This Privacy Notice explains how Fotografen Online Service GmbH (“we,” “our,” or “us”) processes personal data when you apply for a position with us or otherwise participate in our recruitment process.

It applies to candidates located in the European Economic Area and other European countries for positions that Fotografen Online Service GmbH is recruiting for.

Privacy at a glance

We process the information you provide to us, together with information generated during the recruitment process, to assess your application, communicate with you and decide whether to offer you employment.

In some cases, we may also obtain professional information about potential candidates from recruitment agencies, professional networking platforms or other publicly available professional sources.

We use service providers to support our recruitment process, including our applicant tracking system, communication and interview tools and, where applicable, online assessment tools.

Some interviews may use Google Meet functionality to record, transcribe or create AI-supported notes or summaries. Where we use these features, you will be informed accordingly. These tools assist with interview documentation. They do not make the final hiring decision.

If your application is unsuccessful, we normally retain your application data for up to six months following the end of the recruitment process. With your consent, we may retain your information for up to twelve additional months in our talent pool so that we can contact you about suitable future roles.

You can contact us at any time about your personal data or your privacy rights.

1. Controller and Contact Information

The Data Controller responsible for the processing in this notice is:

Fotografen Online Service GmbH

Hausvogteiplatz 12

10117 Berlin

Recruitment enquiries:talentacquisition@fotograf.de

Privacy enquiries and requests concerning your data protection rights:

datenschutz@fotograf.de

For any questions regarding data protection in connection with our recruitment process, you may also contact our Data Protection Officer at any time. Our Data Protection Officer can be reached at the postal address and email address provided above (please mark your correspondence “For the attention of the Data Protection Officer”).

Please note that messages sent to this email address may not be accessed exclusively by our Data Protection Officer. If you wish to communicate confidential information, please first use this email address to request direct contact with our Data Protection Officer.

2. Application and Recruitment Process

2.1. Applications for Open Positions

You may apply for an open position through our career portal, through a recruitment platform, by email or through another recruitment channel.

For the purpose of evaluating your application and potentially entering into an employment relationship with you, we may process in particular:

• your name and contact details;
• your country or place of residence;
• your CV, cover letter and other application documents;
• your employment history;
• your educational background, qualifications and professional certifications;
• your skills and professional experience;
• your salary expectations;
• your availability or possible starting date;
• information relating to your right to work, visa requirements or possible relocation;
• information about how you became aware of the position;
• references or recommendations, where requested;
• information you provide in correspondence with us; and
• other information that you voluntarily provide as part of your application.

Please avoid providing special categories of personal data, such as information concerning your health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership or sexual orientation, unless this information is relevant and necessary for the recruitment process. If special-category data is processed where necessary in connection with employment-related rights or obligations, the processing is based on Section 26(3) of the German Federal Data Protection Act (“BDSG”) in conjunction with Article 9(2)(b) GDPR.

The primary legal basis for processing your application is Article 6(1)(b) and Article 88 GDPR in conjunction with Section 26(1) BDSG, as the processing is necessary to decide whether to establish an employment relationship with you.

If your application is unsuccessful, we normally retain your application data for up to six months following completion of the recruitment process. This allows us, among other things, to establish, exercise or defend legal claims where necessary.

If you are hired, relevant application information may be transferred to your personnel record and retained in accordance with the retention requirements applicable to the employment relationship.

2.2 Candidate Sourcing

We may identify and contact potential candidates who have not applied directly to us. For this purpose, we may obtain professional information from sources such as:

• professional networking platforms;
• professional profiles and websites;
• recruitment agencies;
• job boards; and
• other publicly accessible professional sources.

Depending on the source, we may process:

• your name;
• professional contact information;
• your location;
• your current or previous job titles;
• your employment history;
• your educational background;
• professional skills and qualifications; and
• other professional information that you have made publicly available.

We use this information to determine whether your professional background may be relevant to an open or anticipated position and, where appropriate, to contact you.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is identifying and contacting suitably qualified individuals for our open positions.

When assessing this interest, we take into account the professional nature of the information, the context in which it was made available and your reasonable expectations. If we contact you based on information obtained indirectly, we will provide you with the information required under Article 14 GDPR at the latest when we first communicate with you, unless an exception under the GDPR applies.

We normally retain sourcing information for no longer than six months if no employment relationship is established, unless a longer retention period is permitted or required by law.

You have the right to object to processing based on our legitimate interests as described in Section 11 below.

2.3 Talent Pool

If you are not selected for a particular position, we may ask whether you would like us to retain your application information so that we can contact you about suitable opportunities in the future. Participation in our talent pool is voluntary. If you consent, we may retain your relevant application information for up to twelve months following completion of the recruitment process. The legal basis is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 26(2) BDSG.

You may withdraw your consent at any time with effect for the future by contacting:

talentacquisition@fotograf.de

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. If you withdraw your consent, or once the talent-pool retention period expires, we will delete the relevant information unless another legal basis requires or permits us to retain it.

2.4 Communication and Interview Scheduling

During the recruitment process, we use communication and collaboration tools to arrange interviews and communicate with you.

For these purposes, we may process:

• your name;
• your email address;
• your telephone number, where relevant;
• your profile photo, if provided;
• interview dates and scheduling information;
• the position for which you are being considered; and
• the contents of recruitment-related communications.

We primarily use Google Workspace services, including Google Calendar, Gmail and Google Meet, for these purposes. We may also use other internal communication tools where necessary for recruitment coordination.

The legal basis is Article 6(1)(b) GDPR and Section 26(1) BDSG because this processing is necessary for conducting the recruitment process. We retain this information only for as long as necessary for recruitment and in accordance with the retention periods described in this notice.

3. Interviews and AI-Supported Meeting Documentation

3.1 Google Meet

We generally conduct remote interviews using Google Meet, which forms part of our Google Workspace environment.

Google Meet may process information including:

• your name and email address;
• meeting and scheduling information;
• technical connection and device information;
• audio and video transmitted during the meeting; and
• information contained in chat messages or other content you provide during the meeting.

3.2 Recording, Transcription and AI-Supported Notes

For certain interviews, we may use Google Meet functionality or Ashby AI notetaker that records or transcribes a meeting or creates AI-supported meeting notes or summaries.

Depending on the feature used, this may involve processing:

• your name;
• your voice;
• your image, where video is enabled;
• an audio or video recording of the interview;
• a transcript of the interview;
• written or AI-generated meeting notes or summaries;
• the position for which you are applying;
• the stage of the recruitment process; and
• information discussed during the interview.

We use these features to facilitate accurate interview documentation, allow interviewers to focus on the conversation and support consistent internal recruitment processes. Where recording, transcription or AI-supported note-taking is used, you will be informed through the interview process and/or through Google Meet.

Where we rely on your consent for recording or comparable optional interview documentation, the legal basis is Article 6(1)(a) GDPR in conjunction with Section 26(2) BDSG. Where a feature is used solely as an internal documentation aid and another legal basis applies, we will ensure that its use is lawful and transparent.

Declining an optional recording or comparable consent-based feature will not in itself adversely affect your application. Where reasonably possible, the interview may instead be documented by written notes taken by the interviewers.

Recordings, transcripts and AI-generated notes are made available only to persons who require them for the recruitment process. We retain interview documentation only for as long as necessary for the recruitment process. Where your application is unsuccessful, such information is normally deleted no later than six months after completion of the process and may be deleted earlier where it is no longer required.

4. Candidate Online Assessment

As part of our recruitment and selection process, we may invite you to complete one or more online assessments usingTestGorilla B.V. (“TestGorilla”). These assessments are designed to help evaluate skills, knowledge, aptitude or other characteristics relevant to the position in a fair and consistent manner.

Depending on the assessment, the following information may be processed:

• your name;
• your email address;
• your IP address and browser information;
• your answers to assessment questions;
• assessment scores and evaluation results;
• video or webcam recordings, where a particular assessment requires this and the feature is enabled; and
• optional demographic information, where applicable.

TestGorilla administers the assessment and provides the relevant results to us.

Our processing of assessment results is based on Article 6(1)(b) GDPR and Section 26(1) BDSG where the assessment forms part of the selection process. Where necessary, Article 6(1)(f) GDPR may additionally apply to processing connected with our legitimate interest in operating a fair, consistent and effective recruitment process.

We retain assessment information only for as long as necessary for recruitment, normally no longer than six months after completion of an unsuccessful application unless you are hired or have consented to longer retention in our talent pool.

TestGorilla may process or retain certain information in accordance with its own privacy practices. Where TestGorilla processes information on our behalf, appropriate data-processing arrangements are in place.

5. Career Website and Analytics

When you visit our career website or interact with job postings, certain technical information may be processed automatically. Depending on your privacy preferences, this may include:

• IP address;
• browser and operating-system information;
• device information;
• approximate location derived from your IP address;
• referring website;
• pages viewed and the date and time of access;
• links clicked;
• downloaded files;
• interactions with job postings; and
• conversion or similar analytics events.

We may use services including Google Analytics and PostHog to understand how visitors interact with our career website and to improve our recruitment experience.

Where the use of analytics or similar optional technologies requires consent, processing takes place only after you have provided consent through our consent-management solution. The legal basis is Article 6(1)(a) GDPR. Where applicable, access to or storage of information on your device is also based on the applicable national implementation of the ePrivacy Directive, including Section 25(1) TDDDG in Germany.

You may change or withdraw your consent through the privacy settings provided on the website.

Analytics information collected on the career website is generally retained for no longer than 14 months, subject to the settings applicable to the relevant service.

6. Applicant Tracking System

We use Ashby, Inc. to provide our career portal and support the administration of our recruitment process. Ashby may process information including:

• your name and contact information;
• application documents;
• education and employment history;
• information about the role for which you applied;
• interview feedback;
• assessment results;
• communications with you; and
• other information provided or generated during the recruitment process.

Ashby processes this information on our behalf for the purpose of managing applications and recruitment workflows. The legal basis for our underlying recruitment processing is primarily Article 6(1)(b) and Article 88 GDPR in conjunction with Section 26(1) BDSG.

If your application is unsuccessful, information held in the applicant tracking system is normally retained for up to six months following completion of the recruitment process, unless you have consented to longer storage in our talent pool or another legal basis permits or requires retention.

7. Service Providers and Recipients

We disclose personal data only where this is necessary for the purposes described in this notice, where you have consented, or where disclosure is required or permitted by law.

Service providers used in connection with recruitment may include:

• Ashby, Inc. – career portal, applicant tracking and recruitment administration;
• Google Ireland Limited / Google LLC – Google Workspace services including email, calendar, interviews, meeting transcription and AI-supported meeting documentation;
• TestGorilla B.V. – candidate assessments;
• Usercentrics A/S – consent management for the career website;
• Google Ireland Limited / Google LLC – website analytics, where enabled;
• PostHog, Inc. – website and interaction analytics, where enabled;
• Slack Technologies, LLC – internal recruitment-related communication, where relevant; and
• Personio GmbH – applicant or HR-related administration, where used in connection with the recruitment process.

We have appropriate contractual arrangements in place with service providers that process personal data on our behalf, including data-processing agreements where required by Article 28 GDPR.

Within GotPhoto, personal data is accessible only to employees and other authorized persons who require access for recruitment, HR, management, legal, compliance or IT purposes. We may also disclose personal data where required by law, court order or a lawful request from a public authority, or where necessary for the establishment, exercise or defence of legal claims.

8. International Data Transfers

Some of our service providers are established outside the EEA or may process personal data from countries outside the EEA, including the United States. Where personal data is transferred outside the EEA, we ensure that an appropriate transfer mechanism is in place.

Depending on the recipient, this may include:

• an adequacy decision adopted by the European Commission;
• the EU-U.S. Data Privacy Framework where the relevant U.S. recipient is certified under that framework;
• the European Commission’s Standard Contractual Clauses; and
• where appropriate, supplementary technical or organisational safeguards.

You may contact datenschutz@fotograf.de if you would like further information about the safeguards applicable to a particular transfer.

9. Artificial Intelligence and Automated Decision-Making

We may use AI-supported functionality in limited parts of the recruitment process. At present, such functionality may include:

• AI-supported transcription, note-taking or summarization of interviews through Google Workspace / Google Meet; and

• automated or algorithmic functionality associated with candidate assessments.

AI-supported interview documentation is used to assist our recruitment team with documenting the interview. It is not used by itself to decide whether you will be hired.

Assessment scores or other technology-assisted outputs may form one element considered during the recruitment process, but they are reviewed in the wider context of your application.

We do not make a final hiring decision based solely on automated processing that produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR. Meaningful human involvement remains part of our recruitment decisions.

Where a technology used by us falls within the scope of Regulation (EU) 2024/1689 (the “EU AI Act”), including the rules applicable to certain AI systems used in recruitment or employment, we comply with the requirements applicable to our use of that technology as those requirements become applicable.

If you have questions about the use of AI-supported tools in your recruitment process, you can contact:

talentacquisition@fotograf.de

10. How Long We Retain Your Information

Unless a different period is stated above, we apply the following general retention periods:

Unsuccessful applications

Application and recruitment information is normally retained for up to six months after completion of the recruitment process.

Successful applications

Where you are hired, information relevant to establishing and managing the employment relationship may become part of your personnel record and will be retained in accordance with applicable employment-law and statutory retention requirements.

Talent pool

Where you have consented to our talent pool, relevant information may be retained for up to twelve months after completion of the original recruitment process.

Candidate sourcing

Information obtained for candidate sourcing is normally retained for up to six months where no employment relationship is established.

Career website analytics

Analytics information is generally retained for no longer than 14 months, subject to the settings applicable to the relevant service.

We may retain particular information for longer where necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

11. Your Data Protection Rights

Subject to the requirements of applicable law, you may have the right to:

• access the personal data we process about you;
• correct inaccurate or incomplete personal data;
• request deletion of your personal data;
• request restriction of processing;
• receive certain personal data in a portable format where the requirements for data portability are met;
• object to processing based on legitimate interests under Article 21 GDPR; and
• withdraw your consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

You also have the right to lodge a complaint with a competent data protection supervisory authority.

For Fotografen Online Service GmbH, the competent supervisory authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany

You may also contact another competent supervisory authority, in particular in the EU Member State of your habitual residence or place of work.

To exercise your rights or ask a privacy question, please contact: datenschutz@fotograf.de

For recruitment-specific questions you may also contact: talentacquisition@fotograf.de

12. Updates to This Notice

We may update this Recruitment Privacy Notice where our recruitment processes, service providers or applicable legal requirements change.

The current version will be made available through our career website. Where a change materially affects an ongoing recruitment process, we will provide additional information where required.