Recruiting Privacy Policy

Data protection and the privacy of applicants, employees and users are of great importance to OneFootball GmbH (hereinafter referred to as “OneFootball”, “we” or “us”). The collection and use of your personal data is carried out exclusively in compliance with the statutory requirements of applicable data protection laws. This privacy policy (the “Privacy Policy”) provides information on the processing of personal data in connection with our  recruiting platform (https://onefootball.applytojob.com/, the “Recruiting Platform”). By using the Recruiting Platform, you acknowledge and agree to the collection and use of your information as described in this Privacy Policy.

1. Scope

This Privacy Policy applies to your use of the Recruiting Platform and related websites that provide you to apply for jobs with our company. It also applies to the processing of your personal data in connection with job interviews conducted as part of the recruitment process, including where such interviews are recorded and transcribed using artificial intelligence tools (see Section 7).

For information on data protection in connection with our apps or our main website (www.onefootball.com), please refer to our Data Privacy Policy (Apps) or Data Privacy Policy (Websites).

2. Controller and Point of Contact

The controller responsible for the processing of your personal data in connection with the use of our Recruiting Platform is:

OneFootball GmbH
Donaustraße 44
12043 Berlin
Germany

If you have any questions regarding data protection, you may contact our external Data Protection Officer (the “DPO”). The DPO can be reached at the above postal address and by email at privacy@onefootball.com (Subject line: "Attn: Data Protection Officer").

Please note that e-mails sent to this address may be accessed by individuals other than the DPO. If you wish to exchange confidential information, we kindly ask that you first contact us through this address to arrange a secure communication channel.

3. Categories of Personal Data Processed

When you use our Recruiting Platform, we may process the following categories of personal data, in particular the personal data you transmit when submitting an application:

  • Identification and contact details (e.g. name, address, telephone number, email address)

  • Application documents (e.g. CV, cover letter, references, certificates, work samples)

  • Employment-related information (e.g. work experience, education, skills, qualifications)

  • Technical usage data (e.g., IP address, log data, browser type, device identifiers).

  • Interview recordings and transcripts (e.g. audio and/or video recordings of job interviews and automatically generated transcripts thereof, where an interview is recorded, see Section 7).

Please note that technical usage data may be collected and processed even if you do not submit an application. If you use the “Apply with Indeed” function (see Section 6), additional data categories may be transmitted to us via Indeed. Please further note that interview recordings and transcripts may incidentally contain special categories of personal data within the meaning of Art. 9 GDPR (e.g. information about your health or trade union membership) that you choose to disclose during the interview; we do not seek to obtain such data and do not use it for any purpose other than documenting the interview.

4. Legal Basis

The processing of your personal data is carried out on the following legal bases in accordance with Art. 6 (1) GDPR:

  • Art. 6 (1) (b) GDPR - for application management (e.g. reviewing and processing your application, coordinating interviews, and making hiring decisions).

  • Art 6 (1) (c) GDPR - for compliance with legal obligations (e.g., obligations under labour and social security law).

  • Art. 6 (1) (f) GDPR - for the establishment, exercise, or defence of legal claims (e.g. under the German General Equal Treatment Act (AGG).

  • Art. 6 (1) (a) GDPR - based on your consent (e.g. for retention of your data in our “Talent Pools” as set out below, or for the recording and AI-assisted transcription of job interviews, see Section 7. You may withdraw such consent at any time, without affecting the lawfulness of processing prior to withdrawal and without any disadvantage to your application).

5. Disclosure of Personal Data

Your personal data may be disclosed to the following categories of recipients:

  • Internal recipients: HR staff, managers, and other decision-makers involved in the recruitment process.

  • Service providers (processors): We engage carefully selected service providers pursuant to Art. 28 GDPR, in particular:

    • JazzHR (Employ, Inc.), which operates our online Recruitment Platform. JazzHR acts as our processor and processes applicant data exclusively on our behalf and in accordance with our instructions. As personal data may be transferred to the United States, appropriate safeguards under Art. 46 GDPR (Standard Contractual Clauses) are in place.

    • Google Ireland Limited / Google LLC, which provides the “Gemini” AI tool used, with your consent, to record and transcribe job interviews on our behalf (see Section 7). Google acts as our processor pursuant to Art. 28 GDPR and processes interview recordings and transcripts exclusively for that purpose and in accordance with our instructions. Your interview data is not used by Google to train its AI models.

  • Other third parties: Only where required by law or where necessary for the establishment, exercise, or defend legal claims.

6. Data Transfer to Third Countries

Where personal data is transferred outside the European Economic Area (EAA), for example, to JazzHR in the United States, we ensure that appropriate safeguards are implemented in accordance with Art. 44 et seq. GDPR. These safeguards include, in particular, the use of EU Standard Contractual Clauses. Personal data processed via the “Gemini” AI tool used for interview recording and transcription (see Section 7) may likewise be transferred to the United States; we have implemented corresponding safeguards, in particular EU Standard Contractual Clauses together with supplementary technical and organisational measures.

7. AI-Supported Recording and Transcription of Interviews

As part of the recruitment process, we may invite you to a job interview. With your prior consent, such interviews may be recorded (audio and/or video) and automatically transcribed using the AI tool “Gemini”, provided by Google (see Sections 4 and 5).

  • Purpose: The recording and transcript support our HR staff and interviewers in accurately documenting the interview. The transcript is not used to generate an automated evaluation, score, or recommendation about you, and no decision materially affecting you is based solely on automated processing of the recording or transcript (Art. 22 GDPR).

  • Consent and alternative: We will ask for your consent before the interview begins. If you do not wish to be recorded, you may decline at any time, without giving reasons and without any disadvantage to your application; in that case, the interview will be conducted without recording.

  • Notice: We will inform you before the start of the interview that it is being recorded and transcribed, and by whom.

  • Data minimisation and retention: The raw audio/video recording is deleted once the transcript has been generated and verified, and in any event no later than 30 days after the interview. The transcript is retained together with your other application documents for the retention periods set out in Section 9.

  • Special categories of data: Should the recording or transcript incidentally contain special categories of personal data (Art. 9 GDPR), we do not process such data for any purpose beyond documenting the interview and disregard it for hiring decisions.

  • Your rights: You may object to the recording, request its deletion, or request a copy of the transcript at any time in accordance with Section 10.

8. “Apply with Indeed”- Function

Our Recruiting Platform allows you to apply directly using the “Apply with Indeed” function. If you choose this option, Indeed Ireland Operations Limited (headquartered in Dublin, Ireland) will transmit to us the personal data you have stored with Indeed (e.g., your CV, profile information, and contact details).

Please note:

  • Indeed acts as an independent controller with respect to the processing of your personal data on its own platform. The applicable privacy policy of Indeed governs this processing.

  • Once your personal data has been transmitted to us via “Apply with Indeed,” we process it in accordance with this Privacy Policy.

9. Retention Periods

If your application is unsuccessful, we will retain your personal data for up to six (6) months after the conclusion of the application process, unless (a) a longer retention period is required by law; or (b) you have given us consent to keep your personal data in our “Talent Pool” in order to contact you for future open roles, in which case we will retain your data for a period of three (3) years strictly only for the purposes of contacting you for such future roles. This retention period does not affect the separate, generally shorter retention period applicable to interview recordings, as set out in Section 7.

If your application is successful, your personal data will be transferred to our HR management systems and further processed for the purposes of managing the employment relationship in accordance with our employment data privacy policy.

10. Your Rights

Under the GDPR, you are entitled to the following rights in relation to your personal data:

  • Access (Art. 15 GDPR) - to obtain information about the data we hold about you.

  • Rectification (Art. 16 GDPR) - to correct inaccurate or incomplete personal data.

  • Erasure (Art. 17 GDPR) - to request deletion of your personal data.

  • Restriction of processing (Art. 18 GDPR) - to limit how your data is used.

  • Data portability (Art. 20 GDPR) - to receive your personal data in a portable format or request its transfer to another controller.

  • Objection (Art. 21 GDPR) - to object to the processing of your data in certain circumstances.

  • Withdrawal of consent (Art. 7 (3) GDPR) - to revoke consent you have previously given, at any time.

  • Objection to interview recording (Section 7) - to decline the recording of your interview, or to request deletion of an existing recording or transcript, at any time and without any disadvantage to your application.

To exercise your rights, please contact us at: privacy@onefootball.com.

You also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of your habitual residence or workplace, or where the alleged infringement occurred.

11. Changes to the Privacy Policy

We may update this Privacy Policy from time to time, to comply with new legal or regulatory requirements.

As of: July 2026.