Privacy policy for job applications
– Information pursuant to Articles 13, 14 and 21 of the General Data Protection Regulation (‘GDPR’) –
Last updated: 9 June 2026
We look forward to getting to know you. It doesn't matter whether you've made a speculative application for one of our vacancies or you've caught our eye as a talent: protecting your privacy is important to us. We therefore detail in the following how we process your personal data in connection with the application process. We also explain the rights you have to protect your data.
The controller responsible for the processing of your data is:
Flip GmbH
Rotebühlstrasse 50
70178 Stuttgart
Germany
Email: contact@getflip.com
You can reach our data protection officer at the following contact details:
Flip GmbH
Rotebühlstrasse 50
70178 Stuttgart
Germany
Email: datenschutz@getflip.com
When you visit our website, we process personal data. You can find more information in our general privacy policy.
You have the opportunity to apply for our vacancies via our website. For this purpose, an application form with mandatory and voluntary information is available.
3.1 What data do we process?
When you use the application form on our website, we process the following data:
first name and last name
email address
telephone number
details that we can take from your uploaded CV (e.g. address, education and training)
indication of your desired annual salary
You also have the option of voluntarily providing us with additional information via the application form. If you use this function, we also process the following data:
if applicable, information we can gather from your uploaded cover letter (e.g. previous employers, professional skills and goals)
if applicable, the URL to your LinkedIn profile and information that you have made publicly available on your LinkedIn profile
if applicable, the URL of your website as well as information that you have made publicly available on your website (e.g. previous projects, clients, publications)
In the course of the subsequent application process, further personal data may also be processed in connection with the processing of your application. These include, for example:
your date and place of birth
your nationality
further information on your qualifications and skills (e.g. letters of recommendation, references, proof of existing work experience)
bank details
if applicable, special categories of personal data pursuant to Article 9 (1) GDPR (e.g. health data, if a determination of health suitability for the position is required)
3.2 For what purpose is the data processed and on what legal basis?
We process your data to decide on the establishment of an employment relationship. The legal basis for the processing is Section 26 (1) of the Federal Data Protection Act (BDSG) in conjunction with Article 88 (1) GDPR and Article 6 (1) (1) (b) GDPR.
We process special categories of personal data within the meaning of Article 9 (1) of the GDPR (in particular health data) in the exercise of rights and the fulfilment of obligations under employment law and social law (e.g. recording of a severe disability). The legal basis for this is Article 9 (2) (b) GDPR in conjunction with Section 26 (3) BDSG. In exceptional cases, the processing of health data may also be relevant for the assessment of your ability to work (Article 9 (2) (h) GDPR in conjunction with Section 22 (1) (b) BDSG).
3.3 Use of AI-assisted tools in the application process
In the course of processing your application, we use an AI-based language model service (“AI tool”) provided by Anthropic, PBC (San Francisco, USA) as a technical support tool. This AI tool is used exclusively for the following, narrowly defined purposes:
• Summarizing CVs and cover letters: Creating structured summaries of the content you have submitted, in order to support our HR team in efficiently processing a high volume of applications.
• Skills extraction: Identifying and highlighting specific professional skills, qualifications, and experience mentioned in your application documents to match them against the requirements of the advertised position.
The AI tool does not perform any of the following:
• scoring, ranking, or filtering of applicants;
• making or recommending hiring decisions;
• assessing personal suitability, personality traits, or cultural fit;
• analysing photographs, video, or audio content;
• inferring or processing information relating to your race or ethnic origin, gender, religion or belief, disability, age, or sexual identity within the meaning of Section 1 of the German General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz, “AGG”).
All decisions relating to your application — including whether to invite you to an interview, whether to continue the application process, or whether to make you a job offer — are made exclusively by human decision-makers (qualified HR staff and hiring managers). The AI-generated summaries serve solely as a preparatory aid and are non-binding. Our HR staff are instructed and trained to critically review AI outputs and to disregard any information that could lead to discrimination within the meaning of the AGG.
The legal basis for this processing is Section 26 (1) BDSG in conjunction with Article 88 (1) GDPR and Article 6 (1) (1) (b) GDPR (processing necessary for the decision on the establishment of an employment relationship). We also rely on our legitimate interest pursuant to Article 6 (1) (1) (f) GDPR in the efficient and timely administration of a high volume of applications. We have concluded that this interest is not overridden by your rights and freedoms, taking into account in particular that (i) the AI tool is used exclusively as a preparatory aid, (ii) no automated decisions are made, (iii) all outputs are subject to human review, and (iv) appropriate technical and organizational safeguards are in place to prevent discriminatory processing.
Safeguards against discrimination (AGG compliance):
To fulfil our obligations under Sections 7 and 12 AGG and in anticipation of the requirements for deployers of high-risk AI systems under Regulation (EU) 2024/1689 (EU AI Act), we have implemented the following measures:
(a) The AI tool is prompted with explicit instructions not to consider or infer characteristics protected under Section 1 AGG (race or ethnic origin, gender, religion or belief, disability, age, sexual identity).
(b) The AI-generated summaries are reviewed by trained HR personnel who are aware of the risks of algorithmic bias and their obligations under the AGG.
(c) We conduct periodic reviews of AI outputs to identify and address potential patterns of indirect discrimination (mittelbare Benachteiligung) within the meaning of Section 3 (2) AGG.
(d) We do not use AI outputs as the sole or primary basis for any negative decision regarding your application.
(e) We maintain documentation of our AI use in the application process, the safeguards implemented, and the results of periodic bias reviews.
(f) You have the right to request information about whether and how AI tools were used in the processing of your specific application. Please contact datenschutz@getflip.com.
If your profile matches one of our open job descriptions, we may contact you personally (“active sourcing”).
4.1 What data do we process?
When we contact you for the purpose of filling a vacancy, various personal data may be processed. These include, for example:
first name and last name
contact details (e.g. email address, telephone number)
information on your qualifications and skills (e.g. education and training)
in accordance with the respective operator's terms of use, data that you have provided about yourself in publicly accessible online networks or platforms with a professional focus.
In the course of the subsequent application process, further personal data may also be processed in connection with the processing of your application. These include, for example:
your date and place of birth
your nationality
further information on your qualifications and skills (e.g. letters of recommendation, references, proof of existing work experience)
bank details
if applicable, special categories of personal data pursuant to Article 9 (1) GDPR (e.g. health data, if a determination of health suitability for the position is required)
4.2. For what purpose is the data processed and on what legal basis?
We process your data in order to contact you about job offers in our company. We are interested in approaching suitable candidates regarding vacancies in our company. The processing is carried out on the basis of a balancing of interests according to Article 6 (1) (1) (f) GDPR, which always takes your interests into account.
If you are interested in the vacancy and would like to discuss it further, we may also process your data for the subsequent decision on the establishment of an employment relationship. The legal basis for the processing is Section 26 (1) of the BDSG in conjunction with Article 88 (1) GDPR and Article 6 (1) (1) (b) GDPR.
We process special categories of personal data within the meaning of Article 9 (1) of the GDPR (in particular health data) in the exercise of rights and the fulfilment of obligations under employment law and social law (e.g. recording of a severe disability). The legal basis for this is Article 9 (2) (b) GDPR in conjunction with Section 26 (3) BDSG. In exceptional cases, the processing of health data may also be relevant for the assessment of your ability to work (Article 9 (2) (h) GDPR in conjunction with Section 22 (1) (b) BDSG).
Your personal data will only be processed for the purpose of the application procedure or recruiting measures and then deleted (see Section 6). However, with consent, you have the option of having some of your personal data included in our talent pool at a later date, so that we may contact you in the future about suitable vacancies.
5.1 What data do we process?
If you want to be included in our talent pool, we process various personal data. The data will not be passed on to third parties. Personal data includes, for example:
· first name and last name
· your date and place of birth
· contact details (e.g. email address, telephone number)
· information on your qualifications and skills (e.g. education and training)
5.2 For what purpose is the data processed and on what legal basis?
We process your data in order to contact you in the future about interesting job offers in our company. The processing is based on consent pursuant to Article 6 (1) (1) (a) GDPR. Once you have given your consent, you can revoke it at any time. Please note that your revocation is only valid for the future. Processing that took place before the revocation remains unaffected.
We will delete your personal data as soon as it is no longer required for the above-mentioned purposes:
If you are hired, we store your data for the duration of the employment relationship.
If the application process is completed without us hiring you, we will delete your data no more than four months later, unless you have consented to be included in our talent pool.
Finally, the storage period is also assessed according to the statutory limitation periods, which, for example, according to Section 195 et seq. of the German Civil Code (BGB), are usually three years, but in certain cases can be up to thirty years.
Within the company, your data will be accessed by those departments that need it to process your application and to fulfil their legal obligations (e.g. the HR department and managers).
We use the following service providers as processors appointed by us in accordance with Article 28 GDPR. These processors are strictly bound by our instructions when handling your personal data:
(a) Ashby, Inc., 548 Market St PMP 397006 San Francisco, CA 94104-5401, USA (“Ashby”) — for application management. Ashby receives some of your personal data in the course of managing the application process.
(b) Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA (“Anthropic”) — as provider of the AI language model “Claude”. We use this service exclusively for the purpose of summarizing application documents and extracting skills information as described in Section 3.3. Only the textual content of CVs and, where submitted, cover letters is transmitted to Anthropic. No photographs, no identification numbers, no dates of birth, and no information about protected characteristics under the AGG are intentionally transmitted. Anthropic processes the data solely on our instruction, does not use the data to train its models, and deletes the data after processing in accordance with our data processing agreement.
(c) Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”) — as provider of Google Workspace services (including Gmail, Google Drive, and Google Docs). In the course of managing the application process, your application data and related correspondence may be processed and stored within Google Workspace. Google acts as a processor on our behalf and processes data in accordance with our data processing agreement.
(d) Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA (“Microsoft”) — as provider of Microsoft 365 services (including Microsoft Outlook, Word, Excel, and related productivity tools). In the course of managing the application process, your application data may be opened, reviewed, or stored using Microsoft 365 tools, for example when your documents are in Microsoft Office formats. Microsoft acts as a processor on our behalf and processes data in accordance with our data processing agreement.
We have concluded data processing agreements pursuant to Article 28 GDPR with all of the above service providers. The processors do not receive more data than is necessary for the respective purpose, and they are prohibited from using your data for any other purpose.
When processing your data within the scope of the services described in Section 7, your data may be transferred to the United States of America. This applies to the following service providers: Ashby, Anthropic, Google, and Microsoft.
For each of these transfers, we have ensured an adequate level of data protection through one or more of the following mechanisms:
(a) Standard Contractual Clauses (SCCs) pursuant to Article 46 (2) (c) GDPR, as adopted by the European Commission;
(b) Where applicable, the EU-U.S. Data Privacy Framework pursuant to Article 45 GDPR, to the extent the respective service provider is certified under the framework.
We have also conducted a transfer impact assessment for each service provider in accordance with the requirements set out by the European Court of Justice (Schrems II) and have implemented supplementary technical and organizational measures where necessary. These include encryption of data in transit and at rest, contractual prohibitions on onward transfers, and access restrictions.
Please contact our data protection officer at datenschutz@getflip.com if you would like to receive a copy of the Standard Contractual Clauses or further information about the safeguards in place.
You have the following rights to protect your personal data:
· the right of access in accordance with Article 15 GDPR;
· the right to rectification in accordance with Article 16 GDPR;
· the right to erasure in accordance with Article 17 GDPR;
· the right to restrict processing in accordance with Article 18 GDPR; and
· the right to data portability in accordance with Article 20 GDPR.
The restrictions according to Sections 34, 35 of the BDSG apply to the right of access and the right to erasure.
You also have the option of submitting a complaint about data protection issues to our data protection officer or, pursuant to Article 77 GDPR in conjunction with Section 19 BDSG, to a data protection supervisory authority.
If the processing of personal data is based on your consent pursuant to Article 6 (1) (a) GDPR or Article 9 (2) (a) GDPR, you can revoke this consent at any time. The revocation shall not affect the lawfulness of processing carried out on the basis of the consent up until the revocation.
Sometimes, it may be necessary for you to provide us with personal data in order to establish an employment relationship. Failure to provide personal data may result in us being unable to take this information into account when making a recruitment decision.
Please note that the provision of personal data in the context of the employment relationship may be required by law or contract. Failure to provide such data may potentially have adverse consequences for you.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6 (1) (1) (e) GDPR (data processing in the public interest) and Article 6 (1) (1) (f) GDPR (data processing on the basis of a balance of interests).
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.
The objection can be made informally to the contact details given in the job advertisement.
We do not make any decisions in the application process that are based solely on automated processing within the meaning of Article 22 (1) GDPR. In particular, no applicant is rejected, shortlisted, scored, or ranked solely or predominantly on the basis of an automated process.
As described in Section 3.3, we use an AI-assisted language model service (provided by Anthropic) as a preparatory tool to summarize application documents and to identify skills mentioned therein. This AI tool produces non-binding text summaries that serve exclusively as a support to human decision-makers.
The final assessment of your application, including the decision on whether to invite you to an interview or to offer you a position, is always made by qualified human HR staff and/or hiring managers, who exercise independent judgment. The AI-generated summaries are one of several informational inputs and may be disregarded at any time.
Your rights in connection with the use of AI tools:
(a) You have the right to be informed about whether AI-assisted tools were used in the processing of your application (Article 13 (2) (f) GDPR). You may exercise this right by contacting datenschutz@getflip.com.
(b) You have the right to request that your application be processed entirely without the use of AI tools. We will accommodate such requests without any disadvantage to your application. To make such a request, please contact datenschutz@getflip.com at any time during the application process.
(c) In accordance with the Allgemeines Gleichbehandlungsgesetz (AGG), you have the right to a discrimination-free application process. If you believe that the use of AI-assisted tools in our application process has resulted in a disadvantage linked to a protected characteristic under Section 1 AGG, you may contact our complaints office in accordance with Section 13 AGG. You may also contact our data protection officer or the competent data protection supervisory authority.
We take our obligations under the AGG and the EU AI Act (Regulation (EU) 2024/1689) seriously and have implemented the safeguards described in Section 3.3 to prevent discriminatory effects of AI-assisted processing in our application process.
Flip GmbH
Rotebühlstr. 50
70178 Stuttgart
Germany
Email: datenschutz@getflip.com