Privacy notice for candidates
Information on the processing of your personal data in our recruitment process pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) · Version 2.4 - 14/10/2026
1. Who is responsible for the processing?
Two companies are joint controllers for the processing of your application data:
AlfaDocs GmbH, Balanstrasse 73, 81541 Munich, Germany
AlfaDocs Italia S.r.l., Via dei Campi della Rienza 30, 39031 Brunico (BZ), Italy
Together referred to below as “AlfaDocs”, “we” or “us”. Contact for data protection matters and contact point within the meaning of Article 26(1), third sentence, GDPR: gdpr@alfadocs.com. You may raise any request with that address; we will pass it on internally.
You can reach the data protection officer of AlfaDocs GmbH at: secopan gmbh, Jan Schmidt, datenschutz@secopan.de. You can reach the data protection officer of AlfaDocs Italia S.r.l. at: Cesare Vagnini, Datawave, datawaveprivacy@pec.it .
2. Joint controllership
AlfaDocs GmbH and AlfaDocs Italia S.r.l. process your application data jointly. They are joint controllers within the meaning of Article 26 GDPR and have set out in an agreement which of them fulfils which obligations. The essence of that agreement is as follows:
Both companies decide jointly which positions are advertised, who is invited and who is rejected, and how long application documents are kept. Employees of both companies may access your application in so far as they are involved in the procedure.
AlfaDocs GmbH informs you about the processing of your data, handles your requests concerning your rights, operates the applicant tracking system used and implements erasures.
AlfaDocs Italia S.r.l. participates in the joint decisions and assists in responding to your requests.
Both companies inform each other without undue delay of personal data breaches and each fulfils its own notification obligations towards the supervisory authority competent for it.
You may exercise your rights under the General Data Protection Regulation against either of the two companies. If you wish, simply contact the contact point named above.
Irrespective of the above, you have the right to lodge a complaint with a supervisory authority (section 11).
3. What does this notice cover?
This notice applies when you apply for a position with AlfaDocs — via our career site, a job board, by e-mail or in any other way — and when we keep your data in our talent pool with your consent. It applies to positions of both companies. We use Teamtailor, an applicant tracking system provided by Teamtailor AB, Oestgoetagatan 16, 116 21 Stockholm, Sweden, as a processor on our behalf. Teamtailor may only process your data in accordance with our instructions.
This notice also applies to persons named by a candidate as referees; the information specifically addressed to them is set out in section 12.
4. Which personal data do we process?
Application data you provide: name, contact details, CV, cover letter, qualifications, employment history, salary expectations, earliest start date, and — if you choose to provide them — a photo or video (including video interviews, where used).
Communication and process data: messages exchanged with us, interview notes and evaluations by our hiring team, the status and history of your application.
Data from third parties (Article 14 GDPR): if you apply via a job board or similar partner, we receive the data you submitted there; if you were recommended to us (e.g. by an employee) or if we contact you based on a publicly available professional profile (e.g. LinkedIn), we receive your contact details and profile information from that source. The source is documented in your candidate profile.
Technical data from the career site: IP address, log data and — subject to your consent — analytics data (see section 9).
References: at a later stage of the process, we may ask you to name one or more referees, e.g. former managers or colleagues. We process the information you provide about them (name, job title, employer, professional relationship with you, e-mail address and telephone number) and the content of the reference they give us, which becomes part of your candidate profile. We contact only the referees you have named, and only after informing you. Please name only persons who have agreed to be contacted, and make the information in section 12 available to them.
Information we do not need
We ask you not to include in your application any information that is not relevant to the position — in particular information about health, disability, religion or belief, political opinions, trade union membership, racial or ethnic origin, or your sex life. If your application nevertheless contains such information, we do not take it into account when deciding on your application.
We process such information only where this is necessary to comply with a legal obligation — for example in connection with the employment of persons with disabilities or, for certain roles, with the assessment of fitness for the role. The legal basis is then Article 9(2)(b) GDPR in conjunction with the employment law provisions applicable in the respective country.
5. Purposes and legal bases
Conducting the application process for an advertised position: assessing your application, communication, interviews, decision-making -> Article 6(1)(b) GDPR — steps taken at your request prior to entering into an employment contract
Assessing and replying to an unsolicited application not linked to a specific position -> for positions of AlfaDocs GmbH: Article 6(1)(b) GDPR; for positions of AlfaDocs Italia S.r.l.: Article 6(1)(f) GDPR — our legitimate interest in recruitment and selection
Talent pool, i.e. keeping your profile for future positions beyond the specific process -> Article 6(1)(a) GDPR — your consent, which you can withdraw at any time with effect for the future
Compliance with legal obligations in the field of employment -> Article 6(1)(c) GDPR; for special categories of data additionally Article 9(2)(b) GDPR (see section 4)
Career-site operation and security -> Article 6(1)(f) GDPR; non-essential cookies and analytics only with your consent, Article 6(1)(a) GDPR and Section 25(1) TDDDG (see section 9)
Reference checks: contacting the referees you have named and assessing their statements -> Article 6(1)(f) GDPR, our legitimate interest in verifying information relevant to the hiring decision. This applies both to your data and to the referees' data.
Where we rely on a legitimate interest, we have weighed your interests against ours and documented the result. On request we will explain that assessment to you.
Providing your data is voluntary; however, without the data marked as required we cannot consider your application.
6. Who receives your data?
Within AlfaDocs: the people of both companies involved in the specific hiring process (recruiting/HR and the responsible hiring team). Access is structured by responsibility and not by location; employees of one company may therefore also take part in procedures of the other.
Teamtailor AB (Sweden) as our processor operating the recruitment platform, bound by a data processing agreement under Article 28 GDPR. We use the Teamtailor EU data region: your data is stored with hosting providers in the EU, in particular Amazon Web Services (Ireland) and Hetzner (Germany and Finland). Where we upload a CV to the system manually, Riminder SAS (France) extracts the information into structured fields. Teamtailor sub-processors are listed here: https://support.teamtailor.com/en/articles/4723968-list-of-subprocessors-for-customers-using-teamtailor-s-europe-eu-region
Job boards and partners through which you applied (e.g. Indeed, LinkedIn): these operate as independent controllers; where you have so requested or consented there, status information about your application may be shared back with the respective partner. Their own privacy notices apply.
We do not sell your data and we do not share it with third parties for their own marketing purposes.
7. Are data transferred outside the EU/EEA?
Your application data is processed exclusively in the European Union and the European Economic Area. The applicant tracking system is assigned to the EU data region, and the providers used for it are located in the European Union (see section 6).
The platform offers individual optional features that would involve providers outside the EEA — the sending of SMS messages, push notifications for a mobile app, delivery of the career site under a custom domain, and a content delivery service. These features are not activated. If we start using any of them, we will amend this notice beforehand and state the basis for the transfer — an adequacy decision of the European Commission or the EU standard contractual clauses (Article 46(2)(c) GDPR). You can request information about the safeguards in place, and a copy where applicable, via gdpr@alfadocs.com.
8. How long do we keep your data?
How long we keep your application depends on which company the position belongs to. The reason for keeping an application after the end of a process is a different one in Germany and in Italy, and the periods therefore differ.
For positions related to Alfadocs GmbH:
Application for an advertised position, not hired - up to 6 months after the conclusion of the process
Unsolicited application, not kept in the talent pool - up to 6 months after our reply
Talent pool (with your consent) - up to 24 months from your consent or from your last contact with us, whichever is later; we may ask you to renew it before it expires
References: the referees' contact details and the content of the references are kept for the same periods as the application to which they relate and are deleted together with it. They are not kept in the talent pool and are not transferred to the personnel file.
For positions related to Alfadocs Italia Srl:
Application for an advertised position, not hired - up to 12 months after the conclusion of the process
Unsolicited application, not kept in the talent pool - up to 12 months after our reply
Talent pool (with your consent) - up to 24 months from your consent or from your last contact with us, whichever is later; we may ask you to renew it before it expires
References: we delete the referees' contact details as soon as the reference check is complete. The short summary of a reference is kept with the application to which it relates and is deleted together with it. References are not kept in the talent pool and are not transferred to the personnel file.
After the period has elapsed your data is deleted or anonymised. Documents we need in order to defend against a claim that has actually been raised may be kept for the duration of that matter outside the applicant tracking system, in a separate storage location with restricted access; this concerns the individual case only. Where we have to keep particular documents longer because of a specific legal obligation, we record that obligation for the individual case.
Technical residual copies: platform backups are retained for approximately 10 days after deletion; certain platform logs for up to 28 days (candidate event logs); limited infrastructure logs are kept by Teamtailor as a controller in its own right for up to 365 days.
If your application is successful, the data required is transferred to the personnel file of the hiring company; from that point that company is the sole controller and you will receive a separate employee privacy notice.
9. Cookies and analytics on the career site
The career site runs on the Teamtailor platform. Technically necessary cookies are used to deliver the site. Analytics and marketing cookies (e.g. anonymised visitor statistics, embedded content such as YouTube videos or LinkedIn features) are set only with your consent via the cookie banner; you can change or withdraw your choice at any time via the cookie settings. Details are set out in the cookie policy on the career site.
10. Automated processing and automated decisions
We do not take decisions producing legal effects or similarly significant effects solely by automated means (Article 22 GDPR); your application is always decided by people. We do not use automated ranking, scoring or pre-selection of applications, and no application is rejected automatically.
Individual steps run automatically without any decision being attached to them: where we upload a CV to the system manually, the information is automatically extracted into structured fields; the result is visible to us and corrected where necessary. In addition, messages to you — such as the acknowledgement of receipt — may be triggered by a change of stage that a person has decided on.
Where we use AI-assisted features of our recruitment platform (e.g. for drafting text, translations or summaries), the results are always reviewed by our staff. These features are currently not activated. Before we switch them on we will assess them separately and amend this notice. Further information: gdpr@alfadocs.com.
11. Your rights
Subject to the conditions of the GDPR you have the right of access (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18) and to data portability (Article 20), as well as the right to object to processing based on legitimate interests (Article 21). You can withdraw consent at any time with effect for the future (Article 7(3)).
You may exercise these rights against either of the two controllers (Article 26(3) GDPR). The simplest way is to contact gdpr@alfadocs.com; please include information that allows us to identify you.
You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the EU/EEA state of your residence or place of work. For AlfaDocs GmbH the competent authority is the Bavarian Data Protection Authority (Bayerisches Landesamt fuer Datenschutzaufsicht, BayLDA), Ansbach; for AlfaDocs Italia S.r.l. it is the Garante per la protezione dei dati personali, Rome. An overview of supervisory authorities: https://edpb.europa.eu/about-edpb/board/members_en.
12. Information for referees (Article 14 GDPR)
This section is addressed to you if a candidate has named you as a referee. We received your data from that candidate. The joint controllers are the two companies named in sections 1 and 2; you can contact us and the data protection officers as indicated there.
We process your name, job title, employer, professional relationship with the candidate, e-mail address and telephone number, as well as the information you give us about the candidate and our notes of it. We do so in order to obtain a reference on the candidate as part of our recruitment process. The legal basis is Article 6(1)(f) GDPR: our legitimate interest lies in making an informed hiring decision. Giving a reference is entirely voluntary; you may decline or stop at any time without giving reasons.
When giving a reference, please do not share information about the candidate's health, disability, religion or belief, political opinions, trade union membership, racial or ethnic origin or sex life, or about their private life unrelated to their professional activity.
Your data is accessible only to the people involved in the specific hiring process and to Teamtailor AB as our processor (section 6), and it is processed exclusively in the EU/EEA (section 7). We keep it for the periods described in section 8 under "References".
You have the rights set out in section 11, in particular the right to object to the processing at any time (Article 21 GDPR), and the right to lodge a complaint with the BayLDA or the Garante per la protezione dei dati personali. We refer you to this notice at the latest when we first contact you.
13. Changes to this notice
We amend this notice when our processes, the systems we use or the legal framework change. The current version is available on our career site. Version 2.4 — 14/10/2026
