Privacy Policy
Protecting your data matters to us. Here we explain transparently which personal data we process, for what purposes, and what rights you have. We process data exclusively in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
Part A — General
1. Controller
The controller within the meaning of the GDPR is:
myrecruity GmbH Weihburggasse 5/3 1010 Vienna, Austria
Management: Maximilian Neukirchner, Andreas Fötschl Company register number: FN 674183x (Commercial Court of Vienna) VAT ID: ATU83058619
Email: office@myrecruity.com Website: myrecruity.com
2. Data protection officer
A data protection officer has not been appointed, as there is no legal obligation to do so. For any data protection questions, you can contact the address above at any time.
3. General principles of data processing
We only process personal data where there is a legal basis or where you have consented. In doing so we observe in particular the principles of data minimisation, purpose limitation and storage limitation.
The main legal bases are:
- Art. 6(1)(a) GDPR – consent
- Art. 6(1)(b) GDPR – contract / pre-contractual measures
- Art. 6(1)(c) GDPR – legal obligation
- Art. 6(1)(f) GDPR – legitimate interest
4. Categories of data subjects
This privacy policy applies in particular to:
- Visitors to our website
- Talents (registered users, talent pool, actively sourced individuals, mandate candidates)
- Applicants for specific positions
- Contacts at companies and prospects (B2B)
- Communication partners (email, phone, WhatsApp)
5. Website, hosting & server log files
When you access our website, technically necessary data is processed automatically to provide the website and ensure its stability and security: IP address, date and time of access, pages accessed, referrer, and information about browser, device and operating system.
Legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation). Our website and data storage run on Amazon Web Services (AWS) in data centres within the EU (Frankfurt). A data processing agreement is in place with our hosting provider.
6. Cookies, consent management & tracking
Our website uses cookies and comparable technologies.
- Technically necessary cookies: Art. 6(1)(f) GDPR
- Analytics and marketing cookies: only with your consent, Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021
We obtain your consent via our own consent solution integrated into the platform ("Cookie settings") and document it. You can withdraw your consent at any time with effect for the future and adjust your selection via the cookie settings.
We store your selection locally in your browser as technically necessary (entry mr_cookie_consent in localStorage) — this is not a cookie and serves solely to remember your decision. No analytics or marketing cookies are set before your consent.
Cookies and technologies used
Technically necessary (without consent):
| Name | Provider | Purpose | Storage period | Type |
|---|---|---|---|---|
mr_cookie_consent | myrecruity (first-party) | Stores your cookie consent | persistent, until deleted | localStorage |
| Session/security cookie | myrecruity (first-party) | Login & session in the logged-in area | session | Cookie (HttpOnly) |
NEXT_LOCALE | myrecruity (first-party) | Stores the selected language (DE/EN) | 1 year | Cookie |
Statistics (only with consent):
| Name | Provider | Purpose | Storage period | Type |
|---|---|---|---|---|
_ga, _ga_* | Google – Google Analytics 4 | Distinguishing users, session measurement | 2 years | third-party |
Marketing (only with consent):
| Name | Provider | Purpose | Storage period | Type |
|---|---|---|---|---|
_gcl_au | Google – Google Ads | Conversion measurement | 90 days | third-party |
_fbp, _fbc | Meta – Facebook/Instagram pixel | Reach/conversion measurement, retargeting | 3 months | third-party |
bcookie, bscookie, lidc, li_sugr, UserMatchHistory, AnalyticsSyncHistory | LinkedIn – Insight Tag | Reach/conversion measurement, retargeting | 1 day – 1 year | third-party |
| Apollo tracking | Apollo (Apollo.io) | B2B visitor identification & reach measurement | per provider | third-party |
_ttp | TikTok – pixel | Reach/conversion measurement | 13 months | third-party |
__hstc, hubspotutk, __hssc, __hssrc | HubSpot | Visitor analytics, marketing | 30 min – 6 months | third-party |
Google Tag Manager only serves to deliver these tags and does not set cookies itself. The exact cookie names and lifetimes of third-party providers may change; the providers' own information is authoritative.
7. Marketing, newsletter & reach measurement
With your consent, we send newsletters and measure the reach of our content and campaigns. We process e.g. name, email address, interaction data (opens/clicks) and preferences.
Legal basis is Art. 6(1)(a) GDPR (consent), where applicable Art. 6(1)(f) GDPR. Services used may include Google, Meta (Facebook/Instagram), LinkedIn, TikTok. You can unsubscribe at any time.
8. Contact & communication
When you contact us by email, phone or WhatsApp, we process the transmitted data to handle your request. Legal basis is, depending on the context, Art. 6(1)(b) GDPR (pre-/contractual) or Art. 6(1)(f) GDPR (legitimate interest).
Communication via WhatsApp Business is optional and takes place only on the basis of your consent (Art. 6(1)(a) GDPR). Email and phone are available as alternatives. WhatsApp is a service of Meta Platforms; it cannot be ruled out that metadata is processed.
9. Tools used & processors
We use carefully selected service providers. Data processing agreements compliant with the GDPR (Art. 28 GDPR) are in place with all relevant providers; for advertising and sourcing services that act as joint or independent controllers, the corresponding agreements apply (see section 11).
Currently used:
- Amazon Web Services (AWS) – hosting & data storage (EU, Frankfurt)
- World4You – domain & DNS (Austria)
- HubSpot – CRM, forms, marketing, email delivery
- Microsoft 365 – email, office, collaboration, video calls (Teams)
- SendGrid – transactional email (system/confirmation emails)
- Stripe – payment processing
- Finmatics – accounting
- Perspective – application/funnel tool
- AI service providers for data and document analysis
- Providers for AI-supported voice and audio features
- Provider for data enrichment as part of active sourcing
- Google – web analytics and advertising (Analytics, Ads, Tag Manager)
- Meta Platforms – advertising, pixel and WhatsApp communication
- LinkedIn – active sourcing and advertising
- Apollo (Apollo.io, USA) – B2B visitor analytics & website tracking, and data enrichment
- TikTok – advertising
Where personal data is transferred to third countries in this context, the safeguards in section 10 apply.
10. Transfers to third countries
When using individual tools, personal data may be transferred to third countries (in particular the USA). Such transfers only take place where appropriate safeguards exist — in particular Standard Contractual Clauses (SCC) or certification under the EU-US Data Privacy Framework (DPF).
11. Joint controllership
When embedding advertising and analytics services (e.g. Meta pixel, Google Ads, LinkedIn Ads), we process personal data partly jointly with the respective provider (joint controllership under Art. 26 GDPR). We provide the essential content of the respective agreements on request.
12. Storage period
We store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods:
- Applications without placement: max. 6 months
- Talent profile / talent pool: until your revocation or deletion request
- Candidate mandates: for the duration of the mandate
- Contract and accounting data: statutory retention periods (in Austria usually 7 years)
- Marketing data: until revocation
13. Automated processing and profiling
To bring talents and suitable positions together, we use AI-supported methods. We automatically evaluate profile, qualification and preference data (e.g. skills, experience and wishes from your profile and from conversations) to assess your suitability and fit for specific positions and to make suggestions. This assessment constitutes profiling within the meaning of Art. 4(4) GDPR. We do not pass special categories of personal data (Art. 9 GDPR) to AI/LLM services.
A decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Art. 22(1) GDPR) does not take place. The AI results serve solely for preparation — every decision relevant to you, in particular whether you are proposed to a company, is always made by a human.
Legal basis is Art. 6(1)(b) GDPR (performance of pre-contractual measures and the placement service) and Art. 6(1)(f) GDPR (legitimate interest in an accurate match). Where we use AI in direct interaction with you, we inform you.
You can object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR) and receive information about the essential logic of the methods used. To do so, contact office@myrecruity.com.
14. Your rights
You have the right to:
- access (Art. 15 GDPR)
- rectification (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection (Art. 21 GDPR)
You can withdraw consent given at any time with effect for the future. Please send requests to office@myrecruity.com.
15. Right to lodge a complaint / supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Austrian Data Protection Authority (Österreichische Datenschutzbehörde) Barichgasse 40–42, 1030 Vienna Phone: +43 1 52 152-0 Email: dsb@dsb.gv.at Web: www.dsb.gv.at
Part B — For talents
B1. Registration & profile creation
When you register with myrecruity, we create a talent profile for you. For this we process, among other things, master and contact data, CV, skills, professional experience, preferences and willingness to change. On request, we enrich your profile with information provided by you or publicly available (e.g. professional networks).
Legal basis is Art. 6(1)(b) GDPR (usage and placement relationship) and — where enrichment from public sources is concerned — Art. 6(1)(a) GDPR.
B2. AI-supported conversations
As part of our process, we offer AI-supported conversations to better understand you and your wishes. We process the conversation content and — where activated — audio recordings or their transcripts. For these voice/audio features we use specialised AI service providers.
Recordings only take place with your consent (Art. 6(1)(a) GDPR); we inform you before the conversation that you are speaking with an AI. The content feeds into the preparation of suitable suggestions (see section 13).
B3. Matching & placement with companies
We match your profile with open positions and introduce you to suitable companies. Your data is shared with a company only on a purpose- and need-related basis and — within a mandate — only after coordination with you. Only the data required for the respective purpose is transmitted. Legal basis is Art. 6(1)(b) GDPR.
B4. Talent pool
If you wish to be considered for future positions beyond a specific application, we add you to our talent pool. This is done exclusively on the basis of your voluntary, explicit consent (Art. 6(1)(a) GDPR), which you can revoke at any time.
B5. Active sourcing
We process personal data from publicly accessible sources (e.g. professional networks) in order to approach potentially suitable talents. In particular, we process name, professional information and publicly provided contact data. Legal basis is Art. 6(1)(f) GDPR. On first contact, we inform you about the data processing (Art. 14 GDPR).
B6. Placement on behalf of the talent (mandate)
In certain cases we actively support you in finding a suitable position. The processing takes place to provide the agreed placement service (Art. 6(1)(b) GDPR). Your profile is not shared with companies automatically, but only after prior coordination with you.
B7. Applications for specific positions
As part of applications, we process your application documents (e.g. CV, references), contact data and qualifications to carry out the application and placement process (Art. 6(1)(b) GDPR). Special categories of personal data (e.g. health data) are not required and should be avoided.
Part C — For companies
C1. Initiation & contract handling
When you work with us as a company, we process the data of your contacts (e.g. name, position, contact data, company reference) as well as contract and communication data to initiate and handle our services. Legal basis is Art. 6(1)(b) and (f) GDPR.
C2. Transfer of talent profiles
To fill your open positions, we introduce suitable talents and transmit the necessary, data-minimised profile information. You are independently responsible for the subsequent processing of this data in your organisation.
C3. Market reports & analyses
We provide aggregated market, salary and EVP analyses. These are based on aggregated or anonymised data and generally contain no personal reference. Legal basis is Art. 6(1)(f) GDPR.