Privacy Policy
Last updated: 2 October 2026
1. Data Controller
The data controller is D & R Duoregio UG, Zehmeplatz 14, 15230 Frankfurt (Oder), Germany — operator of the DuoRegio.eu portal, a cross-border service for economic cooperation and labor market in the Lubuskie–Brandenburg region.
Contact: kontakt@duoregio.eu
2. Scope of Data Processed
We process data that users provide themselves and data generated when they use the DuoRegio website and app. The scope depends on the features used:
— Account: first and last name or a name, e-mail address, password as a hash (we never know the password itself), optionally phone number, city and country; sign-in method (e-mail and password, or Google, Apple or LinkedIn — from these providers we receive an account ID, name and e-mail address, and from Apple also a token we use to revoke the link when the account is deleted); if two-step verification is enabled, an encrypted secret and backup codes; the list of devices signed in to the app (app version and operating system, date of sign-in and of last use; sign-in tokens are stored only as hashes); account settings, newsletter consent (the e-mail address is then passed to Brevo), saved jobs, followed companies and blocked users.
— Profile photo, if the user adds one (camera or photo library). We store it on the server and delete it when the user removes it, or together with the account.
— Candidate profile and CV: the details in the “Looking for work” profile (such as occupation, experience, language skills, preferred country and place of work, description, optionally a phone number); the profile is publicly visible on the service. We do not keep CV files: a CV attached to an application is sent by e-mail to the employer only; the file used in “Match your CV” is analysed once and not stored; a draft from the CV generator stays on the user’s device, and the generated document is available via a link for 30 minutes. Keywords extracted from a CV with the user’s consent to suggest jobs are kept in a cache for up to 7 days.
— Job applications: name, e-mail address, phone number, message, answers to the employer’s questions and an attached CV — sent to the employer by e-mail; on the service we keep an application record (job offer, company, e-mail address, account, status and dates) so that the candidate and the company can see its status.
— Company profile: name, contact details (e-mail, phone, website, social media), address and map location, tax number (NIP), industry, description, opening hours, logo, photos, menu, products and services, and data from a link provided for import (e.g. from Google Maps); the company profile is public in the directory.
— Content published by users: job offers, events, news, classified ads, forum posts and replies (including polls) and B2B requests — with any contact details given in them, photos and posters. This content is public and may be checked by an automatic content filter and by moderators.
— Messages: B2B chat between companies (content, time sent, sender and company; if automatic chat translation is enabled, messages from the other party are translated with DeepL or Google Cloud Translation into the recipient’s language — this can be turned off in the chat), company–candidate chat (see section 9), the “Contact us” form (subject, content, an optional screenshot, app version and operating system) and content reports sent to moderation.
— Notifications: entries in the notifications on the service and the device token for push notifications (with platform and app language), which we pass to Google Firebase Cloud Messaging to deliver them.
— Technical data and statistics: IP address, date and time, the address requested, browser type or app version and operating system in server logs — for security (including limits on sign-in attempts) and troubleshooting; aggregated counts of views and clicks on company profiles and job offers (without data identifying a person); on the website, statistics via Google Analytics, with analytics cookies set only after consent (see section 6). The app uses the phone’s location only on the device (nearest jobs and border crossings) and does not send it to the server.
— AI features: data the user provides to an AI feature they start (e.g. a CV, a job description, the text of a letter, a link, a photo of a menu) is processed by Anthropic on our behalf — in the app only after the user’s consent (see section 5).
— Translation: content published on the service (e.g. company descriptions, job offers, events, news, forum posts) and — where the feature is enabled — B2B chat messages (chat translation can be turned off) are translated automatically into the languages of the service with DeepL and, once its quota is used up, with Google Cloud Translation (see section 5).
— Cookies and browser storage: session, form protection, chosen language, cookie consent (see section 6).
3. Purpose of Processing
— Publishing company profiles in the DuoRegio catalog
— Publishing job offers and listings
— Translation of content (DeepL, Google Cloud Translation) and AI features started by the user (Anthropic)
— Contact with users
— Ensuring security and proper functioning of the service
4. Legal Basis
Processing is based on Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract performance), and Art. 6(1)(f) GDPR (legitimate interest of the controller).
5. Hosting and Data Storage
The hosting server is located in the European Union (OVH, Germany). Some features use service providers that process data on our behalf: DeepL (translations; Germany), Google Cloud Translation (translations when the DeepL quota is used up; Google, Ireland — data may also be processed in the USA), Anthropic PBC (AI features: matching a CV with job offers, candidate and B2B partner matching, explaining official letters, reading company details from a link you provide, reading menus from photos, and helping moderators with content stopped by the filter; USA), Google (travel times at border crossings and company details from Google Maps; USA) and Brevo (sending emails; EU). Transfers to the USA are based on the European Commission's Standard Contractual Clauses. Anthropic does not use the data we send to train models. In the app, we only send data to AI features after you agree. Content stopped by the filter, including B2B chat messages, is seen by a DuoRegio moderator.
6. Cookies
The website uses the following types of cookies:
— Essential: Laravel session, CSRF token, cookie consent
— Functional: remembering selected translation language (localStorage)
— Analytical: Google Analytics (website visit statistics). Analytics cookies are set only after consent (“OK, accept”); without consent the tool runs in a limited mode without cookies. The app itself does not use Google Analytics; pages of the service opened from the app in a browser behave as described above.
7. User Rights (GDPR)
You have the right to: access your data, rectification, erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent at any time. To exercise these rights, contact us: kontakt@duoregio.eu
8. Retention Period
Data is stored for as long as necessary to fulfill processing purposes or until consent is withdrawn. Company profiles and job offers are deleted on request or after deactivation.
9. Company–Candidate Chat
In the DuoRegio app, a company can start a conversation with a candidate who has applied for its job offer or has a visible “Looking for work” profile. The chat is used for communication in the recruitment process. We process the content of messages, the date and time they were sent, and the sender’s and recipient’s accounts, including the company the conversation concerns. The legal basis is Art. 6(1)(b) GDPR (provision of the chat feature) and, for security, abuse prevention and handling of reports, Art. 6(1)(f) GDPR (legitimate interest of the controller). Conversations are stored for 12 months after the last message. Deleting a candidate’s account deletes their conversations; after the account of a person writing on behalf of a company is deleted, their messages remain in the company’s conversation but are no longer linked to that account. If a conversation is reported, a moderator sees an excerpt of it (the most recent messages) needed to review the report. Notifications about new messages (push and, where necessary, a short email) do not contain the message content.
10. Contact
For questions regarding personal data protection, please contact:
kontakt@duoregio.eu
D & R Duoregio UG · Zehmeplatz 14 · 15230 Frankfurt (Oder), DE