Privacy Policy & GDPR

1. Introduction

BID Equity ("we", "our", or "us") is committed to protecting your personal data and respecting your privacy. This Privacy Policy describes how we collect, use, and protect your personal information in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable national data protection laws in Germany and Luxembourg.

2. Data Controller

The data controller responsible for your personal data is:

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): When you explicitly agree to the processing of your data
• Contract (Art. 6(1)(b) GDPR): To process your job application and potentially enter into an employment contract
• Legal Obligation (Art. 6(1)(c) GDPR): To comply with legal requirements
• Legitimate Interests (Art. 6(1)(f) GDPR): For our legitimate business interests, such as improving our services

4. Categories of Personal Data Collected

We collect and process the following categories of personal data:

4.1 Application Data

• Full name, email address, phone number
• CV/Resume information including employment history and education
• LinkedIn profile URL (if provided)
• Available start date
• Any additional information you provide in your application

4.2 Interview Data

• Video and audio recordings of interviews
• AI-generated assessments and evaluations
• Language proficiency assessments
• Interview transcripts

4.3 Technical Data

• IP address
• Browser type and version
• Operating system
• Access times and dates
• Pages visited and interactions

5. Purpose of Processing

We process your personal data for the following purposes:

• To process and evaluate your job application
• To conduct and assess AI-powered interviews
• To communicate with you regarding your application
• To match you with suitable positions
• To comply with legal obligations
• To protect against fraud and ensure platform security

6. Data Sharing and Recipients

We share your personal data with the following categories of recipients, each bound by Data Processing Agreements (Art. 28 GDPR):

6.1 Portfolio Companies

Potential employers within the BID Equity portfolio who have engaged our recruitment services. They receive application data, assessment results, and interview summaries relevant to the position you applied for.

6.2 AI and Analysis Service Providers

6.3 Platform and Infrastructure Providers

6.4 Other Recipients

• Legal Authorities: When required by law, court order, or to protect our legal rights.
• Professional Advisors: Lawyers, auditors, and consultants bound by professional confidentiality obligations.

All service providers listed above have executed Data Processing Agreements in accordance with Art. 28 GDPR. We do not sell your personal data. We do not permit our service providers to use your personal data for their own purposes, including for the training of their AI models.

7. International Data Transfers

All personal data is processed within the European Economic Area. We do not transfer your personal data to countries outside the EEA. Should this change in the future, we will update this notice and ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions).

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Unsuccessful Applications: Deleted after 6 months unless you consent to longer retention
• Successful Applications: Transferred to employee records
• Interview Recordings: Retained for 3 months after the recruitment process ends
• Technical Logs: Retained for 90 days

We may retain certain data longer if required by law or for legitimate business purposes.

9. Your Rights Under GDPR

Under GDPR, you have the following rights:

• Right of Access (Art. 15 GDPR): Request information about your personal data we process
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate personal data
• Right to Erasure (Art. 17 GDPR): Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing (Art. 18 GDPR): Request limitation of processing
• Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, commonly used format
• Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, please contact us at privacy@bidequity.de.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against:

• Unauthorized or unlawful processing
• Accidental loss, destruction, or damage
• Unauthorized disclosure or access

These measures include encryption, access controls, regular security assessments, and staff training.

11. Cookies and Tracking

We use cookies and similar tracking technologies on our platform. We distinguish between the following categories:

Essential cookies are strictly necessary for the platform to function (e.g., session management, authentication via Clerk). These are set without consent as they are required to provide the service you requested.

Analytics cookies (PostHog) are only activated after you provide explicit consent via our cookie consent banner. These cookies help us understand how users interact with the platform in order to improve its functionality. IP data capture is disabled. No analytics data is collected until you consent.

You can give or withdraw your consent at any time via the cookie consent banner accessible at the bottom of every page, or by contacting us at privacy@bidequity.de. Withdrawing consent does not affect the lawfulness of data collected before withdrawal.

We do not use advertising or marketing cookies. We do not share cookie data with third parties for advertising purposes.

12. Children's Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete such information.

13. Automated Decision-Making

We use AI technology to assist in the recruitment process, which may involve automated processing of your data. However, final hiring decisions are always made by human recruiters. You have the right to:

• Request human intervention in the decision-making process
• Express your point of view
• Contest decisions based solely on automated processing

14. Data Protection Officer

For questions about data protection or to exercise your rights, you can contact our Data Protection Officer:

15. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR:

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

17. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: