Privacy notice for applicants
How Wasteer GmbH handles your personal data when you apply for a job through this site. Version of 30 October 2026.
In short
- We use your data only to handle your application.
- We store your application data in the EU. An AI model turns your CV into a short summary for our team; people make every decision. You can opt out of AI at any time (your right to object).
- We delete your data 6 months after the decision on your application, or 1 year after you are hired.
- You can see, correct or delete your data at any time on the Your data page.
Who is responsible
Wasteer GmbH, Berliner Straße 80–82, 13189 Berlin, Germany, represented by its managing directors Benedict von Spankeren and Florian Fehr, is the controller. For anything about your data, write to [email protected].
What we collect
- What you enter: your name, email address and, if you give it, your LinkedIn profile link.
- Your CV (PDF or DOCX) and everything written in it.
- What happens during the process: the stage you are in, notes from our hiring team, emails we exchange with you, and, unless you opt out, the AI summary of your CV.
- If we invite you to a case study: the files, links and notes you hand in on the case study page, when you opened and submitted it, and our reviewers' scorecards and decision. To keep the brief private, the page opens only with a code we email you, and we log each code request, wrong code and visit with the time, your browser and a scrambled form of your IP address that only tells us whether two visits came from the same network.
- If you give us your LinkedIn link, our team may look at that public profile.
- To protect the form: a one-way hash of your IP address and email address for rate limiting (deleted after 2 days), and a Cloudflare Turnstile check that tells bots from people.
- When you visit: technical connection data (IP address, browser, time), processed by our hosting and security providers and kept in their logs for a limited time for security and troubleshooting.
You are not legally or contractually obliged to give us any data, but without name, email and CV we cannot consider your application. Please leave out what we do not need, such as your date of birth, a photo, religion, health or family status.
If you did not apply through this site, for example because you emailed us your CV or someone recommended you, we handle your data the same way. We send you a link to this notice when we first contact you, and at the latest within one month, and tell you where we got your data (for example the person who recommended you).
Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Assessing your application, talking to you, deciding about a job offer | Steps you ask for before a possible employment contract, Art. 6(1)(b) GDPR |
| Having an AI model turn your CV into a short summary for our team | Our legitimate interest in handling applications quickly and consistently; the model only restructures what you wrote and does not assess you. Art. 6(1)(f) GDPR. You can object at any time |
| Having an AI model write a short neutral overview of your case study (what you handed in, open questions for the follow-up talk) | Our legitimate interest in reviewing case studies quickly and consistently; the overview does not rate you, and our reviewers always read your work. Art. 6(1)(f) GDPR. You can object at any time |
| Special categories of data you choose to include in your CV (for example a disability) | Art. 9(2)(b) GDPR with § 26(3) BDSG; where you made the information public yourself, Art. 9(2)(e) |
| Protecting the form and the site against spam and abuse (rate limits, Turnstile, server logs) | Our legitimate interest in a secure service, Art. 6(1)(f) GDPR; § 25(2) TDDDG |
| Keeping your data for a while after a decision, in case of legal claims | Our legitimate interest in defending legal claims, Art. 6(1)(f) GDPR |
| Keeping a record of privacy requests and our answers | Our legal obligation to show we comply, Art. 6(1)(c) with Art. 5(2) and 12 GDPR |
We never sell your data and never use it for advertising.
How we use AI
We send your CV to Google's Gemini model, running in Google Cloud's EU region. It turns the CV into a short summary of what you wrote (roles, skills, languages, education) so our team can read applications faster. It does not score, rank, filter or assess you. Our team always has your full CV; the summary is only an aid. The model is instructed to ignore personal characteristics such as age, gender or origin.
If you hand in a case study, the same model reads the documents you upload (and transcribes PDFs into text) to write a short neutral overview for our reviewers: what you delivered and questions to ask you. It does not rate or rank your work; our reviewers score it and a person decides. Files the model cannot read, such as slides, spreadsheets, images or ZIP archives, are only looked at by people. If you opted out of AI, your case study is not sent to the model either.
We do not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.
Under its terms as our processor, Google may not use your data to train its models. To answer quickly it keeps a request in memory for up to 24 hours, and it may log requests to detect abuse of its service.
Your right to object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 6(1)(f) GDPR): the AI summary, protecting the form, and keeping data for legal claims.
For the AI summary we always stop, and you do not need to give reasons: tick “Do not analyse my CV with AI” when you apply, use the Your data page, or email [email protected]. We then delete the AI summary and any AI overview of your case study. Opting out has no effect on your application. For the other purposes we stop unless we have compelling legitimate grounds or need the data to establish or defend legal claims.
Who sees your data
Only the people at Wasteer involved in hiring for the role, and, if a legal claim arises, courts, authorities and our lawyers. We use these service providers, bound by data processing agreements, to run this site:
| Provider | What for | Where, and the safeguard for any access from outside the EU |
|---|---|---|
| Google Cloud | Database, file storage for CVs, the Gemini AI model | EU (Frankfurt; AI in the EU multi-region). Standard Contractual Clauses |
| Vercel | Hosting this website | Frankfurt. Standard Contractual Clauses |
| Cloudflare | Network security and the Turnstile check | Worldwide network, including the USA. EU–US Data Privacy Framework, Standard Contractual Clauses as fallback |
| Twilio SendGrid | Sending emails to you | EU data residency. EU–US Data Privacy Framework and Standard Contractual Clauses |
You can ask us for a copy of these safeguards at [email protected].
How long we keep it
- Not hired, or you withdraw: deleted 6 months after the decision on your application.
- No activity on your application for 6 months: deleted then.
- Hired: kept 1 year after the hire to document how the hiring decision was made, then deleted. What we need for your employment moves to your personnel file, which has its own notice.
- On request: as soon as we have confirmed the request, except a record of the request and anything the law requires us to keep.
Deleted data can remain in encrypted backups for a short time until they are overwritten. A record that we answered a privacy request (your email address and what we did) is kept for 3 years, the general limitation period, so we can show we handled it.
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict its use, receive it in a machine-readable format, object (see above), and withdraw your application at any time. Use the Your data page or write to [email protected].
We answer within one month of receiving your request. For complex requests this can be extended by up to two more months; we tell you within the first month if so, and why. To protect your data we reply only to the email address we hold for you. If you no longer use that address, tell us and we will check it is you another way.
You can also complain to a data protection authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, datenschutz-berlin.de.