Data Protection in aiFind (EU GDPR)
Is aiFind GDPR Compliant?
aiFind is designed to support the requirements of the EU General Data Protection Regulation (GDPR) when used in a
compliant manner.
Personal data is stored exclusively in Germany.
Data processing takes place within the EU.
A Data Processing Agreement (DPA) in accordance with Art. 28 GDPR is available on our website.
New features and service providers are reviewed as part of our internal IT security and data protection processes.
Note:
aiFind provides technical and organizational measures to support GDPR compliance. The legal responsibility for the
lawfulness of data processing lies with the respective customer as the controller within the meaning of the GDPR.
Functional Overview
aiFind offers various features to help you efficiently implement data protection requirements:
Data Protection Report
Double Opt-in Procedure
Opt-out / Unsubscribe
Deletion and Anonymization
Data Access Report for Candidates and Managers
Data Protection Report
A frequently applicable legal basis for processing personal data in recruiting and sales is legitimate interest pursuant
to Art. 6 para. 1 lit. f GDPR. Whether this applies must always be assessed on a case-by-case basis.
As soon as the purpose of processing no longer applies or the legitimate interest ceases to exist, personal data must be
deleted unless another legal basis applies.
aiFind provides a Data Protection Report that creates transparency regarding relevant retention periods—particularly in
candidate management.
aiFind displays deadlines and statuses transparently but does not perform automatic deletion. The decision regarding
storage or deletion lies with the customer.
Retention Period for Candidate Data
During an Application Process
Personal data of candidates may be processed for the duration of an ongoing application process.
After completion of the process, the data may generally be stored for up to six months in order to defend against
potential claims under the German General Equal Treatment Act (AGG). This period does not constitute a statutory minimum
retention obligation but rather a recommended safeguard period.
Extended Storage
Longer storage may be permissible if another legal basis exists, particularly if:
- Valid consent has been given (e.g., for a talent pool)
- The candidate is involved in additional active application processes
- A successful placement has taken place
In these cases, purpose limitation and the principle of data minimization continue to apply.
Retention Period for Customer Data (Managers)
For business contacts, a legitimate interest in processing personal data may exist if the balancing of interests is in
favor of the controller.
There are no fixed statutory retention periods; the permissibility of storage must always be assessed on a case-by-case
basis.
In principle:
- Only as much data as necessary may be stored
- Storage must be limited to the respective purpose
Ongoing processing may be permissible in particular if:
- Consent for marketing communication has been granted
- An ongoing contractual or framework relationship exists
- A successful placement has occurred
Double Opt-in Procedure
For legally secure documentation of consent to marketing communication, particularly within the meaning of Section 7 of
the German Act Against Unfair Competition (UWG), aiFind provides a double opt-in procedure.
Candidates or managers receive an email with a confirmation link through which they actively confirm their consent.
The time, source, and status of consent are documented.
The procedure serves as proof of consent.
Note:
Transactional emails that serve exclusively the performance of a contract or factual communication and contain no
promotional content do not require prior consent.
Example Welcome Email:
Dear Sir or Madam,
Thank you for allowing us to welcome you as a business partner of Muster GmbH.
In order to provide you with relevant offers in the future, we kindly ask you to confirm your email address via the
attached link.
(Confirmation link)
Everything regarding GDPR:
Muster GmbH takes data protection very seriously. Our IT service providers host exclusively within the EU. Further
information can be found in our privacy policy. If you have any questions, please do not hesitate to contact us at any
time.
Unsubscribing from offers:
At the end of each message, you will find an unsubscribe link. You can unsubscribe from further offers at any time with
a single click.
Kind regards
Your Muster GmbH Team
Opt-out / Unsubscribe
Every campaign email sent contains an unsubscribe link that allows recipients to withdraw their consent at any time.
Alternatively, an opt-out can be set manually within the respective data record.
Contacts without a valid double opt-in are automatically excluded from campaigns.
These contacts are marked as “Ignored” in campaign reports.
Data Access for Candidates and Managers
Data subjects have the right to access their stored personal data pursuant to Art. 15 GDPR.
aiFind enables the creation of an access report directly within the “Personal information” section of the data record.
The report contains only personal data.
No internal comments or metadata are included.
It is provided in a structured, machine-readable, and comprehensible format.
Deletion or Anonymization
In accordance with Art. 17 GDPR, personal data may be deleted or anonymized unless statutory retention obligations
prevent this.
Important: After complete deletion, no data access report can be generated.
Recommended order in case of corresponding requests:
1. Provide data access report
2. Delete or anonymize the data
Statutory retention periods (e.g., under the German Commercial Code (HGB) or Fiscal Code (AO)) remain unaffected.