Applicant Privacy Notice

Last updated September 11, 2026

Information pursuant to Article 13 of the General Data Protection Regulation (GDPR) regarding the processing of applicant personal data

1. Controller and Data Protection Officer

The controller responsible for the processing of your personal data in connection with your application is:

Clue by Biowink GmbH. Adalbertstraße 8 - 10999 Berlin, Germany. trust@helloclue.com

Biowink GmbH has appointed RA Michael Panienka as its Data Protection Officer. You can contact the Data Protection Officer at mp@panienka.de.

2. Personal data we process

When you apply for a position at Biowink GmbH, we process personal data necessary to manage your application and conduct the recruitment process.

This may include:

• identification and contact information, such as your name, address, email address and telephone number;

• information contained in your application documents, such as your CV, cover letter, qualifications, education, professional experience, skills and certificates;

• information you otherwise provide to us during the recruitment process;

• communications with you in connection with your application; and

• information generated during the recruitment process, such as your application status, interview and assessment information, internal recruitment notes and recruitment decisions.

We ask that you do not provide information that is not necessary for the recruitment process.

3. Purposes and legal basis

We process your personal data for the purpose of:

• managing and conducting the recruitment process;

• assessing your qualifications, experience and suitability for the relevant position;

• communicating with you regarding your application; and

• making and documenting recruitment decisions.

The legal basis for this processing is Section 26 BDSG, in conjunction with Article 6(1)(b) GDPR, insofar as the processing is necessary for deciding whether to establish an employment relationship with you.

Where we ask for your consent for a specific processing activity, the processing will be based on Article 6(1)(a) GDPR and, where special categories of personal data are concerned, Article 9(2)(a) GDPR, as applicable. You may withdraw your consent at any time with effect for the future.

4. Recipients and service providers

Within Biowink GmbH, access to your personal data is limited to authorised persons who need the information for the recruitment process, such as members of the People/HR team, the relevant Hiring Manager, hiring collaborators and, where necessary, authorised members of management.

We use BambooHR as our applicant management and HR administration service provider. BambooHR processes applicant personal data on our behalf as a processor in accordance with Article 28 GDPR.

Your personal data will otherwise only be disclosed where necessary for the recruitment process, where required by law, or where another legal basis permits the disclosure.

5. International data transfers

In connection with our use of BambooHR, your personal data may be processed in or transferred to the United States.

BambooHR participates in and has certified its compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF). Transfers covered by that certification are therefore based on the European Commission's adequacy decision concerning the EU-U.S. Data Privacy Framework.

Where personal data is otherwise transferred outside the European Economic Area, we ensure that the requirements of Chapter V GDPR are met and that an appropriate transfer mechanism is in place.

6. Retention

We retain your personal data for as long as necessary to conduct and complete the recruitment process.

Following the end of the recruitment process, your applicant data will generally be deleted no later than six months after rejection, unless further retention is required or permitted by law, in particular for the establishment, exercise or defence of legal claims.

If you separately agree that we may retain your application for consideration for future opportunities, we may retain your personal data for the period specified when obtaining your consent. You may withdraw that consent at any time with effect for the future.

7. Recruitment emails and tracking technology

Recruitment-related communications may be sent through BambooHR. In connection with these communications, technical tracking technology may be used as part of the features and functionality provided by BambooHR through its subprocessor, Merge.

This technology is considered necessary for the provision of the relevant BambooHR service features. In connection with its use, technical information may be processed, including:

• timestamps;

• operating system information;

• device and client type;

• user-agent information;

• IP address;

• geolocation information, such as city, country, region and timezone;

• recipient information, including recipient domain and provider; and

• information relating to relevant events, including email-opening events.

The tracking functionality is used in connection with the provision of BambooHR's technical service features and functionality relating to recruitment email communications.

8. Automated decision-making

We do not use solely automated decision-making within the meaning of Article 22 GDPR to make recruitment decisions.

Automated technical processes may be used in connection with recruitment administration or communications, but recruitment decisions are not made solely by automated means.

9. Your data protection rights

Subject to the conditions set out in applicable data protection law, you have the right to:

• obtain information about and access your personal data;

• request correction of inaccurate personal data;

• request deletion of your personal data;

• request restriction of processing;

• object to processing where applicable;

• receive personal data in a portable format where the requirements for data portability are met; and

• withdraw any consent you have provided at any time with effect for the future.

To exercise your rights, you may contact us at trust@helloclue.com or our Data Protection Officer using the contact details above.

You also have the right to lodge a complaint with a competent data protection supervisory authority.