Privacy Policy

Table of Contents

Privacy Policy

1. General information about the website

URL: /

This website is aimed at people applying to AMR Advanced Market Research GmbH as interviewers. Part of the application process is handled via the website.

2. Data controller

AMR - Advanced Market Research GmbH
Poststrasse 7
40213 Düsseldorf
Germany
Further information about our company can be found in our imprint.

3. Data protection officer

Brandeis Digital GmbH
Mr. Steffen Lüning Senior Consultant Data Protection
Phone: + 49 (0) 175 121 7005
Email: dataprotection@amr-research.com

4. Operation of this website

4.1 Content management system: Kirby

We run this website with the content management system Kirby. Kirby runs exclusively on our web space at our hosting provider (see 4.4). Content and applications are stored there in files – not in an external database or cloud. No data is transferred to the manufacturer of Kirby when you visit the website. Only in the password-protected administration area can Kirby check for software updates for administrators; no data of visitors or applicants is transferred in the process.

4.2 Application form and integrated software

The application form is our own development based on Kirby. Voice recordings are created directly in your browser using its built-in recording function and then transmitted to our server in encrypted form. For entering the phone number with country selection, we use the open-source library “intl-tel-input”.

All program libraries and fonts are stored on our own server. No content from third-party providers such as content delivery networks or Google Fonts is loaded when you visit the website or the form (for audience measurement see 6.2).

Uploaded voice recordings and CVs are not publicly accessible but only available to authorised employees after logging in. Files that were uploaded but not submitted with an application are automatically deleted after 24 hours at the latest.

4.3 Protection against misuse

To protect the application form against spam and overload, we limit the number of file uploads and submitted applications per visitor and hour. For this purpose, we create a check value (hash) from your IP address using a secret key and store it together with a counter. The IP address itself is not stored. The check value is no longer used after 60 minutes and is deleted on the following day at the latest.

In addition, the form contains a field that is invisible to humans and checks a minimum completion time to detect automated entries (bots). The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in the security and availability of our application process.

4.4 Hosting: ALL-INKL.COM

We use the infrastructure of ALL-INKL.COM Inhabergeführte KG (owner: René Münnich), Hauptstraße 68, D-02742 Friedersdorf, Germany, to host our website. We have deactivated the logging of server and access logs (access and error logs) in the hosting settings. Therefore, no log files are created.

4.5 Encryption: SSL certificate from Let’s Encrypt

Data transmission between server and client is encrypted via HTTPS (TLS 1.2 or higher). For this purpose, we use an SSL/TLS certificate from Let’s Encrypt, which is provided to us by our hosting provider All-Inkl.com.

5. Processing of data from the application form

An online application form for the position of interviewer is provided on this website. This form collects mandatory and voluntary personal data. It is also possible to create browser-based voice recordings or upload audio files. In addition, a CV can be submitted as a file attachment.

5.1 Data processing

When you submit the application form, we store your information as an application on our server at our hosting provider in Germany (see 4.4). Voice recordings, uploaded audio files and CVs are stored together with the application in a protected directory that is not publicly accessible. Only authorised employees have access after logging in. After you submit the form, we automatically send you a confirmation email to the email address you provided.

For further processing and to contact you, our employees transfer the data via encrypted connections (HTTPS/TLS) to company computers and, if necessary, to a protected Microsoft 365 cloud infrastructure (see 5.4).

You can find out how long we store your data under 5.3.

5.2 Data collected

When a user applies to us via the application form, we ask for the following mandatory information:

How the applicant became aware of AMR
First name
Last name
Year of birth (optional)
Country of residence
Email address
Telephone number
Language proficiency
Audio recordings
Professional experience
CV (optional)
Consent to this privacy policy

5.2.1 Audio recording in the browser

Applicants can create voice recordings directly in the form using a browser. Immediately after each recording is completed, the audio files are stored via HTTPS in a protected directory on the same server. Access is strictly limited to authorized employees.

The audio recordings are only linked to the other application data after the final submission of the form.

Storage period: All audio recordings are automatically deleted completely from our server no later than six months after receipt of the application (see 5.3).

5.2.2 File uploads

In addition to the browser audio recording, applicants can also upload existing audio files (e.g. MP3, WAV) and documents (e.g. CV as PDF or DOCX) in the form. Once the form has been sent in full, the files are encrypted and stored via HTTPS in a secure directory on the same server. Access is only permitted to authorized employees.

Storage period: All uploaded audio files and documents are automatically deleted completely from our server no later than six months after receipt of the application (see 5.3).

5.3 Storage period

We store your application with all personal data on our server (location: Germany) for a maximum of six months after receipt. After that, it is automatically anonymised: name, email address, phone number, voice recordings, uploaded files such as the CV and internal notes are completely deleted. Only information without a direct personal reference is kept for statistical purposes (see 6.4). For data transferred to company computers or Microsoft 365 for processing, the rules under 5.4 apply.

Files that you uploaded but did not submit with an application are deleted after 24 hours at the latest. You can request the deletion of your application at any time before that (see 10.4).

5.4 Further processing on local computers and Microsoft Office 365

Complete applications are downloaded in encrypted form from our web server and transferred to our protected cloud infrastructure on Microsoft Office 365. Microsoft Corporation (One Microsoft Way, Redmond, WA 98052 USA) acts as a processor in accordance with Art. 28 GDPR. Office 365 data processing takes place exclusively in data centers within the European Union or on the basis of standard contractual clauses.

Applications received and the associated audio recordings and file uploads are copied to our local machines for further processing and feedback, but are deleted after processing or after the respective deadlines have expired.

If there is no cooperation between AMR and the applicant, the files will be deleted no later than two months after the decision. If there is cooperation between the applicant and AMR, the application documents remain stored locally for as long as there is cooperation. If an interviewer is no longer commissioned by AMR for two years, the data will be deleted.

The legal basis for this data processing is Art. 6 para. 1 lit. a) and b) GDPR. »The data subject has given consent to the processing of his or her personal data for one or more specific purposes«. And the data »processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract«.

6. User behavior analysis

6.1 No analysis by the hosting provider

The logging of server and access logs (access and error logs) is deactivated in the hosting settings. Therefore, no log files are created.

6.2 Audience measurement with Matomo

We use the open-source software Matomo to statistically evaluate the use of our website, for example pages visited, time spent, referring page, device type, browser and screen resolution.

Matomo is operated without cookies; no information is permanently stored on your device. Your IP address is shortened before it is stored so that it cannot be attributed to you. The Matomo installation is operated by our service provider mixedmode (data.mixedmode.org), with whom we have concluded a data processing agreement pursuant to Art. 28 GDPR. The data is processed in Germany and not passed on to third parties.

6.3 Anonymous analysis of form usage

To improve our application form, we anonymously count up to which section the form is filled in. No cookies are set, no data is stored on your device and no IP addresses or other personal data are collected; only daily counters per form section are stored. It is not possible to link this to individual persons or applications.

6.4 Statistical evaluation of applications

For internal statistics – for example how many applications we receive from which countries, with which language skills and through which sources – we evaluate the information from the application form. The evaluation is only accessible to authorised employees and only shows aggregated figures.

Six months after receipt, every application is anonymised: name, e-mail address, phone number, voice recordings and CV as well as internal notes are deleted. Only information without a direct personal reference is kept for statistical purposes (date of receipt, country, year of birth, language skills, experience, source and whether voice recordings or a CV were provided).

6.5 Legal basis for this data processing

The legal basis for the processing described in this section is Art. 6 para. 1 lit. f GDPR (legitimate interest). Our legitimate interest lies in

  • statistically evaluating the use of our website in order to improve content and user guidance,
  • identifying where the application form is abandoned in order to improve it,
  • statistically assessing our recruiting measures – such as application sources and demand for languages.

7. Cookies

No cookies are set on most pages of this website. Audience measurement with Matomo (see 6.2) and the anonymous analysis of form usage (see 6.3) work without cookies.

Technically necessary session cookie: When you open the application form, we set the cookie “kirby_session”. It only contains a random session ID and is required to protect the form against misuse (security token) and to assign your voice recordings and uploaded files to your application. The cookie expires after two hours without activity, but no later than after four hours.

We use the same cookie for our employees to log in to the protected administration area. For logged-in employees, the session can remain valid for up to two weeks.

Temporary storage of your entries in the browser: So that your entries are not lost if you reload the form page, the form temporarily stores them in the session storage (sessionStorage) of your browser. The data remains exclusively on your device, is not transferred to us and is automatically deleted as soon as you close the browser tab or submit your application. Uploaded files and your consent to the privacy policy are not stored. You can delete the temporary storage yourself at any time via “Start over”.

The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest). Our legitimate interest lies in a secure and functional application process. As the cookie is strictly necessary to provide the application form you requested, no consent is required for it (Section 25 (2) No. 2 TDDDG).

8. Disclosure of data

8.1 Disclosure of data to third parties

Data that you provide to us will not be passed on to third parties. In particular, your data will not be passed on to third parties for their advertising purposes.

8.2 Data processing outside the European Union

We do not process your personal data in a so-called third country outside the European Union.

If we process your personal data on the basis of consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

10. Rights of data subjects

10.1 Right to information

You can request information about your personal data that we process in accordance with Art. 15 GDPR.

10.2 Right to object:

You have the right to object for specific reasons (see point II).

10.3 Right to rectification

If the information concerning you is not (or no longer) accurate, you can request rectification in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.

10.4 Right to erasure

You can request the erasure of your personal data in accordance with Art. 17 GDPR.

10.5 Right to restriction of processing

In accordance with Art. 18 GDPR, you have the right to request that the processing of your personal data be restricted.

10.6 Right to lodge a complaint

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a data protection supervisory authority of your choice in accordance with Art. 77 (1) GDPR. This also includes the data protection supervisory authority responsible for the controller State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, https://www.ldi.nrw.de/kontakt/ihre-beschwerde.

State Commissioner for Data Protection and Freedom of Information
North Rhine-Westphalia
40102 Düsseldorf
Email: poststelle@ldi.nrw.de

10.7 Right to data portability

In the event that the requirements of Art. 20 para. 1 GDPR are met, you have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to third parties. The collection of data for the provision of the website and the storage of log files are absolutely necessary for the operation of the website. They are therefore not based on consent pursuant to Art. 6(1)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR, but are justified pursuant to Art. 6(1)(f) GDPR. The requirements of Art. 20 (1) GDPR are therefore not met in this respect.

11. Right to object pursuant to Art. 21 para. 1 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (f) of Article 6(1) GDPR. The controller will then no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. The collection of data for the provision of the website and the storage of log files are absolutely necessary for the operation of the website.

12. Changes to this privacy policy

We will revise this privacy policy in the event of changes to this website or other occasions that make this necessary.

Last update of this policy: June 2025