1. Introduction
This Privacy Policy provides information about how Kladero GmbH (hereinafter referred to as “Kladero” or “we” or “us”) processes personal data. In particular, we process personal data relating to the following categories of individuals:
- Individuals who represent or work for our Customers (where “Customer” means any natural or legal person that enters into an agreement with Kladero, either as “Kladero Product Customer” if the agreement concerns access to a Kladero product, or as “Kladero Service Customer” if the agreement concerns the provision of services by Kladero), including contact persons, authorized representatives, account administrators, billing contacts, and authorized users of Kladero products or services (hereinafter collectively referred to as “Customer Personnel and Users”);
- Customers who are natural persons;
- Individuals who visit our websites, contact us, attend our events, interact with our communications or social media channels, or otherwise express an interest in Kladero or its products or services (hereinafter collectively referred to as “Prospects”);
- Individuals who create an account for, access, or otherwise use the Kladero Platform, whether on their own behalf or on behalf of another person or organization (hereinafter collectively referred to as “Kladero Platform Users”);
- Individuals who represent or work for our suppliers, service providers, professional advisers, cooperation partners, or other business partners (hereinafter collectively referred to as “Supplier and Business Partner Personnel”);
- Individuals who apply for employment, internships, student theses, or other student projects, or otherwise participate in a related selection process with Kladero (hereinafter collectively referred to as “Job Applicants”); and
- Other individuals who communicate or otherwise interact with Kladero in a professional or business context (hereinafter collectively referred to as “Other Business Contacts”).
This Privacy Policy applies to Job Applicants when they:
- apply for employment, an internship, a student thesis, or another student project with Kladero, whether in response to a published opportunity or through an unsolicited application;
- submit application documents or other information to Kladero in connection with such an opportunity;
- communicate with Kladero or participate in interviews, assessments, or other activities as part of a related selection process; or
- have their personal data provided to Kladero by a recruitment agency, educational institution, professional contact, or another third party in connection with such an opportunity.
Other privacy policies may apply where you interact with Kladero in another capacity, including as a Prospect, Customer, Customer Personnel and User, Kladero Platform User, Supplier and Business Partner Personnel, or Other Business Contact. For processing relating specifically to these categories, this Privacy Policy is supplemented by other privacy policies listed under the “Privacy” section of our Legal Center page.
Where another privacy policy applies to a separate interaction or processing activity, that privacy policy governs the relevant processing.
2. Controller responsible for processing
For the processing activities covered by this Privacy Policy, Kladero acts as the controller and determines the purposes and means of the processing. The contact details of Kladero are as follows:
- Company: Kladero GmbH
- Address: Rüttenscheider Straße 120, 45131 Essen, Germany
- Managing directors: Dr. Paul-Andrei Dragan, Sven Michael Smolka
- Telephone: +49 231 13751426
- Privacy contact email: contact@kladero.com
3. Definitions
For the purposes of this Privacy Policy, “personal data” means any information relating to an identified or identifiable natural person. An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person. Personal data does not include information that has been rendered anonymous in such a manner that the individual is no longer identifiable.
A “data subject” is the identified or identifiable natural person to whom personal data relates.
“Processing” means any operation performed on personal data, whether or not by automated means, including collecting, recording, organizing, structuring, storing, adapting, retrieving, consulting, using, disclosing, restricting, erasing, or destroying personal data.
4. Legal bases for processing
We process personal data in accordance with the General Data Protection Regulation (“GDPR”) and other applicable data protection laws. We process personal data only where an applicable legal basis permits the processing. The legal basis applicable to each processing activity is identified in the relevant section of this Privacy Policy.
4.1 Performance of a contract
We process personal data where the following is necessary:
- to take steps at your request before entering into a contract; or
- to perform a contract to which you are a party.
The legal basis is Article 6(1)(b) GDPR (“Performance of Contract”). This legal basis may apply, for example, where we process your personal data to receive and assess your application, evaluate your qualifications and suitability, communicate with you during the selection process, or take steps at your request before entering into an employment, internship, or other contractual relationship with Kladero.
4.2 Consent
We process personal data for specific purposes where you have given your consent.
The legal basis is Article 6(1)(a) GDPR (“Consent”). This legal basis may apply, for example, when you consent to the retention of your application for consideration for future employment, internships, student theses, or other opportunities.
You may withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
4.3 Legal obligations
We process personal data where this is necessary to comply with a legal obligation to which Kladero is subject.
The legal basis is Article 6(1)(c) GDPR (“Legal Obligations”). This legal basis may apply, for example, where we are required to comply with applicable equal treatment or data protection laws, respond to a competent public authority, or fulfill statutory recordkeeping obligations.
4.4 Legitimate interests
We process personal data where this is necessary for our Legitimate Interests or those of a third party, provided that those interests are not overridden by your interests, fundamental rights, or freedoms.
The legal basis is Article 6(1)(f) GDPR (“Legitimate Interests”). Depending on the processing activity, the interests pursued include:
- receiving, managing, and responding to applications and related communications where processing is not based on Performance of Contract;
- maintaining accurate and reliable recruitment records where necessary for purposes distinct from the selection decision;
- protecting our systems, communications, and personal data against misuse, fraud, unauthorized access, attacks, and other security threats;
- documenting consent, withdrawals, objections, communications, and other relevant activities;
- complying with accountability and evidentiary requirements; and
- establishing, exercising, or defending legal claims.
Before relying on Legitimate Interests, we assess the relevant interests and consider the potential impact of the processing on the individuals concerned.
Where we process personal data on the basis of Legitimate Interests, you may object to the processing on grounds relating to your particular situation, as described in Section 5.
5. Your rights
Subject to the conditions and limitations set out in applicable data protection law, you have the following rights regarding the processing of your personal data:
5.1 Right of access
In accordance with Article 15 GDPR, you have the right to obtain confirmation as to whether we process personal data concerning you and, where this is the case, to obtain access to that personal data and the information specified in Article 15 GDPR.
5.2 Right to rectification
In accordance with Article 16 GDPR, you have the right to request the correction of inaccurate personal data concerning you and the completion of incomplete personal data.
5.3 Right to erasure
In accordance with Article 17 GDPR, you have the right to request the erasure of personal data concerning you where the applicable legal requirements are met.
5.4 Right to restriction of processing
In accordance with Article 18 GDPR, you have the right to request the restriction of the processing of your personal data where the applicable legal requirements are met.
5.5 Right to data portability
In accordance with Article 20 GDPR, where processing is based on consent or a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and, where technically feasible, to have that data transmitted directly to another controller.
5.6 Right to object
In accordance with Article 21 GDPR, where we process your personal data on the basis of legitimate interests, you have the right to object to the processing on grounds relating to your particular situation. Where personal data is processed for direct marketing purposes, you have the right to object at any time to such processing, including related profiling.
5.7 Right to withdraw consent
In accordance with Article 7(3) GDPR, where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
5.8 Rights relating to automated decision-making
In accordance with Article 22 GDPR, where applicable, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, subject to the applicable legal exceptions and safeguards.
5.9 Right to lodge a complaint
In accordance with Article 77 GDPR, you have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.
The supervisory authority responsible for Kladero is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), whose contact details are available at https://www.ldi.nrw.de.
6. Processed personal data
Depending on how you interact with us, we may process the following categories of personal data.
6.1 Personal data collected directly from you
We may collect the following categories of personal data directly from you when you apply for an opportunity with Kladero or otherwise participate in a selection process:
| Category of personal data | Description and examples | When we collect it |
|---|---|---|
| Identity data | Information used to identify or distinguish you, such as your first name, last name, salutation, title, or another personal identifier. | When you apply for an opportunity with Kladero or otherwise participate in the selection process. |
| Contact data | Information used to communicate with you, in particular your email address and, where provided, your telephone number or postal address. | When you submit an application or provide contact details during the selection process. |
| Professional and qualification data | Information concerning your education, training, professional experience, qualifications, skills, certifications, academic work, and relevant professional or academic achievements. | When you provide a CV, certificates, academic records, work samples, or other information concerning your qualifications. |
| Application data | Information concerning your application, such as the opportunity applied for, cover letter, CV and other submitted application documents, expected remuneration, possible start date, availability, and application status. | When you submit or update an application for employment, an internship, a student thesis, or another student project. |
| Application and correspondence data | The content and context of communications exchanged with Kladero in connection with an application, including emails, questions, replies, attachments, and correspondence history. | When you communicate with Kladero concerning an application or selection process. |
| Appointment and scheduling data | Information required to arrange or manage meetings, such as your availability, preferred date and time, time zone, meeting format, scheduling selections, and cancellation or rescheduling information. | When you arrange, reschedule, or cancel an interview or another recruitment-related meeting. |
| Communication preference data | Information concerning how you prefer us to communicate with you, such as your preferred language, communication channel, and accessibility-related communication preferences. | When you state or update communication preferences during a selection process. |
| Consent records | Records demonstrating the giving, confirmation, withdrawal, or refusal of consent, including the relevant wording and privacy information presented to you, the method of collection, timestamps, confirmation status, and associated technical records. | When you provide or withdraw consent, including consent to consideration for future opportunities. |
| Data-subject request and compliance data | Information relating to requests made under data protection law, such as the type and content of the request, correspondence concerning the request, identity-verification information, records of our assessment and response, and any restriction or objection resulting from the request. | When you exercise or seek to exercise a right relating to your personal data, submit a privacy complaint, or otherwise communicate with us about data protection. |
| Terms, notice, and acknowledgment data | Records concerning terms, privacy information, notices, policies, declarations, or other legal information presented to you, and any acceptance or acknowledgment by you, including the relevant version, date, time, method, and associated technical records. | When we provide legal information or ask you to accept or acknowledge a relevant notice or declaration. |
| Other data provided by you | Any other personal data that you voluntarily provide and that is not covered by one of the categories above, including personal data contained in free-text fields, attachments, or other materials submitted to Kladero. | When you voluntarily provide additional information in connection with an application. |
We do not request special categories of personal data, including information concerning health or disability, unless necessary and permitted by applicable law. Where application documents or other information provided by you contain special categories of personal data, we process such data only to the extent necessary and where an applicable legal basis under Article 6 GDPR and a condition under Article 9 GDPR permit the processing.
6.2 Personal data generated through our communications and recruitment activities
We may generate the following categories of personal data when communicating with Job Applicants or conducting selection processes:
| Category of personal data | Description and examples | When we generate it |
|---|---|---|
| Communication delivery and status data | Technical and status information concerning communications, such as email delivery status, bounce information, failed delivery attempts, and whether a communication was successfully delivered. | When we send or attempt to send application-related communications. |
| Recruitment and assessment data | Information generated during the selection process, such as interview notes, evaluations, assessment results, internal feedback, selection decisions, and reasons for those decisions. | When Kladero reviews an application, conducts an interview or assessment, evaluates suitability, or makes a selection decision. |
| Security event and misuse-prevention data | Information relating to actual or suspected security events or misuse, such as suspicious emails or attachments, attempted unauthorized access, and records of security investigations or remedial measures. | When our systems detect, assess, prevent, investigate, or respond to suspected misuse or security threats affecting recruitment-related information. |
6.3 Personal data obtained from third parties
In limited circumstances, we may obtain personal data concerning you from third parties or publicly accessible sources.
Where we obtain personal data from a third party and have not already provided you with the relevant privacy information, we provide that information within the period required by Article 14 GDPR, unless an applicable exception permits us not to do so.
6.3.1 Recruitment agencies and professional contacts
Where a recruitment agency or professional contact introduces you or submits an application on your behalf, we may obtain your Identity data, Contact data, Professional and qualification data, and Application data.
6.3.2 Universities and educational institutions
Where an educational institution refers you to Kladero or provides information in connection with a student opportunity, we may obtain your Identity data, Contact data, Professional and qualification data, and Application data.
6.3.3 Professional networking platforms
Where we review professional information made available through a professional networking platform in connection with your application, we may obtain your Identity data, Contact data, and Professional and qualification data.
6.3.4 References
Where we obtain a reference in connection with your application, we may receive Professional and qualification data and Application and correspondence data relating to the reference.
7. Processing activities
The following sections describe how we process personal data in connection with specific recruitment and selection activities.
For each activity, we provide information about the scope of the processing, the categories of personal data processed, the purposes of the processing, and the applicable legal basis. Where relevant, we also explain activity-specific choices available to you.
7.1 Application and selection process
7.1.1 Scope
This section applies when we receive, review, assess, and decide on applications for employment, internships, student theses, or other student projects, including unsolicited applications, interviews, and other assessments.
7.1.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Identity data | To identify you and associate your application with the relevant selection process | Performance of Contract |
| Contact data | To communicate with you concerning your application and the outcome of the selection process | Performance of Contract |
| Application data | To receive, administer, and assess your application for the relevant opportunity | Performance of Contract |
| Professional and qualification data | To evaluate your experience, qualifications, and suitability for the relevant opportunity | Performance of Contract |
| Application and correspondence data | To respond to your questions and communicate with you during the selection process | Performance of Contract |
| Appointment and scheduling data | To arrange and conduct interviews and other selection-related meetings | Performance of Contract |
| Communication preference data | To accommodate your stated communication preferences during the selection process | Performance of Contract |
| Recruitment and assessment data | To assess Job Applicants, document evaluations, and decide whether to offer the relevant opportunity | Performance of Contract |
| Other data provided by you | To consider additional information that you provide in connection with your application, where relevant to the selection process | Performance of Contract |
Where processing is based on Performance of Contract, the processing is necessary to assess your application and take steps at your request before entering into a potential contractual relationship with Kladero.
7.1.3 Your choices
You must provide the information necessary to identify you, contact you, and assess your application. If you do not provide the necessary information, we may be unable to consider your application. Additional information that is not necessary for the selection process is voluntary.
7.2 Consideration for future opportunities
7.2.1 Scope
This section applies only where you separately consent to our retaining and considering your application for future employment, internships, student theses, or other student projects beyond the original selection process.
7.2.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Contact data | To contact you about suitable future employment, internships, student theses, or other student projects | Consent |
| Application data | To retain and review your application for suitable future opportunities | Consent |
| Professional and qualification data | To assess whether your qualifications match a future opportunity | Consent |
| Recruitment and assessment data | To consider previous recruitment evaluations when assessing your suitability for future opportunities | Consent |
| Consent records | To document your consent and any withdrawal | Legal Obligations |
Where processing is based on Consent, we use the relevant application information only for consideration for future opportunities in accordance with your consent. We process Consent records to document compliance with applicable data protection requirements.
7.2.3 Your choices
You may withdraw your consent at any time with effect for the future by contacting us using the privacy contact details provided in this Privacy Policy. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
7.3 Security and prevention of misuse
7.3.1 Scope
This section applies when we process personal data to protect recruitment-related communications, documents, systems, and stored Application data and other recruitment-related personal data against unauthorized access, misuse, fraud, attacks, and other security threats.
7.3.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Security event and misuse-prevention data | To detect, investigate, and respond to suspected misuse or security incidents affecting recruitment-related personal data | Legitimate Interests |
| Communication delivery and status data | To identify failed recruitment-related communications and maintain reliable delivery records | Legitimate Interests |
Our Legitimate Interests are to protect recruitment-related personal data, ensure reliable recruitment communications, and investigate and respond to security threats.
7.4 Data protection requests
7.4.1 Scope
This section applies when you contact Kladero to exercise your rights concerning your personal data or submit another data-protection-related request.
7.4.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Identity data | To identify you and verify your identity where necessary | Legal Obligations |
| Contact data | To communicate with you concerning the request | Legal Obligations |
| Data-subject request and compliance data | To assess, process, respond to, and document your request | Legal Obligations |
Where processing is based on Legal Obligations, the processing is necessary to receive, assess, and respond to requests made under applicable data protection law, verify the identity of the requesting person where necessary, and document the handling of the request.
7.4.3 Your choices
You must provide the information necessary for us to identify you, verify your identity where required, and understand the scope of your request. If you do not provide this information, we may be unable to process or respond to your request.
7.5 Disputes and legal claims
7.5.1 Scope
This section applies where a dispute arises between you and Kladero or where personal data is necessary to establish, exercise, or defend legal claims.
7.5.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Identity data | To identify the persons involved in the dispute or legal claim | Legitimate Interests |
| Contact data | To communicate with you and other relevant persons concerning the dispute or legal claim | Legitimate Interests |
| Application data | To establish the subject matter and circumstances of an application-related dispute or legal claim | Legitimate Interests |
| Professional and qualification data | To assess evidence relevant to the qualifications or suitability at issue | Legitimate Interests |
| Recruitment and assessment data | To investigate selection decisions and preserve relevant evidence | Legitimate Interests |
| Application and correspondence data | To assess the positions of the persons involved and document the handling of the dispute | Legitimate Interests |
| Terms, notice, and acknowledgment data | To establish which notices or declarations were presented or acknowledged | Legitimate Interests |
| Security event and misuse-prevention data | To investigate security-related circumstances and preserve relevant evidence, where applicable | Legitimate Interests |
Our Legitimate Interests are to investigate and resolve disputes, protect Kladero’s legal rights, preserve relevant evidence, and establish, exercise, or defend legal claims.
7.6 Data protection compliance and documentation
7.6.1 Scope
This section applies where we retain or otherwise process information to comply with, and demonstrate compliance with, applicable data protection law.
7.6.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Consent records | To demonstrate that appropriate consent was obtained and that any subsequent withdrawal was respected | Legal Obligations |
| Data-subject request and compliance data | To document the handling of data protection requests and demonstrate compliance with applicable requirements | Legal Obligations |
| Identity data | To document any identity verification undertaken in connection with a data protection request | Legal Obligations |
| Terms, notice, and acknowledgment data | To document privacy information provided to Job Applicants and relevant acknowledgments | Legal Obligations |
| Data-subject request and compliance data | To establish, exercise, or defend legal claims and respond to inquiries or proceedings involving supervisory authorities, where applicable | Legitimate Interests |
Our Legitimate Interests are to establish, exercise, and defend legal claims and to demonstrate the lawfulness of our processing where this is not already required by a specific legal obligation.
8. Recipients of personal data
We disclose personal data only where necessary for the purposes described in this Privacy Policy. We do not sell or trade personal data.
Depending on the relevant processing activity, personal data may be disclosed to the following recipients:
- authorized employees and other personnel of Kladero who require access to the personal data to perform their duties;
- professional advisers, including lawyers, tax advisers, accountants, and auditors;
- public authorities, courts, and other public bodies where disclosure is required or permitted by applicable law; and
- other recipients where you have expressly authorized the disclosure or where disclosure is otherwise required or permitted by applicable law.
We also engage service providers that process personal data in connection with our recruitment and selection processes and related communications. Our principal service providers are listed below:
| Category of service provider | Provider | Principal processing location |
|---|---|---|
| Hosting and storage infrastructure | Hetzner Online GmbH | European Union |
| Business email and related business applications | Zoho group companies | European Union and, in limited circumstances, other countries |
9. Retention and erasure of personal data
We retain personal data only for as long as necessary for the purposes for which it was collected, unless continued retention is required or permitted by applicable law.
The applicable retention period depends on the nature of the personal data, the relevant processing purpose, and any applicable statutory retention or limitation periods.
9.1 Principal retention periods
The principal retention periods applicable to the processing activities described in this Privacy Policy are set out below:
| Retention period | Personal data and processing context |
|---|---|
| Until the application and selection process is completed | Application data, Professional and qualification data, Application and correspondence data, Appointment and scheduling data, and Recruitment and assessment data necessary for the selection process |
| Generally for up to six months after rejection or conclusion of the selection process | Application data, Professional and qualification data, Application and correspondence data, and Recruitment and assessment data of unsuccessful Job Applicants, where necessary to establish, exercise, or defend legal claims |
| For up to 12 months after consent is given, or until consent is withdrawn, whichever occurs first | Contact data, Application data, Professional and qualification data, and Recruitment and assessment data retained with consent for consideration for future opportunities |
| For the duration required under the privacy and retention rules applicable to the resulting relationship | Application data and Professional and qualification data of successful Job Applicants, to the extent necessary for the resulting employment, internship, thesis, or project relationship |
| Generally for three years from the end of the calendar year in which the relevant activity ended, where necessary to document compliance or establish, exercise, or defend legal claims | Consent records, Terms, notice, and acknowledgment data, Data-subject request and compliance data, |
| Until the relevant security event has been investigated and resolved and, where necessary, for an additional period for compliance documentation or legal claims | Security event and misuse-prevention data |
9.2 Extended retention
We may retain personal data beyond the principal retention periods where this is required by applicable commercial, tax, accounting, or other statutory retention obligations, or where retention is necessary to establish, exercise, or defend legal claims.
Unless a different limitation period applies, records relevant to potential civil-law claims may generally be retained until the expiry of the regular statutory limitation period. Under German law, this period is generally three years and usually begins at the end of the calendar year in which the relevant claim arose and the party entitled to assert the claim became aware, or should have become aware, of the relevant circumstances.
Longer periods may apply where proceedings are pending, a limitation period has been suspended or restarted, a claim has been legally established, or a special statutory retention or limitation period applies.
Where personal data is retained solely for a statutory retention obligation or for legal claims, we restrict its processing to those purposes. It will not be used for recruitment, consideration for future opportunities, or other ordinary operational purposes during the extended retention period.
9.3 Erasure and anonymization
After the applicable retention period has expired, we erase or irreversibly anonymize the personal data unless continued retention is required or permitted by applicable law.
Erasure may take place through a scheduled deletion process rather than immediately upon expiry of the relevant retention period.
Personal data contained in backup systems may remain for a limited period until the relevant backup is overwritten or deleted in accordance with our backup procedures. During that period, the data is not used for ordinary operational purposes and is restored only where necessary for business continuity, security, or disaster recovery.
10. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.
11. International data transfers
Kladero’s primary hosting infrastructure is located within the European Union. Some of our service providers may process personal data outside the European Economic Area (EEA).
Where personal data is transferred to a country for which the European Commission has adopted an adequacy decision, we rely on that adequacy decision. Where no applicable adequacy decision exists, we use appropriate safeguards in accordance with Article 46 GDPR, in particular the European Commission’s Standard Contractual Clauses.
Further information about the safeguards applicable to a particular transfer, including information on how to obtain a copy of the relevant safeguards, may be requested from us using the contact details provided in this Privacy Policy.
12. Changes to this Privacy Policy
We may amend this Privacy Policy to reflect changes in applicable law, our services, or our processing activities.
The current version of this Privacy Policy is available on our website. Where a change materially affects the processing of your personal data or your rights, we will inform you before the change takes effect. Where a change requires your consent, we will request your consent before carrying out the relevant processing.
13. Information about minors
Our websites, products, and services are intended for persons aged 18 or older and are not directed to minors.
We do not knowingly collect personal data from persons under the age of 18. If we become aware that we have collected personal data from a minor, we will take appropriate steps to delete it, unless we are legally required or otherwise permitted to retain it.
If you believe that we may have collected personal data from a person under the age of 18, please contact us using the privacy contact details provided in this Privacy Policy.
14. Language
This Privacy Policy may be made available in multiple languages. In the event of any inconsistency between the English version and a translated version, the English version shall prevail.