for use, are of legal age and have sufficient work authorisation for the relevant placement can be included in specific placement processes.
Subject to the applicable statutory requirements, data subjects have the following rights in particular:
Right of Access – Art. 15 GDPR
Data subjects may request information as to whether AlpineStaff processes their personal data and, if so, which personal data is processed.
Right to Rectification – Art. 16 GDPR
Incorrect or incomplete personal data may be corrected or completed.
Right to Erasure – Art. 17 GDPR
Subject to the applicable statutory requirements, data subjects may request the deletion of their personal data.
Right to Restriction of Processing – Art. 18 GDPR
Under certain circumstances, data subjects may request that the processing of their personal data be restricted.
Right to Data Portability – Art. 20 GDPR
Where the applicable statutory requirements are met, data subjects may request personal data they have provided in a structured, commonly used and machine-readable format.
Right to Object – Art. 21 GDPR
Where processing is based on Art. 6(1)(e) or (f) GDPR, data subjects may object to the processing on grounds relating to their particular situation.
Withdrawal of Consent – Art. 7(3) GDPR
Consent that has been given may be withdrawn at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal remains unaffected.
To exercise these rights, it is sufficient to send a message to:
Where necessary, AlpineStaff may request additional information to verify the identity of the person making the request.
Data subjects have the right to lodge a complaint with a data protection supervisory authority if they believe that the processing of their personal data infringes the GDPR.
The supervisory authority with particular jurisdiction over AlpineStaff is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde).
The right to contact another supervisory authority having jurisdiction under the applicable legal provisions remains unaffected.
AlpineStaff may amend this Privacy Policy if the platform, service providers used, processing activities or applicable legal framework change.
The version currently published on the website shall apply.
Last updated: 26 August 2026