Privacy Policy

1. Who We Are (Data Controller)

The data controller (Verantwortlicher) pursuant to Art. 4(7) GDPR is:

Internal Privacy Lead: Patrick Böert (reachable via privacy@xpreso.ai). We have not yet formally appointed a Data Protection Officer (Datenschutzbeauftragter – DSB). If a formal DSB is appointed, their details will be published here.

2. What Data We Collect

3. How and Why We Use Your Data

For each processing activity below, we identify the purpose and legal basis. For all processing based on legitimate interest (Art. 6(1)(f) GDPR), we have conducted a Legitimate Interest Assessment (LIA / Interessenabwägung), available on request at privacy@xpreso.ai.

4. Automated Decision-Making and Profiling (Art. 22 GDPR)

5. Data Sharing

We do not sell your personal data. We share data only as follows:

• With employers / companies:Talent profile data is shared only after explicit Employer Opt-In. We inform Talents of the employer's identity and data categories shared before any opt-in.
• With service providers and processors (Auftragsverarbeiter): we use third-party providers for hosting, analytics, communication tools, and AI services. All process data on our behalf under written data processing agreements (Art. 28 GDPR). The full sub-processor list is set out in Section 8.
• For legal compliance: where required by applicable law, court order, or governmental authority, to the extent strictly necessary.
• Business transfers: in the event of a merger, acquisition, or sale of assets, data may transfer to a successor entity under equivalent data protection obligations. Affected individuals will be notified.

6. International Data Transfers

We do not routinely transfer personal data outside the European Economic Area (EEA). All sub-processors listed in Section 8 are configured to process data within their EU regions. Any incidental access to personal data from outside the EEA (for example, vendor support personnel) is covered by EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR, supplemented by appropriate technical and organisational safeguards. Details of safeguards for any specific transfer are available on request at privacy@xpreso.ai.

7. Retention Periods

We retain personal data only as long as necessary for the relevant purpose or as required by law.

• Talent account and profile data: retained for the duration of your active account. After a period of inactivity or account closure, data is retained for up to 48 months to enable reactivation, for security purposes, and for product improvement, unless you request earlier deletion. Some data may be retained longer where legally required or necessary for the establishment, exercise, or defence of legal claims.
• Conversation transcripts and AI-generated summaries: maximum 48 months from creation, on a rolling basis unless earlier deletion is requested.
• Company account and billing data: for the duration of the contractual relationship, plus 10 years pursuant to German commercial and tax law (§§ 238, 257 HGB; § 147 AO).
• Website visitor logs: maximum 30 days for security purposes.
• Data subject request records: 3 years from closure.

8. Third-Party Tools and Sub-Processors

We engage the following sub-processors to operate our Platform. All process personal data strictly on our behalf pursuant to written data processing agreements under Art. 28 GDPR. All sub-processors are configured to operate within the European Economic Area (EEA).

We maintain a current sub-processor list. If we engage new sub-processors that materially affect your data, we will update this policy and notify registered users.

9. Your Rights Under GDPR

You have the following rights under Art. 15–22 GDPR at any time:

• Right of access (Art. 15 GDPR): request a copy of your data and information about how it is processed
• Right to rectification (Art. 16 GDPR): request correction of inaccurate or incomplete data
• Right to erasure (Art. 17 GDPR): request deletion, subject to legal retention obligations
• Right to restriction (Art. 18 GDPR): request that we restrict processing in certain circumstances
• Right to data portability (Art. 20 GDPR): receive your data in a structured, machine-readable format
• Right to object (Art. 21 GDPR): object to processing based on legitimate interest or for direct marketing — see the prominent notice at the top of this policy
• Right to withdraw consent (Art. 7(3) GDPR): withdraw consent at any time without affecting prior processing
• Rights regarding automated decisions (Art. 22 GDPR): see Section 4

Contact privacy@xpreso.ai to exercise any right. We will respond within one month (extendable by two months in complex cases, with notice). Requests are free of charge unless manifestly unfounded or excessive.

10. Cookies and Tracking Technologies

We use cookies and similar technologies on our website and Platform in accordance with the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG). We distinguish the following categories:

You can review and change your cookie preferences at any time via the cookie settings link in the footer of our website. Withdrawing consent does not affect the lawfulness of any processing carried out prior to withdrawal.

11. Data Security

We implement appropriate technical and organisational measures (TOMs) pursuant to Art. 32 GDPR, including encryption in transit and at rest, role-based access controls, regular security assessments, and access logging.

In the event of a personal data breach posing a risk to your rights and freedoms, we will notify the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI) within 72 hours (Art. 33 GDPR) and inform affected individuals where required (Art. 34 GDPR).

12. Supervisory Authority

You have the right to lodge a complaint with the competent data protection supervisory authority at any time (Art. 77 GDPR):

13. Changes to This Privacy Policy

We may update this policy to reflect changes in our practices or legal requirements. Registered users will be notified of material changes by email or in-platform notice. The current version is always at www.xpreso.ai/privacy.