Applicant Privacy Notice

Thank you for your interest in working at SOX-AI. This notice explains, in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), how we process your personal data when you apply for a position with us. A German version is available as Datenschutzinformation für Bewerberinnen und Bewerber.

1. Joint controllers

Your application is handled jointly by the following companies, which are joint controllers for the processing of your data (Art. 26 GDPR):

SOX-AI GmbH i.G.
Leopoldstraße 31, 80802 Munich, Germany
Managing Director: Matan Atad
Email: munich@sox-ai.com
SOX-AI Ltd. (Company No. 516999729)
Hamaalot 9, Raanana, Israel
Email: info@sox-ai.com

For positions in Germany, SOX-AI GmbH i.G. will be the employer and is the central point of contact for your questions and rights. Employees of both companies take part in the selection process. You may exercise your rights against either company.

2. What data we process and where it comes from

We process the data you provide as part of your application, in particular:

  • Identification and contact details (name, email address, phone number, place of residence)
  • Application documents (CV, cover letter, certificates, qualifications, work experience)
  • Information from your LinkedIn profile, to the extent you submit it with your application
  • Salary expectations and earliest possible start date
  • Notes and assessments from interviews and, where applicable, technical assignments
  • Video and audio recordings of interviews, only if you have consented beforehand

If you apply via LinkedIn, we receive your data from LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn is responsible for processing on the LinkedIn platform itself; LinkedIn's privacy policy applies.

Please do not send us special categories of personal data (e.g. health, religion or ethnic origin) unless necessary. If you choose to share such information (for example a severe disability), we process it only as required to exercise rights or meet obligations under employment law (Art. 9(2)(b) GDPR, Section 26(3) German Federal Data Protection Act (BDSG)).

3. Purposes and legal bases

  • Running the application process and deciding whether to enter into an employment relationship: Art. 6(1)(b) GDPR in conjunction with Section 26(1) BDSG.
  • Defending against legal claims, in particular under the German General Equal Treatment Act (AGG): Art. 6(1)(f) GDPR. Our legitimate interest is being able to demonstrate a fair and lawful process.
  • Adding you to our talent pool for future positions: only with your separate consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
  • Recording interviews, so the team can review conversations and assess them fairly: only with your explicit consent before recording starts (Art. 6(1)(a) GDPR). Consent is voluntary; declining a recording will not affect your application in any way. You may withdraw it at any time.

If you are hired, we continue to process the necessary data to carry out the employment relationship and add it to your personnel file.

4. Recipients

Only the people involved in the selection process at SOX-AI GmbH i.G. and SOX-AI Ltd. have access to your application. The European Commission has recognised Israel as providing an adequate level of data protection (Decision 2011/61/EU).

We use the following service providers as processors to manage applications and communicate with you:

  • Microsoft 365 (Outlook for email, OneDrive for storing CVs and interview notes), purchased through GoDaddy Europe Limited, Studio 4th Floor, Parts C&D at East West, Tollhouse Hill, Nottingham NG1 5FW, United Kingdom, and operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
  • Zoom (video interviews and, with your consent, storing recordings in the Zoom cloud), provided by Zoom Communications, Inc., 55 Almaden Blvd., San Jose, CA 95113, USA

The European Commission has recognised the United Kingdom (GoDaddy) as providing an adequate level of data protection. Microsoft and Zoom may also process data in the USA; both are certified under the EU-US Data Privacy Framework; transfers are based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). We receive and handle applications submitted via LinkedIn in our LinkedIn account (see section 2). We do not share your data with any other third parties.

5. Retention

If your application is unsuccessful, we delete your data six months after the end of the application process. This period allows us to defend against possible claims under the AGG (Section 15(4) AGG, Section 61b German Labour Court Act). If you have consented to our talent pool, we keep your data until you withdraw your consent, but no longer than 24 months. Interview recordings are deleted when you withdraw your consent, and at the latest together with the rest of your application data.

6. Obligation to provide data

You are not legally or contractually obliged to provide your data. However, we cannot consider your application without the information required for the process.

7. No automated decision-making

Decisions on applications are made by people. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may withdraw any consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation.

To exercise your rights, contact munich@sox-ai.com. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Last updated: October 2026