Recruiting Privacy Policy

Data protection and the privacy of applicants, employees and users are of great importance to OneFootball GmbH (hereinafter referred to as “OneFootball”, “we” or “us”). The collection and use of your personal data is carried out exclusively in compliance with the statutory requirements of applicable data protection laws. This privacy policy (the “Privacy Policy”)  provide information on the processing of personal data in connection with our  recruiting platform (https://onefootball.applytojob.com/, the “Recruiting Platform”). By using the Recruiting Platform, you acknowledge and agree to the collection and use of your information as described in this Privacy Policy.

1. Scope

This Privacy Policy applies to your use of the Recruiting Platform and related websites that provide you to apply for jobs with our company.

For information on data protection in connection with our apps or our main website (www.onefootball.com), please refer to our Data Privacy Policy (Apps) or Data Privacy Policy (Websites).

2. Controller and Point of Contact

The controller responsible for the processing of your personal data in connection with the use of our Recruiting Platform is:

OneFootball GmbH
Donaustraße 44
12043 Berlin
Germany

If you have any questions regarding data protection, you may contact our external Data Protection Officer (the “DPO”). The DPO can be reached at the above postal address and by email at privacy@onefootball.com (Subject line: "Attn: Data Protection Officer").

Please note that e-mail address sent to this address may be accessed by individuals other than the DPO. If you wish to exchange confidential information, we kindly ask that you first contact us through this address to arrange a secure communication channel.

3. Categories of Personal Data Processed

When you use our Recruiting Platform, we may process the following categories of personal data, in particular the personal data you transmit when submitting an application:

  • Identification and contact details (e.g. name, address, telephone number, email address)

  • Application documents (e.g. CV, cover letter, references, certificates, work samples)

  • Employment-related information (e.g. work experience, education, skills, qualifications)

  • Technical usage data (e.g., IP address, log data, browser type, device identifiers).

Please note that technical usage data may be collected and processed even if you do not submit an application. If you use the “Apply with Indeed” function (see Section 6), additional data categories may be transmitted to us from Indeed.

4. Legal Basis

The processing of your personal data is carried out on the following legal bases in accordance with Art. 6 (1) GDPR:

  • Art. 6 (1) (b) GDPR - for application management (e.g. reviewing and processing your application, coordinating interviews, and making hiring decisions).

  • Art 6 (1) (c) GDPR - for compliance with legal obligations (e.g., obligations under labour and social security law).

  • Art. 6 (1) (f) GDPR - for the establishment, exercise, or defence of legal claims (e.g. under the German General Equal Treatment Act (AGG).

  • Art. 6 (1) (a) GDPR - based on your consent.

5. Disclosure of Personal Data

Your personal data may be disclosed to the following categories of recipients:

  • Internal recipients: HR staff, managers, and other decision-makers involved in the recruitment process.

  • Service providers (processors): We engage carefully selected service providers pursuant to Art. 28 GDPR, in particular JazzHR (Employ, Inc.), which operates our online Recruitment Platform. JazzHR acts as our processor and processes applicant data exclusively on our behalf and in accordance with our instructions. As personal data may be transferred to the United States, appropriate safeguards under Art. 46 GDPR (Standard Contractual Clauses) are in place.

  • Other third parties: Only where required by law or where necessary for the establishment, exercise, or defend legal claims.

6. Data Transfer to Third Countries

Where personal data is transferred outside the European Economic Area (EAA), for example, to JazzHR in the United States, we ensure that appropriate safeguards are implemented in accordance with Art. 44 et seq. GDPR. These safeguards include, in particular, the use of EU Standard Contractual Clauses.

7. “Apply with Indeed”- Function

Our Recruiting Platform allows you to apply directly using the “Apply with Indeed” function. If you choose this option, Indeed Ireland Operations Limited (headquartered in Dublin, Ireland) will transmit to us the personal data you have stored with Indeed (e.g., your CV, profile information, and contact details).

Please note:

  • Indeed acts as an independent controller with respect to the processing of your personal data on its own platform. The applicable privacy policy of Indeed governs this processing.

  • Once your personal data has been transmitted to us via “Apply with Indeed,” we process it in accordance with this Privacy Policy.

8. Retention Periods

If your application is unsuccessful, we will retain your personal data for up to six (6) months after the conclusion of the application process, unless a longer retention period is required by law.

If your application is successful, your personal data will be transferred to our HR management systems and further processed for the purposes of managing the employment relationship

9. Your Rights

Under the GDPR, you are entitled to the following rights in relation to your personal data:

  • Access (Art. 15 GDPR) - to obtain information about the data we hold about you.

  • Rectification (Art. 16 GDPR) - to correct inaccurate or incomplete personal data.

  • Erasure (Art. 17 GDPR) - to request deletion of your personal data.

  • Restriction of processing (Art. 18 GDPR) - to limit how your data is used.

  • Data portability (Art. 20 GDPR) - to receive your personal data in a portable format or request its transfer to another controller.

  • Objection (Art. 21 GDPR) - to object to the processing of your data in certain circumstances.

  • Withdrawal of consent (Art. 7 (3) GDPR) - to revoke consent you have previously given, at any time.

To exercise your rights, please contact us at: privacy@onefootball.com.

You also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of your habitual residence or workplace, or where the alleged infringement occurred.

10. Changes to the Privacy Policy

We may update this Privacy Policy from time to time, to comply with new legal or regulatory requirements.

As of: September 2025