Privacy Policy
This is an English translation of our Datenschutzerklärung, provided for convenience. The German version at getonyxagent.com/datenschutz is binding; if the two differ, the German version prevails.
Controller
Recruit-ME (Recruitment Made Easy) Inh. Sibel Kurtcebe e.K.
Ganghoferstraße 71, 81373 München, Germany
Email: info@getonyxagent.com
Full details are given in the Imprint.
Onyx Agent (including Onyx Network) is a service of the company named above. No data protection officer has been appointed, as the statutory requirements for one are not met.
Roles: when we are responsible and when our customers are
We are the controller for the data of our customers and their users (account, contract, billing, support) and for visitors to this website.
We are a processor for data that customers process in Onyx, in particular applicant and candidate data (CVs, interview recordings, assessments). In this case the respective customer company is the controller. Processing takes place on the basis of a data processing agreement under Art. 28 GDPR. Candidates should first direct their requests to the company they applied to; we forward any requests that reach us.
What data we process
Website visitors: IP address, browser information, pages visited (technically necessary server logs); information from the contact or demo form.
Customers and users: name, business email address, company, role, LinkedIn profile and website (where provided), login and usage data (e.g. which features were used, for billing quotas and to improve the service), time, IP address and version of the accepted terms, billing data. When you register through a link on our website, additionally the page the registration started from and, if the link contained them, the campaign details utm_source, utm_medium and utm_campaign (e.g. "linkedin"). They are stored with the account and used to evaluate which pages and campaigns lead users to us (Art. 6(1)(f) GDPR).
On behalf of our customers (candidate data): CVs and information extracted from them (work experience, education, skills), contact details, messages, phone interviews (transcript, no audio recording), video meeting recordings and transcripts, assessments and notes, data from publicly accessible professional sources (sourcing).
Browser extension “Onyx: save LinkedIn profiles”: If a user installs our Chrome extension, it shows a button only on LinkedIn member profiles (linkedin.com/in/…). Only when the user clicks “Read profile” does it read the profile currently open: name, headline, location, the “About” text, up to five entries each from experience and skills, and the profile address. The user checks the fields and saves them to their candidate pool in Onyx with a further click. The extension does not read any other page or profile, does not scroll or collect in the background, does not read LinkedIn login data, cookies or messages, and contains no code loaded from elsewhere. In the browser it stores only a connection token issued by Onyx Network (valid for at most 8 hours) and the interface language; “Disconnect” or uninstalling the extension removes them. A saved profile is candidate data that we process on behalf of the customer (section 2); before saving, the user confirms that their company has a legal basis of its own. Deletion and objection requests: info@getonyxagent.com.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provision of the platform, performance of the contract, support | Art. 6(1)(b) GDPR |
| Billing, retention under commercial and tax law | Art. 6(1)(c) GDPR |
| Security, abuse prevention, technical operation, improving the service based on usage data | Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning service) |
| Responding to enquiries sent through website forms | Art. 6(1)(b) or (f) GDPR |
| Processing of candidate data | on behalf of the customer, Art. 28 GDPR; the legal basis is determined by the customer |
Record of acceptance of the data processing agreement: When a user accepts the data processing agreement (AVV) on behalf of their company, we store the time, version, IP address and browser information of the acceptance. This information serves as proof that the contract was concluded. The legal basis is Art. 6(1)(c) and (f) GDPR (legitimate interest in proving the conclusion of the contract). We store it for the term of the contract and thereafter until the limitation periods have expired.
Artificial intelligence
Onyx uses AI models to structure CVs, match candidates against job requirements, transcribe interviews and create summaries.
- A human decides. Onyx provides recommendations and assessments. The decision about candidates is always made by a person at the customer company. No solely automated decision within the meaning of Art. 22 GDPR takes place.
- What data goes to the AI. For these functions, the content required in each case, such as the text or image of a CV and the job requirements, is transmitted to our AI service provider. The transmission is limited to data that the respective user already has access to.
- No training. Neither we nor our AI service providers use customer or candidate data to train AI models. Our AI service providers act as sub-processors and may use the data only to provide the service.
- Storage at the AI service provider. Our AI service provider for text and document analysis (based in the USA) may store inputs and outputs for up to 30 days in order to provide the service and detect abuse; they are then deleted.
Recipients and service providers
We use service providers in the following categories. Data processing agreements are in place with all of them that process personal data on our behalf. Our customers receive the complete list of sub-processors, by name, in the data processing agreement.
| Category | Purpose | Place of processing |
|---|---|---|
| Hosting: database, authentication, file storage | Storage of all platform data | Frankfurt am Main, Germany |
| Hosting: application servers and queue | Operation of the platform | Amsterdam, Netherlands |
| Hosting: delivery of the websites | Serving the web applications | server-side functions in Frankfurt am Main; static content through a global network |
| AI service provider: text and document analysis | Structuring, matching, summarisation | USA |
| AI service provider: phone interviews, with a telephony provider | AI-assisted phone interviews (only when used by the customer) | USA. No audio recordings are stored; calls are deleted at the provider after 7 days |
| Service provider for video meetings | Recording and transcription of video meetings (only when used by the customer) | EU (Frankfurt am Main) |
| Email delivery | Sending system and notification emails | Ireland (EU), company headquarters in the USA; no open or click tracking |
| Message delivery | Sending through LinkedIn, email and WhatsApp accounts connected by the user (only at the user's request) | France (EU) |
| Provider of publicly accessible professional profile data (sourcing, data source) | Candidate search at the customer's request; we send search criteria and receive publicly accessible professional profile data in return | USA |
| Location suggestions (OpenStreetMap Foundation) | when you enter a work location, your browser calls the service directly; the location text you entered, your IP address and browser information are transmitted | United Kingdom (adequacy decision) |
Payment: Stripe Payments Europe, Ltd., Ireland. Card data and billing identity are collected by Stripe, not by us. We only receive confirmation that payment has been made.
Appointment booking: To book a demo we use Google Workspace (Google) appointment scheduling. Data reaches Google only after you click "Pick a time", which opens Google's booking page in a new tab. The details you enter there (name, email address, chosen slot) are used to arrange and hold the demo (Art. 6(1)(b) GDPR). Transfers to the USA may occur, based on the EU-US Data Privacy Framework.
Services connected by the user: If a user connects calendar, email, storage, job board or HR systems (e.g. Microsoft, Google, LinkedIn, Greenhouse, Personio), we transmit data to these services only at that user's request.
Others: professional advisers, authorities or an acquirer, where we are obliged to do so or need to enforce rights.
We do not sell personal data.
Transfers to third countries
Some service providers are based in the USA. Where the service provider is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision; otherwise it is based on the European Commission's standard contractual clauses.
Storage period
- Account data: for the duration of the contract.
- Deleted candidate records are permanently removed after 30 days.
- After a trial period or contract ends, we provide an export of the data on request and delete the data no later than 30 days after the end of the contract, unless a statutory retention obligation applies.
- Phone interviews: no audio recordings are stored. At the phone interview service provider, calls are deleted after 7 days.
- At AI service providers: see section 5.
- Billing records: statutory periods (up to 10 years).
- Server logs: at most 7 days.
Cookies and local storage
We do not use analytics or advertising cookies. On our website we use cookieless audience measurement provided by our hosting provider, which evaluates page views only in aggregated form, without cookies and without cross-device profiles (Art. 6(1)(f) GDPR, legitimate interest in improving the website). It records the time, the page visited, the referring page, approximate location (country, region, city), operating system, browser and device type. Visitors are recognised for at most 24 hours through a hash formed from the request; the hash is then discarded. IP addresses are not stored. We use the same cookieless audience measurement on the Onyx Network sign-in and sign-up pages (network.getonyxagent.com/login and /signup). Only visits to these two pages are recorded, without URL parameters; pages after sign-in are not recorded. For login, a technically necessary session key is stored in the browser (Section 25(2) of the German TDDDG).
Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). To exercise these rights, contact info@getonyxagent.com.
You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.
Onyx CV Evaluator for ChatGPT
Onyx CV Evaluator is an app that runs inside ChatGPT. When you ask it to evaluate a CV, ChatGPT (operated by OpenAI) reads the CV and the job description you provide and sends our server only a structured scorecard: the job title, a neutral candidate label, scores, short evidence notes, strengths, gaps and interview questions.
Our server does not receive the full CV text, and the app instructs ChatGPT not to send names together with contact details, email addresses, phone numbers or postal addresses. Our server does not store the scorecard, does not use it to train models and does not share it with third parties; it only returns it so ChatGPT can display it to you. Standard technical request logs kept by our hosting provider may record the time of a request and network metadata such as the IP address, for security and operations.
Your conversation with ChatGPT, including any CV you paste, is processed by OpenAI under OpenAI's own privacy policy. The evaluation ignores protected characteristics such as age, gender, nationality, religion and photos, and is decision support only, not an automated hiring decision. Questions about this app can be sent through the contact details below.
Changes
We update this policy when our processing changes. The version published on this page applies.