Data privacy
Evidio ("we", "our", or "us") is committed to protecting your personal data and respecting your privacy. This Privacy Policy describes how we collect, use, and protect your personal information in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable national data protection laws in Germany.
1. Data Controller
The data controller responsible for your personal data is: Evidio GmbH Rathausmarkt 5 20095 Hamburg Email: privacy@evidio.de Phone: +49 40 822 169 420
2. Legal Basis for Processing
We process your personal data based on the following legal grounds: • Consent (Art. 6(1)(a) GDPR): When you explicitly agree to the processing of your data. • Contract (Art. 6(1)(b) GDPR): To process your job application and potentially enter into an employment contract. • Legal Obligation (Art. 6(1)(c) GDPR): To comply with legal requirements. • Legitimate Interests (Art. 6(1)(f) GDPR): For our legitimate business interests, such as improving our services.
3. Categories of Personal Data Collected
We collect and process the following categories of personal data: Application Data: full name, email address, phone number; CV/résumé information including employment history and education; LinkedIn profile URL (if provided); available start date; any additional information you provide in your application. Interview Data: video and audio recordings of interviews; AI-generated assessments and evaluations; language proficiency assessments; interview transcripts. Technical Data: IP address; browser type and version; operating system; access times and dates; pages visited and interactions. We process your personal data to evaluate your application, conduct and assess AI-powered interviews, communicate with you, match you with suitable positions, comply with legal obligations, and protect against fraud and ensure platform security.
4. Data Sharing and Recipients
We share your personal data with the following categories of recipients, each bound by Data Processing Agreements (Art. 28 GDPR). AI and analysis service providers: • Anthropic (Claude) — Language model API; CV content, interview transcripts, assessment responses; AI-assisted evaluation and candidate summaries; EU (AWS eu-central-1). • OpenAI — Language model API; CV content, interview transcripts, assessment responses; AI-assisted evaluation used in parallel with Claude; EU (Azure EU). • Hume AI — Conversational AI; interview audio/video and spoken responses; AI-powered interview conduct and analysis; EU. • SpeechSuper — Speech analysis API; interview audio recordings; language proficiency, pronunciation and fluency analysis; EU. Platform and infrastructure providers: • Clerk — Authentication and user management; name, email, credentials, session data; EU. • Amazon Web Services (AWS) — Cloud hosting; all application and platform data; EU (eu-central-1, Frankfurt). • Vercel — Hosting and deployment for staging; technical session data, page requests; EU. • PostHog — Product analytics; anonymised usage data; EU. We also disclose data to legal authorities where required by law, and to professional advisors bound by confidentiality obligations. We do not sell your personal data and do not permit our service providers to use it for their own purposes, including training their AI models.
5. International Data Transfers
All personal data is processed within the European Economic Area. We do not transfer your personal data to countries outside the EEA. Should this change in the future, we will update this notice and ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions).
6. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected: • Unsuccessful applications: deleted after 6 months unless you consent to longer retention. • Successful applications: transferred to employee records. • Interview recordings: retained for 3 months after the recruitment process ends. • Technical logs: retained for 90 days. We may retain certain data longer if required by law or for legitimate business purposes.
7. Your Rights Under GDPR
Under GDPR, you have the following rights: • Right of access (Art. 15 GDPR) • Right to rectification (Art. 16 GDPR) • Right to erasure — "right to be forgotten" (Art. 17 GDPR) • Right to restrict processing (Art. 18 GDPR) • Right to data portability (Art. 20 GDPR) • Right to object (Art. 21 GDPR) • Right to withdraw consent at any time where processing is based on consent To exercise these rights, please contact us at privacy@evidio.de.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, damage, and unauthorised disclosure or access. These measures include encryption, access controls, regular security assessments, and staff training.
9. Cookies and Tracking
We use cookies and similar tracking technologies on our platform. Essential cookies are strictly necessary for the platform to function (e.g. session management, authentication via Clerk). They are set without consent as they are required to provide the service you requested. Analytics cookies (PostHog) are only activated after you provide explicit consent via our cookie consent banner. IP data capture is disabled. No analytics data is collected until you consent. You can give or withdraw consent at any time via the cookie consent banner accessible at the bottom of every page, or by contacting us at privacy@evidio.de. Withdrawing consent does not affect the lawfulness of data collected before withdrawal. We do not use advertising or marketing cookies and do not share cookie data with third parties for advertising purposes.
10. Children's Privacy
Our services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete such information.
11. Automated Decision-Making
We use AI technology to assist in the recruitment process, which may involve automated processing of your data. However, final hiring decisions are always made by human recruiters. You have the right to request human intervention in the decision-making process, express your point of view, and contest decisions based solely on automated processing.
12. Data Protection Officer
For questions about data protection or to exercise your rights, you can contact our Data Protection Officer: Email: dpo@evidio.de Phone: +49 40 822 169 420 Address: Evidio GmbH, Rathausmarkt 5, 20095 Hamburg
13. Supervisory Authority
You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR: The Hamburg Commissioner for Data Protection and Freedom of Information Ludwig-Erhard-Str. 22, 20459 Hamburg Tel: +49 40 428 54 4040 Website: www.datenschutz-hamburg.de
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.
15. Contact Us
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: Email: privacy@evidio.de Phone: +49 40 822 169 420 Address: Evidio GmbH, Rathausmarkt 5, 20095 Hamburg
Last updated: 8 July 2026.