Processing of (personal) data by the entity in charge of the online application process
Privacy Policy
For Applicants
Prewave GmbH (“Prewave”, “us” or “we” or referred to by “our”) takes the protection of your data very seriously and has implemented numerous technical and organizational measures to ensure the most complete protection of personal data.
Understanding our talent needs is Prewave’s top priority. We collect and process your data to evaluate your suitability for open positions, manage the recruitment process, and improve our candidate experience.
This policy (“Policy”) describes the types of personal data that Prewave collects from or about you as a job applicant (“Applicant”) who applies via the Prewave career page, LinkedIn, or other recruitment platforms. It also explains how Prewave uses and discloses the personal data it collects and how you can exercise your privacy rights and choices.
Please read the privacy policy carefully. By confirming on Prewave’s career page and/or Linkedin, you acknowledge this privacy policy and consent to the respective processing of your data.
Controller and contact details
When Prewave processes Applicant data, Prewave acts as a controller within the meaning of Article 4 (7) of Regulation (EU) 2016/679 (“General Data Protection Regulation” or “GDPR”), the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, as well as the Swiss Federal Act on Data Protection (“FADP”). Prewave is primarily responsible for ensuring that the personal data is processed in an appropriate way.
Prewave GmbH
FN 474673 z
Rothschildplatz 4, Austria Campus 4, 3rd floor 1020 Vienna, Austria
Phone: +43 1 30 50 743
E-mail: privacy@prewave.ai
Website: www.prewave.com
Description of the processing of data
When you apply for a position and/or for our talent pool, Prewave will obtain the following information about Applicants from relevant platforms (e.g., LinkedIn or similar) or directly from you:
Your name and last name (required)
Contact details: Your email address (required), phone number (optional)
Professional information (required): Any documents uploaded by you (e.g. CV, resume, cover letter, certificates, etc.) which can include your work history and educational background.
Availability (optional)
Location (required)
Languages & Level (optional)
Gender (optional)
Information about where you heard from us (required)
Social Media & External Links (optional): If you include links in your application documents (e.g., to social media profiles such as LinkedIn or other external websites), please note that any data accessible via those links may be processed as part of your application in our applicant tracking system.
Technical data: Your Internet Protocol (IP) address and the web browser type and version operating system used for the application, timestamp of the application access.
Application date
Inferred information: Information about interactions during interviews, which Prewave may use to evaluate skills and fit for the role, including interview evaluations, case study or test results.
Consent & compliance data: Data privacy consent (required), and consent to be included in our talent pool (optional).
(Background screening data: We may occasionally request a criminal record certificate prior to signing an employment contract.)
We ask you not to share sensitive personal information (e.g., credit card numbers, religion, or political opinions). We have no intention of collecting this type of information.
In addition to data you provide directly or via platforms like LinkedIn, we may also receive personal data about you from third parties, such as recruitment agencies, headhunters, or through internal employee referrals.
Our recruitment process and career page are not intended for minors under the age of 18 (or the applicable legal age of majority in your jurisdiction). We do not knowingly collect personal data from minors.
If you choose to be added to our talent pool, we will store and process the same application data in order to inform you about relevant job opportunities and potential recruiting events. Your profile may be reviewed by our recruiting team for suitable roles. Your data will be retained for up to 365 days. You can withdraw your consent at any time. For more details, please refer to section 6 “Duration of Storage” and section 8 “Rights of the Data Subject.”
Legal basis
Prewave’s lawful bases for processing your personal data include the following:
Pre-contractual measures (Article 6 (1) lit. b GDPR): Processing is necessary to take steps at the request of the Applicant prior to entering into a contract.
Applicant's Consent (Article 6 (1) lit. a GDPR): Prewave may ask for consent to retain your data for future job openings beyond the specific role applied for. You may withdraw it at any time.
Prewave's Legitimate Interests (Article 6 (1) lit. f GDPR): Prewave processes information when necessary for legitimate interests, such as administering the recruitment process and ensuring the security of our systems, or occasionally checking on criminal record certificates (Art 10 GDPR in combination with § 4 Para 3 Austrian Data Protection Law).
The provision of certain personal data (marked as “required” during the application process) is necessary to evaluate your application and initiate pre-contractual steps. If you choose not to provide this required information, we may not be able to process your application or consider you for employment.
Purposes of processing
We process your personal data for the following purposes:
Evaluating your qualifications for the role and managing the recruitment process.
Communicating with you regarding your application, including interviews and feedback.
Conducting reference checks or background screenings, where permitted by applicable law and relevant to the position. This may include occasionally requesting a criminal record certificate prior to signing an employment contract. We will generally only contact references if you have provided us with their contact details and consented to us doing so.
Allowing hiring managers and relevant stakeholders to review application materials, interview notes, and evaluations.
Managing and maintaining our recruitment systems, including automatic updates and data synchronization.
Storing application history to enable reference to previous recruitment stages.
Considering your profile for future job opportunities (talent pool, where applicable).
Complying with legal and regulatory obligations.
Establishing, exercising, or defending legal claims.
Recipient of the data
Prewave shares personal data with select third parties, subject to appropriate safeguards. When we share personal data, we do so in accordance with applicable data protection laws and regulations. We do not disclose your information to third parties except as noted below:
Service Providers: Third-party vendors such as Applicant tracking systems (e.g., Personio), communication tools (e.g., Slack), cloud service providers (e.g., Google Cloud including all Google Workspace services such as Gmail and Google Calendar), recruitment platforms (e.g., LinkedIn Recruiter, Join), organisation/scheduling tools (e.g. Calendly, Perk) .
As part of our use of these service providers, your data may be transferred to and processed in countries outside the European Union (EU), the European Economic Area (EEA), the UK, and Switzerland. Specifically, data may be transferred to the United States.
Legal & Business Transfers: Necessary disclosures to comply with the law, including sharing data with the Public Employment Service (e.g., for the application of potential funding), as well as, where applicable, with social and training funds to support the financing of education or training measures, or in the context of applications for residence permits, and as part of a merger or acquisition.
Prewave has implemented organizational and contractual measures designed to ensure that your personal data receives the same level of protection that you would expect, no matter where it goes.
Adequacy Decisions: Where Prewave shares personal data subject to European data protection laws with a recipient located in a country that has been deemed to grant a similar level of protection to personal data, the personal data is sometimes transferred under or pursuant to the decisions adopted by the relevant authorities of the European Union or Switzerland or the UK as relevant.
Standard Contractual Clauses: Prewave shares personal data subject to the European data protection laws by implementing the most recent version of the Standard Contractual Clauses, as those clauses have been approved by the European Commission as an “adequate safeguard” pursuant to GDPR Article 46 (2), as well as analogous mechanisms under UK and Swiss law.
Duration of storage
Prewave retains your personal data for as long as is necessary to fulfill the purpose for which we collected your personal data and any other permitted linked purpose, and in compliance with our data retention policies:
Specific Applications: If you apply for a specific position, the application and submitted documents will at the latest be deleted seven (7) months after the application has been decided, unless overriding statutory retention obligations apply.
Talent Pool: If you have joined our talent pool, your data will be deleted one (1) year from the date of the talent pool entry.
Successful Candidates: Your data will be transferred to your personnel file to prepare for your entry into the company.
(Background Check Documents: If requested, criminal record certificates are strictly used for verification purposes prior to or shortly after the starting of your employment and are stored securely in your personnel file if hired.)
Cookies
Prewave utilizes only those cookies which are operationally necessary and technically required for the recruitment websites. These cookies are essential for the following purposes:
To enable the intended use of our websites;
To ensure that all functionalities remain available to you; and
To perform necessary authentications; and
To preserve application data integrity within the recruiting workflow through source attribution.
In accordance with applicable legal requirements, the deployment of these cookies does not require your prior consent.
If you choose to apply for a position via external platforms such as LinkedIn (for example, using the “Easy Apply” function), please be aware that your interaction with these platforms is governed by their own privacy and cookie policies. Prewave has no control over the cookies set by LinkedIn or the data they collect while you are on their platform.
Prewave’s responsibility - and the scope of this Privacy Policy - begins the moment your application data is securely transmitted to and received by our Applicant tracking system to evaluate your suitability for the role.
Rights of the data subject
The GDPR grants data subjects certain rights, to which we draw your attention below. To assert these rights, please contact us using the contact details provided in point 1 of this Policy.
Right to information
Data subjects are entitled to request confirmation as to whether we are processing personal data concerning them. If applicable, data subjects also have the right to request information about this data and, among other things, about the purposes of processing, categories of data processed and categories of recipients.
Right to data portability
Data subjects are entitled to receive the personal data concerning them that has been provided to us in a structured, commonly used and machine-readable format. Furthermore, they have the right to transmit this data to another controller without hindrance from us, provided that such transmission is technically feasible.
Right to rectification
If we process inaccurate personal data, the data subjects can request that the data be corrected.
Right to restriction of processing
Furthermore, under certain circumstances, the data subjects are entitled to request the restriction of processing. In this case, we may only process the data, apart from storing it, with the consent of the data subject or within narrow limits, for example for the assertion, exercise or defence of legal claims.
Right to be forgotten
Under certain circumstances, data subjects are entitled to request the erasure of data processed about them. This right to erasure does not exist, for example, if the processing of the data is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
Right of objection
In certain situations, data subjects are entitled to object to data processing. In this case, we will no longer process the data unless we can demonstrate legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.
Right of appeal
Finally, data subjects are entitled to lodge a complaint with the data protection authority if they are of the opinion that the data processing violates data protection regulations.
Within the European Union, data subjects may lodge a complaint with the respective supervisory authority in their Member State of habitual residence, place of employment, or the location of the alleged infringement.
Regarding the United Kingdom, you are entitled to submit a complaint to the Information Commissioner's Office (ICO) via its official website at https://ico.org.uk.
In Switzerland, data subjects have the right to file a complaint with the Federal Data Protection and Information Commissioner (FDPIC), accessible at https://www.edoeb.admin.ch.
In order to exercise any of the above-mentioned rights or if you have any questions, concerns, or requests regarding this Policy, please contact us at privacy@prewave.ai.
Changes to this Policy
We may update this Policy periodically to reflect changes in our practices. The latest version will be posted on this page with the effective date.