DeepL Candidate Privacy Notice

1. Introduction & Background

In connection with the recruitment process you enter into with the DeepL Group, we will collect and process your personal data. We take the privacy, including the security, of personal information we hold about you seriously and only process it in accordance with applicable data protection laws within your jurisdiction. 

This privacy notice informs you of how (i) we collect your personal data; (ii) how we process it during the recruitment process (including how we may share it); and (iii) how you may exercise your legal rights as a data subject. In the event you are successful with your application, we will provide you with a copy of our employee privacy notice alongside your contract. We are entitled to amend this privacy notice from time to time, as we consider necessary and we will notify you of any substantial changes via email. 

You should read this privacy notice carefully so that you know and can understand how we use the information we collect and hold about you.

The DeepL Group is made up of different legal entities, which are:

Where we reference the DeepL Group in this privacy notice we will refer to the company in the group that acts as controller of, and is responsible for your personal data – this will be the DeepL Group entity that will employ you should you be successful with your application.  

Should you have any questions about which entity is the controller of your personal data, please contact privacy@deepl.com. We have appointed Dr. Christian Lenz as our external Data Protection Officer. You may contact Dr. Lenz by writing to him at the following address dhpg IT-Services GmbH, Bunsenstr. 10a, 51647 Gummersbach, or by e-mail at datenschutz@dhpg.com or by telephone on +49 2261 8195 0.

2. What personal data do we collect and how do we collect it?

We may, as set out below, collect and process the following personal data about you where you provide it directly to us as part of the recruitment process, where we have actively sourced it via your professional social media channels such as LinkedIn or where we receive it via third parties including recruiters and DeepL employee referrers: 

• Contact Data: Full name, mailing address, email address, telephone number and other similar contact data.
• Demographic Data: Date of birth, gender identity as well as more sensitive personal data (also known as special category data) including information relating to racial and ethnic origin, religious affiliation, immigration status, sexual orientation, marital and parental status, trade union membership or information about your health, disability and neurodiversity.
• Recruitment Information: Application forms, CVs, cover letters, employment history, right to work information, photo, a copy of your ID such as your passport, interview notes (inc. case study responses), references, details of your qualifications, details of any professional memberships and details of any assessments you took prior to employment/work. 
• Meta Data: Electronically collected information such as use of the IT and communications system, CCTV images and swipe card/entry records. This also includes data that is generated when using our IT systems or other IT applications. 

3. Why do we process your personal data, what do we process and what’s our lawful basis?

• To undertake our recruitment process and to assess your suitability for the role you have applied for at DeepL, we will process your Contact Data and Recruitment Information. We do this in order to take steps to enter into a contract of employment with you. We may also use AI tools to record and transcribe your interview via our third-party provider Ashby, in order to better assess your suitability for a role, as well as for internal analysis connected to your application and staff training purposes. We will only do this in line with your preferences as set out when you are invited to an interview. Please note that where we use AI tools in connection with your application, these are for guidance purposes only and they will not be used to make decisions autonomously without human review and assessment. 
• To ensure you have the right to work in the relevant country you are hired, we will process your Recruitment Information to ensure we comply with legal obligations we are required to comply with as your potential employer. 
• For equal opportunity purposes and in connection with our commitment to fostering a diverse and inclusive workplace, we may process your Demographic Data as part of our voluntary diversity survey. This is necessary to identify areas for improvement in our diversity and inclusion efforts and to ensure our recruitment practices are equitable and reach a broad range of candidates. Where we process special category data, we will only do so where we have your explicit consent to do so. Please note that taking part in the survey and giving your consent is entirely voluntary and your application will not be impacted should you not wish to do so. You can also choose to answer none or only some of the questions. You also have the option to click 'I prefer not to answer' for each question.
• To deal with any problems or concerns you may have, we will process your Contact Data and Recruitment Information, as well as any additional personal data that forms a part of a problem or concern raised by you or relating to you. This is necessary for our legitimate interests in ensuring that your problems or concerns are dealt with appropriately.
• To prevent and detect crime or fraud, and for security purposes we will process your Contact Data and Meta Data. We do this as necessary for our legitimate interests in ensuring the security of our offices.
• To assist us in upholding or enforcing our professional, legal and regulatory obligations, we will process all of the data listed above. This is as necessary to fulfil our legal obligations.
• To maintain IT security and for access control systems we will process your Contact Data and Meta Data. This is as necessary for our legitimate interests in managing IT systems and security and in preventing unauthorised access to DeepL’s systems.

4. Who do we share your personal data with and why?

• Applicant management system (Ashby) under our legitimate interests to ensure an appropriate and efficient recruitment process. You can find more information on Ashby’s data processing here. We also work with Ashby in connection with our voluntary diversity survey. Please note that due to the technical implementation with Ashby, it is not possible for us to see how you responded to the survey. All responses will remain confidential and will be aggregated for analysis. Where we record or transcribe an interview you undertake with us, this will be stored by Ashby and only in line with your preferences as set out when you are invited to an interview
• Pre-employment check providers as necessary to take steps to enter into an employment contract with you and to comply with our legal obligations. We use:
  • Jobbatical OU to assist us with your work permit and your eligibility to obtain a work visa. You can find more information on Jobbatical’s processing here; and
  • Zinc Work Limited to assist us with any additional pre-checks that are required e.g. DBS checks. You can find more information on Zinc’s processing here.
• Coding challenge providers (Geektastic & HackerRank) as necessary to take steps to enter into an employment contract with you and assess your suitability for developer positions. Please note that Geektastic or HackerRank (where relevant and as applicable) may contact you directly regarding the performance of the coding challenges. You can find more information on Geektastic’s processing here and HackerRank’s processing here.
• Professional advisors, such as accountants, lawyers or auditors where we are required to do so to comply with our legal obligations or to defend or protect our rights. 
• Regulators, other authorities or insurance providers where we are required to do so to comply with our legal obligations including in respect of audits, disclosures and investigations.

5. How do we transfer your personal data internationally?

In sharing your personal data for the reasons set out in this privacy notice, we may need to share your personal data with organisations (including DeepL group companies) based or who store your personal data outside of the EU and UK including the US and Japan. We will ensure that your personal data will always be protected by appropriate safeguards to give you enforceable rights and legal remedies. 

All providers secure their transatlantic data traffic through standard contractual clauses. In addition, we have concluded a data processing agreement with each of these providers, meaning that they may only process the data transmitted by DeepL in accordance with our instructions and not for their own purposes.

6. Automated Decision Making

The DeepL Group does not use personal data to make automated decisions as to whether or not you are offered a job.

7. Retention of your data

Unsuccessful Candidates: In the event your application is unsuccessful, we will retain the information you have provided to us for a maximum of another six months from the date you are notified. We will then delete the data automatically, unless we are required by law to retain it for a longer period of if you have consented to a longer storage of your data e.g., for the talent pool as set out below.

Successful Candidates: If, following the recruitment process, an employment contract is concluded, we will store your personal data as part of your personnel file. When working on a freelance basis for DeepL, we will store your personal data for the purpose of executing your contract with us.

Talent Pool: Following your recruitment process we will ask if you would like for us to store your application details on file for two years (whether successful or unsuccessful), so that we can consider you for future opportunities at DeepL. We will ask you again whether you still want to be part of our talent pool after two years. You have the option to withdraw your consent at any time: if you do so, your data will be deleted automatically. 

You can always request us to delete your data by emailing us at privacy@deepl.com. Please note that doing so means that you are withdrawing from any still on-going application processes and that the legal retention period still applies.

8. Your rights as a data subject

Under applicable data protection legislation you have a number of rights available, namely the right to:

• access your personal data;
• correct incomplete/ inaccurate data;
• erase the personal data we hold about you;
• restrict how we handle your personal data;
• ask us to transfer your personal data to a third party;
• object to how we process your personal data; and
• withdraw your consent at any time.

However, please note that some of these rights may not always apply, as there are sometimes requirements and exemptions which may mean we need to keep processing the personal data or not disclose it, or other times when the rights may not apply at all.

You also have the right to complain to the regulator about the DeepL Group’s processing activities and compliance under applicable data protection legislation. Where you are in:

• Germany, you can contact the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, at (i) Kavalleriestraße 2 - 4, 40213 Düsseldorf; or (ii) poststelle@ldi.nrw.de; 
• EU, you may contact your local Supervisory Authority - a full list of Supervisory Authorities in the EU can be found here; or
• UK, you can contact the Information Commissioner’s Officer (“ICO”) and you can make your complaint via the ICO's website here.

9. Changes

This privacy notice may be updated from time to time and you will be provided with a copy where any substantial amends are made.