Information pursuant to Section 5 DDG (German Digital Services Act)
CRM Kraft LLC
Florida Limited Liability Company
7901 4th St. N, Ste. 300
St. Petersburg, FL 33702
USA
Represented by
Justus Kraft (Authorized Member)
Register entry
Register: Florida Department of State, Division of Corporations
Document Number: L23000258039
Consumer dispute resolution
We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.
Last updated: 2 November 2026
1. Overview and scope
This privacy policy explains which personal data we process when you visit this website, apply via our online form or contact us, for what purposes, on what legal basis and for how long. It also explains your rights.
"Personal data" means any information relating to an identified or identifiable person, for example a name, email address or IP address.
This privacy policy applies to the website cr-careers.com ("CR Careers"), the careers website of CRM Kraft LLC. It does not apply to websites of other providers that we link to.
In short:
- Through the application form we only collect the information we need for your application (section 10).
- The booking calendar (Calendly) and the Meta Pixel are loaded only with your consent, which you give in the cookie banner and can withdraw at any time via "Cookie settings" in the footer. The YouTube video is only loaded after your consent in the cookie banner or when you expressly request it with a click.
- We do not send a newsletter.
- The website is hosted by Hetzner Online GmbH in Germany.
2. Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
CRM Kraft LLC
Florida Limited Liability Company
7901 4th St. N, Ste. 300
St. Petersburg, FL 33702
USA
Registered with the Florida Department of State (Division of Corporations), Document Number L23000258039
Represented by: Justus Kraft (Authorized Member)
Phone: +49 174 5444423
Email: justus@crm-kraft.de
You can contact us at any time using these details with any questions about data protection or to exercise your rights.
3. Data protection officer
We have not appointed a data protection officer because, in our assessment, we are not legally required to do so. Please send any data protection requests directly to the contact details above.
4. Overview: purposes, legal bases and storage periods
| Processing | Purpose | Legal basis | Storage period |
|---|
| Server log files (hosting) | secure and stable delivery of the website, defence against attacks, error analysis | Art. 6(1)(f) GDPR | 7 days, then deleted automatically |
| Storing your cookie choice in your browser | remembering your decision so that we do not ask again | Section 25(2) no. 2 TDDDG, Art. 6(1)(c) and (f) GDPR | until you change it or delete it in your browser (section 8) |
| Application via the online form | reviewing your application and contacting you | Art. 6(1)(b) GDPR (pre-contractual steps) | 6 months after the end of the application process (section 10) |
| Campaign parameters (UTM) with the application | seeing which ad or link applications come from | Art. 6(1)(f) GDPR | same as the application |
| Talent pool (only with consent) | considering you for suitable positions later on | consent, Art. 6(1)(a) GDPR | until withdrawn (section 10) |
| Loading Calendly (only after consent) | displaying the booking calendar | consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG | until withdrawn; section 11 |
| Booking an appointment via Calendly | arranging and holding the introductory call | Art. 6(1)(b) GDPR | section 11 |
| Meta Pixel via Calendly (only after consent in "External media: Calendly") | measuring whether an appointment is booked (conversion measurement), including for ads on Meta | consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG | until withdrawn; section 11 |
| Loading the YouTube video (only after consent or a click) | displaying the video | consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG | section 12 |
| Meta Pixel (only with consent) | measuring and optimising our ads on Facebook and Instagram | consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG | until withdrawn; "_fbp" cookie 90 days (section 13) |
| Contact by email or phone | handling your request | Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR | until your request has been dealt with (section 14) |
Our legitimate interest under Art. 6(1)(f) GDPR is in each case to operate the website securely and reliably, to handle applications and requests efficiently and to understand through which channels applications reach us.
5. Hosting and server log files
This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. Hetzner processes the data on our behalf (data processing under Art. 28 GDPR).
Each time the website is accessed, the server automatically processes the following data in server log files:
- IP address of the requesting device
- date and time of access
- page or file requested (URL)
- referrer (the previously visited page, if your browser transmits it)
- user agent (browser type and version, operating system)
- HTTP status code
- amount of data transferred
Purpose: delivering the website, ensuring security and stability, detecting and defending against attacks, and error analysis.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely and without technical errors.
Storage period: Log files are stored with the full IP address for 7 days and then deleted automatically. They are not combined with other data sources or analysed for analytics or marketing purposes.
6. Name resolution (DNS)
So that your browser can find this website under its domain name, we use the DNS service of Namecheap, Inc. (USA). For a DNS query, the DNS provider usually only receives the request from your DNS resolver (usually that of your internet provider) for the website's IP address, but no website content and no data you enter on the website.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the website being reachable). For transfers to the USA see section 16.
7. SSL/TLS encryption
For security reasons this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" and the padlock symbol in your browser's address bar. This means that data you send to us cannot be read by third parties.
8. Cookies, storage in your browser and consent management (Section 25 TDDDG)
Under Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), storing information on your device (e.g. cookies or localStorage) and accessing it is generally only permitted with your consent. Exceptions are storage operations that are strictly necessary for us to provide a service you have explicitly requested (Section 25(2) no. 2 TDDDG).
Cookie banner: On your first visit we ask you in a cookie banner whether you allow optional services. You can choose "Accept all", "Only necessary", or select individual categories under "Settings":
- Necessary (always active): We store your choice in your browser's local storage (localStorage, key "ck_consent_v2", with date and version) so that we do not have to ask again. No cookie is set and nothing is sent to us or third parties. This is technically necessary (Section 25(2) no. 2 TDDDG).
- "External media: Calendly": loads the Calendly booking calendar and the services Calendly loads, including the Meta Pixel (section 11).
- "External media: YouTube": displays the YouTube video directly (section 12).
- Marketing (Meta Pixel): loads the Meta Pixel (section 13).
"External media: Calendly" and "External media: YouTube" are two separate categories: "Accept all" gives all consents (both categories and Marketing), and in "Cookie settings" you can choose each category with its own switch. The "Load calendar" button stores consent for Calendly only. Without stored YouTube consent, the YouTube video can also be loaded by clicking it; this click is not stored.
Without your consent, no third-party services are loaded and no cookies are set when you visit the website. Only after you consent can Calendly, YouTube or Meta store cookies or similar technologies on your device. The legal basis is then your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG).
Changing and withdrawing: You can change or withdraw your choice at any time via "Cookie settings" in the footer (section 20). You can also view and delete cookies and website data in your browser settings at any time.
9. Fonts
This website uses the system fonts already installed on your device. No connection to third-party servers (e.g. Google Fonts) is made when the website is loaded, except to the services Calendly loads after your consent, including Google Fonts (section 11).
10. Application via the online form
On this website you can apply via a multi-step online form (programmer or technical assistant). We process:
- the position you are applying for
- your self-assessment of your English skills
- your programming experience (programmer applications only)
- whether you are open to full-time work
- your name, email address and phone number
- the date and time of submission
- if you reached the website via a link with campaign parameters (UTM parameters, e.g. "utm_source" or "utm_campaign"), these parameters. They show us which ad or link brought you to us.
Purpose: reviewing your application, contacting you and, where applicable, arranging an introductory call.
Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract); for the campaign parameters Art. 6(1)(f) GDPR (legitimate interest in knowing through which channels applications reach us).
Transmission: When you submit the form, the data is sent in encrypted form to an automation service (workflow tool) and processed there. The service is run on our behalf by a service provider bound by a data processing agreement under Art. 28 GDPR.
After submitting: After a programmer application we show you the booking calendar for an introductory call (section 11); after a technical assistant application, a video about the next steps (section 12). If you have consented to the "Marketing" category, the Meta Pixel also reports that an application was submitted, without your form entries (section 13).
Storage period: We delete your application data 6 months after the end of the application process, unless longer retention is required by law or you have consented to being included in our talent pool. If we do start working together, we transfer the necessary data to the contract or personnel records.
Talent pool: We include you in our talent pool only with your consent (Art. 6(1)(a) GDPR), so that we can consider you for suitable positions later on. Your data then remains stored until you withdraw your consent. Your consent is voluntary. You can withdraw it at any time with effect for the future, for example by email to justus@crm-kraft.de. This does not affect the lawfulness of processing carried out before the withdrawal.
Philippine data privacy law: We also process your application data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).
11. Appointment booking with Calendly
To book an introductory call after your application, we use the Calendly service of Calendly LLC (USA).
Loaded only after consent: The booking calendar is loaded only after your consent: via "Accept all", the "External media: Calendly" category in "Cookie settings", or the "Load calendar" button. Without consent, you instead see a notice with this button. Only after your consent is a connection to Calendly established. In particular, your IP address, browser and device information and the page visited are sent to Calendly, and Calendly may store cookies or similar technologies on your device. Alternatively, you can open Calendly directly on calendly.com via a link; Calendly's privacy policy then applies.
Services loaded by Calendly: when the booking calendar opens, Calendly itself loads further services. In a test on 2 November 2026 these were the payment provider Stripe (js.stripe.com, m.stripe.com, m.stripe.network), Google (Google Analytics, Google Tag Manager, reCAPTCHA, Google sign-in, Google Fonts), Meta (Meta Pixel, connect.facebook.net), Segment, Sprig, Survicate, Braze (appboycdn.com), Airbrake and Amazon CloudFront. Technical data such as your IP address may be sent to these providers, and cookies or similar technologies may be set. This happens only after you have consented in the category "External media: Calendly". Calendly decides which services it uses; you can find details in Calendly's privacy policy.
Meta Pixel via Calendly: through the conversion-tracking integration of our Calendly account, Calendly may load the Meta Pixel after your consent. The provider is Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. Data may also be transferred to Meta Platforms, Inc., USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023, Art. 45 GDPR). The pixel is used to measure whether an appointment is booked after a visit to this page (conversion measurement), including for ads on Meta; Meta may link the data to your Meta account. We and Meta Platforms Ireland Ltd. are joint controllers for collecting and transmitting the data via the pixel (Art. 26 GDPR); Meta's Controller Addendum applies (https://www.facebook.com/legal/controller_addendum). Meta alone is responsible for any further processing (https://www.facebook.com/privacy/policy/). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time with effect for the future via "Cookie settings".
Legal bases:
- Loading Calendly and the services it loads, and storing information on your device: your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). You can withdraw it at any time via "Cookie settings" in the footer ("External media: Calendly" category; Calendly will then no longer be loaded).
- Booking an appointment: If you book an appointment, we process the data you provide (e.g. name, email address, phone number if applicable, the selected time) to arrange and hold the call (Art. 6(1)(b) GDPR). Calendly processes this data as a processor on our behalf.
Third country: Calendly is based in the USA; data is transferred to the USA (section 16).
Storage period: We keep booking data in Calendly for as long as necessary to hold and follow up on the appointment and the application process, but no longer than the period of 6 months after the end of the application process stated in section 10; it is then deleted unless statutory retention obligations apply. The respective providers inform you about how long the cookies set by Calendly and the services it loads are stored.
12. YouTube video
After a technical assistant application we show a video from the YouTube platform. The provider is Google Ireland Limited (Ireland); an affiliated company is Google LLC (USA).
We use the privacy-enhanced mode (youtube-nocookie.com). The video is loaded only after your consent or click: if you have consented to the "External media: YouTube" category (its switch in "Cookie settings" or "Accept all"), it is displayed directly without a further click. Otherwise we only show a preview image stored on our own server, and only clicking the video loads it; this click is not stored. Only then is a connection to YouTube/Google servers established. In particular, your IP address, browser and device information and the page you visited are transmitted. YouTube may also store cookies or similar technologies on your device. If you are logged in to your Google account, YouTube can associate the visit with your account.
Legal basis: your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG), which you give in the cookie banner or by clicking the video. You can withdraw consent given in the cookie banner at any time with effect for the future via "Cookie settings" in the footer ("External media: YouTube" category); the video is then removed and the preview image is shown again. Consent given by clicking the video is not stored and ends when you leave or reload the page. You can also delete the cookies set by YouTube in your browser.
Third country: Data may be transferred to the USA (section 16). More information can be found in Google's privacy policy.
13. Meta Pixel
If you allow the "Marketing (Meta Pixel)" category in the cookie banner, we use the Meta Pixel of Meta Platforms Ireland Limited (Ireland). Without this consent, the Meta Pixel is not loaded.
Purpose: We measure how many visitors come to this website through our ads on Facebook and Instagram and apply, so that we can evaluate our ads and target them better.
What happens: The pixel is loaded from Meta servers (connect.facebook.net). It sets the "_fbp" cookie on this domain (lifetime 90 days), stores information about the last external page visited in your browser's local storage ("lastExternalReferrer") and sends Meta in particular your IP address, browser and device information, the page visited, the referrer, the cookie ID and the events "PageView" and, after you submit the form, "Lead" (application submitted). The pixel may also automatically record button clicks and page information (e.g. the page title). We do not pass your form entries (e.g. name, email address or phone number) to the pixel. If you are logged in to Facebook or Instagram, Meta can associate the data with your account and also use it for its own purposes.
Legal basis: your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). You can withdraw it at any time via "Cookie settings" in the footer.
Joint controllership: We and Meta are joint controllers for collecting the data on this website and transmitting it to Meta (Art. 26 GDPR). This is based on Meta's joint controller agreement ("Controller Addendum"). Meta is solely responsible for the further processing at Meta. You can also exercise your rights directly against Meta.
Third country: Meta may transfer data to Meta Platforms, Inc. in the USA (section 16). More information can be found in Meta's privacy policy.
14. Contact by email and phone
If you contact us by email or phone, we process the data you provide (e.g. name, email address, phone number and the content of your request) to answer your request and any follow-up questions.
Legal basis: Art. 6(1)(b) GDPR if your request relates to your application or a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in handling requests effectively).
Email service: For our email communication we use Google Workspace from Google Ireland Limited (Ireland) or Google LLC (USA). Google processes the emails as a processor on our behalf. Data may be transferred to the USA (section 16).
Storage period: We delete your data once your request has been fully dealt with and no further communication is expected, unless statutory retention obligations apply or a contractual relationship arises.
15. Recipients of personal data
We only pass on your data if this is necessary for the purposes stated, there is a legal basis or you have consented. Recipients or categories of recipients are:
| Recipient | Role | Purpose | Location |
|---|
| Hetzner Online GmbH | processor | hosting, server log files | Germany |
| service provider for the automation service (workflow tool) | processor | receiving and processing application data | – |
| Calendly LLC | processor (booking) | appointment booking, only after consent | USA |
| services loaded by Calendly (Stripe, Google, Meta Platforms Ireland Ltd., Segment, Sprig, Survicate, Braze, Airbrake, Amazon CloudFront) | embedded via Calendly; for the Meta Pixel: Meta Platforms Ireland Ltd. is a joint controller (Art. 26 GDPR) | scripts in the booking calendar, Meta Pixel for conversion measurement, only after consent in "External media: Calendly" | mainly USA; Meta: Ireland (transfer to the USA possible) |
| Google Ireland Limited / Google LLC (YouTube) | independent controller | video, only after consent or a click | Ireland / USA |
| Meta Platforms Ireland Limited (Meta Pixel) | joint controller (Art. 26 GDPR) | ad measurement, only with consent | Ireland (transfer to the USA possible) |
| Google Ireland Limited / Google LLC (Google Workspace) | processor | email | Ireland / USA |
| Namecheap, Inc. | DNS provider | name resolution | USA |
Beyond this, we only pass on data if we are legally required to do so (e.g. to authorities) or if this is necessary to establish, exercise or defend legal claims. We do not sell personal data.
16. Transfers to third countries
Some of the providers mentioned are based in the USA or may process data in the USA. CRM Kraft LLC itself is based in the USA; your data is therefore also processed by us in the USA.
For transfers to the USA we rely, where the recipient is certified under the EU-US Data Privacy Framework (DPF), on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). Where there is no certification, we use the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). For services we only load with your consent, the transfer is additionally based on your consent. You can request a copy of the safeguards using the contact details in section 2.
Hetzner Online GmbH processes data in Germany; no transfer to a third country takes place there.
17. Storage period
Unless a specific storage period is stated in this privacy policy, we only store personal data for as long as necessary for the respective purpose. We then delete it unless statutory retention obligations (e.g. commercial or tax law periods) apply. In that case we restrict processing and delete the data when the period expires.
If you withdraw consent or validly object to processing, we delete the data concerned unless there is another legal basis for continued storage.
18. Your rights
Under the GDPR you have the following rights:
- Access (Art. 15 GDPR): You can ask whether and which personal data we process about you and receive a copy.
- Rectification (Art. 16 GDPR): You can ask us to correct inaccurate data and complete incomplete data.
- Erasure (Art. 17 GDPR): You can ask us to delete your data unless legal reasons prevent this.
- Restriction of processing (Art. 18 GDPR): Under certain conditions you can ask us to restrict the processing of your data.
- Data portability (Art. 20 GDPR): You can ask us to give you data you provided to us, which we process automatically on the basis of your consent or a contract, in a structured, commonly used and machine-readable format, or to transmit it to another controller where technically feasible.
- Objection (Art. 21 GDPR): see section 19 below.
- Withdrawal of consent (Art. 7(3) GDPR): see section 20.
- Complaint to a supervisory authority (Art. 77 GDPR): see section 21.
To exercise your rights, an informal message to justus@crm-kraft.de or to the address in section 2 is sufficient.
19. Right to object (Art. 21 GDPR)
RIGHT TO OBJECT
Where we process your personal data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
If your data is processed for direct marketing purposes, you have the right to object to this processing at any time; your data will then no longer be processed for this purpose.
You can send your objection informally to justus@crm-kraft.de.
20. Withdrawing your consent (Art. 7(3) GDPR)
Where processing is based on your consent (loading Calendly, Meta Pixel, YouTube video, talent pool), you can withdraw this consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.
How to withdraw: click "Cookie settings" in the footer, switch off the category concerned ("External media: Calendly", "External media: YouTube" or "Marketing (Meta Pixel)") and click "Save selection", or choose "Only necessary" for all of them. If Calendly or the Meta Pixel was already loaded on the current page, the page is reloaded; the service is then no longer loaded. The YouTube video is removed immediately. Consent given by clicking the YouTube video is not stored and ends when you leave or reload the page. You can also delete cookies already set by the providers (e.g. "_fbp") in your browser. You can also tell us informally that you withdraw consent at justus@crm-kraft.de.
21. Right to lodge a complaint with a supervisory authority
If you believe that the processing of your personal data infringes the GDPR, you have the right, without prejudice to any other remedy, to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). You can contact in particular the supervisory authority in the member state of your habitual residence, your place of work or the place of the alleged infringement.
We would, however, appreciate it if you contacted us directly first with any questions or complaints.
22. Whether you are required to provide data
You are not legally or contractually required to provide us with personal data. You can use the website without providing personal information; however, processing the server log files (section 5) is technically necessary for the website to be displayed.
For an application we need the information requested in the form. Without it we cannot process your application or contact you.
23. No decisions based solely on automated processing
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. This also applies to your application.
24. Changes to this privacy policy
We update this privacy policy when the website, our service providers or the legal situation change. The current version published on this page applies.
Last updated: 2 November 2026
.jpg)