Privacy Policy

  1. Home
  2. Privacy Policy

Privacy Policy


1.1. This Privacy Policy governs the manner in which OPEN WAY LTD, registered under number 15074503 (“Company”), collects, uses, maintains, and discloses information collected from users (“User”) of the "" website (“Website”).

2. Basis and management of personal information

2.1. Legal age and capacity

Effective consent for the gathering, processing, and utilization of your data can only be provided once you attain legal age and possess the necessary legal capacity. Consequently, if you are under 18 years old, the operator is prohibited from storing your data on this website. By agreeing to this privacy policy, you affirm that you possess legal competence upon reaching the age of majority. It is the responsibility of parents or guardians to safeguard the privacy of their children.

2.2. Objectives and legal foundation for data processing

The operator processes your data for the following purposes (Art. 13 para. 1c GDPR):

  1. Facilitating the initiation of a service, work, labor, or other employment relationship between the freelancer and the project provider via a project.
  2. Displaying freelancer and employee profiles.
  3. Showcasing projects and company profiles.
  4. Managing contract and payment processes.
  5. Organizing office and administration tasks.
  6. Sending notifications, including sales/promotional information.
  7. Handling customer and invoice management, time recording, and reporting.
  8. Providing customer support.
  9. Managing contracts, including the establishment of contact, negotiation, conclusion, administration, and control.
  10. Providing insurance coverage for property damage, material damage, and personal injury (for selected projects).

The processing of your data is based on the following legal grounds:

  1. Consent (Art. 6 para. 1 lit. a GDPR).
  2. Necessity for the fulfillment of the contract (Art. 6 para. 1 lit. b GDPR).
  3. Legitimate interest (Art. 6 para. 1 lit. f GDPR).
  4. Processing is not absolutely necessary to protect the legitimate interests of the controller or a third party (Art. 13 para. 1 lit. d GDPR). In the case of individual product functions or services, a legitimate interest (Art. 6 para. 1 lit. f GDPR) must be assumed; otherwise, these functions or services may not be available or may be available only to a limited extent. Additional information on legitimate interest can be found in the respective chapters.

2.3. Management of Personal Information and utilizes personal data for its services, storing this information internally in a database managed by the operator. No data is gathered from individuals who are minors.

The operator strictly adheres to data protection regulations when handling personal data, implementing all necessary technical and organizational security measures to ensure continuous protection against unauthorized access and misuse.

Any storage or processing of personal data occurs within a highly secure data center. To safeguard data during transmission, advanced encryption methods (e.g., SSL) are employed through HTTPS. Servers are fortified with firewalls and virus protection. Standard practices such as backup and recovery procedures, as well as role and authorization concepts, are implemented to uphold data security.

Employees of the operator are obligated to adhere to the regulations outlined in the German Telemedia Act (TMG), the German Telecommunications Act (TKG), the new Federal Data Protection Act, and the General Data Protection Regulation (GDPR) when handling data.

2.4 Individuals and authorized personnel with access to personal data

The operator may disclose the personal data stored to the specified recipients or categories of recipients, as per Article 13, paragraph 1, letter e of the GDPR:

Your personal data may be accessible to our customers based on their membership status. These include:

  • Freelancers
  • Project providers (end customers, system houses, consulting companies, and personnel service providers)

Your personal data will be internally processed by the relevant department(s), which include:

  • IT
  • Support
  • Sales & marketing
  • Accounting

We have engaged service providers (referred to as order processors) who undergo careful selection and verification. Additionally, we enter into an order processing contract (OPC contract) with each service provider. Our service providers encompass:

  • Data center operator, cloud services provider
  • Partner portals
  • Development, system administration, and consulting services
  • Shipping service provider
  • Contract management ( Service GmbH)

To fulfill your request or comply with a legal obligation, it is necessary to share your personal data with the following third parties:

  • Tax office
  • External payment service providers

3. Website Overview

3.1. Gathering General Information

The operator does not create individual user profiles for users of However, when accessing the website, general information is automatically gathered and stored in log files. This information, such as IP addresses, operating system details, browser information, referrer URL, access time, and similar data, is collected for purposes such as ensuring a smooth website connection, facilitating its use, evaluating system security and stability, meeting accountability and verification obligations, and other administrative purposes.

This data is not used to make conclusions about individual users. Instead, it may be statistically analyzed to optimize the website and its underlying technology. The processing is conducted in accordance with Article 6, paragraph 1, lit. f of the GDPR, based on the legitimate interest in enhancing the stability and functionality of the website.

Technical service providers, serving as order processors for website operation and maintenance, may be recipients of the data. The collected data is deleted when it is no longer needed for its intended purpose, generally after the respective session ends. General log files are retained for six weeks, and encrypted audit logs related to payment transactions are stored for 12 months (in compliance with PCI-DSS certification requirements).

While providing personal data is neither legally nor contractually obligatory, the absence of an IP address may impact the guaranteed service and functionality of the website. Certain services may also become unavailable or restricted. As a result, objection to this data processing is excluded.

3.2 Incorporation of external services and content

Third-party content, such as tweets from Twitter, videos from YouTube, RSS feeds, or graphics from other websites, may be incorporated into the website. This integration necessitates that the providers of this third-party content obtain the user's IP address, as without it, they cannot transmit the content to the user's browser. The IP address is essential for displaying this content. The operator strives to include only content from providers who use the IP address solely for content delivery. However, the operator cannot control whether third-party providers store the IP address, for example, for statistical purposes. If such information is known, the operator will notify the user.

3.3. Cookies and local storage

Like many other websites, utilizes "cookies" and "local storage" (also referred to as "local data" and "local storage") to enhance the design and continuous improvement of the website. These technologies are employed to optimize the user experience. In addition to essential cookies, external cookies are used for analysis or personalization of website access.

Cookies, which are small text files, are stored on your end device (such as a laptop, tablet, smartphone) when you visit the website. This automatically provides the operator with specific information, including your IP address, browser type, operating system, and your internet connection details. Cookies do not have the capability to execute programs or deliver viruses to a computer. The operator utilizes the information stored in cookies to facilitate navigation and ensure the correct display of web pages. No data collected through cookies will be shared with third parties or linked to personal data without your consent.

Local storage allows data to be stored locally in the browser's cache, remaining available until the cache is cleared. Third parties cannot access the data stored in local storage, and it is not used for advertising purposes.

According to legal requirements, the website may store cookies (or local storage) on your device if they are essential for the site's operation. For other types of cookies, your permission is required. The operator uses a cookie consent (cookie banner) from Cookiebot to obtain consent, and you can view, change, or revoke your consent at any time through the cookie notice at

You have the option to delete individual cookies or the entire cookie stock through the cookie consent (cookie banner) or your browser settings. Information and instructions on deleting or blocking cookies can be found based on your browser provider:

This website uses various types of cookies, including those placed by third parties appearing on the pages.

4. Participants, user accounts, and tasks

4.1. Registration

To effectively register on, a valid email address is required. To verify the registration made by the email address owner, the operator employs the double opt-in procedure. This involves sending a confirmation email and logging the receipt of the response.

As a registered user, you can access content and services based on your membership. Registered users have the flexibility to modify or delete the provided data at any time. The operator is committed to providing information about stored personal data and will make corrections or deletions upon request, as long as it complies with legal data retention obligations. Contact us for assistance (refer to "Operator").

During registration, the following personal data is collected:

For Freelancers:

  • Salutation
  • First and last name
  • Email address

For End Customers, System Houses, and Consultancies:

  • Company name
  • Company address
  • First and last name of the contact person
  • Email address
  • Telephone number

For Personnel Service Providers:

  • Company name
  • Company address
  • First and last name of the contact person
  • Email address
  • Telephone number
  • Payment method and data
  • Billing address

If registration serves the fulfillment of a contract or pre-contractual measures, the additional legal basis for data processing is Art. 6 para. 1 lit. b GDPR.

Technical service providers acting as order processors for website operation and maintenance may receive the data.

Providing personal data is voluntary. Without it, access to offered content and services is not possible.

4.2. Freelancers and Profiles

Mandatory information when creating a freelancer profile:

  • Gender
  • First and last name
  • Address
  • Telephone number
  • Email address
  • Date of birth
  • Nationality
  • Mother tongue
  • Work experience (in years)
  • Qualifications/Skills
  • User-ID
  • Profile-ID

All data marked with * can be set to be visible only to registered users or invisible to all users. To make an existing profile completely offline, use the button under the menu item, submenu item.

Voluntary information on the freelancer profile: In addition to mandatory information, freelancers can provide additional details about themselves or their services in their profile. Uploading a photo and other personal documents (CV, certificates, project documents, professional experience, etc.) is optional.

For chargeable services, additional data, such as payment data, is requested to execute orders. Data processing for contract conclusion is based on Art. 6 para. 1 lit. b GDPR, while processing additional profile data relies on legitimate interest (Art. 6 para. 1 lit. f GDPR).

By providing a profile, the aim is to offer freelancers a straightforward way to showcase their skills on the website and connect with project providers for potential employment relationships.

The provision of personal data is voluntary, and without it, access to offered content and services is not possible.


5.1. By using this Website, you signify your acceptance of this policy. If you do not agree to this policy, please do not use our Website.


6.1. If you have any questions about this Privacy Policy, the practices of this Website, or your dealings with this Website, please contact us at: [email protected].


7.1. The Company has the discretion to update this privacy policy at any time. When we do, we will post a notification on the main page of our Website and send you an email.