Hospitly Elite is in an open test phase (beta). Availability and features may change; uninterrupted, error-free use is not guaranteed in this phase. Details in our terms of use

Hospitly Elite

Privacy policy

Information pursuant to Art. 13 GDPR · As of: 2026-11-12

1. Controller

Enrico Kaldasch for Enrico Kaldasch & Pornvilai Kaldasch GbR, Ackerstraße 19, 04910 Elsterwerda, Germany, info@hospitly.de.

2. Data protection officer

A data protection officer is not legally required (micro-enterprise) and has not been appointed.

3. Hosting, auth & backend

Database, authentication and storage via Supabase (region eu-central-1, Frankfurt/EU) under a data-processing agreement (Art. 28 GDPR). System emails (sign-up confirmation, password reset) are sent via the SMTP service of our mailbox provider Strato as a processor. An encrypted backup copy of the data is additionally kept on a server operated by us (Strato VPS, Germany). Server logs are processed for operational security (Art. 6(1)(f) GDPR). Images are served locally (source: Pexels). We notify ourselves of a new enquiry via the messenger service Telegram; this message contains only the time of receipt and no details from the enquiry.

4. Third-country transfer

The backend is in the EU; there is no planned transfer to third countries. As the provider (Supabase) belongs to a US parent company, a residual access path to the US cannot be fully excluded; the EU Standard Contractual Clauses serve as a safeguard (Art. 46 GDPR). If you apply for a placed position with a household outside the EU (e.g. Gulf states), your application data is transferred there — only after your explicit consent at the application step (Art. 49(1)(a) GDPR).

5. What data & legal bases

Registration/login (Art. 6(1)(b)), profile/CV/usage data of candidates (b, optionally a), applications/saved jobs (b), system emails (b). For invoicing the placement fee to clients, additionally tax retention (c). We do not ask for special categories of personal data (Art. 9 GDPR, e.g. health or religion) and do not need them for placement. Please do not include such information in your profile, your CV, a message or a consultation request; if we receive it anyway, we do not use it for placement.

6. Retention

Account data until account deletion; backups expire on a rolling basis. We keep our own invoices and records (placement fee) for eight years from the end of the calendar year (§ 147(3) AO, § 14b UStG). Server logs are deleted after 7 days at the latest.

7. Your rights & supervisory authority

Access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR); consents can be withdrawn at any time with future effect. You can delete your account and personal data yourself at any time in the “My area” section; there you can also export a machine-readable copy of your data (JSON) via “Download my data”, or request it informally by email to info@hospitly.de. Right to lodge a complaint with the competent supervisory authority: the Data Protection Commissioner of Brandenburg (LDA Brandenburg).

8. Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR (server logs, enquiries made for another household, reports), any data subject may object at any time on grounds relating to their particular situation (Art. 21(1) GDPR). A message to info@hospitly.de is sufficient.

9. Cookies & tracking

We do not use cookies or any tracking, analytics or advertising tools. The browser stores only what is needed to run the site (§ 25(2) no. 2 TDDDG): the login session (sessionStorage, until the tab is closed) and the note that the cookie notice or the beta notice was closed (sessionStorage, for the session only). No automated decision-making within the meaning of Art. 22 GDPR takes place.

10. Consultation request

Anyone requesting a consultation sends us the details from the form: name, email address, phone number if provided, preferred contact channel, the roles sought, details on working arrangement and start, whether the staff member should be ready to travel and whether they will be part of a wider household team, residences, languages and household composition, the interface language, and the note. We use these details only to answer the enquiry and prepare an offer. The legal basis is Art. 6(1)(b) GDPR where the person enquiring does so for themselves; where they enquire for another household, for example as a family office or assistant, the legal basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The enquiry is stored in our database; only we have access. If WhatsApp is chosen as the contact channel, we write or call via WhatsApp; WhatsApp (in Europe: WhatsApp Ireland Limited) then receives the phone number and connection data, and its privacy policy applies. If no contract is concluded, we delete the enquiry six months after it was received; if we are still discussing an offer at that point, six months after the last contact. Information about health, religion or other particularly sensitive topics and names of third parties do not belong in the form.