This document, PitchYou’s Privacy Policy, explains the principles of data processing and the protection of personal data in accordance with the European General Data Protection Regulation (GDPR) and national laws. It defines “personal data” as identifiable information and “processing” as any handling thereof.
The purpose of this policy is to inform users about the type, scope, purpose, and legal basis of data collection when using PitchYou’s website and services, and to outline their rights as data subjects—such as the right to access, rectification, erasure, and objection to data processing.
Furthermore, the policy details the use of cookies, the use of third-party tools (including those based in the U.S. with reference to potential data protection risks), as well as contact information for the data protection officer.
What is the text displayed on the disclaimer page shown before the interview by PitchYou?
“We process your personal data electronically for the purpose of handling your application. Our and apply.
I consent to the use of WhatsApp for submitting my application and for the execution of the application process.
I am aware that I can revoke my consent at any time without formal requirements. .
The provider identification can be found in our .”
<Terms of Use> links to: https://www.pitchyou.de/nutzungsbedingungen
<More Information> links to: https://www.pitchyou.de/datenschutz-whatsapp
<Privacy Policy> links to the client’s privacy policy
<Legal Notice> links to the client’s legal notice (Impressum)
Is there a suggested text for updating our privacy policy?
Our non-binding suggestion for extending your privacy policy is as follows:
“If you use our ‘Apply via WhatsApp’ feature, the legal basis for the communication is your consent, which can be revoked at any time (Art. 6 para. 1 a GDPR). The ‘Apply via WhatsApp’ feature is provided by an IT service provider (PitchYou), which may access your data as a data processor. Further information can be found here: https://www.pitchyou.de/datenschutz.
WhatsApp’s privacy policy, including details about their processing practices and how to exercise your rights under data protection law, can be found here: https://www.whatsapp.com/legal/privacy-policy-eea.”
Is there a process description we can include in our record of processing activities?
Process Overview:
The processor provides a SaaS solution for collecting application data via messaging services, particularly WhatsApp, and either
transfers applicant profiles into the client’s applicant management system, or
displays the applicant profiles in a web application.
Process Steps:
Job Posting:
The client publishes job postings online via career portals, their own career page, on social media, or offline. With PitchYou, job postings can be enhanced with a button or link (online) or a QR code (offline) to initiate a WhatsApp application.
Disclaimer Page:
When scanning the QR code or clicking the link, applicants are redirected to a web page under the domain http://your-company.pitchyou.de. There they receive information about the WhatsApp application process and can provide opt-in consent to continue the application via WhatsApp.
WhatsApp Launch:
Only after giving consent is the applicant’s WhatsApp application launched on their smartphone, initiating communication with the client’s WhatsApp channel. This channel is accessed via the WhatsApp Business API through PitchYou.
Interview:
PitchYou starts a chatbot via this channel that conducts a predefined interview. The chatbot sends questions via WhatsApp messages, which the applicant answers in turn.
Interview Completion:
After the final question is answered, PitchYou creates an applicant profile in its database, which either:
5.1 is automatically transferred into the client’s applicant management system, or
5.2 can be viewed via a login-protected web application hosted under http://your-company.pitchyou.de.
Is there a data deletion policy?
Yes. The deletion policy is part of the “Record of Processing Activities” document. See next item.
What data is stored? Where is the data stored? How long is the data stored?
All information regarding the location, duration, and scope of data storage can be found in this document:
https://datenschutz.pitchyou.de/datasec/py-datasec.pdf
Are data processed in the USA?
No. Personal data is only processed within the EU. PitchYou stores data in data centers operated by Hetzner AG within the EU. Access to the WhatsApp Business Cloud API is provided via 360Dialog GmbH, which also operates within the EU.
How is it ensured that Facebook/Meta cannot access the data?
The content of communication (texts, voice messages, files) is end-to-end encrypted. One end is on the applicant’s smartphone, and the other end is the WhatsApp Business Cloud API. According to Meta, they have no access to this data.
See also: Data Privacy & Security – WhatsApp Cloud API – Documentation – Meta for Developers
Communication metadata (e.g., phone numbers involved) may be visible to Facebook/Meta but is processed only within the EU (via WhatsApp Ireland) and, according to Meta, is not shared within the corporate group.
Who is the data controller?
The client company is the controller. PitchYou is a data processor. Hetzner and 360Dialog are subprocessors.
Where can we find the TOMs (Technical and Organizational Measures)?
The TOMs are listed in the appendix of the data processing agreement (DPA) at: https://www.pitchyou.de/avv
Does PitchYou have ISO27001 certification?
No, but we use a data center provider that is ISO27001 certified.
Do we need our own WhatsApp Business Account? What are the implications for data privacy?
The WhatsApp Business Account (WABA) requirement is not a data protection issue but a Meta policy.
No company may impersonate another. The phone number and company profile displayed in the WhatsApp chat must match the company offering the job.
The solution: Register your own WABA, link and verify your phone number, and manage your company profile.
A WABA is set up within your existing Facebook Business Account, which most companies already use for campaigns or business pages.
You will receive detailed onboarding instructions and support for registering and linking your WABA with PitchYou.
There are no costs for registration or usage of the WABA.
Cookies
We do not use cookies. Therefore, no cookie banner or cookie policy text is required.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article