Recruitment Privacy Notice
This notice explains how CashXChain handles the personal data of people who apply to work with us, or whom we approach about a role. It is our information notice under Articles 13 and 14 of the General Data Protection Regulation (GDPR) for recruitment.
It stands on its own. The Privacy Policy covers customers, their representatives and payees, and does not apply to applicants.
1. Who is responsible
1.1 The controller is CashXChain UG (haftungsbeschränkt), Georg-Bichler-Str. 9, 83620 Feldkirchen-Westerham, Germany.
1.2 Contact us on any question about this notice at [email protected]. Questions about a specific application can go to [email protected].
1.3 We have not appointed a data protection officer; the reasoning is set out in clause 14 of the Privacy Policy and applies here too.
2. Whose data this covers
Applicants for any role, whether they applied to an advertised vacancy or sent a speculative application; people we approach directly about a role; people put forward by a recruitment agency; and referees an applicant names.
3. What we process
3.1 From you. Name, contact details, CV or résumé, cover letter, work history, education and qualifications, references, work-permit and right-to-work information, salary expectations, notice period, portfolio or code samples, and anything else you choose to include in your application.
3.2 From the process itself. Interview notes, assessment and exercise results, scheduling and correspondence, and the outcome at each stage.
3.3 From third parties. Information from a recruitment agency that put you forward; references from the referees you name, which we contact only after telling you; and information from professional profiles you have made public, such as LinkedIn or a public code repository, where it is relevant to the role.
3.4 What we ask you not to send. Please leave out data we do not need: date of birth, marital or family status, photograph, health information, religious or political affiliation, trade-union membership, and national insurance or tax identifiers. Where you include such data anyway, we do not use it in the decision and delete it at the retention point in clause 6.
3.5 We do not carry out background checks, credit checks or criminal-record checks during recruitment. Where a role would require one before it starts, we tell you before we ask, and it happens under a separate basis and with your knowledge.
4. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Assessing your application and taking steps before an employment contract | Art. 6(1)(b) GDPR and § 26(1) Bundesdatenschutzgesetz |
| Communicating with you about your application and organising interviews | Art. 6(1)(b) GDPR |
| Keeping the file after a rejection to defend a discrimination claim | Art. 6(1)(f) GDPR — our legitimate interest in being able to defend a claim under the Allgemeines Gleichbehandlungsgesetz (AGG) |
| Keeping your details in a talent pool for future roles | Art. 6(1)(a) GDPR — your consent, which you can withdraw at any time |
| Statistics on the recruitment process, in aggregated form only | Art. 6(1)(f) GDPR |
4.1 Providing the data in clause 3.1 is not a legal requirement, but we cannot assess an application without it. There is no consequence to declining beyond our being unable to consider you.
5. Who sees it
5.1 Inside CashXChain: the hiring manager for the role, the people on the interview panel, and the founders. Access is limited to those people.
5.2 Outside CashXChain: our applicant-tracking and scheduling providers, and our email and document hosting, each acting as our processor under a contract meeting Article 28 GDPR . Where a recruitment agency introduced you, we confirm the outcome to that agency.
5.3 We do not pass applicant data to our customers, to our Partners, or to anyone for marketing.
6. How long we keep it
6.1 If we do not offer you the role: six months after we tell you the outcome. That period covers the two-month window in § 15(4) AGG for raising a claim and the further period for bringing it before a court, plus a margin. We then delete the file.
6.2 If you consent to the talent pool: two years from your consent, after which we delete the data or ask you whether to extend. You can withdraw at any time at [email protected] and we delete it then.
6.3 If you join us: the relevant parts of the application become part of your personnel file and are kept under the employee privacy notice you receive on joining. The rest is deleted.
6.4 If a claim is raised or threatened: we keep the file until the matter is finally resolved, and delete it afterwards.
7. Transfers outside the European Economic Area
Our recruitment tooling is hosted in the European Union where the provider offers it. Where a provider processes data outside the European Economic Area, we rely on an adequacy decision where one covers the destination and otherwise on the European Commission’s Standard Contractual Clauses with a transfer impact assessment. Ask us at [email protected] for the detail on a specific provider.
8. Automated decision-making
We do not screen, rank, score or reject applications by automated means. Every decision at every stage is made by a person. We do not use an AI system to decide who advances.
9. Your rights
9.1 You have the rights of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent at any time, on the same terms as set out in clause 12 of the Privacy Policy. Write to [email protected].
9.2 You may complain to a supervisory authority under Article 77 GDPR . The authority competent for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) , Promenade 18, 91522 Ansbach, Germany.
10. Changes
We publish the current version here and keep earlier versions, with the dates each applied, in the Versioned Terms Archive & Change Log.