Overview
This text outlines how PitchYou ensures GDPR compliance in the application process—particularly when using WhatsApp as a communication channel.
Applicant Control
Applicants retain full control over their data:
They initiate the conversation themselves.
They can terminate the conversation at any time, which leads to the automatic deletion of their data.
Data Processing in the Recruitment Process
PitchYou processes applicant data in two ways:
Transfer of data into the company’s existing applicant tracking system.
Display of data within PitchYou’s secure, password-protected web application.
Data is deleted automatically based on predefined rules or upon withdrawal of consent.
Technical Implementation & Data Protection
PitchYou acts as a data processor (Auftragsverarbeiter).
All servers used are located in Germany.
External services such as the WhatsApp Business API are integrated in full compliance with GDPR.
The integration ensures maximum data minimization to protect sensitive applicant data.
1. Application Process
Privacy-Compliant Applications via WhatsApp
PitchYou allows candidates to apply easily through WhatsApp Messenger.
Entry via Apply button or job QR code in job ads.
WhatsApp opens automatically when the interview starts on the applicant’s phone.
The conversation is always initiated by the applicant.
Full Control & Data Deletion by the Applicant
Applicants retain full control at all times.
Sending /stop ends the chat and triggers automatic deletion of all collected data.
If inactive for 24 hours, the interview is considered ended → data is deleted.
Privacy Info & Consent
Before the chat begins, applicants are informed via a webpage:
about your privacy policy and legal notice,
and must provide explicit consent (opt-in).
Existing documents from your career page are reused—no extra texts needed.
2. Recruiting Process
Two Processing Options
Transfer to your existing ATS, or
Use the PitchYou web application:
Browser-based (no installation)
Encrypted via HTTPS
Password-protected access
Optional Matching Index
Prequalification via custom matching index (0–100 %)
No profiling or automated decision-making
The recruiter makes all final decisions.
Deletion Timelines
After transfer to your system: Immediate deletion at PitchYou.
Using PitchYou app: 6-month deletion period begins after recruiter deletes record.
3. Data Processing Agreement & External Providers
WhatsApp Handled Entirely by PitchYou
Your staff don’t use WhatsApp themselves.
PitchYou handles messaging as a data service provider.
A GDPR-compliant data processing agreement (DPA) is in place.
WhatsApp Business API
All communication runs via the official WhatsApp Business API.
Contracts with 360dialog GmbH (Berlin), a certified provider.
Messages & files are deleted after processing.
No address book access – no contact data can be shared.
4. Infrastructure & Data Security
Servers & Development in Germany
Hosting via Hetzner AG (Germany)
PitchYou developed entirely in Germany.
Employees with access to personal data are bound by written confidentiality.
End-to-End Encryption
Chat content is end-to-end encrypted.
Only metadata (e.g. that a chat occurred) is shared with WhatsApp.
Applicants accept this by agreeing to WhatsApp’s terms.
US Data Transfers
Metadata handling complies with the EU–US Data Privacy Framework.
Users are explicitly informed about potential risks during the consent process.
5. Additional Third-Party Services
Google Maps API
Used to calculate distance from applicant to job location
Only postal code is submitted – no personal data involved.
DeepL API
Translations via DeepL (Germany)
Only individual text strings are submitted – no user or conversation context.
No data is stored after processing.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article