This notice explains how we process your personal data when you apply for a position at CareerSide through our careers page, in line with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Data Controller

Iotonic GbR

Kaufmannshof 15, 55120 Mainz, Germany

Email: info@iotonic.dev

Phone: +49 176 55755595

2. Data We Process

Identity and contact data: your name, email address and, if you provide them, your phone number and LinkedIn profile URL
CV and documents: the CV you upload and the optional cover note, including any information you choose to include in them
Screening answers: your answers to the questions asked in the application form
Communications: emails and notes from calls and conversations during the application process
Consent records: which consents you gave, when, and for which version of this notice

Please do not include special categories of personal data (for example health data, religious beliefs or ethnic origin) unless they are relevant to your application.

3. Purposes and Legal Basis

3.1 Handling your application

We use your data to review your application, contact you, run the interviews and decide whether to make you an offer. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract), in conjunction with, where applicable, § 26 BDSG and Art. 88 GDPR (data processing for employment purposes).

3.2 Talent pool (optional)

If you tick the talent-pool box, we keep your application so we can contact you about other suitable roles. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw this consent at any time with effect for the future.

3.3 Defending legal claims

Within the retention period below we may use your data to defend ourselves against claims, in particular under the German General Equal Treatment Act (AGG), which gives applicants two months to assert claims (§ 15(4) AGG). The legal basis is our legitimate interest under Art. 6(1)(f) GDPR.

4. Recipients

Internal: only the people involved in the hiring decision for the role you applied for
Processors: providers who host our systems and deliver our emails, bound by data processing agreements under Art. 28 GDPR
No sale of data: we do not sell your data or share it with other employers

We do not transfer your data to countries outside the EU/EEA. If that ever becomes necessary, we only do so with appropriate safeguards such as an adequacy decision or the EU Standard Contractual Clauses (Art. 44 et seq. GDPR).

5. How Long We Keep Your Data

Your application and CV: deleted 180 days (6 months) after you submit your application
With talent-pool consent: deleted 24 months (730 days) after you submit your application
On request: we delete your data earlier if you ask us and no legal obligation requires us to keep it

If we hire you, the application data we need for the employment relationship is moved to your personnel file and handled under our employee privacy notice; everything else is deleted in line with the retention rules above.

6. Your Rights

Access: a copy of the data we hold about you (Art. 15 GDPR)
Rectification: correction of inaccurate data (Art. 16 GDPR)
Erasure: deletion of your data (Art. 17 GDPR)
Restriction: limiting how we process your data (Art. 18 GDPR)
Portability: your data in a machine-readable format (Art. 20 GDPR)
Objection: objecting to processing based on legitimate interests (Art. 21 GDPR)
Withdraw consent: at any time, without affecting processing that happened before

To exercise these rights, email info@iotonic.dev.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34, 55116 Mainz, Germany
Website: www.datenschutz.rlp.de

7. No Automated Decisions

A person on our team reviews every application. We do not make hiring decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

8. Is Providing Your Data Required?

Applying is voluntary, and there is no legal or contractual obligation to provide your data. Without the required information (name, email, CV and your agreement to this notice), however, we cannot consider your application.

Applicant Privacy Notice