Processing of (personal) data by the entity in charge of the online application process
Privacy Policy of Snap Fusion GmbH
As of: May 2026
1 Name and contact details of the controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States as well as other data protection provisions is:
Snap Fusion GmbH
Springerstraße 8
81477 Munich
Germany
Represented by the Managing Director: Dr. Michael Daum
Phone: +49 160 97609588
Email: hello@snap-fusion.com
Website: https://www.snap-fusion.com
Commercial register: HRB 310102, Local Court (Amtsgericht) of Munich
2 Data protection officer
Due to its size and the nature of its data processing, Snap Fusion GmbH has not appointed a data protection officer pursuant to Art. 37 GDPR in conjunction with Section 38 of the German Federal Data Protection Act (BDSG). If you have questions about data protection, please contact the management directly at hello@snap-fusion.com .
3 General information on data processing
3.1 Scope of the processing of personal data
As a general rule, we process our users' personal data only to the extent necessary to provide a functional website and to deliver our content and services. We generally process our users' personal data only after obtaining the user's consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by statutory provisions.
3.2 Legal bases for processing
Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.
When processing personal data that is necessary for the performance of a contract, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for carrying out pre-contractual measures.
Where processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
Where processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6(1)(f) GDPR serves as the legal basis.
3.3 Data erasure and storage period
The personal data of the data subject will be erased or blocked as soon as the purpose of storage ceases to apply. Data may continue to be stored if provided for by European or national legislators in EU regulations, laws, or other provisions to which the controller is subject. The data will also be blocked or deleted if a retention period prescribed by the aforementioned provisions expires, unless continued storage of the data is necessary for the conclusion or performance of a contract.
4 Provision of the website and creation of log files
4.1 Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:
- User's IP address (generally anonymized/shortened)
- Date and time of access
- Name and URL of the retrieved file
- Website from which access originated (referrer URL)
- Browser used and, if applicable, your computer's operating system and the name of your access provider
- Volume of data transmitted and HTTP status code
The data is also stored in our system's log files. This data is not stored together with other personal data of the user.
4.2 Legal basis and purpose of data processing
The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR. The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. Storage in log files takes place to ensure the functionality of the website and the security of our information technology systems (in particular to detect and defend against attacks).
4.3 Storage period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. Where data is collected for the provision of the website, this is the case when the respective session has ended. Log file data is generally erased after 14 days at the latest. Storage beyond this is possible where necessary to investigate security-related incidents.
5 Hosting / web hosting
Our website is hosted on servers of an external service provider. The provider is:
STRATO AG
Otto-Ostrowski-Straße 7
10249 Berlin
Germany
Privacy policy: https://www.strato.de/datenschutz/
STRATO AG processes on our behalf and on the basis of a data processing agreement pursuant to Art. 28 GDPR all data generated when our website is accessed and used (in particular server log files, IP addresses, access data). The data is processed exclusively on servers in Germany.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of our online offering).
6 Contact by email
6.1 Description and scope of data processing
On our website we provide our email address hello@snap-fusion.com for contacting us. When you click the contact link, your local email client opens (mailto function). No data is transmitted to us until you yourself send an email.
If you contact us by email, the personal data transmitted with the email (name, email address, content of the message, and any other information you voluntarily provide) is stored by us and used exclusively to process your enquiry.
6.2 Legal basis
The legal basis for processing is Art. 6(1)(a) GDPR where consent has been given. The legal basis for processing data transmitted in the course of an email enquiry is Art. 6(1)(f) GDPR (legitimate interest in answering the enquiry). If the email contact aims at the conclusion of a contract, Art. 6(1)(b) GDPR is an additional legal basis for processing.
6.3 Storage period
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from email correspondence, this is the case when the respective conversation with the user has ended. The conversation has ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved. Statutory retention obligations (e.g. under the German Commercial Code (HGB) or the German Fiscal Code (AO)) remain unaffected.
7 Careers section and applications
7.1 Current application processes (until 30 June 2026)
Applications may currently be sent via email to careers@snap-fusion.com . The application documents you submit (cover letter, CV, certificates, other attachments) will be processed exclusively for the purpose of conducting the application process.
7.2 Planned Transition to Personio (starting July 1, 2026)
From July 1, 2026, applications will be processed via the applicant management system of Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany. An applicant portal will be provided, allowing applications—including the necessary documents—to be submitted electronically.
Personio Privacy Policy: https://www.personio.de/datenschutzerklaerung/
A data processing agreement pursuant to Art. 28 GDPR is in place with Personio, effective July 1, 2026. Data processing takes place exclusively within the European Union.
7.3 Scope of processed applicant data
As part of the application process, we process the following data in particular:
- Master data (name, address, contact details, date of birth, photo if applicable)
- Qualification data (CV, references, certificates, professional experience)
- Cover letter and other voluntarily submitted information
- Correspondence during the application process (e.g., interview notes, evaluations)
7.4 Legal basis
The legal basis for processing your application data is Section 26 (1) of the Federal Data Protection Act (BDSG) in conjunction with Art. 88 of the GDPR (data processing in the employment context for the purpose of establishing an employment relationship) and Art. 6 (1) (b) of the GDPR (implementation of pre-contractual measures).
If you voluntarily submit special categories of personal data pursuant to Art. 9 of the GDPR (e.g., information regarding a severe disability), processing is additionally based on Art. 9 (2) (b) or Art. 9 (2) (a) of the GDPR (your explicit consent given by submitting the data).
7.5 Retention period
In the event of a rejection, application data will be deleted no later than six months after the conclusion of the application process, unless statutory retention obligations prevent this or you have expressly consented to longer storage (e.g., for inclusion in a talent pool). In the event of hiring, the relevant data will be transferred to the personnel file and retained in accordance with statutory regulations.
8 Embedding of social media content (LinkedIn)
8.1 LinkedIn plugin / embed
A content item or widget of the social network LinkedIn is embedded on our website. The provider is:
LinkedIn Ireland Unlimited Company
Wilton Plaza, Wilton Place
Dublin 2, Ireland
Privacy policy: https://www.linkedin.com/legal/privacy-policy
Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
8.2 Description and scope of data processing
When a page of our website containing a LinkedIn embed is accessed, a connection to LinkedIn servers is established automatically. In particular, the following data is transmitted to LinkedIn:
- Your IP address
- Date and time of access
- Page of our website accessed (referrer URL)
- Browser type and operating system
- Cookie information for recognition
If you are logged in to LinkedIn at the same time, LinkedIn may associate your visit to our website with your LinkedIn profile. If you interact with the plugin (e.g. by clicking), the corresponding information is also transmitted directly to a LinkedIn server and stored there.
Please note that, as the provider of these pages, we have no knowledge of the content of the transmitted data or its use by LinkedIn. The purpose and scope of data collection and the further processing of the data by LinkedIn are set out in LinkedIn's privacy policy.
8.3 Legal basis and consent
The LinkedIn widget with tracking functionality is embedded exclusively with your prior express consent pursuant to Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG; formerly Section 25 TTDSG) in conjunction with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via our cookie/consent management.
Without your consent, the LinkedIn widget is not loaded; a placeholder is displayed instead (so-called two-click solution or consent-based loading).
8.4 Data transfers to third countries
When using LinkedIn, personal data may be transferred to the USA. LinkedIn has committed to the EU-US Data Privacy Framework, which, through the European Commission's adequacy decision of 10 July 2023 (C(2023) 4745 final), ensures a level of data protection equivalent to EU law. Insofar as data transfers take place outside this framework, they are based on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
9 Cookies
Our website uses only technically necessary cookies. Cookies are small text files that are stored on your device by your browser.
We use only cookies that are strictly necessary for the proper provision and functioning of the website (so-called session cookies and, where applicable, cookies storing your consent settings). These cookies are set on the basis of Section 25(2) no. 2 TDDDG and do not require consent.
Tracking, analytics or marketing cookies are currently not used. Should this change in future, we will inform you in advance and obtain your express consent via a consent management tool.
Legal basis: Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR (legitimate interest in technically error-free presentation and optimisation of our website).
10 Use of Microsoft 365 (internal communication)
For internal communication, email processing and document management, we use Microsoft 365 (email, SharePoint, Teams, OneDrive) of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. When you contact us by email, your data is processed via the Microsoft 365 infrastructure.
A data processing agreement pursuant to Art. 28 GDPR is in place with Microsoft. Processing takes place primarily on servers within the European Union (EU Data Boundary); a transfer to the USA may take place in individual cases and is based on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses.
Further information: https://privacy.microsoft.com/de-de/privacystatement
11 Rights of the data subject
If personal data concerning you is processed, you are a data subject within the meaning of the GDPR and you have the following rights against the controller:
11.1 Right of access (Art. 15 GDPR)
You may request confirmation from the controller as to whether personal data concerning you is being processed by us. Where such processing takes place, you may request information from the controller on the matters listed in Art. 15 GDPR.
11.2 Right to rectification (Art. 16 GDPR)
You have the right to rectification and/or completion vis-à-vis the controller if the personal data concerning you that is processed is inaccurate or incomplete. The controller must carry out the rectification without undue delay.
11.3 Right to restriction of processing (Art. 18 GDPR)
Under the conditions of Art. 18 GDPR, you may request the restriction of the processing of personal data concerning you.
11.4 Right to erasure (Art. 17 GDPR)
You may request that the controller erase the personal data concerning you without undue delay if one of the grounds listed in Art. 17(1) GDPR applies (in particular where the data is no longer necessary for the purposes for which it was collected).
11.5 Right to data portability (Art. 20 GDPR)
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format.
11.6 Right to object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(e) or (f) GDPR.
The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
11.7 Right to withdraw consent (Art. 7(3) GDPR)
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
11.8 Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data concerning you infringes the GDPR.
The supervisory authority responsible for Snap Fusion GmbH is:
Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA)
Promenade 18
91522 Ansbach
Germany
Website: https://www.lda.bayern.de
12 Data security
In accordance with Art. 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
For security reasons and to protect the transmission of confidential content, our website uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the address bar of the browser changes from " http://" to " https://" and by the lock symbol in your browser bar.
13 Currentness and amendment of this privacy policy
This privacy policy is currently valid and dated May 2026. Due to the further development of our website and offers or due to changed statutory or regulatory requirements, it may become necessary to amend this privacy policy. The current privacy policy can be accessed and printed by you at any time on the website at https://www.snap-fusion.com/datenschutz.