Privacy Policy
How we collect, use, and protect your personal data
Version 2.3, 11 February 2026
1. Introduction
This Privacy Policy explains how AeroSelect UG (haftungsbeschränkt)(“AeroSelect”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you use our services, including the AeroHire recruitment platform, the TalentHub job portal, and our associated websites and applications. We are committed to protecting your privacy and processing your data in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
2. Data Controller
AeroSelect UG (haftungsbeschränkt)
Mühlenstraße 20, 10243 Berlin, Germany
Email: [email protected]
Managing Director: Christoph Lombard
Where employers use the AeroHire platform to manage recruitment, the employer acts as the data controller for candidate data processed through their tenant, and AeroSelect acts as a data processor in accordance with our General Data Processing Agreement (GDPA).
3. Categories of Personal Data
3.1 Candidate Data
- Identity data: full name, date of birth, nationality, gender, photograph
- Contact data: email address, phone number, postal address
- Professional data: CV/resume content, education history, employment history, skills, certifications, references, cover letters
- Application data: application status, recruiter notes, interview scheduling, assessment results
- Account data: login credentials (hashed), profile preferences, notification settings
- Technical data: IP address, browser type and version, device information, operating system, referral URLs
3.2 Company / Employer Data
- Organisation data: company name, address, industry, company size, logo
- Contact person data: name, email, phone number, role/position of authorised representatives
- Billing data: billing address, payment method details (processed by Stripe), subscription plan, invoices
- Usage data: platform activity, feature usage statistics, job postings, hiring pipeline data
4. Hotline and Support Data
When you contact our customer support by email, we collect your name, email address, the content of your enquiry, and any attachments you provide. This data is processed to handle your request and improve our support services. Support enquiries are received and handled by email and retained for 3 years after the enquiry is closed for quality assurance and dispute-resolution purposes.
5. Purposes and Legal Bases
The following table summarises the purposes for which we process personal data, the corresponding legal basis, and the applicable retention period:
| Purpose | Legal Basis | Retention |
|---|---|---|
| Account registration & authentication | Art. 6(1)(b) GDPR, Contract performance | Duration of account + 30 days |
| Processing job applications | Art. 6(1)(b) GDPR, Contract performance / Pre-contractual measures | 6 months after application closure (or longer with consent) |
| AI-assisted CV analysis & job matching | Art. 6(1)(a) GDPR, Consent | Duration of application process |
| Subscription billing & payment processing | Art. 6(1)(b) GDPR, Contract performance | 10 years (German tax retention requirements) |
| Transactional emails & push notifications | Art. 6(1)(b) GDPR, Contract performance | Duration of account |
| Platform analytics & service improvement | Art. 6(1)(f) GDPR, Legitimate interest | 26 months (aggregated/anonymised) |
| Customer support & helpdesk | Art. 6(1)(b) GDPR, Contract performance | 3 years after ticket closure |
| Legal compliance & fraud prevention | Art. 6(1)(c) GDPR, Legal obligation | As required by applicable law |
| Marketing communications (with consent) | Art. 6(1)(a) GDPR, Consent | Until consent is withdrawn |
6. Third-Party Processors
We use the following third-party service providers to process personal data on our behalf. All processors are bound by data processing agreements in accordance with Art. 28 GDPR:
| Processor | Purpose | Location / Safeguards |
|---|---|---|
| NetCup GmbH | Cloud hosting & infrastructure | Germany / EU |
| OpenAI, Inc. | AI-powered CV analysis & matching | USA (SCCs) |
| Mailgun Technologies, Inc. | Transactional email delivery | EU / USA (SCCs) |
| Stripe, Inc. | Payment processing | EU / Ireland |
| Microsoft Corporation | Video conferencing (Teams meeting creation via Microsoft Graph API) | EU / USA (SCCs) |
| Google LLC (Calendar API) | Video conferencing (Google Meet link generation via Calendar API) | EU / USA (SCCs) |
| Zoom Video Communications, Inc. | Video conferencing (meeting link generation) | EU / USA (SCCs) |
6a. Third-Party Integrations (OAuth)
AeroHire allows employers to connect their Microsoft 365, Google Workspace, or Zoom account via the industry-standard OAuth 2.0 protocol to automate the creation of video meeting links for candidate interviews.
When an employer connects their account, AeroHire receives an access token that is strictly scoped to calendar event creation. AeroHire does not read, store, or process any existing calendar data, emails, or other account information. Video meeting events are created only at the moment a candidate books an interview time slot.
OAuth access tokens are stored in encrypted form and are automatically refreshed as needed. Employers can disconnect their account at any time via Settings → Integrations, which immediately revokes all stored access tokens and removes the connection. No candidate personal data is transmitted to the third-party provider beyond what is necessary to create the meeting event (i.e., meeting subject, date, and time).
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specific retention periods are outlined in the purposes table above. When personal data is no longer required, it is securely deleted or anonymised. Candidates may request early deletion of their data at any time, subject to any overriding legal retention obligations.
8. Data Sharing
We do not sell personal data. We share personal data only in the following circumstances:
- With employers: When candidates apply for jobs, their application data is shared with the respective employer via their AeroHire tenant.
- With service providers: As described in Section 6, with processors acting on our behalf under appropriate data processing agreements.
- For legal compliance: When required by law, court order, or governmental request, or to protect the rights, property, or safety of AeroSelect, our users, or others.
- In business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity with equivalent data protection commitments.
9. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
| Right | Legal Basis | Description |
|---|---|---|
| Right of Access | Art. 15 GDPR | Obtain confirmation and a copy of your personal data. |
| Right to Rectification | Art. 16 GDPR | Request correction of inaccurate or incomplete data. |
| Right to Erasure | Art. 17 GDPR | Request deletion of your personal data (“right to be forgotten”). |
| Right to Restriction | Art. 18 GDPR | Request restriction of processing in certain circumstances. |
| Right to Data Portability | Art. 20 GDPR | Receive your data in a structured, machine-readable format. |
| Right to Object | Art. 21 GDPR | Object to processing based on legitimate interest or direct marketing. |
| Right to Withdraw Consent | Art. 7(3) GDPR | Withdraw consent at any time without affecting prior processing. |
| Right to Lodge a Complaint | Art. 77 GDPR | Lodge a complaint with a supervisory authority (e.g. Berliner Beauftragte für Datenschutz). |
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.
10. Children's Privacy
Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete such data promptly. If you believe that a child has provided us with personal data, please contact us at [email protected].
11. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include TLS 1.3 encryption in transit, AES-256 encryption at rest, role-based access controls, multi-factor authentication for administrative access, regular security assessments, and continuous monitoring. For full details, please refer to Appendix 1 of our General Data Processing Agreement.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our website and, where appropriate, via email or in-app notification. The “Version” and date at the top of this policy indicate when it was last revised. We encourage you to review this policy periodically.
13. Contact
If you have any questions about this Privacy Policy or our data processing practices, please contact us:
AeroSelect UG (haftungsbeschränkt)
Mühlenstraße 20, 10243 Berlin, Germany
Email: [email protected]
You also have the right to lodge a complaint with the competent supervisory authority. The supervisory authority for Berlin is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstraße 219, 10969 Berlin
Website: www.datenschutz-berlin.de