Candidate Privacy Notice

Kyvera GmbH, Edmund-Rumpler-Straße 5, 51149 Cologne, Germany, is the controller for the processing described here. Applications reach us at jobs@kyvera.com; for anything in this notice, write to the same address. Managing directors: Marina Ribke, Christian Müller.

We read your application to decide one thing: whether we should work together. It is seen only by the people hiring, it is not fed into any automated screening, and it is deleted six months after the process ends unless you ask us to keep you in mind for future roles. The rest of this notice describes exactly that.

When you apply, we process what you send us: your contact details, CV, the work you share, your message, and the correspondence and interview notes that follow. We use it solely to decide on establishing an employment relationship with you. Legal basis: section 26(1) BDSG and Art. 6(1)(b) GDPR. Providing this data is necessary for considering your application; what you do not send, we cannot consider.

Your application stays with the people hiring; jobs@kyvera.com is a restricted shared mailbox. We use no applicant-tracking system. Our mail and calendar run on Google Workspace; our contracting party is Google Ireland Limited, Dublin, and where Google processes data in the United States, the transfers are safeguarded by Google LLC’s certification under the EU-U.S. Data Privacy Framework and by the EU Standard Contractual Clauses incorporated in Google’s Cloud Data Processing Addendum. You can request a copy of the safeguards at jobs@kyvera.com. Beyond this, we disclose your data only where a legal obligation requires it. If you apply or communicate with us through an external platform such as LinkedIn or a job board, that platform processes your data under its own responsibility and privacy notice until it reaches us.

If we do not end up working together, your application and the related correspondence are deleted six months after the process ends; we keep them that long to be able to respond to legal claims arising from the process. Legal basis: Art. 6(1)(f) GDPR. If you ask us to keep you in mind for future roles, we keep your application for 12 months on the basis of your consent, Art. 6(1)(a) GDPR, and delete it earlier the moment you withdraw, which you can do at any time at jobs@kyvera.com. If we do work together, your application becomes part of your personnel file.

We contact references only if you name them or agree to it beforehand.

You have the right to access the personal data we hold about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

You have the right to object to processing based on legitimate interests (Art. 21 GDPR).

Consent, once given, can be withdrawn at any time with effect for the future. We make no automated decisions about applications, including profiling, within the meaning of Art. 22 GDPR: every application is read and decided by people. You also have the right to complain to a supervisory authority; the authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), though you may contact any supervisory authority.

When our hiring process changes, this notice changes with it; the effective date above tells you which version you are reading.