Privacy Policy

Why we use your data and on what legal basis

• Running the selection process. Reviewing your application, scheduling and conducting interviews and tests, communicating with you, making a hiring decision, and preparing an offer. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Improving our selection process. Analysing our hiring process, for example time-to-hire, and fairness of the process. Legal basis: legitimate interest in an effective and fair process (Art. 6(1)(f) GDPR).
• Contacting references. Asking your referees for feedback on your qualifications and suitability for the role. If you're a reference, this means using your name, contact details, and role to contact you, and keeping a record of the feedback you give. Legal basis: legitimate interest in verifying suitability (Art. 6(1)(f) GDPR).
• Supporting accurate interview evaluation. Transcribing and summarizing interviews to support accurate evaluation. Legal basis: legitimate interest in evaluating candidates accurately and fairly (Art. 6(1)(f) GDPR).
• Providing the support you request. In some cases, you may choose to share sensitive personal data (such as health information, if requesting an accommodation). We use this data only to provide the support requested. Sharing it is always optional and doesn't affect your evaluation or the outcome of your selection process. Legal basis: your explicit consent (Art. 9(2)(a) GDPR).
• Considering you for future roles. Keeping your profile and contacting you about other suitable roles. Legal basis: legitimate interest in identifying suitable candidates for future roles (Art. 6(1)(f) GDPR).
• Identifying prospective candidates. Finding prospective candidates whose profile matches our roles and contacting them about opportunities. Legal basis: legitimate interest in finding qualified talent (Art. 6(1)(f) GDPR).
• Legal compliance. Complying with applicable law and responding to authorities. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Defending our rights and preventing fraud. Handling disputes and detecting fraudulent applications (for example, fake identities or false qualifications). Legal basis: legitimate interest to establish, exercise, or defend our rights (Art. 6(1)(f) GDPR); for sensitive data (Art. 9(2)(f) GDPR).
• Corporate transactions. Sharing data, when necessary, in the context of a merger, acquisition, or reorganization. Legal basis: legitimate interest to carry out corporate transactions or operations (Art. 6(1)(f) GDPR).

The data we collect

• Identity and contact details. Name, email, phone number, address, and where relevant your right to work in the country of the role.
• Professional background. Qualifications, education, skills, and employment history.
• Documents. CV, cover letter, portfolio, academic transcripts.
• Application information. Your responses to the questions on our application form, including work and location preferences.
• Assessments. Results and feedback from your selection process, and AI-supported outputs such as match scores and summaries of your application.
• Interview note-taking and transcripts. For some interviews, we may use an AI-supported note-taker to transcribe the conversation and create a summary, so our interviewers can focus on you rather than on taking notes.
• Public professional information. For example your LinkedIn profile.
• References. Name, contact details, role, and the feedback given.
• Correspondence. Messages between you and us, including interactions with our candidate support tools.
• Sensitive information. Only what you choose to share, for example health information for an accommodation.

How long we keep your data for

Automated and AI-supported tools

Recipients of your data

• Our group. Other Bending Spoons group companies, where they support our recruitment operations.
• Service providers. Trusted partners who support us with the selection process, such as IT, storage providers or AI-supported tools providers. In rare cases, this may include independent entities like professional advisors.
• Advisors and new owners. For instance, if a corporate transaction takes place, such as a merger, acquisition, reorganization, or sale of assets, we may need to share personal data as part of due diligence.
• Authorities. Public, judicial, or police authorities when the law requires.
• Other parties, if necessary. For instance, insurers, or competent authorities if we believe you've broken the law, or if sharing is needed to protect the rights, property, or safety of our employees, the public, or others.

International transfers

• Standard contractual clauses approved by the European Commission
• Adequacy decisions adopted by the European Commission
• Binding corporate rules

Your rights

• Access. Ask for a copy of your personal data and information about how we use it, including the categories of personal information collected, the sources from which the personal information is collected, the business or commercial purpose for collecting or sharing personal information, the categories of third parties to whom we disclose personal information, the categories of personal information disclosed to third parties, and the specific pieces of personal information we have collected about you.
• Correction. Ask us to update or correct inaccurate data.
• Deletion. Ask us to delete your data, subject to any legal retention requirements.
• Portability. Ask for an electronic copy of the data you provided, in a reusable format.
• Objection. Object to processing based on our legitimate interests, in whole or in part.
• Restriction. Ask us to limit how we use your data in certain circumstances.
• Withdraw consent. Where we rely on consent, you can withdraw it at any time. Withdrawing your consent does not affect how we processed your data before that point.
• Human review. Where automated tools were used to assess your application, ask for a human to review the outcome and for an explanation of the logic involved.
• Complaint. If you have any concerns about how we handle your data, please email us at privacy@vimeo.com. You also have the right to complain to a supervisory authority. In the EEA, that's normally the authority in the country where you live, work, or where the issue arose. In the UK, it's the Information Commission, and you also have the right to raise a complaint directly with us. If you're in California, you may contact the California Privacy Protection Agency or the California Attorney General.
• Designating authorized agents. Where available under applicable law, you may also designate an authorized agent to submit a privacy rights request on your behalf. We may ask authorized agents to submit proof of their authority to make a request, such as a valid power of attorney or proof that they have signed permission from the consumer who is the subject of the request. In some cases, we may contact the individual who is the subject of the request to verify their own identity or confirm the authorized agent has permission to submit the request.
• Non-discrimination. We will not discriminate or retaliate against you for exercising your privacy rights.

How to contact us

Changes to this privacy policy