Privacy Policy

As of: October 12, 2026

1. General Information

1.1. Controller

The controller responsible for the processing activities described in this Privacy Policy is Lunelink GmbH, Georgsplatz 1, 20099 Hamburg, Germany, email info@lunelink.com, phone +49 40 29997020 (“Lunelink”, “we”).

1.2. What this is about

We operate a platform at lunelink.com and app.lunelink.com with two sides: professionals and executives in the real estate industry create a candidate profile, which is initially shown to employers in anonymized form (“Candidates”, Section 3). Companies use it to recruit staff and, depending on the functions booked, use additional tools for marketing and sales, such as websites, online appointment booking, contact management, advertising on Meta and the AI assistant “Lune” (“Customers”, Section 4). Section 2 concerns the lunelink.com website, Section 5 the websites of our customers, Section 6 our database of real estate companies from public sources and Section 7 communication with us.

1.3. Legal bases

We process personal data on the following legal bases:

  • Consent (Art. 6(1)(a) GDPR), for example for the Meta Pixel on lunelink.com; for special categories of personal data that Candidates themselves include in their profile or documents, Art. 9(2)(a) GDPR.

  • Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), for example for candidate profiles, chats, Workspaces, billing and quote requests.

  • Legal obligations (Art. 6 para. 1 sentence 1 lit. c GDPR), such as statutory retention obligations under commercial and tax law.

  • Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR), such as the secure operation of the platform, reach measurement without cookies, measuring the success of our advertising, and contacting companies as potential employers. We state the respective interest for each individual processing activity.

The storage of and access to information on the end device (cookies) is governed by Section 25 TDDDG: strictly necessary cookies pursuant to Section 25 para. 2 no. 2 TDDDG, and all others only with consent pursuant to Section 25 para. 1 TDDDG.

1.4. Storage period

We delete personal data as soon as the purpose of the processing no longer applies and no statutory retention obligation prevents this. We specify the applicable periods for each individual processing activity. Documents that must be retained under commercial and tax law (invoices, credit notes, payment data, business correspondence) are stored for the statutory periods of six to ten years.

1.5. Recipients and service providers

Within Lunelink, only employees who need personal data to perform their duties have access to it. In addition, we use the following service providers as processors, who are contractually bound pursuant to Art. 28 GDPR:

  • Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland: hosting of the platform (application, database, file storage, technical logs) in data centers in the European Union.

  • Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA: Delivery of the lunelink.com website and our customers’ websites, domains and network security.

  • OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland: AI models for the AI functions described in this policy; processing is carried out by OpenAI in the USA. OpenAI does not use data transmitted via the interface to train its models.

  • ActiveCampaign, LLC (Postmark), 1 North Dearborn Street, Chicago, IL 60602, USA: Sending our emails.

  • Twilio Ireland Limited, 3 Dublin Landings, North Wall Quay, Dublin 1, Ireland: Sending SMS messages and forwarding telephone calls; some processing is carried out by Twilio in the USA.

  • LiveKit Incorporated, 369 Sutter Street, San Francisco, CA 94108, USA: Transmission of video and audio in video appointments (Section 2.6).

  • Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland: WhatsApp Business Platform, which we use to communicate with candidates via WhatsApp.

  • Pingen GmbH, Switzerland (Commercial Register CHE-115.571.921): Printing and mailing letters.

  • Legistry GmbH, Hunoldstraße 52, 26203 Wardenburg, Germany: Preparing and sending our invoices and credit notes, and reconciling payments.

  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: Google Workspace for our email communications, Google Maps Platform for searching for companies (Section 6). Other recipients include employers to whom candidates disclose their profile (Section 3.6), Meta as the provider of the Meta Pixel and our customers’ advertising accounts, banks and tax advisers as part of accounting, and public authorities where we are legally required to disclose data.

1.6. Processing of Data in Third Countries

Some of our service providers process personal data outside the EU and the EEA. For the United States, we base transfers on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the recipient is certified (Meta Platforms, Inc., Google LLC, Cloudflare, Inc., ActiveCampaign, LLC, Twilio Inc., LiveKit Incorporated); otherwise, we rely on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR (in particular OpenAI). An adequacy decision by the European Commission applies to Switzerland (Pingen). A copy of the EU Standard Contractual Clauses is available at https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:32021D0914.

1.7. Your Rights

You have the following rights in relation to us:

  • Access to the personal data we process (Art. 15 GDPR), in particular information about the purposes, categories, recipients, storage period and origin of the data.

  • Rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR).

  • Erasure (Art. 17 GDPR), unless processing is necessary to fulfil a legal obligation or to establish, exercise or defend legal claims.

  • Restriction of processing (Art. 18 GDPR).

  • Data portability (Art. 20 GDPR): receipt of the data you have provided in a structured, commonly used and machine-readable format.

  • Withdrawal of consent with effect for the future (Art. 7 para. 3 GDPR).

  • The right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg.

Right to object: Where we process data on the basis of legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 para. 1 GDPR). You may object to processing for the purpose of direct marketing—including contacting companies under Section 6—without giving reasons (Art. 21 para. 2 GDPR). Please send your objection to info@lunelink.com.

1.8. No automated decision-making in individual cases

Decisions that produce legal effects or similarly significantly affect you—in particular, activating a candidate profile, rejecting a registration, blocking or deleting an account—are made by our employees. AI functions only prepare these decisions (Art. 22 GDPR does not apply).

1.9. Data security

Data transmitted between your browser and our systems is encrypted using TLS; the database and file storage are encrypted at rest. We store passwords exclusively as hashes. Access to data is restricted by roles and workspaces; employees are bound to confidentiality.

2. Website lunelink.com

2.1. Provision and logs

When you access lunelink.com, we process the data transmitted by your browser: IP address, date and time, URL accessed, referrer, browser type and version, operating system, and the country derived from the IP address. The pages are delivered via Cloudflare and generated by our application hosted on Google Cloud. We delete technical logs of our application that may contain IP addresses no later than 30 days after collection. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest is providing, securing and troubleshooting the website.

If an error occurs in your browser on our website or platform, the page sends us an error message containing technical information (error text, affected page, browser type and, for logged-in users, the user ID) so that we can fix the error. We store these messages for 30 days.

2.2. Cookies

On lunelink.com, we use the following strictly necessary cookies (Section 25(2) no. 2 TDDDG, Art. 6 para. 1 sentence 1 lit. f GDPR):

  • i18n_redirected (Lunelink, 1 year): selected language.

  • country_setting (Lunelink, 360 days): selected country.

  • cookie_consent_given (Lunelink, 270 days, supplemented by the website identifier): whether the cookie selection has been made.

  • meta_pixel_enabled (Lunelink, 360 days, supplemented by the website identifier): whether consent has been given to the Meta Pixel.

The Meta Pixel cookies are set only with your consent (Section 25(1) TDDDG, Art. 6 para. 1 sentence 1 lit. a GDPR): _fbp and _fbc (Meta Platforms, three months each). You can change your selection at any time via the “Cookies” link in the website footer. After logging in to the platform (app.lunelink.com), we set the user_tkn login cookie, which keeps your session active until the end of the calendar day; it is strictly necessary for logging in.

2.3. Reach measurement without cookies

We measure the use of lunelink.com without cookies and without storing IP addresses. A hash value is generated from the IP address, browser identifier, date and website ID using a secret key; it changes daily and can no longer be assigned to any person after the day has ended. For each visit, we store this hash value, the pages visited, the entry and exit pages, the source (referrer domain, UTM parameters), country, device type, and browser and operating system category, as well as events such as submitting a form or booking an appointment. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest is analysing and improving our website. Since no cookie is set, consent under Section 25 para. 1 TDDDG is not required.

2.4. Meta Pixel and Conversions API

With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”) on lunelink.com. In this process, the pages visited, goals achieved (e.g. a request for a quote), IP address, browser data, and the pixel cookies _fbp and _fbc are transmitted to Meta. We also transmit events server-side via Meta’s Conversions API when you request a quote or book an appointment through lunelink.com; in doing so, we send your email address and telephone number exclusively as hashed values, as well as your country, IP address, browser identifier, and the pixel cookies. The purpose is to measure and optimise our advertising campaigns on Facebook and Instagram and to retarget visitors with advertising. We and Meta are jointly responsible for the collection and transmission of data to Meta (Art. 26 GDPR); you can find the agreement at https://www.facebook.com/legal/controller_addendum. Meta may process data in the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (§ 25 (1) TDDDG, Art. 6 (1) sentence 1 lit. a GDPR), which you can withdraw at any time via the “Cookies” link in the website footer. Information on data protection at Meta: https://www.facebook.com/privacy/policy.

2.5. Quote Requests and Contact Forms

Companies can request a quote via the request form on lunelink.com. We process the answers to the form questions, name, telephone number and email address, language, time zone and country, the page from which the request originates, as well as IP address and browser identifier. The request is stored as a contact and activity in our contact management system and sent to our team by email; we contact the company to clarify the company details, contact person, billing address and terms, and then set up the workspace (Section 4.1). The legal basis is Art. 6 (1) sentence 1 lit. b GDPR. If no contract is concluded, we delete the request as soon as the process has been completed.

2.6. Online Appointment Booking on lunelink.com

You can book a conversation with us via the appointment calendar on lunelink.com. We process your name, telephone number, email address, message, language, time zone and country, as well as the selected appointment. The appointment is stored on our platform and notified to the responsible employees by email. We send you an email confirmation with a calendar entry as a file attachment listing the appointment participants by name and email address, a personal link that allows you to reschedule or cancel the appointment, and reminders 24 hours, one hour and ten minutes before the appointment. For a telephone appointment, we will call you. The legal basis is Art. 6 (1) sentence 1 lit. b GDPR. We store booking data for as long as necessary for the customer relationship. A video meeting takes place in a meeting room on our platform at app.lunelink.com, which you open in your browser via the link in the confirmation; you do not need an account for this. Anyone who knows the link can participate under a name of their choice—please therefore only share it with people who are meant to participate. We use LiveKit to transmit video and audio (Section 1.5). In doing so, the name you provide, your IP address, and device and connection data are processed, and video, audio, and shared screen content are transmitted to the other participants. Even before joining, the page shows you a preview of your camera and your microphone level as soon as you allow access in your browser; this preview does not leave your browser. Video and audio are transmitted only when you join the meeting. You can switch off your microphone and camera at any time before joining and during the meeting; you share your screen only if you choose to do so. Transmission between your browser and LiveKit’s servers is encrypted. Video meetings are not recorded; video and audio are not stored after transmission. LiveKit retains technical log and usage data from the session for up to twelve months. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR; for additional participants, Art. 6 para. 1 sentence 1 lit. f GDPR (our legitimate interest in conducting the meeting).

2.7. Registration as a candidate

Anyone who registers as a candidate via lunelink.com is directed to the app.lunelink.com platform; registration is governed by Section 3.

3. Candidates (Applicant Profiles)

3.1. Registration and Confirmation via WhatsApp

When you register, we process the information you provide about your job search (field, postal code, search radius, German language skills, availability, sought-after roles and experience, salary expectations) and your mobile number. We derive coordinates from the postal code for the search-radius function. We also store your IP address, browser identifier and – if you have consented to the Meta Pixel on lunelink.com – the pixel cookies _fbp and _fbc at the time of registration so that we can later measure the success of our advertising (Section 3.9).

For confirmation, we send you a message via Meta’s WhatsApp Business Platform asking you to confirm your registration. Your reply confirms the mobile number and logs you in. Confirmation concludes the contract for the free use of the platform; the legal basis is Art. 6(1)(b) GDPR. We treat unconfirmed registrations like profiles undergoing preliminary review and delete them if no contact is established (Section 3.12).

3.2. Profile Data

You complete your profile on the platform. We process the information you provide there: form of address, title, first and last name, date of birth, place of birth, marital status, nationalities, address, email address, telephone number, language, time zone, career history (positions with employer, role, period and description), skills, language skills, sought-after roles and experience level, salary expectations, availability, search radius, profile picture, optionally an introduction video and an audio recording, as well as uploaded documents (CV, certificates). From the profile picture, we create a reduced-size version and an anonymized version; from video and audio, we create playable versions. You decide which information to provide; mandatory fields are marked on the platform. If your documents or information contain special categories of personal data (e.g. religious affiliation, health data, severe disability), we process them only because you provided them yourself (Art. 9 para. 2 lit. a GDPR); you can remove them from your profile at any time. The legal basis otherwise is Art. 6 para. 1 sentence 1 lit. b GDPR.

3.3. AI Analysis of Application Documents

At your request, we use AI to analyze uploaded documents and suggest profile information based on them (e.g. career history, skills, languages, contact details). For this purpose, we transmit the files to OpenAI (Section 1.5). If the documents contain a photo, the model identifies its position so that we can suggest a cropped version as your profile picture; the crop is generated on our systems. You review all suggestions and decide what is added to your profile. Our team may initiate the analysis in consultation with you (Section 3.5). The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

3.4. Anonymization and Summary of the Profile

To enable employers to view your profile without identifying you, we use AI to create an anonymized version of your career history and skills, from which names and identifying information are removed or generalized, as well as a brief summary of your career history for letters to employers (Section 3.8). For this purpose, we transmit the relevant profile information to OpenAI. The versions are recreated whenever you change your profile. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

3.5. Pre-screening, activation and visibility

Before activation, our team reviews your profile, generally in consultation with you via WhatsApp (Section 3.11). An AI-assisted pre-screening may evaluate your profile information, documents and previous communications to support our employees; the decision on activation is made by an employee. After activation, we will inform you by email, WhatsApp or SMS. You then control whether your profile is not shown to employers, is shown anonymously or is made public. We store the processing status of your profile (open, deferred, closed, activated), the time of your last login and internal notes. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

3.6. Display to employers and chats

After activation, we suggest your profile to employers whose locations are within your search radius and whose requirements match the roles you are seeking. Employers see only the anonymized version: form of address, age range, country, federal state and the first two digits of the postal code, approximate distance from their location, desired roles with experience level, availability, salary expectations, German language skills, the anonymized career history and anonymized skills, the obscured profile picture, and information on whether a video, audio recording, email address, telephone number, place of birth, marital status and nationalities are provided (not their content). Employers can start a chat with you; we use AI to generate a draft of the first message for the employer based on the anonymized version. We store chat messages for both parties. Only when you share your profile for a chat or set your profile to “public” does the employer receive the full details, including your name, age, place of birth, marital status, nationalities, email address, phone number, profile picture, résumé as a PDF, video, and audio. From this point onward, the employer is responsible for their further processing of this data; we contractually require employers to use the data only to fill their own positions and to treat it confidentially. At your request, we can block employers (e.g. your current employer) from viewing your profile. The legal basis is Art. 6(1)(1)(b) GDPR.

3.7. Job Agent

The Job Agent shows you employers and locations within your search radius that match your roles: employer profiles of our customers and real estate companies from our database (Section 6). No data about you is transmitted to these companies. The legal basis is Art. 6(1)(1)(b) GDPR.

3.8. Introducing You to Employers by Post

We also introduce approved profiles to real estate companies within the search radius that do not yet have an account with us, particularly by letter. The letter contains only the anonymized version: the obscured profile picture, salutation, age range, postal code region and federal state, approximate distance to the location, up to six sought-after roles with experience level, the AI-generated summary of your career history, salary expectations, availability by category, and German language skills—no name or contact details. Pingen GmbH (Switzerland) handles printing and mailing; we send the letter to it as a PDF. Recipients are companies from our database (Section 6) whose locations are within your search radius and match your roles; companies you have blocked do not receive a letter. If you set your profile to “not visible,” you will not be introduced in any letter. The legal basis is Art. 6(1)(1)(b) GDPR.

3.9. Measuring the Success of Our Advertising

When your profile is approved, we transmit an event to Meta’s Conversions API to measure which of our advertisements on Facebook and Instagram lead to registrations. We send the email address, telephone number and country exclusively as hashed values, along with the IP address, browser identifier and the pixel cookies _fbp and _fbc stored at the time of registration. Meta matches the hashed values with its user accounts; no content from your profile is transmitted. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest is measuring the success and managing the cost-effectiveness of our advertising. You may object to this processing at any time (Section 1.7). Section 2.4 applies to processing by Meta.

3.10. Notifications and Login Links

We notify you about new chats and unread messages by email (Postmark), via WhatsApp (Meta) and—if neither is possible—by SMS (Twilio). For unread messages, you receive an initial notification shortly after the message and then no more than three reminders after one, three and seven days; reminders stop as soon as you open the chat and are suspended if you have not been active on the platform for more than 60 days. Notifications contain a personal login link that takes you directly to your profile without a password; do not share this link. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

3.11. Communication via WhatsApp

Our team communicates with you via Meta’s WhatsApp Business Platform. We store the messages you send us and those we send you, including attachments, your WhatsApp profile name, and delivery status. Outside the 24-hour window specified by WhatsApp after your last message, we can only send you templates approved by Meta, such as the confirmation request, notification that your profile has been approved, notices about unread messages, queries about your profile, and notification of a deletion. WhatsApp’s Privacy Policy applies to the transmission: https://www.whatsapp.com/legal/privacy-policy-eea. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

3.12. Storage Period and Deletion

We store your profile for as long as you use the platform. You may request deletion at any time via WhatsApp or by email to info@lunelink.com. We may also delete a profile on our own initiative if you do not respond to our messages for an extended period or do not have the professional experience sought by employers; we will inform you of this via WhatsApp. Upon deletion, we remove your profile, documents, images, video, audio, chats, and WhatsApp conversation history. Technical logs are deleted after 30 days. Data that an employer has already received after you granted access is the responsibility of that employer.

4. Customers (Employers and Advertisers)

4.1. Workspace, Members and Onboarding

After a request for an offer, we clarify the contact person, billing address and terms with the company and set up a Workspace. We process company data (name, address, VAT identification number, website), the data of Workspace members (form of address, title, first and last name, e-mail address, telephone number, language, time zone, country, role in the Workspace, availability for appointment booking) and contract data (booked access packages, credits, invoice recipient, notification recipients). New members receive their access credentials by e-mail. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR; for the customer's employees who are not themselves contractual partners, Art. 6 para. 1 sentence 1 lit. f GDPR (our legitimate interest in providing the platform to the customer).

4.2. Login and Security

You can log in using your e-mail address or mobile number and password, or with a one-time code that we send by e-mail or SMS. We store passwords as hashes. Each user receives a personal API key for the application programming interface. We store the time of the last activity and set the login cookie user_tkn (Section 2.2). The legal basis is Art. 6 para. 1 sentence 1 lit. b and lit. f GDPR (account security).

4.3. Billing

We create invoices and credit notes through Legistry GmbH. For this purpose, we transmit the invoice recipient's name, address, VAT identification number, website, e-mail address and telephone number, as well as the invoice items; Legistry sends the invoice by e-mail and notifies us of incoming payments. Invoices are available on the platform. The legal basis is Art. 6 para. 1 sentence 1 lit. b and lit. c GDPR; we retain billing data for the statutory retention periods (Section 1.4).

4.4. Employer Profiles and Candidate Data

We show employer profiles (name, description, logo, locations with addresses, areas of service, roles sought) to candidates in the Job Agent and in chats. Candidates are initially suggested to the customer anonymously; the customer receives complete data only after the candidate has granted access (Section 3.6). We store chat messages, access requests, hidden and archived candidates in the workspace. The draft of the first chat message is generated with AI assistance based on the anonymized profile and previous workspace messages (OpenAI). The customer is responsible for processing candidate data granted access outside the platform. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

4.5. Websites, Forms, Appointment Booking and CRM

If the customer creates websites using the website builder, captures forms, appointment bookings and contacts, or manages deals, we process the data of the customer's visitors, prospects and contacts on the customer's behalf as a processor (Art. 28 GDPR), on the basis of the data processing agreement in our General Terms and Conditions. Section 5 applies to visitors of customer websites. We connect the customer's own domains via Cloudflare.

4.6. Calendars, Calendar Subscriptions and Video Appointments

Each workspace member has their own calendar on the platform, from which we calculate the bookable time slots for online appointment booking. It contains appointments booked with the member through appointment booking, the availability they have specified, and blocked times entered by the member themselves (time period and, optionally, a name). To ensure that appointments from other calendars are also taken into account, a member can subscribe to up to five external calendars (e.g. Google Calendar, Outlook or iCloud). To do so, the member enters the subscription URL in iCalendar format provided by the respective calendar provider. We retrieve the calendar from the provider via this URL approximately every five minutes; this does not provide access to the account there, and we do not write anything to the external calendar. The retrieval includes the calendar content made available by the provider at that URL. We store only the start and end of busy periods from the previous day up to one year in advance, as well as the calendar name—no subjects, participants, locations or descriptions; we discard everything else immediately after evaluation. The subscription URL permits the calendar to be read; we store it in our database, which is encrypted at rest, and do not display it again after saving. If a member removes a subscription, we delete the URL and the times imported from it; the same applies when the account is deleted.

When an appointment is booked, rescheduled or cancelled, we send the person who made the booking and the members involved an email with a calendar entry as a file attachment that specifies the appointment participants by name and email address. Video appointments take place in the meeting room described in Section 2.6; insofar as prospective customers and contacts of the customer participate, we process their data on behalf of the customer (Section 4.5). The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR; for the customer’s employees who are not themselves contractual partners, Art. 6 para. 1 sentence 1 lit. f GDPR (Section 4.1).

4.7. Meta Advertising Accounts

If the customer connects its Meta business account, we store the access token as well as the ID and name of the business portfolio and mirror the customer’s advertising accounts, campaigns, ad sets and ads, including the fields provided by Meta, in the platform. When managing audiences, Facebook Pages, Instagram accounts and pixels, we retrieve the lists live from Meta. At the customer’s instruction, we transmit advertising materials, ad copy and destination URLs to its advertising account. At the customer’s instruction, we send conversion events from the customer’s websites (forms, appointment bookings) to its Meta Pixel (Section 5). The customer can disconnect the connection at any time; we then revoke the authorization with Meta and delete the token. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR. Meta’s Privacy Policy applies to processing in the advertising account.

4.8. Advertising Materials and AI Assistant Lune

We create image advertising materials from the customer’s specifications (text, logos, images, colors) using OpenAI’s image models. For uploaded video advertising materials, we transmit the video’s audio track and individual video frames to OpenAI to generate a transcript and ad copy; at the customer’s instruction, we transmit the video itself to its Meta advertising account.

The AI assistant Lune performs tasks in the platform at the user’s instruction. For this purpose, we transmit to OpenAI the instructions and conversation history, the user profile details (form of address, name, email address, telephone number, language, time zone, country), information about the user’s workspaces, and the data that Lune reads from the platform or retrieves from websites it accesses at the user’s instruction. We store conversation histories and results in the user’s account and delete them upon request. If the user connects Lune to Legistry with a click, we transmit the user ID and email address to Legistry GmbH in signed form; Legistry uses them to create or link an account, after which Lune can work in Legistry on the user’s behalf. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

4.9. Notifications

We send members access credentials and one-time codes by email, notifications of new prospects and unread chats (after a delay of a few minutes and then no more than three reminders after one, three and seven days), appointment confirmations and reminders, notifications about activities in contact management, as well as notifications seven, three and one day before access expires and when it expires. The customer determines which members receive notifications about prospects and chats. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

4.10. Storage Period

We store Workspace data for as long as the usage agreement is in force. At the customer's request, we delete the Workspace and all its contents; we retain invoices, credit notes and payment data for the statutory retention periods.

4.11. Connected AI Apps

Users can connect third-party AI applications — such as Claude (Anthropic) or ChatGPT (OpenAI) — to the platform via a standardized interface (Model Context Protocol). The user sets up the connection themselves and confirms it on a consent page; in doing so, they decide which application to connect. A connected application can then access the data in the user's account and Workspaces via the API on the user's behalf, to the extent of the user's own permissions; login credentials, the API key and WhatsApp communications are excluded. We store the access credentials only as hashes and separately for each device; users can disconnect a connection at any time under “Account → AI Apps”, which immediately revokes all access credentials for the application. The respective provider determines, under its own responsibility and in accordance with its terms and privacy policy, which data the connected application transmits to it and how it processes that data; the user selects the application and is responsible for deciding which application to grant access. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR (provision of the interface requested by the user).

5. Websites of Our Customers

Customers publish their own websites using our website builder under lunelink.com or their own domains. The respective customer is responsible for data protection on these websites; information about the operator can be found in the legal notice of the respective website. We operate the websites on the customer's behalf. Technically, we process the access data specified in Section 2.1, cookie-free reach measurement pursuant to Section 2.3, the consent manager's consent cookies pursuant to Section 2.2, form entries, appointment bookings and files uploaded for the customer and—if the customer has configured its own Meta Pixel and you consent—the Meta Pixel and Conversions API with the customer's pixel pursuant to Section 2.4. If the customer embeds YouTube videos, they are loaded via youtube-nocookie.com; Google processes your data when you play them. When an appointment is booked, we send you the confirmation with a calendar entry and reminders by e-mail on the customer's behalf; video appointments take place in the meeting room described in Section 2.6, for whose transmission of video and audio we use LiveKit.

6. Database of Real Estate Companies from Public Sources

To show candidates suitable employers and contact companies as potential employers, we maintain a database of real estate companies in Germany. We identify companies via the Google Maps Platform (Places API) based on location and field of activity and then use AI to analyze the company's publicly accessible website (OpenAI). We store company data (company name, brand, description, service areas, locations with addresses, legal entity with registry details, logo, information about open positions) as well as personal data of contact persons named on the website: name, position and business contact details (e-mail address, telephone number), including addresses derived from the pattern of business e-mail addresses. We may also incorporate data from the commercial register, including the persons authorized to represent the company published there. The purposes are to display the companies to candidates as potential employers (without details of contact persons), to contact the companies by letter with anonymized candidate profiles (Section 3.8), and to contact them by email or telephone. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest is to directly contact companies in a business context with an offer related to their staffing needs. We use only data that the companies themselves have published for business purposes. As the number of companies is large, providing the contact persons with individual information would involve disproportionate effort; we therefore provide information through this Privacy Policy (Art. 14 para. 5 lit. b GDPR). We store the data for as long as the company is considered a potential employer for candidates. You may object to the processing at any time (Section 1.7); we will then block the company from being displayed and contacted.

7. Communication with us

When you contact us by email, telephone, WhatsApp or via the platform, we process the data you provide exclusively to handle your inquiry and in case of follow-up questions. If the communication is aimed at concluding a contract, the legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR; otherwise, it is Art. 6 para. 1 sentence 1 lit. f GDPR (our legitimate interest in responding to your inquiry). We delete the data as soon as the matter has been resolved and no retention obligation applies. We operate our email inboxes with Google Workspace (Google Ireland Limited). Calls to our phone number are forwarded to our employees via Twilio; Twilio processes your phone number and connection data in the process. Section 3.11 applies to WhatsApp; WhatsApp’s privacy policy is available at https://www.whatsapp.com/legal/privacy-policy-eea.

8. Contractual Partners and Suppliers

With contractual partners, suppliers and service providers, we process the data required for the contractual relationship: names and contact details of contact persons, order, invoice and payment data, as well as correspondence. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR; for contact and contract management and the operation of our IT systems, Art. 6 para. 1 sentence 1 lit. f GDPR; and for obligations under commercial and tax law, Art. 6 para. 1 sentence 1 lit. c GDPR. We delete the data after the contractual relationship ends unless retention obligations apply.

9. Changes to this Privacy Policy

We adapt this Privacy Policy when our processing activities or legal requirements change. The version published on lunelink.com at any given time applies; the effective date can be found at the beginning of this page.