Steps to full compliance

As part of your application, we may invite you to take an AI-led interview conducted by Madita (a product of HeyJobs GmbH) to assess your suitability for the target position. The cooperation with Madita as a data processor is governed by a data processing agreement covering all the following steps.

Step 1 (before the invitation)

Your application documents are processed by the provider using AI in order to generate suitable interview questions matched to the profile of the target role and to draft and send you an AI-generated invitation email. For this purpose we process the following data: first name, last name, email address, phone number, and application documents. No assessment of your application documents takes place. The legal basis for this processing is Art. 6 (1) lit. f GDPR (legitimate interest).

Step 2

You will receive an invitation to the AI interview. Participation in the AI interview is voluntary and not a prerequisite for the application process. For the AI interview we process the following data: the contact data listed in Step 1 as well as your interview answers (audio recording of the interview and automatically generated transcript). The interview is processed by an AI system based on role-specific criteria. The final decision regarding the further application process is made exclusively by a human. The legal basis for this processing is Art. 6 (1) lit. a GDPR (consent).

Step 3

After the interview, before the data is deleted, an anonymisation step is performed. In this step all personally identifiable information is removed from the data. After anonymisation the data can no longer be linked to your person. The anonymisation is carried out by us as the controller in fulfilment of our data protection obligations regarding data minimisation (Art. 5 (1) lit. c and e GDPR). The legal basis for the anonymisation as such is Art. 6 (1) lit. f GDPR (legitimate interest).

You can exercise your right to withdraw consent (Step 2) and your right to object (Steps 1 and 3) via the contact channels listed in this privacy policy.

1. Legitimate interest

The employer has a legitimate business interest in conducting application processes in a structured, efficient and comparable way for all candidates. The use of an AI-supported interview system enables standardised, role-specific questions and reduces subjective bias in the selection process.

Result: legitimate interest established.

2. Necessity

The processing of application documents by the data processor is technically necessary to generate candidate-specific interview questions tailored to the requirements profile of the target role. Without this step only a generic interview, not tailored to the candidate, would be possible. Only data required for question generation is processed. No assessment of the documents, no scoring and no profiling takes place.

Result: processing is necessary and proportionate.

3. Balancing of interests

For the employer: structured and efficient application process with standardised, role-specific questions.

For the candidate: the impact is minimal. No assessment of the documents takes place. The data is used solely for the development of interview questions and is not further processed for other purposes. The candidate has actively submitted the application documents as part of their application and can reasonably expect that these will be processed during the application process.

Safeguards: contractual binding of the data processor (DPA pursuant to Art. 28 GDPR), purpose limitation, deletion after completion of the application process, transparency through the privacy policy.

Result: the legitimate interest of the employer prevails. The processing is foreseeable for the candidate and the impact on their fundamental rights is low.

Right to object (Art. 21 GDPR)

Candidates can object to the processing at any time. An objection to this processing step has the consequence that no AI interview can be conducted. The right to object is disclosed in the employer's privacy policy.

1. Legitimate interest

The employer has a concrete, independent interest in keeping the volume of personal data it stores to a minimum and in minimising its data protection liability exposure. This interest is not derived from the interests of the data processor but follows directly from the employer's obligations as a controller under the GDPR.

Result: concrete and independent legitimate interest established.

2. Necessity

Anonymisation is the technically appropriate measure to achieve a deletion-equivalent effect while permanently eliminating the liability exposure associated with the processing. It is in line with the principles of data minimisation (Art. 5 (1) lit. c GDPR) and storage limitation (Art. 5 (1) lit. e GDPR). The anonymisation is performed by the data processor according to the current state of the art on behalf of and on the instructions of the employer.

Result: anonymisation is necessary and appropriate.

3. Balancing of interests

For the employer: permanent elimination of data protection risks from the storage of personal candidate data, fulfilment of obligations regarding data minimisation and storage limitation.

For the candidate: the anonymisation works in their favour, as it permanently and irreversibly removes the personal data stored about them. After anonymisation, linking the data to the candidate is excluded according to the state of the art. The processing serves to reduce the data volume, not to expand it. Transparency is ensured through the employer's privacy policy.

Result: the legitimate interest of the employer prevails. The anonymisation ultimately works in favour of the candidate.

Right to object (Art. 21 GDPR)

Candidates can object to the processing at any time. An objection to this processing step has the consequence that the data is deleted directly without prior anonymisation. The right to object is disclosed in the employer's privacy policy.