Skip to content

Privacy Notice

What we collect, why we collect it, and how to ask us to delete it.

Last updated: September 2026.

1. Purpose and scope

Welcome to the services offered by Vesoma Ltd (we, us, our, Vesoma), a company registered in Cyprus, and its affiliated group company, Vesoma GmbH in Germany. Your privacy is important to us. We are committed to protecting your privacy. In this Privacy Notice, we set out how we collect your personal data, how we use it, and what rights and choices you have in relation to the personal data we hold and process.

This Privacy Notice should be read alongside our website Terms of Use. This Privacy Notice applies when you: (a) apply for a position with us or ask to join our talent pool; (b) send us an enquiry; (c) subscribe to our newsletter; or (d) browse the website.

You can contact us about this Notice or your rights using the details in section 14.

2. Who decides why and how we process your data

Vesoma is the controller for all processing described in this Notice, including the website, contact enquiries, newsletter subscriptions and recruitment. Vesoma GmbH processes Personal Data for applications for positions in Germany on behalf of Vesoma and under its instructions.

3. What personal data we collect

Personal Data refers to any information relating to an identified or identifiable natural person. It does not include data that has been anonymised so that you can no longer be identified from it.

We collect different types of Personal Data for different reasons. This may include:

  • Identity - your first and last name.
  • Contact - your email address and telephone number (where provided).
  • Application - application documents such as your CV, cover letter, references, and any additional information you voluntarily submit, such as your date of birth and address.
  • Professional - information relating to your availability, salary expectations, and professional background.
  • Enquiry - the content of the message you send us through our contact form, the topic you select, and the name of your organisation if you give it.
  • Newsletter Subscription - your email address, and a record of your having requested and then confirmed your newsletter subscription. We keep that record as our evidence that you consented.
  • Technical - your IP address, browser type, operating system, and other technical information relating to your use of our website.
  • Usage - the date and time of access and the pages you request or view on our website.

We use Technical and Usage Data for website operation, security and troubleshooting, including investigating incidents where necessary. We do not use it for advertising or behavioural tracking. Our retention criteria are set out in section 9.

4. When and how we process your data

We process Personal Data only to the extent necessary for the purposes described in this Notice (Permitted Purposes), in accordance with applicable data protection law.

If we need to process your Personal Data for a purpose other than the one it was collected for, we will tell you before we do so, explain why, and - where the law requires it - ask for your consent.

5. Legal grounds for processing

The legal basis depends on the purpose of processing, as explained below. Where we rely on legitimate interests, we balance those interests against your rights and freedoms.

Employment applications

We use Identity, Contact, Application and Professional Data to assess your application and take steps at your request before entering an employment contract (Article 6(b) GDPR). Retaining necessary application records to establish, exercise or defend legal claims is based on our legitimate interest in protecting our legal position (Article 6(1)(f) GDPR).

Talent pool

We use Identity, Contact, Application and Professional Data to consider you for future vacancies only with your separate consent (Article 6(1)(a) GDPR). You may withdraw consent at any time without affecting your current application.

Enquiries and business contacts

We use Identity, Contact and Enquiry Data to respond to you and manage business communications. This serves our legitimate interest in responding to requests and maintaining business relationships (Article 6(1)(f) GDPR). Where you personally request steps towards a contract with us, or processing is necessary to perform your contract, Article 6(1)(b) GDPR applies. A contract with your organisation does not by itself make Article 6(1)(b) applicable to your personal data.

Newsletter

We use Contact and Newsletter Subscription Data to send newsletters after you confirm your subscription, based on consent (Article 6(1)(a) GDPR). Withdraw consent using the unsubscribe link or [email protected]. We retain necessary consent records to meet our accountability obligations (Article 6(1)(c), read with Articles 5(2) and 7(1) GDPR) and, where necessary, to defend legal claims (Article 6(1)(f) GDPR). Any minimal unsubscribe record is used only to respect your opt-out, on the basis of our legitimate interest in preventing unwanted communications.

Website operation and security

We use Technical and Usage Data to operate the website, troubleshoot faults and detect and respond to security incidents. This serves our legitimate interest in providing a reliable and secure website (Article 6(1)(f) GDPR).

Legal obligations

We process the data necessary to comply with applicable legal duties, including responding to valid requests from competent authorities and administering data protection rights (Article 6(1)(c) GDPR). The data involved depends on the obligation and may include any relevant category listed in section 3.

Providing your data

You choose whether to apply, enquire or subscribe. Information identified as required in the relevant form is needed to handle that request; without it, we may be unable to consider your application, answer you or send the newsletter. Optional information is voluntary. Technical information is processed when your browser accesses the website.

6. How we share your data

We limit the access to Personal Data to those who require such access to perform their tasks and duties, and to third parties who have a legitimate purpose for accessing it. Only authorised employees involved in the recruitment process have access to your Personal Data. Whenever we permit a third party to access Personal Data, we will implement appropriate measures, retain control over and will use appropriate safeguards as required by the applicable laws to ensure the integrity and security of your Personal Data when engaging such service providers.

Transferring to other group companies

Vesoma GmbH processes Personal Data on our behalf and under our instructions to support recruitment in Germany and, where applicable, website operations and communications:

Vesoma GmbH
Zeppelinstraße 22D
85748
Garching bei München, Germany
Commercial Register (HRB): 306532
Registration Court: Amtsgericht München.

Transferring to third party service providers

We use external providers for recruitment software, website hosting and newsletter delivery. Providers acting as processors process Personal Data on our behalf and under our instructions. These include:

Personio SE & Co. KG (Personio), Seidlstraße 3, 80335 Munich, Germany - applicant management software for our recruitment platform.

Vercel Inc., United States - hosting and delivery of our website.

Sendinblue SAS, trading as Brevo, 17 rue Salneuve, 75017 Paris, France - sending our newsletter and managing subscriptions and unsubscribes.

Transfers outside the European Economic Area

Some of our service providers process Personal Data outside the European Economic Area. Where they do, we rely on an adequacy decision of the European Commission - including, in the case of transfers to the United States, the Commission's adequacy decision for organisations certified under the EU-U.S. Data Privacy Framework - or, where none applies, on the European Commission’s standard contractual clauses together with any additional measures identified as necessary by a transfer impact assessment. You can ask us for a copy of the safeguards we rely on by writing to [email protected].

We will otherwise transfer your Personal Data to third parties or disclose your Personal Data on other lawful grounds, when:

  • Where necessary to comply with legal or tax obligations, a court order, or an administrative or judicial process;
  • In response to lawful requests by public authorities (including for national security or law enforcement purposes);
  • As necessary to establish, exercise or defend against potential, threatened or actual litigation;
  • Where necessary to protect the vital interests of another person;
  • In connection with the sale, assignment or other transfer of all or part of our services if we are acquired by a third party or where we may seek to acquire other businesses or merge with them;
  • You direct us or give us permission or separate consent to do so.

7. Third-party links

The Vesoma website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of the website you visit.

Recruitment forms and related content are provided through Personio on our behalf, whether displayed within our careers page or accessed through a link. This Notice and any additional recruitment privacy information shown with the form explain how application data is processed.

8. How we keep your data safe

In order to protect the security of your Personal Data, we will use security measures that comply with the relevant standards under the laws and the current level of technology to prevent any unauthorised access, leakage, tampering or loss. The Personal Data transmitted as part of your application will be transferred using TLS encryption and stored in a secured database.

9. How long we keep your data

We delete your Personal Data once it is no longer reasonably necessary for us to keep it for the Permitted Purposes or, where we have relied on your consent to keep your Personal Data, once you withdraw your consent for us to do so, and we are not otherwise legally permitted or required to keep the Personal Data.

Applications. Following an unsuccessful application process, we retain necessary application data for up to 180 days after the process concludes to establish, exercise or defend legal claims. If a specific claim or legal obligation requires longer retention, we keep only the relevant records for as long as necessary for that matter. If you are hired, records needed for employment are transferred to your personnel file and covered by the employee privacy notice. The separate talent pool period below applies where you consent.

With your separate consent, we may retain your Personal Data for up to 365 days after the conclusion of the application process and include your profile in our Talent Pool so that we may contact you regarding other suitable vacancies. Participation in the Talent Pool is voluntary and has no effect on your current application. You may withdraw your consent at any time with effect for the future by contacting [email protected].

Newsletter. We keep your email address while you are subscribed. On unsubscribe, we promptly stop newsletter sending and remove your address from the active mailing list. We retain the subscription and confirmation record for a further two years to demonstrate consent, subject to longer retention where necessary for a specific legal claim or obligation. A minimal suppression record may be retained for as long as necessary to respect your unsubscribe request; it is not used to send marketing.

Enquiries. We retain your enquiry and related correspondence for twelve months after our last exchange, unless records are needed for an ongoing matter, to perform a contract, to meet an applicable legal retention duty or to establish, exercise or defend a legal claim. In those cases, we retain only the relevant records for as long as necessary.

Technical and Usage Data. We retain routine logs only for the period necessary to operate the website, troubleshoot faults and detect and investigate security incidents. Relevant extracts may be retained longer for an ongoing incident or legal claim, and are deleted when no longer needed.

At the end of the applicable retention period, we delete the data or irreversibly anonymise it so that individuals are no longer identifiable by means reasonably likely to be used. Removing names alone is not anonymisation. We may retain genuinely anonymous aggregate statistics, such as application numbers.

10. What rights do you have

Subject to certain circumstances under the applicable legislation, you have the right to:

  • Request a copy of the Personal Data which we hold about you or in certain cases request us to transfer the data we hold about you to another provider;
  • Have any inaccurate data we hold about you corrected;
  • Object or restrict our use of your Personal Data, including but not limited to object to our use of automated decision making in certain cases;
  • Submit a complaint if you have concerns about the way in which we are handling your data;
  • Request that we delete the Personal Data we hold on you;
  • Where we have relied on consent to process your Personal Data, to withdraw your consent;
  • Request that we transfer your data to another provider.

To do any of the above, please contact us using the contact information in the "Get in touch" section of this Privacy Notice. To enable us to process your request, we may require that you provide us with proof of your identity, such as by providing us with a copy of a valid form of identification. This is to protect the Personal Data we hold from unauthorised access requests and comply with our security obligations. We will respond to your request within mandatory period according to applicable laws and regulations.

We may charge you a reasonable administrative fee for any unreasonable or excessive requests we may receive, and for any additional copies of the Personal Data you may request.

11. Corrections, updates and complaints

Where any Personal Data you have provided us with has changed, or where you believe the Personal Data we hold is inaccurate, or where you wish to make a complaint regarding our handling of your Personal Data, please contact us (you can find our contact information in the "Get in touch" section of this Privacy Notice).

You may complain directly to the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy), or to the supervisory authority in the EU or EEA country where you habitually reside, work or consider that an infringement occurred. You do not have to contact us first.

12. Changes to this Privacy Notice

We have the right to update the contents of this Privacy Notice from time to time to reflect any changes in the way in which we process your Personal Data or to reflect legal requirements as these may change.

13. Cookies

Our website uses cookies solely to remember your language preference, embedded on the recruitment platform operated by Personio on our behalf. This allows us to display content in your chosen language and improve your browsing experience.

The only cookie we process is strictly necessary for this functionality and does not track your activity or collect personal data. No cookies are used for analytics, marketing, or tracking purposes.

A cookie is a small file of letters and numbers that is stored on your browser or the hard drive of your device (such as a computer, tablet, or mobile phone) when you visit our website.

14. Get in touch

We would be happy to hear your views about this Privacy Notice and our services. Please share any questions, comments, suggestions or clarifications you may have to our Privacy Team at [email protected] or send us a letter addressed at:

Vesoma Ltd
Alexandreias 6, Bridgetower II, 2nd Floor
3013 Limassol, Cyprus