[TO BE COMPLETED — Company name, registration number, address] Data protection contact: admin@staffera.eu Web: https://staffera.eu

Candidates: name, email, phone (optional), location, nationality (optional), work experience, languages, desired positions, availability, CV (optional), photo (optional), salary preferences (optional), presentation video (optional). Hotels: hotel name, email, location, country, description, logo (optional), subscription data. Technical data: IP address (in security logs), preferred language, session data. We do not collect special categories of data (health, ethnic origin, religion, sexual orientation, trade union membership, political opinions, biometric data, or criminal records).

Service delivery: create and manage your account, professional profile and connection with hotels. Recruitment: allow verified hotels to discover candidates, evaluate profiles and make contact. Communication: internal messaging between hotels and candidates. Security: account protection, fraud and abuse prevention. Service improvement: anonymous platform usage analysis. AI and recommendations: generate candidate suggestions for hotels based on professional criteria (see section 6). Payments: process hotel subscriptions.

Contract performance (Art. 6.1.b GDPR): account creation, service delivery, hotel-candidate communication, professional profiles. Legitimate interest (Art. 6.1.f GDPR): platform security, abuse prevention, anonymous usage analysis. Consent (Art. 6.1.a GDPR): AI-based recommendations, promotional emails, optional analytics. Legal obligation (Art. 6.1.c GDPR): retention of billing data per tax regulations. You can withdraw consent at any time from Settings > My Data and Privacy. Withdrawal does not affect the lawfulness of prior processing.

Verified hotels: access candidate professional profiles (experience, languages, location, availability). Direct contact information is shared according to the platform flow. Technology providers: payment processing (Stripe), artificial intelligence (OpenAI via Emergent), web hosting, database. We do not sell your data to third parties. We do not share your data for third-party advertising. [TO BE COMPLETED — Detailed list of processors with processing regions]

Staffera uses AI (currently OpenAI GPT-5.2) to generate candidate recommendations for hotels based on professional criteria: experience, languages, positions, location, availability and salary preferences. The AI does NOT receive: email addresses, phone numbers, CV content or photos. Recommendations are advisory and support human decision-making. No automated decisions with significant legal effects are made without human intervention. You can disable AI use on your profile from Settings > My Data and Privacy. [LEGAL REVIEW REQUIRED — Classification under the EU Artificial Intelligence Act]

Some technology providers may process data outside the European Economic Area (EEA). Where this occurs, appropriate safeguards under the GDPR will be applied (Adequacy decisions, Standard Contractual Clauses or DPF certification as applicable). [TO BE COMPLETED — Transfer details per processor]

Active account: your data is retained while your account is active. Deleted account: your personal data is deleted or anonymised, except data we must retain by legal obligation (billing data, security logs). Billing data: retained per applicable tax regulations. [LEGAL REVIEW REQUIRED — Specific retention periods]

Under the GDPR, you have the right to: - Access: know what data we process about you. - Rectification: correct inaccurate data. - Erasure: request deletion of your data. - Objection: object to certain processing. - Restriction: request limitation of processing. - Portability: receive your data in a structured format. - Withdraw consent: withdraw any consent given. You can exercise your rights from Settings > My Data and Privacy, or by contacting admin@staffera.eu. You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Staffera only uses strictly necessary cookies: - Session cookie (session_token): required to keep you logged in. - Language preference (staffera_lang): required to display the platform in your language. - Cookie preference (cookie_consent): required to record your cookie choice. We do not use third-party analytics or marketing cookies. We do not use trackers, pixels or advertising SDKs. You can manage your cookie preferences at any time from the cookie banner.

We implement technical and organisational measures to protect your data: password encryption (bcrypt), secure connections (HTTPS), role-based access control, rate limiting, security headers, injection protection, audit logging and hotel isolation.

[LEGAL REVIEW REQUIRED — Staffera is an employment platform. The minimum age policy will be determined by Staffera in accordance with applicable employment law.]

We may update this policy periodically. Any significant changes will be communicated through the platform. We recommend reviewing this page regularly.

For any data protection enquiries: Email: admin@staffera.eu Web: https://staffera.eu/privacy [TO BE COMPLETED — Controller's address, DPO if applicable]