Applicant Privacy Information

Last updated: October 2026

1. Controller

yoummday GmbH, Infanteriestr. 11a, 80797 München, Germany
Data protection contact: [email protected]

2. Applicant tracking system

Since 6 October 2026, we use Ashby as our applicant tracking system, replacing Personio. Data from ongoing applications and from our previous talent pool was transferred to Ashby.

3. What data we process

  • Data you provide: e.g. name, contact details, CV, cover letter, certificates and your answers to application questions.
  • Data from the process: e.g. interview notes, results of assessments and case studies, and our communication with you.
  • If we approach you first (active sourcing): data from your public professional profile, e.g. on LinkedIn, such as name, current and previous roles, skills, education and profile link.

4. Purposes and legal bases

  • Carrying out the application process: Art. 6(1)(b) GDPR.
  • Talent pool for future positions, only with your consent: Art. 6(1)(a) GDPR.
  • Active sourcing, i.e. identifying and contacting potential candidates: Art. 6(1)(f) GDPR. Our legitimate interest is filling open positions with suitable people.
  • Retention after a rejection: Art. 6(1)(f) GDPR. Our legitimate interest is the ability to defend ourselves against legal claims.

Providing your data is not legally or contractually required. Without it, we cannot consider your application.

5. Talent pool

You can join our talent pool in two ways: by ticking the box in the application form, or by confirming via a link we send you, e.g. together with a decision on your application. If you agree, we keep your data for 12 months and may contact you about suitable positions. You can withdraw your consent at any time with effect for the future, e.g. by email to [email protected]. Withdrawal does not affect the lawfulness of processing before it.

6. Active sourcing

If we contact you on our own initiative, we create a candidate profile with data from your public professional profile and our messages. We inform you about this processing with our first message, at the latest within one month. If you are not interested or do not reply, we delete your data after 3 months. You can object at any time, and we will then delete your data without delay.

7. AI-supported screening

We use AI features of our applicant tracking system to compare application documents with the criteria of a specific position, e.g. required skills, tools or experience. The AI provides an assessment per criterion with a short reasoning. It does not make decisions. Every decision on your application is made by a person. We do not use solely automated decision-making within the meaning of Art. 22 GDPR.

8. Recipients

Within yoummday, only the people involved in the hiring decision have access to your data. Ashby, Inc. processes your data on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR.

9. Transfer to the United States

Ashby stores and processes data in the United States. Ashby participates in the EU-U.S. Data Privacy Framework, so the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). In addition, our data processing agreement with Ashby contains the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

10. Retention

  • If you are hired, your application data becomes part of your electronic personnel file.
  • Rejected applications are deleted 6 months after the end of the application process.
  • Talent pool data is kept for 12 months from your consent, or until you withdraw it, whichever is earlier.
  • Active sourcing profiles without reply or interest are deleted after 3 months.

11. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). Where we rely on legitimate interests, you have the right to object (Art. 21 GDPR). You can withdraw your consent at any time. To exercise your rights, contact [email protected].

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach.