Applicant Privacy Statement

Effective Date and last update: December 18, 2025

Introduction & Scope of this Privacy Statement

We are delighted that you are interested in our company and have applied for a position with us. 

Leapsome ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Statement explains how we collect, use, disclose, and protect personal information from job applicants who apply with us, in compliance with the EU General Data Protection Regulation (GDPR), UK GDPR, and the California Consumer Privacy Act (CCPA).

Data Controller

The data controller under data protection law is:

  • Leapsome GmbH
  • Brunnenstraße 153
  • 10115 Berlin, Germany
  • Phone: +49 30 311 960 34
  • Commercial register entry number: HRB 187546 B
  • Registration Court: Amtsgericht Charlottenburg

‍Data Protection Officer

You can reach our appointed data protection officer by mail or by email at:

  • Leapsome GmbH -Data Protection Officer -
  • Brunnenstraße 153
  • 10115 Berlin, Germany
  • email: privacy@leapsome.com

‍Personal Data Collected and Processed 

Personal data (= personal information) means any information concerning the personal or material circumstances of an identified or identifiable individual or natural person. This includes information such as, for example, your name, address, telephone number and date of birth, but also data relating to a specific individual that can be identified with reasonable effort.

We process the personal data you have provided to us electronically (i.e. via e-mail or using our online form on our career page) in connection with your application.

We collect and process the following personal data, including but not limited to:

  • Personal Identifiers (name, address, email, phone number, date of birth, gender)
  • Personal records like your education history, employment or employment history, Immigration status and work permits, demographic information, information about skills and abilities, accomplishments, training and development information, performance evaluation information, and employment termination information and other information included in your resume or cover letter.
  • Job interview notes, responses to screening questions, assessment results, salary expectations & salary history (to the extent permitted by applicable local laws), information available from your LinkedIn profile and/or your LinkedIn profile URL, results of the selection process, and any other information you provide in connection with the recruitment process, legal and contractual information (information necessary to respond to law enforcement and governmental agency requests, comply with legal and contractual obligations, exercise legal and contractual rights, and initiate or respond to, or establish, exercise, and defend legal and contractual rights claims).
  • Protected characteristics (for equal opportunity monitoring) like minority, veteran and disability status, VISA status, through voluntary self-disclosure (will only be collected as permitted by applicable law and will not be used to make hiring decisions)
  • References and data related to permissible background checks or results of any pre-employment testing (if applicable and permissible by law)
  • Online activity, device and location data and online identifiers and website, device and mobile app usage (if applicable)
  • Business or government relationships that may lead to conflicts of interest (if applicable
  • Video or photo images or audio recordings (e.g., in connection with virtual interviews and/or CCTV footage (where applicable)

Purposes of Processing

The data collected by us is processed and used exclusively to:

  • Assess your suitability for the position (or other open positions in our company, if applicable) and evaluate your job application
  • Carry out the application process, schedule and facilitate interviews and if necessary preparing offer letters and employment contracts.
  • Conduct background checks and verify or contact references
  • Comply with legal obligations (e.g., right to work checks)
  • Monitor diversity and inclusion within recruitment (if applicable)
  • Communicate with you about recruitment stages
  • Perform pre-employment screening and testing (if applicable and permissible by law)
  • Engage in diversity and equal opportunity initiatives (where permitted and/or required under applicable law);
  • Improve and develop our recruitment processes (including by way of candidate experience surveys);
  • Respond to inquiries, complaints and disputes;
  • Comply with legal and other requirements.

If we deem it necessary for filling the position and permissible under applicable law, we may also collect personal data about you from third parties. This may include, for example, internet research or research on professional social media platforms (e.g., LinkedIn), recruiters or recruiting platforms (e.g., Ashby), prior employers (e.g., for references), professional references you provide to us, educational institutions, pre-employment screening services, credentialing and licensing organizations.

Please note that only authorized Human Resources staff and/or internal/external staff involved in the application process have access to your data. Your application data will be reviewed by the Human Resources department after we receive your application. Suitable applications will then be forwarded internally to the department managers responsible for the respective open position.

There is no legal or contractual obligation to provide us with your personal data. However, we can only consider your application if you have provided the necessary data. Which data is required is described in the application process, through which you have or will submit the data yourself. Your personal data will not be used for automated individual decision-making including profiling.

Note for applicants based in California (U.S.) and under CCPA: Leapsome does not "sell" your personal information, nor do we "share" your personal information for cross-context behavioral advertising purposes, as those terms are defined under the CPRA. We may disclose your personal information to service providers who assist us with recruitment and hiring, such as background check providers or recruitment software platforms, under contractual agreements that limit their use of the data.

Automated Note Taking (Transcription via Audio Recording) during Interview

We might use Ashby Inc. (see Ashby data privacy policy), which enables AI-driven notetaking (transcription via audio recording) during candidate interviews, automated report generation, and job posting support.
We use the note taking feature - on a voluntary basis - to enhance our interview process. For this purpose we may ask for your permission/consent to use the AI-powered service to record and transcribe our conversation (via audio recording).

  • Purpose of Use: We use this technology to allow our interviewers to focus fully on the conversation rather than on manual note-taking. This helps us conduct a more consistent, fair, and thorough evaluation.
  • Participation is Voluntary: Your participation and consent is completely voluntary. You have the right to decline, and your decision will not negatively affect your application or our evaluation in any way. Even if you consent, you can ask to stop the recording at any time during the interview.
  • Data Processors: We use the native AI feature within our Applicant Tracking System provided by Ashby, to provide this service. This means Ashby processes the interview recording (audio) and transcript on our behalf and on the basis of an agreement concluded with the provider (data processing agreement).
  • Data Access and Retention: Access to interview recordings and transcripts is restricted to the recruitment and hiring team members directly involved in your application. This data is stored securely and will be deleted in accordance with our standard data retention schedule for applicant information; the audio recordings and the transcript will be deleted after 14 days at the latest.

Legal Basis for Processing of Your Data

The legal basis for the processing of your personal data as part of the application process is Art. 6 (1) (b) GDPR if not specified otherwise in this Privacy Statement. According to this, the processing of data that is necessary in connection with the decision to establish an employment relationship is permissible.

If special categories of personal data within the meaning of Art. 9 GDPR are processed (e.g., health data), the legal basis is Section 26 (3) Bundesdatenschutzgesetz (German Federal Data Protection Act, “BDSG”) or Art. 9 (2) lit. b) GDPR in conjunction with Art. 6 (1) lit. b) GDPR.

If the data is required for legal purposes after the application process has been completed, data processing may be carried out on the basis of the requirements of Art. 6 GDPR, in particular for the purposes of legitimate interests pursuant to Art. 6 (1) (f) GDPR. Our interest then lies in asserting or defending claims.

The legal basis for pre-employment screening (if applicable) and if you are not hired, we retain your personal data after the application process has ended (purpose asserting or defending legal claims). Both processings are carried out for the purpose of pursuing our legitimate interests (Art. 6 (1) (f) GDPR).

The legal basis for the automated note taking and video recording (see above) during the interview is your explicit consent (Article 6 (1) (a) GDPR). At the beginning of an interview at the latest, the interviewer will explain the process and ask for your verbal permission before activating the AI notetaker.

Under UK GDPR, our lawful bases include legitimate interests, compliance with legal obligations, and your consent for special category data where applicable.
For applicants in California (U.S.), processing is conducted for business purposes and compliance with legal requirements as defined under CCPA.

Data Retention

We store the data you provide or we have collected for the duration of the application process.

If you are offered and accept a position, your application information will become part of your employee file and stored in our ATS and in our HRIS for at least the duration of your employment and thereafter, provided there is justification and a legal basis for doing so.

If you are not hired, we retain your personal data for a period of 180 days after the application process has ended. This storage of your data is carried out for the purpose of pursuing our legitimate interests (Art. 6 (1) (f) GDPR); our interest lies in asserting or defending legal claims. 

After this period, we delete or anonymize your data, unless you have given your consent to store your data in our “talent pool”. In case of anonymization, the data will only be available to us in the form of so-called metadata, without any direct personal reference, for statistical analysis (for example, share of male and/or female applicants, number of applications per specified period of time etc.).

Should you be offered and accept a position with us during the application process, we will store the personal data collected during the application process in our ATS and in our HRIS for at least the duration of your employment and thereafter, provided there is justification and a legal basis for doing so.

Disclosure of Data to Third Parties & Use of Sub-processors

We use specialized (software) service providers for the application process. These providers may also obtain access to your personal data in connection with the application process. The legal basis for the use of the service provider/processors and the related processing is our legitimate interests pursuant to Art. 6 (1) (f) GDPR unless otherwise specified below. Our legitimate interest is the efficient and professional execution of the application process.

We have concluded a so-called data processing agreement (DPA) under Art. 28 GDPR with all these providers, which ensures that data processing is carried out in a permissible manner.

Your data is transmitted as part of your application and will be transferred using TLS encryption and stored in a database. This database is operated by Ashby Inc. in the United States of America, which offers an applicant management software solution (see Ashby data privacy policy). 

Furthermore, any data transmitted as part of your application will be securely transferred to Idalto Ltd. in the United States using TLS encryption. Idalto Ltd. assists us in creating benchmarking tests for our assessment center through its Bry platform (see Bryq Privacy Policy). 

Additionally, data transmitted as part of your application will be transferred using TLS encryption to Juicebox App, Inc. in the United States of America. Juicebox App, Inc. offers the platform PeopleGPT that helps us automate our sourcing and outreach practices (see Juicebox App, Inc. privacy policy).

International Data Transfers: If the use of a service provider or data processor involves transferring your data outside of the European Economic Area (EEA), we ensure this transfer is safeguarded under a valid data transfer mechanism, such as the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses, to guarantee your personal data is handled with a level of protection compliant with GDPR.

Your Data Subject Rights

If we as the controller process personal data, you as the data subject have certain rights under Chapter III of the EU General Data Protection Regulation (GDPR), depending on the legal basis and the purpose of the processing, in particular the right of access (Article 15 of the GDPR) and the rights to rectification (article 16 of the GDPR), erasure (Article 17 of the GDPR), restriction of processing (Article 18 of the GDPR), and data portability (Article 20 of the GDPR), as well as the

Right to object (Article 21 of the GDPR). If the personal data is processed with your consent, you have the right to withdraw this consent under article 7 III of the GDPR.

Note for applicants based in California (U.S.) and under CCPA: ‍

The Right to Non-Discrimination: You have the right not to be discriminated against for exercising any of your CCPA/CPRA rights. We will not deny you an employment opportunity or provide you with a different level or quality of services for exercising your rights.

To assert your rights as a data subject in relation to the data processed, please contact us via email privacy@leapsome.com.

Protection of Your Personal Data‍

We maintain appropriate administrative, technical, and physical safeguards to protect your personal data (Art. 32 GDPR). We retain your data only for as long as necessary to fulfill the purposes for which it was collected, in accordance with our retention policies and applicable law.

When your information is no longer required for these purposes, we will either delete it or maintain it in a non-identifiable (anonymized) form, unless we are legally required to keep it longer.

Additional information on the processing of personal data not collected from the data subject (Art. 14 GDPR)

In the event that we process personal data about you in the context of the application process that we have not received directly from you, the following additional information applies:

Data categories that we may process in this context include information about you that is generally available on the Internet or can be researched via (professional) social media platforms (e.g., LinkedIn). Furthermore, it may be data about previous employment relationships. The legal basis for this data processing is Art. 6 (1) lit. f) GDPR, whereby our interest lies in finding the most suitable applicants for the respective positions.

In the event that we process personal data about you that we have not collected from you, we will inform you separately about the source of the personal data, unless you already have this information. For further information required under Art. 14 GDPR, please refer to the information in this privacy policy.

Changes to This Privacy Statement

‍We may update this Privacy Notice from time to time. We encourage you to review this privacy statement periodically to stay informed of any changes. The "Last Updated" date at the top of this notice will indicate the date of the latest revision.

‍

‍