Privacy Policy

Last updated: April 30, 2026

1. Controller

Joyride GmbH
Bartenbacher Str. 4
73033 Göppingen, Germany
Managing Director: Jens Kammerer
Email: privacy@joyri.de

2. Scope

This privacy policy applies to the processing of personal data in connection with our careers website and recruitment activities at careers.joyri.de.

3. Data We Collect

When you apply for a position or join our Talent Pool/Connect, we may collect the following personal data:

• Name and email address
• Video introduction
• CV and cover letter
• Country of residence
• Compensation expectation
• Earliest start date
• English fluency level
• Description of a typical workday
• Answers to custom application questions
• Optional additional documents you choose to upload (e.g. portfolio, references)
• Your LinkedIn profile URL, if you choose to provide it (manually or via the Apply-with-LinkedIn flow)
• The IP address used to submit your application, plus the approximate location (country, city), timezone, and network/ASN organization derived from it via a third-party geolocation lookup. Used internally as a soft signal for plausibility (e.g. comparing stated country with detected region). Not used as the sole basis for any hiring decision.
• Internal review notes and ratings recorded by our hiring team about your application. Reviewer-private notes are visible only to the individual reviewer; team comments are visible to the whole hiring team for the role you applied to.
• Anonymous server-side page-view analytics (URL, referrer, user agent) used to understand which job postings are seen and from where. Not linked to your application record.

4. Purpose and Legal Basis

4.1 Job Applications

We process your application data for the purpose of evaluating your suitability for the advertised position. The legal basis is Art. 6(1)(b) GDPR (processing necessary for the performance of pre-contractual measures taken at the data subject's request).

4.2 Talent Pool / Connect

If you join our Talent Pool or use our Connect feature, we process your data to match you with future opportunities. The legal basis is Art. 6(1)(a) GDPR (your consent). You may withdraw your consent at any time by contacting privacy@joyri.de.

5. Data Retention

• Job applications: If your application is unsuccessful, your data will be retained for 6 months after the rejection decision, then deleted.
• Hired applicants: Your application data becomes part of your employee file and is retained for the duration of employment, subject to applicable retention obligations.
• Talent Pool / Connect: Your data is retained until you withdraw your consent.

6. Third-Party Processors

We use the following third-party service providers who process personal data on our behalf or that we transfer data to as part of our recruitment workflow:

• MinIO / S3-compatible object storage (self-hosted within our EU infrastructure) for storing uploaded files (CV, cover letter, video, additional documents).
• Postmark (ActiveCampaign LLC) for transactional email delivery and inbound email parsing of replies to our recruitment messages. Data is processed in the EU and US.
• Anthropic, PBC for an AI-generated fit summary used internally by our hiring team. The model receives the job description and your application content (name, email, country, salary expectation, free-text answers, extracted CV text). The output is advisory only; final hiring decisions are made by humans (see §8). Data is processed in the United States.
• LinkedIn Ireland Unlimited Company / LinkedIn Corporation when you choose "Apply with LinkedIn". Your name and verified email are returned to us via OpenID Connect and pre-filled into the application form. Data may be transferred to the United States.
• Google Workspace (Calendar, Meet) (Google LLC) for scheduling and conducting remote interviews. Data may be transferred to the United States.
• ipapi.co (Kloudend, Inc.) for IP-based geolocation lookups at submission time. Only the submission IP is sent; results (country, city, timezone, ASN/ISP organization) are stored alongside your application. Lookups are made on a best-effort basis and may fail silently. Data may be transferred to the United States.

Note: web fonts are self-hosted on our infrastructure — no third-party font CDN (Google Fonts etc.) is contacted by your browser when you visit our careers site.

Where required, these processors are bound by data processing agreements (Art. 28 GDPR) and process data only on our instructions.

7. International Data Transfers

Where personal data is transferred to processors in the United States (Anthropic, LinkedIn Corporation, Google LLC, Postmark, Kloudend), the transfer is covered by the EU-US Data Privacy Framework where the processor is certified, and by Standard Contractual Clauses otherwise.

8. Automated Decision-Making

We use an AI-generated fit summary (Anthropic Claude) to assist our hiring team in reviewing applications. This is decision-support only: the AI does not select, reject, or rank candidates on its own. Every hiring decision is made by a human reviewer who has access to the full application. You have the right under Art. 22 GDPR to ask that any decision not be based solely on automated processing — this is already how our process works.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You may request confirmation of whether we process your data and obtain a copy.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your data where the legal basis no longer applies.
• Right to restriction of processing (Art. 18 GDPR): You may request that processing be limited under certain conditions.
• Right to data portability (Art. 20 GDPR): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. The competent authority for us is the State Commissioner for Data Protection, Baden-Wuerttemberg (Landesbeauftragter fuer den Datenschutz und die Informationsfreiheit Baden-Wuerttemberg).

To exercise any of these rights, please contact privacy@joyri.de.

10. Cookies

Our careers website uses only strictly necessary cookies (session cookies) that are required for the website to function. These cookies do not require consent under the GDPR. We do not use analytics, tracking, or marketing cookies.

11. Contact

For any questions about this privacy policy or data protection requests, please contact:

Joyride GmbH
Privacy
Bartenbacher Str. 4
73033 Göppingen, Germany
Email: privacy@joyri.de