The AI Screening Assistant helps companies review job applications more efficiently and objectively. At the same time, it meets rigorous standards for data protection, transparency, and compliance, and adheres to the requirements of the EU AI Act. The following points provide a structured summary of all legally relevant information.
1. Activation & Responsibilities
The use of the AI Screening Assistant is optional and is managed by administrators.
The feature is disabled by default and must be explicitly activated.
Companies are required to inform applicants in advance that their data may be processed by AI.
Upon activation, a corresponding notice is automatically added to the privacy policy.
Companies decide for themselves whether the AI Screening Assistant should evaluate only new applications or existing ones as well.
2. Data Protection & GDPR Compliance
The AI Screening Assistant strictly adheres to the principle of data minimization.
The following data are neither processed nor transmitted:
Name
Email address
Phone number
Address
Date of birth
Gender
Nationality
Disability status
Photograph
Academic titles
Only the following data are processed:
Professional experience
Education
Languages
Skills
Driver’s licenses
Profile summary
Responses from the pre-screening process
Additional data protection considerations:
Raw documents (e.g., PDF resumes) are never transmitted to the LLM.
Re-identification can never be technically ruled out entirely, particularly in the case of free-text fields.
Recommendation: Applicants should avoid including any identifying information in free-text fields.
3. EU AI Act & Legal Classification
In principle, AI used in recruitment is classified as high-risk AI.
However, the AI Screening Assistant falls under the exceptions, as it performs only a narrowly defined, preparatory task.
Human oversight is guaranteed at all times:
no automated decision-making
no automated rejections
no automated status changes
Protected characteristics (age, gender, ethnicity, disability) are entirely excluded.
Audit trail & explainability: Every assessment is substantiated and linked back to specific passages within the profile.
4. LLM Security & Data Governance
Use of an OpenAI model, hosted on Microsoft Azure servers within the EU.
Data is neither stored nor used for training purposes.
Contractual agreements prohibit the use of input or output data for training.
All LLM calls are executed server-side.
API keys are never exposed to the frontend.
5. Responsibility for Selection Criteria
The AI Screening Assistant checks criteria for bias, clarity, and legal compliance.
If impermissible criteria (e.g., nationality, age) are used, a warning is issued.
The ultimate responsibility for ensuring that criteria are legally permissible lies with the company or the users.
6. Auditing, Logging & Compliance
All AI-based assessments are fully documented.
The following data is stored:
Version
Hash
Model
Prompt
Timestamp
Result
Justification
Additional compliance features:
LangFuse observability for LLM tracing
DSAR export: Data Subject Access Requests include complete AI assessment data as well as any manual overrides
Overrides are documented with the user's name, the action taken, and the justification
Audit trail is retained for 6 months
Template for Privacy Policy
AI-Assisted Application Screening
Once you have submitted your application to us, it may be evaluated with the aid of AI. In this process, structured information from your application profile is automatically compared against the criteria we have defined for the specific position. For each criterion, the system provides an assessment indicating whether there is a full match, a partial match, no match, or whether a match cannot be determined due to a lack of data.
The system processes only structured, technically predefined fields from your application profile. This includes, in particular, information regarding professional experience (company, position, industry, career level, time periods, and any descriptions provided), education, language skills, abilities, driver’s license categories, any profile summary you may have included, and your responses to pre-screening questions asked during the application process. Specifically, direct identifiers—such as your name, contact details (email address, phone number, address), date of birth, gender, nationality, information regarding any disability, and your photograph—are not transmitted to the system.
The data transmitted to the AI model is technically processed in such a way that, as a general rule, it is not possible to identify you personally. However, in exceptional cases, identification cannot be entirely ruled out—particularly if free-text fields (e.g., descriptions of professional experience or responses to pre-screening questions) contain information that allows for direct or indirect identification, or if the submitted information, due to its combination or unique nature, could effectively be attributed to only one specific individual (e.g., a highly specific professional biography). We therefore recommend that you refrain from including direct identifying information in your free-text entries.
The analysis performed by the AI system serves solely to assist our users in reviewing incoming applications. All hiring decisions are made exclusively by humans. The system does not make automated decisions as defined by Article 22 of the GDPR; specifically, it neither automatically rejects nor automatically forwards applications. Our recruiters can view, question, and manually override the system’s assessments at any time.
The legal basis for processing your personal application data as part of this AI-supported screening process is our legitimate interest in maintaining an efficient and structured recruitment process, in accordance with Article 6(1)(f) of the GDPR. In this context, we have taken into account that the system serves a purely advisory function, makes no automated decisions, and is limited to analyzing profile fields that are objectively relevant to assessing a candidate's suitability.
The system is operated by our data processor, softgarden e-recruiting GmbH. The processing utilizes a Large Language Model (LLM) provided by OpenAI, which is hosted on servers within the EU via the Microsoft Azure infrastructure. The use of your data for training AI models is contractually prohibited.
Your data is not stored within the AI model itself. Data transmitted to the AI model for evaluation is processed solely for the purpose of the screening process and is deleted immediately thereafter.
Evaluation data generated during the screening process is stored in a separate audit trail. For each application and each evaluation criterion, this audit trail records the AI’s assessment result, the corresponding rationale, and technical metadata; it thereby ensures that the AI-supported evaluation remains transparent and verifiable. The audit trail is stored for a period of six months on a separate system (external to the AI model).
Otherwise, your personal data will be deleted in accordance with the general retention and deletion periods applicable to the application process (see Section 6 of this privacy information).