Privacy PolicyHow we process your data under the GDPR

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

DokTing - Hazem Ibrahim
Operator of the “DokTing” website
Represented by: Hazem Ibrahim
Berliner Straße 24b
23738 Lensahn
Germany
Email: info@dokting.de
Phone: +49 152 29555290

Data protection officer: Based on the current assessment, the appointment of a data protection officer is not legally required (Article 37 GDPR, Section 38 BDSG). For data protection questions, please use the contact details above.

2. General information on data processing

We process personal data only to the extent necessary for providing the website, handling enquiries, preparing and performing contracts, fulfilling legal obligations, or on the basis of consent.

The services offered relate to organizational support, administrative assistance, document preparation, application support, and general guidance in connection with study, career, recognition, and application processes relating to Germany.

3. Categories of personal data processed

Depending on how the website is used and the service booked, the following data in particular may be processed: name, email address, phone number, billing address, details of education, studies, professional experience, language skills, the desired study or career path, CV, certificates, professional licenses, language certificates, application documents, uploaded documents, payment and invoicing data, communication content, proof of consent, IP address, browser data, device data, time of access, and server log files.

If clients voluntarily upload documents, these may in individual cases also contain particularly sensitive information, such as health-related data or professional evidence from the medical field. Such data is processed only to the extent necessary for the requested service or where explicit consent has been given.

4. Purposes of processing

Processing is carried out in particular for the technical provision of the website, handling contact and booking enquiries, performing pre-contractual measures, fulfilling the contract, preparing and reviewing documents, communicating with clients, processing payments, issuing invoices, documenting consents, coordinating appointments, processing uploaded documents, and fulfilling statutory retention and evidence obligations.

5. Legal bases for processing

Depending on the purpose, processing is based on Art. 6(1)(b) GDPR where it is necessary to perform pre-contractual measures or to fulfil the contract, on Art. 6(1)(c) GDPR where legal obligations exist, on Art. 6(1)(f) GDPR where there are legitimate interests in a secure, economical, and functional provision of the website, and on Art. 6(1)(a) GDPR where consent is obtained.

Where special categories of personal data within the meaning of Art. 9 GDPR are processed, this is done only where the data subject voluntarily provides such data for the requested service and where corresponding consent or another legal basis exists.

6. Contact form, enquiry form, and communication

If you contact us via a form, by email, or through other communication channels, we process the data you provide in order to handle your enquiry and any follow-up questions. This data is not passed on to third parties unless necessary.

7. Uploading documents

Documents may be uploaded as part of an enquiry or booking. These documents are processed exclusively to handle the requested service, to organizationally review the case, and to prepare the agreed support.

Clients are responsible for uploading only those documents that are necessary for the requested service. Particularly sensitive information that is not required should be redacted before uploading, where it is not needed for the service.

8. Booking and paid orders

For a paid booking, we process in particular the selected service, package data, invoicing data, payment method, contact data, uploaded documents, messages, and the confirmations given regarding data protection, the Terms & Conditions, the Withdrawal Policy, early commencement of services, and the obligation to pay.

9. Payment processing

According to the current project structure, the website provides for payment by advance payment / bank transfer. In the case of a bank transfer, the data required for invoicing and payment allocation is processed.

10. Cookies, local storage, and external services

10.1 Technically necessary storage and the cookie banner

The website uses technically necessary storage, server log files and functional processes required for operation, security, form processing, payment or display (Section 25 (2) no. 2 TDDDG).

Your choice in the cookie banner is stored locally in your browser (LocalStorage, key dokting_consent_v2) so that your decision is remembered on future visits. This storage is technically necessary to document your consent or refusal and is not used for tracking.

10.2 Google Analytics 4 – only after your consent

We use the web analytics service Google Analytics 4 (GA4) on this website to understand how visitors use the site and to improve our content and services. The service is only loaded and activated after you have given your explicit consent via the cookie banner (category “Analytics”). Until then, all measurement signals are set to “denied” in accordance with Google Consent Mode v2.

Legal basis: your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future by changing your selection via the “Cookie settings” link/button at the bottom of the page.

Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; such transfers are based on the adequacy decision for the EU-US Data Privacy Framework, to which Google is certified, and on standard contractual clauses where required.

Data processed: pseudonymous usage data (pages visited, session duration, events, device and browser information, approximate location). GA4 does not log full IP addresses; IP data is processed for coarse geolocation and is not stored.

Retention: the retention of user- and event-level data in GA4 is set to the maximum selectable period of 14 months, after which the data is automatically deleted or aggregated.

Further information: policies.google.com/privacy.

10.3 Marketing services

Marketing services such as Meta Pixel are currently not used. Should consent-requiring marketing services be used in the future, this will only take place after prior consent via the cookie banner (category “Marketing”).

11. Server log files and hosting

When you visit the website, the hosting provider may automatically process technical data, for example the IP address, the date and time of access, the file retrieved, the referrer URL, the browser type, the operating system, and status codes. This processing serves the secure and stable provision of the website.

Website hosting: Hostinger (Hostinger International Ltd.). For the secure, time-limited upload of client documents, ownCloud.online (operated by ownCloud GmbH, Germany) is used; the documents are processed there and are not stored on the website's web server. Data processing agreements pursuant to Article 28 GDPR are in place with these providers.

12. Recipients of data

Recipients of personal data may, where necessary, include IT and hosting service providers, payment service providers, email and communication service providers, accounting or invoicing service providers, and — at the express request or with the consent of the client — also universities, employers, recognition bodies, authorities, or other competent bodies.

13. Transfers to third countries

A transfer of personal data to countries outside the European Union or the European Economic Area may be considered in particular where external services, such as payment or communication service providers based or with infrastructure outside the EU/EEA, are used. The main processors (Hostinger for website hosting and ownCloud.online for document uploads) process personal data within the EU/EEA. Where, in individual cases, services based or with infrastructure outside the EU/EEA are used, we base the transfer on appropriate safeguards within the meaning of Articles 44 et seq. GDPR, in particular the European Commission's Standard Contractual Clauses or an adequacy decision.

14. Storage period

Personal data is stored only for as long as is necessary for the respective purposes or for as long as statutory retention obligations apply. In particular, the following periods apply:

Invoices and accounting vouchers: 8 years pursuant to Section 147 (3) AO (as amended since 2025), Section 257 (4) HGB, and Section 14b (1) UStG.

Annual financial statements and comparable accounting records: 10 years pursuant to Section 147 (3) AO / Section 257 (4) HGB.

Business and commercial correspondence (including emails): 6 years pursuant to Section 147 (1) nos. 2 and 3 in conjunction with (3) AO / Section 257 (4) HGB.

Contract data and proof of consent: for the duration of the contractual relationship and thereafter until the expiry of the statutory limitation periods, regularly 3 years pursuant to Sections 195, 199 BGB, unless longer retention obligations apply.

Documents uploaded via ownCloud.online: deleted after completion of the booked service or after expiry of the time-limited upload link, unless a statutory retention obligation applies.

Enquiry and contact data without conclusion of a contract: deleted as soon as they are no longer required for processing, as a rule no later than 6 months.

Server log files: deleted or anonymized by the hosting provider after a short time, as a rule within a few days, unless they are needed to investigate security incidents.

After the respective period expires, the data is deleted or destroyed in a data-protection-compliant manner, unless further retention is required by law or necessary for the establishment, exercise, or defense of legal claims. Tax-relevant documents may, in individual cases, need to be retained for longer as long as the statutory tax assessment period (Sections 169, 170 AO) has not yet expired.

15. Rights of data subjects

Within the statutory requirements, data subjects have the right to access, rectification, erasure, restriction of processing, data portability, objection to certain processing, and withdrawal of a given consent with effect for the future.

There is also the right to lodge a complaint with a competent data protection supervisory authority. The supervisory authority responsible for the controller is the Independent State Centre for Data Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, https://www.datenschutzzentrum.de.

16. Obligation to provide data

The provision of certain data is necessary in order to answer enquiries, prepare contracts, or provide services. Without this data, the processing or performance of the requested service may be wholly or partially impossible.

17. Automated decision-making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place according to the current project status.

18. Data security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration, or disclosure. These measures are adapted in line with technological developments.

19. Processing of requests in the nursing section

When you submit the nurses' initial assessment form we process the details you enter: contact data, nationality, country of residence and country of recruitment, details of your qualification, duration of studies, year of graduation and experience, language level, recognition status, current presence in Germany and your notes. The purpose is the initial administrative review and responding to your request; the legal bases are Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (pre-contractual steps).

This form does not request documents or copies of passports or ID cards. After the initial review, a separate secure and time-limited upload link is provided.

Sharing your profile with a potential employer: your data is never shared automatically with any institution or with an undefined list of institutions. Sharing takes place only after the specific employer has been identified and named to you, the data to be shared has been explained, and you have given separate and explicit consent. You may withdraw this consent at any time with effect for the future.

When you submit the employer enquiry form we process the details of the institution, the contact person and the stated need in order to answer the enquiry and organise cooperation; the legal bases are Art. 6(1)(b) and 6(1)(f) GDPR (legitimate interest in answering business enquiries).

Forms are transmitted to DokTing through the website's secured interface; documents are not stored on the web server. The data is retained for as long as it is required to process the request and the resulting relationship or to meet statutory retention periods, and is then deleted. You may at any time exercise the rights of access, rectification, erasure, restriction, objection and withdrawal set out in this policy.

20. Qualification code (Freigabecode)

When a qualification code is issued after the free initial call, we process your email address, the package discussed, the correspondence language, and the issue, expiry and usage times. The purpose is to organise the pre-contractual stage and confirm that the service suits your situation before booking; the legal basis is Art. 6(1)(b) GDPR (pre-contractual steps).

The code can be used once and is bound to your email address and the package named. The data is retained for as long as it is required to evidence the pre-contractual stage and to meet statutory retention periods for the resulting order, and is then deleted. The code creates no payment obligation, and while unused you may request its deletion.

21. Success stories and testimonials

When publishing a success story on our website we process — on the basis of the person’s explicit written consent (Art. 6(1)(a) GDPR, in conjunction with Section 22 KUG) — the name in the form they chose (full name, or first name with the initial of the surname), profession, country of origin, city and year, the story text, a photo and, where applicable, a short video. The consent document is retained as proof. Consent can be withdrawn at any time with future effect via info@dokting.de; upon withdrawal the story is removed from the website and the photo and video files are deleted from our servers. Only the record of consent and withdrawal is retained as proof of compliance.

22. Validity and amendment of this Privacy Policy

This privacy policy may be amended if technical, legal, or organizational circumstances change. The current version is available on this website.