Back

This is an English translation provided for convenience. The German version is the original and legally binding text; in case of any discrepancy, the German version prevails.

Privacy Policy

1. Controller

myrecruity GmbH, Weihburggasse 5/3, 1010 Vienna, Austria
Email: office@myrecruity.com · Web: www.myrecruity.com

2. Principles

We process personal data exclusively in accordance with the GDPR and the Austrian Data Protection Act (DSG) — for clearly defined purposes, on the basis of a valid legal ground, and only for as long as necessary.

3. Processing activities, purposes & legal bases

a) Visiting the website / server log files. Technically necessary data (e.g. IP address, date/time, page accessed, browser type) to provide the website securely and reliably. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

b) Contact, forms & appointment booking. Processing of the data you provide (name, email, phone number, selected role) to handle your enquiry and to get in touch with you. If you book a call through our scheduling link, the same applies to the details you enter there. Legal basis: consent (Art. 6(1)(a)) and the initiation/performance of a contract (Art. 6(1)(b)).

c) Talent & client data / placement. Processing of profile, contact and job-related data to match suitable talents with companies. Legal basis: consent (point (a)), performance of a contract (point (b)) or legitimate interest (point (f)).

Presenting your profile to companies. With the consent you give when registering, we present your profile to companies whose positions suit you. Companies first see an anonymised version without your name, contact details or other information that would identify you. A company sees the full profile only once it expressly unlocks it; we log the unlocking. We never pass on your salary expectation, reasons for changing jobs or exclusion list (see d). You can withdraw your consent at any time in your account; we then stop presenting your profile, and companies no longer see any information about you. For the disclosure of your profile by recruiter organisations, see g). Legal basis: your consent (Art. 6(1)(a) GDPR).

Skill suggestions from LinkedIn. When you fill in your profile from your LinkedIn profile, our data provider Coresignal also supplies skills it has inferred automatically from your LinkedIn information. Of these, we only take skills that your own profile texts mention into your profile (at most 15). We store up to 20 more separately from your profile and show them only to you as suggestions; they only become part of your profile once you add and save them yourself. We do not pass suggestions on to companies and do not use them for placement or in any AI processing. We remember dismissed suggestions as skill names (at most 200) so that we do not suggest them again. We delete open suggestions as soon as you add them or remove your LinkedIn source; suggestions and dismissed suggestions are deleted when you reset your profile and at the latest when you delete your account.

AI suggestions for the roles you are looking for and your industries. To make it easier to answer which roles you are looking for and which industries you have experience in, we let an AI model suggest up to five matching job titles and up to five industries. For this, the model only receives the job titles of your work experience together with the names of the respective employers (with month and year and whether the position is current), your skills and the names of your degrees — no names, contact details, salary information, locations, descriptions or educational institutions. The suggested industries do not contain employer names. The model runs at Amazon Web Services (Amazon Bedrock) in the EU; the data is not used for training. The suggestions are non-binding and marked as AI suggestions. We show them only to you; they only become part of your profile once you adopt and save them yourself. We do not pass them on to companies and do not use them for placement. We store the suggestions separately from your profile until they are generated again; they are deleted when you remove the underlying profile data (work experience, skills and degrees), when you reset your profile and at the latest when you delete your account. Legal basis: as under c).

Profile sources and AI drafts of your profile texts. When you create or complete your profile, you can add sources: CVs and other documents, pasted text, your LinkedIn profile (through our data provider Coresignal) and a website of your own. We read the professional information out of them with an AI model and assemble a draft profile from it for you to check and change. In addition, the AI model writes a first draft of your job title, your short headline and your "About me" text from these sources; this step is preset when you create your profile, and you can switch it off before the draft is built — we then take these texts from your sources as they are, and you write them yourself. Before any text goes to the model, we remove your name, email addresses, phone numbers and links; the model may only restate what your sources contain, and employers, dates or figures that do not appear in them are discarded. AI-written texts are marked as such in your profile; we submit your profile to our team for review only once you have checked or confirmed these texts, and companies see them only after you have released your profile (see above). The model runs at Amazon Web Services (Amazon Bedrock) in the EU; the data is not used for training, and we do not store the model's answers in raw form. We delete added sources at the latest 30 days after they were added and intermediate results of the assembly after 24 hours; only what is in your profile remains. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — assembling your profile from the sources you provide is part of the service you request from us.

d) Career preferences of talents. When you complete your profile as a talent (in the profile itself or through our profile questions), we process the information you choose to provide:

  • the job direction and career level you are aiming for, and the industries in which you have particular experience;
  • your reasons for changing jobs and your requirements for a future employer, each with an optional note;
  • your place of residence (city and country only), willingness to relocate, home-office preference, desired working hours and availability, including your notice period;
  • your salary expectation (gross, monthly and annual);
  • preferred companies and companies you do not want to work for (exclusion list).

The purpose is to find suitable jobs and companies for you and to prepare the placement. We do not ask for your current or past salary. We never pass your salary expectation, reasons for changing jobs or exclusion list on to companies; the other information only as part of the staged release of your profile. This information is currently not used in any AI processing. You can change or delete it in your profile at any time. Please do not include information about your health, religion or other special categories of personal data (Art. 9 GDPR) in the notes. Legal basis: as under c).

e) Marketing. Where you have given consent, we contact you for information and marketing purposes (e.g. product updates). Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

f) Referral partnerships (referral codes). Partners, companies, agencies and individual persons may receive a referral code from us with which they refer others to myrecruity. If you reach our website through such a link or code and register as a talent or company, we attribute your registration to that code and its owner. The purpose is to measure and settle referral partnerships and to manage the codes themselves. For this we store only the code, your account identifier (for companies also the identifier of the company account), the time the code was captured and the time of your registration — no names, email addresses or profile data. The attribution is made only if the code is valid and your account was created within a short time after the code was captured; it is never changed afterwards. We pass on to partners only aggregated figures (e.g. how many registrations a code accounts for), never who registered. Where the owner of a code is an individual, we store only their account identifier with the code, no name. The attribution is kept for the lifetime of your account and deleted when you delete your account; a code whose owner deletes their account is deactivated and detached from the owner. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in measuring and settling referral partnerships. For the cookie that keeps the code until you register, see section 7.

g) Talent suggestions from recruiters to companies (invitations). Recruiter organisations that use myrecruity can suggest up to ten talents to a company for a specific position. For this, the recruiter organisation passes us the email address of a contact person at the company; we send this person an invitation with links to the talents' anonymised exposés and a link to register. The full profile (with name and contact data) of a talent with a myrecruity account is passed on only if the talent has accepted the Terms of Service and this Privacy Policy in version 2026.10 or a later version and has released the profile for recruiters. For talents the recruiter organisation manages itself, it is passed on only if the recruiter organisation has documented the talent's consent to this disclosure. The company sees the profile only after it has registered or signed in with exactly the invited email address. The purpose is to place the suggested talents with this company. The recruiter organisation decides which talents it suggests and is responsible for the consent of the talents it manages itself; we provide the invitation and its delivery and are responsible for the company account.

The invitation stores the contact person's email address and the details of the position; for talents the recruiter organisation manages itself, it also stores a copy of the profile (name, job title, contact data, summary, skills, languages, locations, work experience and education — never salary information, CV files or internal notes). The email address is stored only in the invitation itself, not in queues or logs. An invitation is valid for 30 days; if it is not accepted, we delete it together with the email address and the profile copy no later than 7 days after that. If it is accepted, revoked or re-sent to another address, we remove the email address and the profile copy at once and keep a record without these details for 180 days. Suggestions the company has decided on are deleted 180 days after the decision. For signing in through an invitation link we use the technically necessary cookie oauth_invite, which keeps the invitation code for at most 10 minutes.

If you have a myrecruity account as a talent and your profile was passed to a company this way, we notify you. In your account settings, under "Shared with companies", you can see which company received your profile, for which position and when, and you can withdraw the release there at any time; the company can then no longer see your profile. Deleting your account has the same effect. As a company's contact person, you can object to the processing of your email address at any time (office@myrecruity.com).

Legal basis: for the disclosure of the profile of a talent with a myrecruity account, the consent the talent gives by accepting the Terms of Service in version 2026.10 (Art. 6(1)(a) GDPR); for the disclosure of the profile of a talent the recruiter organisation manages itself, the talent's consent documented by the recruiter organisation (Art. 6(1)(a) GDPR); for processing the contact person's email address, the legitimate interest of the recruiter organisation and our legitimate interest in initiating the placement (Art. 6(1)(f) GDPR).

h) Conversations with Anna and AI-assisted calls. Anna is our AI agent. She holds conversations with you, for example to capture your profile and your preferences. Wherever you talk to an AI, we tell you so. We process the content for the purposes under c) and d). We run the AI models on Amazon Bedrock in the EU; the data is not used for training. Calls with talents may be held with AI assistance through the service Voiceflow; at the start of the call you are told that an AI is speaking. Legal basis: as under c).

i) Payment processing (companies). We process payments from companies through the payment service provider Stripe; this involves invoice, contact and payment data. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and statutory retention obligations (Art. 6(1)(c) GDPR).

j) Error monitoring. To detect and fix errors on the platform, we send technical error reports to the service Sentry. They contain information about the error and the technical environment and may contain identifiers such as an account identifier. Legal basis: legitimate interest in secure, error-free operation (Art. 6(1)(f) GDPR).

k) Audience measurement and advertising on the website. With your consent, we measure how our website is used and how our campaigns perform, and show advertising on other platforms. For this we use Google Analytics, the Meta Pixel, the LinkedIn Insight Tag, Apollo's website tracker and HubSpot's website tracking. Apollo and HubSpot also attribute visits to companies and known contacts. Cookies and their lifetimes are listed in section 7. Legal basis: consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021), which you can withdraw at any time in the cookie settings.

4. Service providers & recipients

We use carefully selected service providers. Data processing agreements under Art. 28 GDPR are in place with our processors; for the analytics and advertising services for which we are jointly responsible with the provider, see section 7.

  • Amazon Web Services (AWS) — hosting and storage of website and platform in data centres within the European Union (Frankfurt am Main region, Germany), sign-in as identity provider, delivery of system emails and operation of the AI models (Amazon Bedrock, EU).
  • HubSpot (HubSpot, Inc., USA / HubSpot Ireland Ltd.) — CRM, forms, appointment booking, email marketing and, with your consent, website tracking.
  • Microsoft 365 (Microsoft Ireland Operations Ltd.) — email, office, collaboration and video calls.
  • Coresignal — data provider for profile data from LinkedIn (section 3 c).
  • Voiceflow — AI-assisted calls (section 3 h).
  • Stripe — payment processing for companies (section 3 i).
  • Sentry — error monitoring of the platform (section 3 j).
  • Google, Meta Platforms, LinkedIn and Apollo (ZenLeads Inc., USA) — audience measurement and advertising on the website, only with your consent (sections 3 k and 7).
  • Finmatics and our tax advisers — accounting.
  • World4You — domain and DNS.

5. Transfers to third countries

Where data is transferred to service providers outside the EU/EEA (in particular the USA), we ensure an adequate level of data protection through appropriate safeguards (EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework).

6. Retention period

We store personal data only for as long as required for the purposes stated above or as long as statutory retention periods apply. The data is then deleted or anonymised. Processing based on consent ends when you withdraw your consent.

  • Talent profiles and placement data: 24 months on the basis of your consent, then anonymised or deleted; earlier if you withdraw your consent or delete your account.
  • Contact persons at companies: for as long as we need the data for the business relationship; if you ask us to delete it, we delete it. We do not sell this data and do not pass it on to third parties.
  • Contract and billing data: in line with statutory retention obligations, in Austria generally seven years (§ 132 BAO).
  • Invitations from recruiter organisations: see section 3 g; cookies: see section 7.

7. Cookies, consent & tracking

Our website uses cookies and similar technologies. Technically necessary cookies are required for the website to work (Art. 6(1)(f) GDPR); all other cookies are only set with your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021). You make and change your choice in the cookie settings, where you can also withdraw your consent at any time with effect for the future. Before you consent, we do not load any of the analytics or advertising services. We keep your choice in your browser for 90 days (entry mr_cookie_consent in localStorage, not a cookie); after that we ask again.

Technically necessary

  • mr_cookie_consent (myrecruity): stores your cookie choice (localStorage) — 90 days
  • Session and security cookies (myrecruity): sign-in and session in the logged-in area — session
  • NEXT_LOCALE (myrecruity): stores the selected language — 1 year
  • oauth_referral (myrecruity): keeps the code during sign-in through a referral link — at most 10 minutes
  • oauth_invite (myrecruity): keeps the invitation code during sign-in through an invitation link — at most 10 minutes

Functional / partner attribution (only with consent)

  • mr_ref (myrecruity): remembers the referral code until you register (section 3 f) — 30 days

Referral cookie. If you reach our website through a referral code (section 3 f), we set — only after your consent in the cookie settings — the cookie mr_ref (in our staging and development environments mr_ref_stg or mr_ref_dev) for the domain myrecruity.com. It contains only the code and the time it was captured, no personal data, and expires after 30 days; a cookie that is already set is not overwritten. If you register within that time, it is deleted after the attribution. When you create an account through a referral link we additionally use the technically necessary cookie oauth_referral, which keeps the code for at most 10 minutes during the sign-in through our identity provider and is deleted afterwards. The legal basis for storing the referral cookie is your consent (§ 165(3) TKG 2021), which you can withdraw at any time in the cookie settings.

Statistics (only with consent)

  • _ga, _ga_* (Google Analytics 4): distinguishing visitors, measuring sessions — 2 years

Marketing (only with consent)

  • _gcl_au (Google): conversion measurement — 90 days
  • _fbp, _fbc (Meta Pixel): reach and conversion measurement, retargeting — 3 months
  • bcookie, bscookie, lidc, li_sugr, UserMatchHistory, AnalyticsSyncHistory (LinkedIn Insight Tag): reach and conversion measurement, retargeting — 1 day to 1 year
  • Website tracker (Apollo): identifying companies that visit the website, reach measurement — as stated by the provider
  • __hstc, hubspotutk, __hssc, __hssrc (HubSpot): visitor analytics and attribution to contacts — 30 minutes to 6 months

Third-party cookie names and lifetimes may change; the providers' information prevails. For Google, Meta and LinkedIn, we process the data of the analytics and advertising services partly jointly with the provider (joint controllership under Art. 26 GDPR); we provide the essential content of these arrangements on request. These providers also process data in the USA (section 5).

8. Profiling and automated decisions

To bring talents and positions together, we use AI-assisted methods: we evaluate profile, qualification and preference data to identify matches and prepare suggestions. This is profiling within the meaning of Art. 4(4) GDPR. Whether a company would like to meet you and whether it hires you is decided by people — the company and you. We do not take any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Art. 22(1) GDPR). Wherever you talk to an AI, we tell you so. You can request meaningful information about the logic involved (Art. 15(1)(h) GDPR) and object to the processing on grounds relating to your particular situation (Art. 21 GDPR) — by email to office@myrecruity.com. Legal basis: as under section 3 c).

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent you have given at any time with effect for the future — by email to office@myrecruity.com.

Right to lodge a complaint with the supervisory authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

10. Contact for data protection matters

myrecruity GmbH, Weihburggasse 5/3, 1010 Vienna — office@myrecruity.com

Last updated: 20 October 2026 (version 2026.10)