AUVY careers site (career.auvy.ai)
AUVY GmbH · Am Haag 8 · 82166 Gräfelfing · HRB 311039 (Munich Local Court) · VAT ID DE461400892
Privacy: privacy@auvy.ai · General: contact@auvy.ai
Version: 1.0 · Date: 2026-11-02
The German text is the leading version.
§ 1 What this is about
This notice tells you, under Art. 13 GDPR, what happens to your data when you apply to AUVY GmbH ("AUVY") through our careers site, join our talent pool or visit the careers site. AUVY GmbH is the employer for all its brands and ventures; if you apply to several of them, we keep your applications together as one person.
§ 2 Controller
AUVY GmbH · Am Haag 8 · 82166 Gräfelfing · Germany, represented by its managing directors Achim Ströbel and Patrick Schröppel. Privacy: privacy@auvy.ai. We have not appointed a data protection officer.
§ 3 The data we process
- What you send us: name, email address, phone number (if given), town or postcode, links (such as LinkedIn), your CV and other files, your answers to the job's questions, and for some jobs a short description of your experience.
- What the process creates: the stage of your application, interview times, our interviewers' scorecards against the requirements set for the job in advance, notes from conversations, references you name (with the consent of the person named), how we confirmed your identity before an offer (not the ID document itself), and an offer with its terms.
- Where you came from: the source of your application (such as our website or a referral), when the link carries it.
- Special categories: we do not need details about your health, religion or ethnic origin; please leave them out of your CV and letter. If you choose to tell us about a severe disability or equivalent status, we use it only to meet our duties towards severely disabled applicants (Art. 9(2)(b) GDPR with section 26(3) BDSG and section 164 SGB IX). If such details are in your documents anyway, we disregard them in our decision.
§ 4 Purposes and legal bases
- Running the application process: deciding whether to employ you, arranging interviews, writing to you. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract).
- Talent pool: if you agree, we keep your details to contact you about later roles that fit. Legal basis: your consent, Art. 6(1)(a) GDPR. You confirm it through a link in an email and can withdraw it at any time with effect for the future.
- Defending legal claims: after a rejection we keep the application for six months so we can answer claims under the German General Equal Treatment Act (section 15(4) AGG, section 61b ArbGG). Legal basis: Art. 6(1)(f) GDPR.
- If we hire you: the details the employment needs move to your personnel file, where the privacy notice for employees applies.
§ 5 No automated decisions
No AI and no algorithm rates, ranks or sorts out applications, and we make no decisions based solely on automated processing within the meaning of Art. 22 GDPR. Software only orders applications by their deadlines and helps us write texts and questions, never to judge you.
§ 6 Who sees your data
- At AUVY: the people responsible for hiring, and the members of the hiring team for the job you apply to, each from the stage they take part in. For some jobs we review the first stage without names or CVs.
- Processors:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Data centre for the careers site and application data, which we run with our own software | EU (Helsinki) |
| Microsoft Ireland Operations Ltd. | Email with you (it goes through the mailbox patrick.schroeppel@auvy.ai), calendar and video interviews (Microsoft 365, Teams) | EU, see § 7 |
- No one else: we do not sell your data or pass it to recruitment agencies. We report job ads to the German Federal Employment Agency and to Google; no data about you goes with them.
§ 7 Transfers outside the EU
Application data is stored in the EU. Microsoft Ireland Operations Ltd. processes mail and calendar data in the EU; its parent company is in the United States, so access from the US cannot be ruled out entirely. As in our general privacy notice (§ 8), we base such a transfer on the EU-US Data Privacy Framework, under which Microsoft is certified (the European Commission's adequacy decision, Art. 45 GDPR), and on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Art. 46(2)(c) GDPR). You can get copies of these safeguards from privacy@auvy.ai.
§ 8 Visiting the careers site
When you open the careers site, our server processes technically necessary data: IP address, time, the page requested, browser. We need it to deliver the site and protect it against abuse (Art. 6(1)(f) GDPR). We keep no access logs for the careers site. We hold your IP address only in memory to turn away too many requests in a short time, and we do not use it to identify you. The careers site sets no cookies and stores nothing in your browser. If you arrive through a tagged link, such as from a job ad, we count the source, not you.
§ 9 How we protect your data
Files you upload are stored encrypted. Only the people named in § 6 can open applications, and every time a file is opened it is recorded.
§ 10 How long we keep your data
- Application: until six months after our decision, then it is deleted automatically. This includes scorecards, interview notes, references and the identity check note.
- If we hire you: what the employment needs moves to your personnel file, including the identity check note; the privacy notice for employees, which you receive with your contract, applies to it. Scorecards and notes from the process are deleted six months after you accept.
- Talent pool: twelve months from your confirmation. Shortly before it ends we may ask whether you want to stay; unless you confirm again, the entry is deleted automatically.
- At your request: at once. On your personal application page (the link is in our confirmation email) you can withdraw your application and delete everything at any time.
§ 11 Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time (Art. 7(3)). On your personal application page you can download everything we keep about you as a file. For anything else, write to privacy@auvy.ai.
Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), such as keeping it after a rejection, you may object at any time on grounds relating to your particular situation. We then stop, unless we show compelling legitimate grounds or need the data to defend legal claims. A simple email to privacy@auvy.ai is enough.
Notwithstanding other legal remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular the authority competent at AUVY's seat:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18 · 91522 Ansbach · lda.bayern.de
§ 12 Whether you must provide data
You have no legal or contractual obligation to give us data. Without your name, email address and the details the job needs, however, we cannot consider your application.