Privacy policy for the Xoople employer branding and recruitment
Date of publication: 10-09-2026
Xoople, S.L. carries out its employer branding and recruitment activities, including recruitment activities for Xoople group companies where applicable, through its Career Site (the “Career Site”) and the associated applicant tracking system, which are powered and hosted by Teamtailor’s recruitment platform. In this privacy policy, we explain how we process your personal data if:
1. You visit the Career Site (you being a “Visitor”)
2. You connect with us via the Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)
3. You apply for a position with us, via the Career Site or a third party service (you being an “Applying Candidate”)
4. We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
5. We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)
6. We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).
This privacy policy also describes what rights you have when we process your personal data, and how you can exercise these rights.
When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates, Applying Candidates, Sourced Candidates and Referred Candidates, unless it’s stated otherwise.
1. About processing of personal data
Personal data means any information relating to an identified or identifiable natural person. Examples of personal data are: name, e-mail address, telephone number and IP address. Processing of personal data is any automated use of personal data - such as collecting, creating, analyzing, sharing, and deleting personal data.
There are laws and regulations on how companies may process personal data, so-called data protection laws. Different data protection laws apply to different types of use of personal data, and in different parts of the world. An example of a data protection law that is relevant for our use of your personal data, as described in this privacy policy, is the EU Data Protection Regulation (2016/679, “GDPR”) and Spanish Organic Law 3/2018 on Personal Data Protection and guarantee of digital rights.
Most obligations under the GDPR apply to the so-called data controller. A data controller is the entity that decides for which purposes personal data will be processed, and how the processing will be executed. The data controller can use a so-called data processor. A data processor is an entity that is only allowed to process personal data as instructed by the data controller, and may not use the personal data for its own purposes.
The data controller responsible for processing your personal data as described in this Privacy Policy is Xoople, S.L. Where you apply for a position with another Xoople group company, or where another Xoople group company is involved in the relevant recruitment process, that group company may also act as an independent controller in respect of the processing activities relating to that recruitment process. You can contact us at dataprotection@xoople.com or at Avenida de los Encuartes 19, 28760 Tres Cantos, Madrid, Spain. You may contact Xoople’s Data Protection Officer at dataprotection@xoople.com.
2. What personal data do we process?
All individuals
Device information - If you visit the Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
Technical and statistical data - If you visit the Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
Contact details - Such as your name, email address, telephone number and physical address.
Candidates
Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements, job preferences and information generated during the recruitment process.
Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
Information in your public profile - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer. We will only use information from public sources where it is relevant to your professional profile and to the recruitment process.
Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.
We do not require the submission of special categories of personal data, such as health information, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or information about your sexual orientation, unless we specifically request this and inform you of the applicable legal basis.
We do not seek to collect information that is not relevant to the recruitment process. If you voluntarily provide information that is not necessary for the recruitment process, we may delete it or disregard it.
3. Where do we receive your personal data from?
All individuals
From the Career Site. If you visit the Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us.
References
From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.
Candidates
From public sources. · We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer, provided that the information is relevant to your professional profile and the recruitment process.
From referrals or recruitment partners. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
From your references. · If you provide us with references, we may collect information about you from them.
Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.
If we obtain your personal data from sources other than you, including public professional sources or referrals, we will provide you with the required privacy information within a reasonable period and, in any event, within the applicable legal timeframe, unless an exemption applies.
4. For what purposes do we process your personal data?
In each case, we will only process the categories of personal data that are necessary and relevant for the specific purpose.
Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims.
Affected individuals: The individual(s) affected by the legal issue - this may include persons from all categories of individuals listed above.
Categories of personal data used: All the categories of personal data listed above can be used for this purpose.
Share your personal data with other recipients, for the purposes mentioned in Section 5 below.
Affected individuals: Varies depending on the purpose of the sharing, see Section 5 below.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect information about your use of the Career Site, using cookies and other tracking technologies, as described in the Cookie Policy.
Affected individuals: Visitors.
Categories of personal data used: Device information and technical and statistical data, as applicable.
Maintain, develop, test, and otherwise ensure the security of the Career Site.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Analyse how the Career Site and its content is being used and is performing, to get statistics and to improve operational performance.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Keep you connected with Xoople and send you updates about current or future job opportunities.
Affected individuals: Connecting Candidates.
Categories of personal data used: Contact details; Communications data; information in your candidate profile.
Review profiles and applications sent to us. This also includes communicating with you about your application and profile.
Affected individuals: Connecting Candidates; Applying Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile.
Affected individuals: Sourced Candidates; Referred Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose. This processing will be limited to information relevant to your professional profile and potential recruitment opportunities.
Contact you directly about specific, future vacancies with us.
Affected individuals: Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose. We will only contact you about future job opportunities where we have a valid legal basis to do so, such as your permission or consent where required.
Record interviews or generate interview transcripts or summaries.
Affected individuals: Candidates.
Categories of personal data used: Communications data. We will only do this where you have been specifically informed in advance and where we have an appropriate legal basis. Xoople will not use recording, transcription, meeting insight or AI-based recruitment features unless you have been specifically informed in advance and the applicable legal requirements are met.
Contact you to ask for your participation in surveys.
Affected individuals: Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose. Participation in surveys will be voluntary unless otherwise stated.
Contact you to ask you to provide information about a Candidate, and evaluate the information you provide.
Affected individuals: References.
Categories of personal data used: Contact details; Communications data.
Manage data protection requests submitted through the Career Site or recruitment platform.
Affected individuals: All individuals.
Categories of personal data used: Contact details; Communications data; information relevant to the request.
5. Whom do we share your personal data with?
Our service providers. We share your personal data with our suppliers who provide services and functionality in our employer branding- and recruitment process. For example, this includes recruitment service providers and the supplier of the Career Site and related applicant tracking system. Where these suppliers process personal data on our behalf, they act as data processors and process your data under our instructions and subject to appropriate data processing arrangements.
Our group companies. We share your personal data with our group companies where they are involved in the relevant recruitment process, where you have asked or agreed to be considered for opportunities within the Xoople group, when they provide us services and functionality to our employer branding- and recruitment process, such as access to particular systems and software, or where this is necessary for recruitment administration, internal support or group-level recruitment management purposes.
Companies providing cookies on the Career Site. If you consent to it, some cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in the Cookie Policy.
To authorities and other public actors - when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.
To parties involved in legal proceedings. If needed to protect or defend our rights, we may share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.
Mergers and acquisitions etc. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data to other parties involved in the process.
6. On what legal bases do we process your personal data?
To be able to process your personal data, we need to have a so-called legal basis. A legal basis is a reason for processing the personal data that is justified under the GDPR.
When we process your personal data for the purposes described in this Privacy Policy, we rely on the following legal bases, depending on the relevant processing activity:
Pre-contractual measures requested by you. We rely on this legal basis when we process your personal data to manage and assess your application for a specific role, communicate with you about that application and take steps prior to entering into an employment contract.
Your consent or permission. We rely on this legal basis where you connect with us, agree to be considered for future job opportunities, give us permission to keep your information in our talent pool, extend that permission, or where we carry out specific activities that require consent, such as interview recording, transcription or similar features, where applicable. You may withdraw your consent or permission at any time.
Our legitimate interests. We rely on this legal basis where we process personal data to manage, document and improve our recruitment processes, assess and document candidate suitability, consider professional profiles for relevant opportunities, protect and enforce our rights, defend against potential claims, ensure the security of the Career Site, or use strictly necessary technical information. We have assessed that these interests are not overridden by your rights and freedoms. You may contact us for more information about this assessment.
Compliance with legal obligations. We rely on this legal basis where we are required to process or retain information under applicable law or to respond to lawful requests from authorities.
We do not rely on consent as the legal basis for processing personal data that is necessary to manage a specific job application. In those cases, the legal basis is normally the implementation of pre-contractual measures requested by you and, where applicable, our legitimate interest in managing and documenting the recruitment process and addressing potential liabilities.
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, unless you have been specifically informed and the applicable legal requirements are met.
7. When we transfer your personal data outside of the EU/EEA, how do we protect it?
We always strive to process your personal data within the EU/EEA area.
However, some of our service providers may process your personal data outside of the EU/EEA. We also use suppliers whose parent company, or whose subcontractor’s parent company, is based outside the EU/EEA. In these cases, we have taken into account the risk that the personal data may be disclosed to countries outside the EU/EEA, for example because of an authority request.
Depending on the position for which you apply and the international nature of Xoople’s business, this may include other Xoople group companies involved in the relevant recruitment process and may also be processed through Xoople’s group-wide systems and service providers used to support recruitment, HR and business operations. Where such processing involves recipients located outside the EU/EEA, appropriate safeguards are implemented in accordance with applicable data protection laws.
In cases where another recipient of your personal data (as described in Section 5 above) is based outside the EU/EEA, this will also mean that your personal data is transferred outside the EU/EEA.
When we, or one of our suppliers, transfer your personal data outside the EU/EEA, we will ensure that a safeguard recognized by the GDPR is used to enable the transfer. We use the following safeguards:
A decision by the EU Commission that the country outside of the EU/EEA to which your personal data is transferred has an adequate level of protection, which corresponds to the level of protection afforded by the GDPR. Depending on the recipient, we rely on the EU Commission’s adequacy decision for the US via the so-called EU-US Data Privacy Framework, and the adequacy decision for the UK.
Entering into the EU Commission’s standard clauses with the recipient of the personal data outside the EU/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the GDPR still applies, and that your rights are still protected.
When your personal data is transferred outside the EU/EEA, we also implement appropriate technical and organizational safeguards, to protect the personal data in case of a disclosure. Exactly which protective measures we implement depends on what is technically feasible, and sufficiently effective, for the particular transfer.
If you want more information about the cases in which your personal data is transferred outside the EU/EEA you can contact us using the contact details in Section 9 and 10 below. Where applicable, you may request information about the relevant transfer safeguards by contacting us at dataprotection@xoople.com.
8. For how long do we keep your personal data?
All individuals
If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.
Visitors
We keep your personal data for one (1) year for security purposes. The retention periods for cookies are set out in our Cookie Policy. We keep your personal data to analyse the performance of the Career Site for as long as we keep personal data about you for other purposes. Where analytics cookies or similar technologies require consent, the applicable retention periods and controls will be described in the Cookie Policy.
Candidates
If you are a Connecting Candidate, we keep your personal data for as long as you remain connected with us and, in any event, for no longer than 12 months from your permission or last renewal, unless you renew your permission or withdraw it earlier.
For other types of Candidates, we keep your personal data for as long as necessary to assess whether you are a suitable candidate for the relevant vacancy or recruitment opportunity. If you do not succeed in the recruitment process, we will generally retain the relevant recruitment information for up to 12 months after the end of the process, unless we need to retain limited information for a longer period to establish, exercise or defend legal claims.
If you give us permission to retain your candidate profile and contact you about future job opportunities, we keep the relevant information in our talent pool for up to 12 months, unless you withdraw your permission earlier or renew it. If you do not give or renew your permission for future job opportunities, we will not continue to use your candidate profile for that purpose, unless another valid recruitment purpose or legal basis applies.
If you are a Sourced Candidate or Referred Candidate and you do not give us permission to keep your information, your information will be removed shortly, unless we are required or permitted to retain limited information for legal purposes.
If you are hired, we will keep your personal data during your employment for other purposes, which you will be informed of separately. Information that is necessary for the employment relationship may be transferred to Xoople’s HR or personnel systems and processed in accordance with the applicable employee privacy information. Recruitment data that is not necessary for the employment relationship will be deleted or retained only where required for legal or evidentiary purposes.
References
We keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference, unless we need to delete it earlier or retain limited information for legal purposes.
9. What rights do you have, and how can you exercise them?
In this section, you will find information about the rights you have when we process your personal data. As described below, some of the rights only come into play when we process your personal data under a particular legal basis.
If you want to exercise any of the rights listed here, we suggest that you:
Visit the Data & Privacy page on the Career Site, where we offer features to let you exercise your rights;
Log in to your account with us, where you can use the settings in the account to exercise your rights; or
Contact us directly at dataprotection@xoople.com.
We may request additional information where necessary to verify your identity.
Right to be informed
You have the right to be informed about how we process your personal data. You also have the right to be informed if we plan to process your personal data for any purpose other than that for which it was originally collected.
We provide you with such information through this privacy policy, through updates on the Career Site (see also Section 11 below), and by answering any questions you may have for us.
Right to access your personal data.
You have the right to know if we process personal data about you, and to receive a copy of the data we process about you. In connection with receiving the copy of your data, you will also receive information about how we process your personal data.
Right to access and to request a transfer of your personal data to another recipient (“data portability”).
You can request a copy of the personal data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.
Right to have your personal data deleted (“right to be forgotten”).
In some cases, you have the right to have us delete personal data about you. This is for example the case if it’s no longer necessary for us to process the data for the purpose for which we collected it; if you withdraw your consent; if you have objected to the processing and there are no legitimate, overriding justifications for the processing. (For the separate right to object, see below.)
Right to object against our processing of your personal data.
You have the right to object to processing of your personal data which is based on our legitimate interest, by referencing your personal circumstances.
Right to restrict processing.
If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we don’t need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. If you object to our processing, as described just above, you can also request us to restrict processing of that personal data while we make our assessment of your request.
When our processing of your personal data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.
Right to rectification.
You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.
Right to withdraw your consent.
When we process your personal data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop processing your data for the purposes you’ve withdrawn your consent for. However, it doesn’t affect the lawfulness of processing that was based on your consent before it was withdrawn.
Right not to be subject to decisions based solely on automated processing.
You have the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects concerning you or similarly significantly affects you, except where permitted by applicable law and subject to appropriate safeguards.
Right to raise a complaint.
If you have complaints about our processing of your personal data, you can raise a complaint with the data protection authority in Spain, the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD), at www.aepd.es.
You can also lodge a complaint with your national data protection authority, if applicable, which you can find listed here if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here.
10. Where can you turn with comments or questions?
If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to dataprotection@xoople.com.
11. Updates to this Privacy policy
We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.
We encourage you to regularly check this page for any changes. You can always check the top of this page to see when this privacy policy was last updated.