Privacy Policy

Candidate Privacy Notice

Thanks for considering a job opportunity at Staffbase. In order that we can process your application, you’ll be asked to provide personal data (also referred to as “information” or “data”) to us. Staffbase cares about your privacy and we will make sure to collect and process your data in line with our privacy obligations. 

This Candidate Privacy Notice explains how we collect and process your personal data as an applicant before, during and after the hiring process. It also describes the rights you have in relation to your personal data.

Who are we?

We are Staffbase, a group of companies with offices all over the world. You can find an overview of all our entities and offices here: 

For the purposes of the General Data Protection Regulation (“GDPR”), the data controller is Staffbase GmbH (located at Annaberger Straße 73, 09111 Chemnitz, Germany and further referred to as “Staffbase”, “we”, and / or “us”). However, your data may be processed by other entities within the Staffbase group of companies (“Staffbase Group”) during the recruitment process. For example, your information may be shared with the Staffbase Group entity that employes the relevant recruiter(s) for the role.  In case of a successful application, you will receive an offer from one of the Staffbase Group entities acting as the data controller under the relevant employment agreement.

Scope of this Candidate Privacy Notice

This Privacy Notice applies to any personal data which you submit to Staffbase: (i) through the Jobs page on the Staffbase website ( as part of an application at any of Staffbase’s global offices; (ii) via any other application platform that allows you to directly apply to an open position at Staffbase, such as LinkedIn; and (iii) at any time during the job application process. This Privacy Notice also covers personal data you may submit as part of a general inquiry related to employment opportunities with Staffbase or which you might provide to any Staffbase Group company at a recruiting event. Further, this Privacy Notice applies to personal data collected from third parties in the course of reference and background checks during the application process that are required or allowed under applicable law. This Privacy Notice does not apply to information you submit through any other website or service owned or operated by Staffbase.

Information on the processing of your personal data when visiting our website, can be found at:

What personal data do we collect about you?

When you apply for a job at Staffbase, we collect and process the following categories of personal data:

  • Contact information: Your name, email address, current postal address, phone number, city and country of residence.
  • Personal details: Personal data on your CV or resume or other material you submit to us during the recruitment process, such as your gender, your date of birth, academic qualifications, work experience, your salary and job expectations, information about your work permit or visa status. 
  • Interview notes: We will likely make notes during the recruitment process, for example notes about your work experience and work expectations. We store these notes in our application portal and share them with the Staffbase employees involved in the recruitment process.
  • Financial details: In certain circumstances we might want to reimburse you for any costs created by you during the recruitment process. To process such reimbursement we require limited financial details from you, such as you name and bank account number.
  • Reference and background checks: Depending on your location, and only where required or allowed under applicable law, we collect reference information and information received from background checks, including criminal records (if applicable).
  • Diversity, Equity, and Inclusion information: When you apply via our website, you might be given the choice to answer some Diversity, Equity and Inclusion (“DEI”) questions. You can answer these questions on an entirely voluntary basis and providing, or not providing this information, will have no impact whatsoever on your application. Your answers will be aggregated and pseudonymized. Staffbase will use the pseudonymized information to monitor and improve our DEI efforts within the recruitment process and to generate aggregated data which shall be reported on towards our internal and external stakeholders. We process the DEI information on the basis of our legitimate interests in order to improve our company diversity efforts, unless we require a different legal basis under applicable law. 

How we use your personal data

We will use the information we collect about you for the following purposes:

  • To respond to your general inquiries related to employment opportunities with Staffbase and to communicate with you throughout the recruitment process. We process your information for this purpose based on our legitimate interests.
  • To update and keep your contact information, CV and/or other information accurate if you provide us with a new or updated version. We process your information for this purpose based on our legitimate interests.
  • To assess your qualifications, skills, and suitability for the position you are applying to. We process your information for this purpose based on our legitimate interests.
  • To verify your information and carry out reference checks. We process your information for this purpose based on our legitimate interests or (depending on applicable law) on a legal obligation.
  • To prepare your employment agreement if you are offered a job at Staffbase and you have accepted the offer. We process your information for this purpose based on the performance of a contract or carrying out pre-contractual steps.
  • To assist you with obtaining an immigration visa or work permit (if requested and necessary). We process your information for this purpose based on our legitimate interests.
  • To consider you for, and inform you about other job opportunities (with your consent). We process your information for this purpose based on your consent.

The legal basis of the processing

We may base the processing of your personal data on the following legal grounds:

  • Legitimate interests. We collect and process information about you as necessary for our legitimate interest to assess whether you are fit for employment at Staffbase (Article 6(1)(f) GDPR).
  • Performance of a contract or carrying out pre-contractual . We may process your personal data to carry out pre-contractual steps upon your request. For example, we use your information to make you a job offer or to complete a contract of employment with you (Article 6(1)(b) GDPR). 
  • Consent. In some cases, we may seek your consent to process your personal data. You have the right to withdraw such consent at any time by contacting us at (Article 6(1)(a) GDPR). 
  • Legal obligation. In some cases, we may have a legal obligation to process your personal data (for example, in response to a claim or regulatory order) (Article 6(1)(c) GDPR).

Provision of your personal data during the application process

You are not required by law or by contract to provide your personal data. However, your personal data is necessary so that we can process your job application,  any general inquiries related to employment opportunities with Staffbase, the recruitment process and the decision about whether Staffbase employs you. 

Wherever it is necessary for you to provide personal data, we have identified that data by making it a required field. If you do not provide us with the required personal data in connection with your application, we will not be able to consider your application for the open job position or answer your inquiries. Wherever we ask you to provide additional personal data on a voluntary basis in connection with your application you are, of course, free to decide whether you would like to provide such personal data. Not providing such personal data will have no impact on the recruitment process or our decision about whether we establish an employment relationship with you.

Sharing your personal data

Staffbase will not sell, lease, or licence your personal data to any third party. However, we will share your personal data internally within the Staffbase Group to allow the job application and recruitment processes to work. Your data will only be shared with those people in Staffbase who need to view your data in order to do their job. All employees entrusted with data processing are obliged to maintain the confidentiality of your information. Staffbase Group entities other than Staffbase GmbH processing your information may act as data processors (for example, when the recruiter(s) employed by another Staffbase Group company process your application), or as separate data controllers (for example, when entering into an employment agreement with you). We can base these processing activities on: (i) our legitimate interests (Art. 6(1)(f) GDPR); the performance of a contract or carrying out pre-contractual steps (Art. 6(1)(b) GDPR); or, where applicable, §26(1)(1) German Federal Data Protection Act. 

In addition, we share your information with the following categories of recipients:

  • Third-party service providers: To optimize our recruitment process we use the services of various third parties, such as: pre-employment screening service providers, application portals (such as Greenhouse), interview scheduling software, and recruitment event organizations. These third-party service providers act as data processors. Staffbase will ensure it has properly vetted any third-party service provider and has entered into appropriate data transfer agreements with the relevant service provider. The legal basis for these transfers is Staffbase’s legitimate interests (Art. 6(1)(f) GDPR).
  • Government agencies and law enforcement: We may share your personal data when required by law, court orders, legal process, or a discovery request in civil litigation, or if we believe that your actions violate applicable law, or threaten the rights, property, or safety of Staffbase or our employees. We will only disclose information as required or permitted by applicable data protection laws. The legal basis for these transfers can be Staffbase’s legitimate interests (Art. 6(1)(f) GDPR) or Staffbase’s compliance with a legal obligation (Art. 6(1)(f) GDPR).

When you use third-party apps, websites or other products integrated with our systems to apply for a position at Staffbase, these third parties – when acting as separate data controllers – may collect information about you subject to their own terms and privacy policies.

International Data Transfers

Your personal data may be shared with other Staffbase group companies or third party service providers located outside of the European Economic Area (“EEA”).

To protect your personal data when this is transferred to countries outside of the EEA, we have implemented appropriate safeguards. When we transfer your data within the Staffbase Group, these transfers are protected by an intragroup data processing agreement containing standard contractual clauses approved by the European Commission or any other relevant authority. For transfers to any service providers located outside of the EEA, we will ensure an appropriate transfer mechanism (such as, an “adequacy decision”, or relevant “standard contractual clauses”), and where necessary, we will ensure additional safeguards are in place. 

Data retention and deletion of your personal data

A successful application

If you are successful in your job application, most of the information we collect about you during the hiring process will become part of your employment record and retained in accordance with our privacy policies for employee data. If we have no legal obligation or other legal basis to store certain application information after the recruitment process, we will delete that information within a period of 6 months after the recruitment decision.

An unsuccessful application

If your application was unsuccessful, we may contact you about possibly relevant positions which may become available in the future, but only if you have given us your consent to do so. We will then delete the information in your application file one (1) year after the recruitment decision. 

If you do not consent  to Staffbase storing your information to contact you about possibly relevant future positions, we will delete your application information within a period of 6 months after any rejection.

Staffbase may retain your application information for a longer period of time if we have to protect Staffbase’s legal interest. In that case, we will keep your information for as long as necessary, until any relevant claim(s) have been settled or until the applicable statute of limitation has lapsed.

Your rights

You have the following rights over your personal data. You have the right to:

  • know whether we process personal data about you and, if we do, to access that personal data;
  • have your personal data corrected or updated;
  • have your personal data deleted;
  • have us restrict the processing of your personal data;
  • have your personal data transferred to you or another controller.

Withdrawal of your consent. If you have given us your consent to process certain information, you may withdraw your consent at any time without affecting the lawfulness of processing based on your consent before its withdrawal. In that case we will stop processing the relevant information unless we’re legally required to keep the information. 

Right to object. If we process your personal data based on our legitimate interests, you have the right to object to the relevant processing activity. 

To exercise any of these rights please contact us via Please make sure to clarify what request you have in the email subject line. When you exercise your rights, we process your personal data based on our legal obligation to comply with these rights and so that we can demonstrate such compliance. 

Keep in mind, we might ask for additional information to verify your identity, before we can start working on your request. We may not always be able to fulfil your request, for instance if we have a legal obligation or a legitimate interest to keep your information.

No automated decision making. We do not use any automated decision making techniques that have a legal or similarly significant effect on you.

Contact us, questions and complaints

Thank you for reading our Candidate Privacy Notice. If you have any questions about this Candidate Privacy Notice, please contact us by emailing

If you wish to communicate directly with our external Data Protection Officer  please send an email to  

If you have a complaint about the way we handle your personal data, you also have the right to address this with any competent data protection authority, including the data protection authority of the EEA Member State in which you live or work or the place of the alleged infringement.