1. Scope and Controller

This Policy explains personal data processing when visiting, registering for, using the free account and using paid services of MyRecruit.App.

2. Registration, free use and contract

We process name, organization and register details, email, credentials, settings, usage levels and contract communications to create the account, provide the free functions and allowances, prevent abuse and prepare an individual offer if requested. The legal bases are Art. 6(1)(b) GDPR and, for security, Art. 6(1)(f) GDPR.

Required fields are necessary to supply access. Reaching a free limit does not result in paid use without an express SaaS Agreement.

3. Use, logs and communications

Login, access, device, IP, time, error and security data and support communications are processed to provide and secure the service and resolve faults (Art. 6(1)(b) and (f) GDPR). Logs are retained only as necessary for those purposes, incident investigation or legal proof and are then deleted or anonymized.

4. Customer Data

The Customer is generally the controller for applicant, employee, customer, supplier, financial and document data entered in MyRecruit.App. SteinmetzPartners processes that data under the DPA and TOM, which applies from the start of free use. Data subjects should primarily contact the relevant Customer.

5. AI-assisted sourcing strategies

Only when an authorized user triggers the feature, required position and task data is sent to OpenAI through an API to draft a strategy for the Customer. Users should not submit unnecessary applicant data or special-category data. Output is not used for automated individual decisions and must be reviewed by a user.

6. reCAPTCHA

Google reCAPTCHA protects registration from automated abuse. IP, browser, device and interaction data may be sent to Google on the basis of our security interest (Art. 6(1)(f) GDPR). Google processes this data under its own privacy terms.

7. Recipients

8. International transfers

Processing outside the EEA takes place only under Art. 44 et seq. GDPR, such as an adequacy decision or EU Standard Contractual Clauses and required supplementary measures. The DPA lists sub-processors for Customer Data.

9. Retention

• Account and contract data is retained for the contract and statutory retention and limitation periods.
• Free-account users may use available self-service exports. When the account ends, productive data is deleted within 30 days unless a subsequent agreement applies; backups are overwritten under established cycles.
• Processor data is returned or deleted under the DPA. Customers with a SaaS Agreement receive the tenant-specific standard export described there; separately requested migration services may be charged.
• Requests and acceptance records are retained while needed for proof or legal defense.

10. Your rights

Subject to the GDPR, you may request access, rectification, erasure, restriction and portability and may object. Consent may be withdrawn prospectively. You may lodge a complaint with a supervisory authority, in particular the Hessian Commissioner for Data Protection and Freedom of Information.

We do not make solely automated decisions producing legal or similarly significant effects under Art. 22 GDPR.