Privacy Policy according to Art. 13 & 14 GDPR

We are pleased that you are interested in our website and our services. The protection of your personal data is particularly important to us. We therefore process your data exclusively based on the applicable legal provisions (GDPR, TKG 2003). Your information will be treated confidentially and used solely for the purposes we describe below.

This privacy notice informs you about the key aspects of how we process your data within the scope of our website and recruitment activities — in particular, how we handle your personal information. We process your personal data in the following cases:

---

1. Applicant-related processing of personal data

1.a Applicant contact

When you contact us as an applicant by email or through our online application platform, the data you provide will be stored in our internal system and an applicant profile will be created. For reasons of clarity, efficiency, and data protection, we ask that you only provide the information necessary for the application process. If we require additional information, we will contact you directly.

If you have an applicant profile on a business-oriented social media platform such as Xing, LinkedIn, Stepstone, or Karriere.at, or if we receive your contact information as a referral through our professional network, and your profile matches our candidate requirements, we may process the publicly available data from your profile to contact you. This processing is based on our legitimate interest arising from your use of such professional networking platforms. Only data you have made public yourself, such as contact details and uploaded résumés, will be used.

The purpose of the contact is to create your record in our system and potentially initiate an application process. By submitting your data, we assume that you consent to this processing. You may withdraw this consent at any time by emailing dataprotection@today-experts.com.

Data processing in this context takes place with the following service providers:

• monday.com Ltd. – used to process and organize application data. Processing occurs under a data processing agreement, and data is stored locally or within the EU in accordance with GDPR.
• Microsoft Corporation – used via the Outlook Email API to send GDPR confirmation and communication emails. Data may be transmitted to Microsoft servers; appropriate safeguards and data processing agreements under Art. 28 GDPR are in place.
• OpenAI, L.L.C. – used for skill normalization purposes. Only non-personally identifiable, abstracted data (e.g., skill terms or categories) is processed; no personally identifying information (PII) is transmitted.
• Google LLC (Google Locations API) – used to derive approximate geographic data related to roles or project locations; no personally identifying information is transmitted.

The data you submit will be stored for a maximum of 6 months and then deleted, unless you choose to have your data stored in our talent pool beyond this period. At your request, we will stop processing or delete your data record.

Providing data is voluntary; however, without it we cannot consider you in the application process or offer related services.

You may request access to your processed data at any time by contacting dataprotection@today-experts.com.

1.b Application process

If, at your request, your applicant profile is added to our system, we will use your information regarding qualifications, skills, and professional experience to assess whether your profile matches the requirements for open positions. If we identify you as a suitable candidate for one of our positions, we will forward your data to our client so that they can review our proposal. No automated decision-making or profiling is carried out.

The purpose of the application process is to facilitate the initiation of a potential employment or service contract. By contacting us, you indicate your consent to the processing of your data. You may withdraw this consent at any time by contacting dataprotection@today-experts.com.

Data processing in the application process takes place through the following providers:

• monday.com Ltd. – for organizing and processing applicant data (stored locally/in the EU).
• Microsoft Corporation – for communication and GDPR confirmation via Outlook Email API.
• OpenAI, L.L.C. – for skill normalization (no personal identifiers).
• Google LLC – for non-personal geographic data enrichment.

Data processing agreements are in place with all service providers as required by Art. 28 GDPR. Additional recipients may include clients of TODAY Experts GmbH, for the purpose of evaluating your suitability for specific positions.

All application data is stored for a maximum of 6 months and then deleted, unless you consent to inclusion in our talent pool or a specific recruitment process extends beyond that period. You may request deletion or suspension of processing at any time.

Providing data is voluntary, but without it we cannot process your application or offer our services. You can request access to your data by emailing dataprotection@today-experts.com.

1.c TODAY Experts Talent Pool

At your request — and with your explicit consent — we will store your application documents in the TODAY Experts Talent Pool. This authorizes us to retain your data beyond the standard 6-month storage period and to consider you for future suitable job opportunities. We will contact you by email or phone with job offers that match your profile.

The purpose of the TODAY Experts Talent Pool is to maintain your applicant data for future consideration. The legal basis for this is your explicit consent. You may withdraw your consent at any time by emailing dataprotection@today-experts.com.

Data processing in the Talent Pool involves:

• monday.com Ltd. – for secure management and retention of candidate data.
• Microsoft Corporation – for communication and confirmation emails.
• OpenAI, L.L.C. – for skill classification (without PII).
• Google LLC – for role-related geographic enrichment (without PII).

Data processing agreements under Art. 28 GDPR exist with all these providers. Additional recipients may include clients of TODAY Experts GmbH where relevant to recruitment.

Your data will be retained until you withdraw your consent. Upon request, we will stop processing or delete your data from our systems.

Providing your data is voluntary, but necessary if you wish your profile to be retained beyond 6 months.

You may request access to your stored data at any time by contacting dataprotection@today-experts.com.