Privacy Policy

Candidate Privacy Note

Thanks for considering a job opportunity at Staffbase. In order that we can process your application, you’ll be asked to provide personal data (also referred to as “information” or “data”) to us. Staffbase cares about your privacy and we will make sure to collect and process your data in line with our privacy obligations. 

This Candidate Privacy Notice explains how we collect and process your personal data as an applicant before, during and after the hiring process. It also describes the rights you have in relation to your personal data.

Who are we?

We are Staffbase, a group of companies with offices all over the world. You can find an overview of all our entities and offices here: https://staffbase.com/en/contact/. 

For the purposes of the General Data Protection Regulation (“GDPR”), the data controller is Staffbase SE (located at Annaberger Straße 73, 09111 Chemnitz, Germany and further referred to as “Staffbase”, “we”, and / or “us”). However, your data may be processed by other entities within the Staffbase group of companies (“Staffbase Group”) during the recruitment process. For example, your information may be shared with the Staffbase Group entity that employs the relevant recruiter(s) for the role.  In case of a successful application, you will receive an offer from one of the Staffbase Group entities acting as the data controller under the relevant employment agreement.

When does this Candidate Privacy Notice apply?

This Privacy Notice applies to any personal data which you submit to Staffbase: (i) through the Jobs page on the Staffbase website (https://staffbase.com/jobs/) as part of an application at any of Staffbase’s global offices; (ii) via any other application platform that allows you to directly apply to an open position at Staffbase, such as LinkedIn; and (iii) at any time during the job application process. This Privacy Notice also covers personal data you may submit as part of a general inquiry related to employment opportunities with Staffbase or which you might provide to any Staffbase Group company at a recruiting event. Further, this Privacy Notice applies to personal data collected from third parties in the course of reference and background checks during the application process that are required or allowed under applicable law. This Privacy Notice does not apply to information you submit through any other website or service owned or operated by Staffbase.

Information on the processing of your personal data when visiting our website, can be found at: https://staffbase.com/en/privacy-policy/.

1. The personal data we process

When you apply for a job at Staffbase, we collect and process the following categories of personal data:

  • Contact information when you apply or register for a recruitment event: Your name, email address, current postal address, phone number, city and country of residence.
  • Personal details: Personal data on your CV or resume or other material you submit to us during the recruitment process, such as your gender, your date of birth, academic qualifications, work experience, your salary and job expectations, information about your work permit or visa status. 
  • Interview notes: We will likely make notes during the recruitment process, for example notes about your work experience and work expectations. We store these notes in our application portal and share them with the Staffbase employees involved in the recruitment process.
  • Financial details: In certain circumstances we might want to reimburse you for any costs created by you during the recruitment process. To process such reimbursement we require limited financial details from you, such as your name and bank account number.
  • Reference and background checks: Depending on your location, and only where required or allowed under applicable law, we collect reference information and information received from background checks, including criminal records (if applicable).
  • Diversity, Equity, and Inclusion information: When you apply via our website, you might be given the choice to answer some Diversity, Equity and Inclusion (“DEI”) questions. You can answer these questions on an entirely voluntary basis and providing, or not providing this information, will have no impact whatsoever on your application. Your answers will be aggregated and pseudonymized. Staffbase will use the pseudonymized information to monitor and improve our DEI efforts within the recruitment process and to generate aggregated data which shall be reported on towards our internal and external stakeholders. We process the DEI information on the basis of our legitimate interests in order to improve our company diversity efforts, unless we require a different legal basis under applicable law. 
  • Information you voluntarily provide: such as information about your compensation history.

2. The purpose and legal basis of processing

We process the above-mentioned information for the purposes outlined in this section. Under applicable laws, such as the GDPR, we require a legal basis for the processing of your personal data. For each processing purpose we will explain the legal basis for our processing.

  • Communicate with you: We process your data to respond to your general inquiries related to employment opportunities with Staffbase and to communicate with you throughout the recruitment process. We process your information for this purpose based on our legitimate interests.
  • Update your information: To update and keep your contact information, CV and/or other information accurate if you provide us with a new or updated version. We process your information for this purpose based on our legitimate interests.
  • To determine your qualifications for employment and to make hiring decisions: To assess your qualifications, skills, and suitability for the position you are applying to. We process your information for this purpose based on our legitimate interests.
  • Background and reference checks: To verify your information and carry out background and reference checks. We process your information for this purpose based on our legitimate interests or (depending on applicable law) on a legal obligation.
  • Initiate a job offer: To prepare your employment agreement if you are offered a job at Staffbase and you have accepted the offer. We process your information for this purpose based on the performance of a contract or carrying out pre-contractual steps.
  • Provide assistance: To assist you with obtaining an immigration visa or work permit (if requested and necessary). We process your information for this purpose based on our legitimate interests.
  • Contact you about other job opportunities at Staffbase: To consider you for, and inform you about other job opportunities (with your consent). We process your information for this purpose based on your consent.
  • To inform you about Staffbase recruitment events: Staffbase regularly organizing recruitment events, such as our Job Speed Dating event. When you have registered for an event or when you have visited our events in the past, we may send you emails or other types of communication to update you about upcoming recruitment events. The legal basis for this processing activity is our legitimate interest, or (when required) your consent.
  • Establish, exercise, or defend against legal claims: Obviously we hope we don’t need to process your data to establish, exercise, or defend against any legal claims related to you. In case Staffbase deems it necessary to do so, we may process all relevant information related to your job application to protect our interests. Staffbase will base these activities on its legitimate interests or a legal obligation. 

3. Provision of your personal data during the application process

You are not required by law or by contract to provide your personal data. However, your personal data is necessary so that we can process your job application,  any general inquiries related to employment opportunities with Staffbase, the recruitment process and the decision about whether Staffbase employs you. 

Wherever it is necessary for you to provide personal data, we have identified that data by making it a required field. If you do not provide us with the required personal data in connection with your application, we will not be able to consider your application for the open job position or answer your inquiries. Wherever we ask you to provide additional personal data on a voluntary basis in connection with your application you are, of course, free to decide whether you would like to provide such personal data. Not providing such personal data will have no impact on the recruitment process or our decision about whether we establish an employment relationship with you.

4. How and why we share your personal data

Staffbase will not sell, lease, or licence your personal data to any third party. However, we will share your personal data internally within the Staffbase Group to allow the job application and recruitment processes to work. Your data will only be shared with those people in Staffbase who need to view your data in order to do their job. All employees entrusted with data processing are obliged to maintain the confidentiality of your information. Staffbase Group entities other than Staffbase SE processing your information may act as data processors (for example, when the recruiter(s) employed by another Staffbase Group company process your application), or as separate data controllers (for example, when entering into an employment agreement with you). We can base these processing activities on: (i) our legitimate interests (Art. 6(1)(f) GDPR); the performance of a contract or carrying out pre-contractual steps (Art. 6(1)(b) GDPR); or, where applicable, §26(1)(1) German Federal Data Protection Act. 

In addition, we share your information with the following categories of recipients:

  • Third-party service providers: To optimize our recruitment process we use the services of various third parties, such as: pre-employment screening service providers, application portals (such as Greenhouse), interview scheduling software, and recruitment event organizations. These third-party service providers act as data processors. Staffbase will ensure it has properly vetted any third-party service provider and has entered into appropriate data transfer agreements with the relevant service provider. The legal basis for these transfers is Staffbase’s legitimate interests (Art. 6(1)(f) GDPR).
  • Government agencies and law enforcement: We may share your personal data when required by law, court orders, legal process, or a discovery request in civil litigation, or if we believe that your actions violate applicable law, or threaten the rights, property, or safety of Staffbase or our employees. We will only disclose information as required or permitted by applicable data protection laws. The legal basis for these transfers can be Staffbase’s legitimate interests (Art. 6(1)(f) GDPR) or Staffbase’s compliance with a legal obligation (Art. 6(1)(f) GDPR).

When you use third-party apps, websites or other products integrated with our systems to apply for a position at Staffbase, these third parties – when acting as separate data controllers – may collect information about you subject to their own terms and privacy policies.

How we transfer personal data internationally

For EEA / UK / Swiss residents

Your personal data may be shared with other Staffbase group companies or third party service providers located outside of the European Economic Area (“EEA”), the United Kingdom (“UK”), and Switzerland.

To protect your personal data when this is transferred to countries outside of the EEA, we have implemented appropriate safeguards. When we transfer your data within the Staffbase Group, these transfers are protected by an intragroup data processing agreement containing standard contractual clauses approved by the European Commission or any other relevant authority. For transfers to any service providers located outside of the EEA, we will ensure an appropriate transfer mechanism (such as, an “adequacy decision”, or relevant “standard contractual clauses”), and where necessary, we will ensure additional safeguards are in place. 

For Australian residents

Staffbase will transfer your personal information to third parties located outside of Australia for the purposes set out in the Privacy Notice. Staffbase may also transfer your Personal Information to Staffbase entities in the Staffbase Group.

For Canadian residents

Staffbase will transfer your personal information to third parties located outside of Canada for the purposes set out in the Privacy Notice. These third party service providers or contractors may be located in the United States. Staffbase may also transfer your Personal Information to Staffbase entities in the Staffbase Group.

5. Data retention and deletion of your personal data

A successful application

If you are successful in your job application, most of the information we collect about you during the hiring process will become part of your employment record and retained in accordance with our privacy policies for employee data. If we have no legal obligation or other legal basis to store certain application information after the recruitment process, we will delete that information within a period of 6 months after the recruitment decision.

An unsuccessful application

If your application was unsuccessful, we may contact you about possibly relevant positions which may become available in the future, but only if you have given us your consent to do so. We will then delete the information in your application file 1 year after the recruitment decision. 

If you do not consent  to Staffbase storing your information to contact you about possibly relevant future positions, we will delete your application information within a period of 6 months after any rejection.

Staffbase may retain your application information for a longer period of time if we have to protect Staffbase’s legal interest. In that case, we will keep your information for as long as necessary, until any relevant claim(s) have been settled or until the applicable statute of limitation has lapsed.

6. How we store and secure personal data

We have implemented security procedures and technical restrictions to protect your personal data from unauthorised access, destruction or modification. We only retain your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law. Anonymous and aggregated information may be stored indefinitely.

7. Your privacy rights and how to exercise them

You have the following rights over the personal data we hold about you:

  • Right to be informed and to access your data. You have the right to know whether we hold personal data about you and, if we do, to access that information; 
  • Right of rectification. You can request us to correct or update personal;
  • Right to request deletion. You can request us to have your personal data deleted;
  • Right to restrict processing. You can request us to have us restrict the processing of your personal data;
  • Withdrawal of your consent. If you have given us your consent to process certain information, you may withdraw your consent at any time. In that case we will stop processing the relevant information unless we’re legally required to keep the information.
  • Right to object. If we process your personal data based on our legitimate interests, you have the right to object to the relevant processing activity. 
  • Right to data portability. You may have your personal data transferred to another controller, to the extent possible; 
  • File a complaint. You have the right to complain to a data protection authority about our collection and use of your personal data. 

No automated decision making. We do not use any automated decision making techniques that have a legal or similarly significant effect on you. 

Rights under the CCPA. If you are a California resident, please review our Section 9 of this Privacy Notice for information regarding your California privacy rights.

How to exercise your rights?

To exercise any of these rights please contact us via privacy@staffbase.com. Please make sure to clarify what request you have in the email subject line. Keep in mind, we might ask for additional information to verify your identity, before we can start working on your request. We may not always be able to fulfil your request, for instance if we have a legal obligation or a legitimate interest to keep your information. 

If we have received your personal data from or on behalf of a Staffbase customer and you wish to exercise any rights you may have under applicable data protection law, please contact the relevant customer directly. 

8. Contact us, questions and complaints

Thank you for reading our Candidate Privacy Notice. If you have any questions about this Candidate Privacy Notice, please contact us by emailing privacy@staffbase.com.

If you wish to communicate directly with our external Data Protection Officer  please send an email to dpo@staffbase.com.  

If you have a complaint about the way we handle your personal data, you also have the right to address this with any competent data protection authority, including the data protection authority of the EEA Member State in which you live or work or the place of the alleged infringement. 

Staffbase SE
Annaberger Straße 73
09111 Chemnitz
Germany

Site Notice: https://staffbase.com/en/site-notice/

9. CCPA – Additional disclosures for California residents 

Applicability

This section applies only to California consumers and supplements the information provided in the rest of this Privacy Policy. For purposes of this CCPA section the definition “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, or as otherwise defined by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (California Civil Code §§ 1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time (“CCPA”).

Categories of personal information we collect and disclose

In the past 12 months, Staffbase may have collected, and disclosed the following categories of Personal Information to third parties for our business purposes:

    • Identifiers: such as your: name, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, or other similar identifiers. We collect this information directly from you or we receive it from third party sources.
    • Commercial information: such as: products or services purchased, obtained, or considered by you on behalf of our Customer (e.g. subscription records) or by you as an individual (e.g. event tickets). We collect this information directly from you.
    • Internet or other electronic network activity information: such as, your browsing and search history, and information regarding interaction with the Staffbase Website and/or a Staffbase application or advertisement. We collect this information from your device or we receive it from a third party.
  • Geolocation data: such as your IP address. We collect this information from your device
  • Audio, electronic, visual or similar information: such as, audio and visual information when you participate in Staffbase promotional material, such as our podcast or campaigns.
  • Professional or employment-related information: such as, information about your profession and role. We collect this information directly from you or from a third party.
  • Financial information: such as payment information or financial account numbers in the process of providing you with a certain service, for example, a ticket to our Voices conference.
  • Inferences drawn from the above categories. We may get such inferences by using third party software to give us accurate insights into our audience and market.

Why do we collect these categories of personal information?

The business and commercial purposes for which we collect this personal information are described in Section 2 of this Privacy Policy. 

Who do we share the personal information with?

The categories of third parties to whom we disclose these listed categories of personal information for a business purpose are described in Section 3 of this Privacy Policy. 

How long do you store the personal information?

The period of time for which we retain this information is described in Section 4 of this Privacy Policy.

Sale of your personal information

We do not sell personal information. For purposes of this Privacy Policy, “sell” means the disclosure of personal information to a third-party for monetary or other valuable consideration.

Your privacy rights under the CCPA

You have certain rights regarding the Personal Information we collect or maintain about you. Please note these rights are not absolute, and there may be cases when we decline your request as permitted by law.

    • The right to know and access. You have the right to know and request disclosure of personal information collected by us about the consumer, from whom it was collected, why it was collected, and, if sold, to whom. 
    • The right to limit. You have the right to limit the use and disclosure of personal information.
    • The right to correct: You have the right to request that we correct any inaccurate personal information that we maintain about you.
    • The right to delete: You have the right to request that we delete personal information collected or maintained by us, subject to certain exceptions. 
  • The right to opt out of the sale or sharing of personal information (if applicable). Staffbase will not sell your personal information. You can opt-out to Staffbase sharing personal information via the use of cookies via our Cookie Preference Menu on the Staffbase Website. More information can be found in Section 7 of this Privacy Policy.
  • The right to non-discrimination: You will not receive any discriminatory treatment when you exercise one of your privacy rights. 

How to exercise your rights?

You can contact us by privacy@staffbase.com to exercise your rights.

You can exercise your rights yourself or you can alternatively designate an authorized agent to exercise these rights on your behalf. Please note that to protect your personal information, we may need to verify your identity by a method appropriate to the type of request you are making. We may also request that your authorized agent have written permission from you to make requests on your behalf, and we may also need to verify your authorized agent’s identity to protect your personal information.