Privacy Policy

talentmonkeys GmbH, Kirchberggasse 16-18, 1070 Vienna, Austria Email: info@tamo.ai

We have not appointed a Data Protection Officer because the requirements of Article 37 GDPR do not apply. For any questions regarding data protection, you can contact us using the email address above.

This Privacy Policy relates to our recruitment software. In this context, we process personal data in two different roles:

As data controller, we process the personal data of our customers and of individuals who visit our website.

As data processor, we process, on behalf of our customers, personal data relating to individuals who may be considered candidates for an open position. The respective customer company is the controller responsible for this processing. Such processing is governed by a Data Processing Agreement pursuant to Article 28 GDPR.

We process the following data:

• Master data: name, business email address, company, role or position
• Access data: encrypted login information
• Usage data: logins, searches performed, campaigns started, usage of search credits
• Billing data: billing address, VAT identification number, payment transactions

The legal basis for this processing is the performance of the contract pursuant to Article 6(1)(b) GDPR. Billing data is additionally processed for compliance with legal obligations pursuant to Article 6(1)(c) GDPR.

Retention period: for the duration of the contractual relationship. Documents relevant for accounting and taxation purposes are retained for seven years in accordance with Section 132 of the Austrian Federal Fiscal Code (BAO). All other data will be deleted within 90 days after termination of the contractual relationship.

In order to send messages on behalf of our users, their LinkedIn account is connected once to our messaging infrastructure.

The login credentials entered during this process are transmitted exclusively to the infrastructure provider for the purpose of establishing this connection.

We do not store these credentials, either in plain text or in encrypted form, and they are not logged.

We only store the identifier of the connected account returned by the provider.

Types of data: name, publicly available professional profile including profile URL, job title, current and previous employers, periods of employment, educational information, and location at city or regional level.

Source: The data is not obtained directly from the data subjects. It is obtained from Crustdata Inc., 95 Third Street, 2nd Floor, San Francisco, California 94103, United States of America, a specialized professional profile data provider which processes publicly accessible professional and web sources and makes the resulting professional profiles available via an interface.

This information about the source is provided in accordance with Article 14(2)(f) GDPR. Data is transferred to the United States in this context.

Purpose: Identification and contact of individuals whose professional background matches a specific open position at one of our customer companies.

Legal basis: The processing is carried out on behalf of the respective customer company as controller and is based on that controller's legitimate interests pursuant to Article 6(1)(f) GDPR, namely filling its open positions and making suitable individuals aware of them. Assessing and documenting the legal basis for a specific search remains the responsibility of the respective controller.

We process only professional information that the individuals themselves have made publicly accessible. We do not process special categories of personal data within the meaning of Article 9 GDPR.

Information provided to data subjects: Every individual contacted receives, in the first message, information regarding the source of their data and a link to our candidate information page at https://tamo.ai/kandidateninfo.

Retention period: Candidate data is automatically deleted twelve months after it was added to our database. Where an outreach process is still running at that point, the record is kept until that process has ended and is deleted afterwards.

If an individual objects to the processing of their data, we delete their data without undue delay and permanently record that the individual must not be contacted, in order to prevent them from being contacted again in future searches.

Professional profiles are evaluated and ranked on a partially automated basis.

This evaluation is used exclusively for preliminary screening. Whether an individual is contacted is decided in each case by a human user who reviews and approves the proposed candidate list beforehand.

No decision based solely on automated processing within the meaning of Article 22 GDPR takes place.

When you access our website, server log data is automatically collected, including:

• IP address
• Date and time of access
• Page accessed
• Browser used
• Operating system

This data is technically necessary for operating the website and is used to ensure security and stability. It is deleted after no more than 30 days.

The legal basis is Article 6(1)(f) GDPR.

By default we use only technically necessary cookies and local storage entries that are required for login and operation of the application. Non-essential technologies are used only with your consent, as described below. We do not use ad personalisation or remarketing audiences built from website behaviour.

Google Ads conversion tracking: If you select "Accept all" or enable "Marketing (Google Ads)" in the cookie settings, we load the Google tag (gtag.js) of Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) with our conversion ID. It sets cookies (e.g. _gcl_au) and processes your IP address, device and browser information, the visited page, the click ID of a Google ad you came from and a pseudonymous workspace ID, in order to measure whether a click on our Google ad led to a completed registration (conversion measurement). We use Google Consent Mode v2: until you consent, all signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) are set to "denied" and the Google tag is not loaded at all. Data may be transferred to Google LLC in the United States; Google is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent pursuant to Article 6(1)(a) GDPR and § 165(3) TKG 2021. Your choice is stored in your browser together with the date and the version of the notice shown.

Referral tracking: If you actively consent via the notice displayed on our website, we load the referral tracking service FirstPromoter (First Promoter Ltd.). It sets a cookie so that a partner who referred you can be credited for the referral. The legal basis is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, § 165(3) TKG 2021. Without consent, this service is not loaded. You can withdraw your consent at any time via "Cookie settings" in the website footer (select "Only necessary") or by deleting the cookies and site data for tamo.ai in your browser.

Support chat: Within the logged-in application we use the support chat Crisp (Crisp IM SAS, France) so that customers can contact us directly. Crisp stores an identifier in your browser in order to maintain the conversation. This is used exclusively for customer support, not for advertising analytics.

Withdrawal: You can change or withdraw any consent at any time with the same effort via "Cookie settings" in the website footer. Withdrawal takes effect immediately for the future; Google Ads cookies are deleted where technically possible. The lawfulness of processing before withdrawal remains unaffected.

If further tracking technologies or other non-essential cookies are introduced in the future, this Privacy Policy will be updated accordingly and, where required, consent will be obtained beforehand.

We use the following service providers. Data Processing Agreements pursuant to Article 28 GDPR are in place with all relevant processors.

Where personal data is transferred to a third country, such transfers are based on the European Commission's Standard Contractual Clauses or an applicable adequacy decision.

• Lovable Labs Incorporated, Sweden — operation of the application
• Supabase Inc., United States — database and authentication; data is stored exclusively on servers located within the European Union
• n8n GmbH, Germany — execution of search workflows
• Crustdata Inc., United States — provision of professional profile data compiled from publicly accessible professional and web sources
• HeyReach, North Macedonia — sending messages via LinkedIn
• OpenAI Ireland Ltd., Ireland — automated evaluation of job advertisements and professional profiles
• Stripe Payments Europe Ltd., Ireland — payment processing
• Resend (Plus Five Five, Inc.) — delivery of transactional emails such as notifications and account emails
• Crisp IM SAS, France — support chat within the logged-in application
• First Promoter Ltd. — referral tracking, only after consent has been given
• Google Ireland Limited, Ireland (with possible transfer to Google LLC, United States) — Google Ads conversion measurement, only after consent has been given

Candidate data is not disclosed to third parties other than the processors listed above.

In particular, we do not sell personal data.

You have the right to access your personal data pursuant to Article 15 GDPR, rectify inaccurate personal data pursuant to Article 16 GDPR, request deletion pursuant to Article 17 GDPR, restrict processing pursuant to Article 18 GDPR, exercise your right to data portability pursuant to Article 20 GDPR, and object to processing pursuant to Article 21 GDPR.

If you wish to object to the processing of your candidate data or exercise any of your data protection rights, you may contact us at info@tamo.ai.

We will process your request without undue delay in accordance with the applicable requirements of the GDPR.

You also have the right to lodge a complaint with the competent supervisory authority:

Austrian Data Protection Authority Barichgasse 40-42 1030 Vienna Austria

Email: dsb@dsb.gv.at Website: www.dsb.gv.at

Data is transmitted exclusively through encrypted HTTPS connections.

Our customers' data is separated from other customers' data through tenant-specific access controls at database level.

Access credentials for third-party systems are stored in encrypted form.

Access by our employees is restricted based on roles and permissions and is logged.

We reserve the right to amend this Privacy Policy in order to reflect changes in applicable law or changes to our services.

The version available on our website at the time of your visit shall apply.