Privacy Policy

At a glance

1. Controller and data protection officer

Pactos GmbH
Pettenkoferstraße 33, 80336 Munich, Germany
info@pactos.ai
Managing directors: Antonio Zill, Philipp Eckert
Munich Local Court (Amtsgericht München), HRB 284386 · further details in the legal notice (https://www.pactos.ai/en/legal-notice)

Data protection officer
Dr. Kilian Schmidt, Kertos GmbH, Brienner Straße 41, 80333 Munich, Germany
dsb@kertos.io

For any questions about data protection, an informal message to either of the two addresses is sufficient.

2. Visiting our website

2.1 Delivery and security

Our website is delivered via Cloudflare Pages (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA).

Each time you visit, Cloudflare processes the data your browser transmits for technical reasons: IP address, time, page requested, status code, amount of data transferred, referrer as well as browser, language and operating system. This serves to deliver the website and to defend against attacks and misuse.

• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation.
• Retention period: 30 days.
• Third country: USA, see Section 6.

2.2 Consent management

We manage and document your choices in the cookie banner with Cookiebot (Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark). A random identifier and the time and scope of your choice are stored — in a cookie on your device and with the provider.

• Legal basis: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (proof of consent); storage on your device under Section 25(2) no. 2 TDDDG.
• Retention period: 12 months.

2.3 Cookies

We set strictly necessary cookies without consent (Section 25(2) no. 2 TDDDG); this includes the proof of consent described in 2.2.

Without consent to reCAPTCHA, you cannot submit our forms. In that case, you can reach us at info@pactos.ai.

We only set all other cookies and similar technologies (local storage, pixels) with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You will find the complete, continuously updated list with provider, purpose and duration in the cookie settings.

2.4 Analytics and advertising — only with consent

The following services only load once you have given your consent. The legal basis in each case is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future.

Google and Microsoft may transfer data to their parent companies in the USA (Section 6) and process it partly under their own responsibility, for example to improve their services and for advertising. Settings for personalized advertising at Google: https://myadcenter.google.com.

2.5 Our LinkedIn page

On our company page on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland), LinkedIn processes your data under its own responsibility. For the page statistics (“Page Insights”), we are joint controllers with LinkedIn (Art. 26 GDPR); the agreement: https://legal.linkedin.com/pages-joint-controller-addendum.

• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is informing people about our services and engaging with prospects and applicants.
• Your rights are most effectively asserted directly with LinkedIn; we forward any requests sent to us.

3. Contact and business relationship

3.1 Forms, email and CRM

For forms (demo requests, downloads, events, newsletter), contact management and sending emails, we use HubSpot (HubSpot Ireland Ltd., One Dockland Central, Guild Street, Dublin 1, Ireland). The data is stored in the EU.

We process the information you provide — usually your name, business email address, company and, where applicable, phone number and message — to handle your inquiry. The same applies to emails you send us.

• Legal basis: Art. 6(1)(b) GDPR if your inquiry is aimed at a contract; otherwise Art. 6(1)(f) GDPR (handling inquiries).
• Retention period: until your inquiry has been dealt with; if a business relationship arises, in accordance with Section 7.
• Third country: Access from the USA cannot be ruled out, see Section 6.

3.2 Newsletter

We only send the newsletter once you have confirmed your subscription via the link in our confirmation email (double opt-in). We log your subscription and confirmation.

We only analyze whether and when you open the newsletter and which links you click if you have separately agreed to this when subscribing. For this purpose, the emails contain a tracking pixel and personalized links. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw this consent at any time, independently of your newsletter subscription, via the subscription settings at the end of each email or at info@pactos.ai. We delete the analysis data when you unsubscribe or withdraw your consent.

• Legal basis: Art. 6(1)(a) GDPR; logging under Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.
• Retention period: until you unsubscribe; we keep the proof of consent until the statutory limitation periods have expired.
• Unsubscribe: via the link in every issue or informally at info@pactos.ai.

3.3 Business contacts and direct outreach

We process business contact details of contact persons at companies that may become customers or partners: name, position, company, business email address and phone number.

• Source: Information you provide yourself, publicly available sources (company websites, professional networks) and providers of business contact data (e.g. Lusha).
• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is direct marketing to businesses. Where the law requires consent for such outreach (Section 7 UWG), we obtain it.
• Retention period: 24 months after the last contact, unless a business relationship arises.

You can object to this processing at any time without giving reasons (Section 8).

3.4 Appointments, demos and video calls

For demos, trial accounts and onboarding, we process contact details, appointments, information about your company and your requirements as well as the course of the conversation. We hold online meetings via Google Meet or Microsoft Teams.

With your prior consent, we record meetings and have a summary created from them. Without consent, no recording takes place. This also applies to phone calls that are used exclusively for internal training.

• Legal basis (otherwise): Art. 6(1)(b) GDPR.
• Retention period: in accordance with Section 7; if no contract is concluded, 90 days after the last contact.

3.5 Accounts and sign-in

We set up accounts for our products when your company nominates you, or you register yourself. We process your name, business email address, role, permissions and sign-in times. You sign in with a password or with a one-time sign-in link sent to your email address; in doing so, we log technical data to detect misuse.

• Legal basis: Art. 6(1)(b) GDPR if you are a contracting party yourself; otherwise Art. 6(1)(f) GDPR (secure access management).
• Retention period: for as long as the account exists; security logs 180 days.

4. Job applications

We handle job postings and applications via JOIN (JOIN Solutions AG, Eichenstrasse 2, 8808 Pfäffikon SZ, Switzerland). We process your information and documents — usually your name, contact details, CV, references and cover letter. Only the people involved in the selection have access.

• Legal basis: Art. 6(1)(b) GDPR (carrying out the application process). We only process information we did not ask for insofar as it is relevant to the process. We only process special categories of personal data, such as a severe disability, insofar as this is necessary to fulfill obligations under employment and social security law (Art. 9(2)(b) GDPR).
• Retention period: six months after the process has been completed, so that we can defend ourselves against claims under the German General Equal Treatment Act (AGG) (Art. 6(1)(f) GDPR). Longer only with your consent, for example for our talent pool.
• Third country: Switzerland; an adequacy decision of the European Commission exists for Switzerland.

5. Data within our platform

Principle. Our customers use the platform to manage their processes around external workforce. For the data they process there — including data of temporary workers, freelancers and applicants who have never visited our website — the company that uses the platform is the controller: depending on the setup, the customer, a managed service provider or a connected staffing provider. Pactos processes this data as a processor under Art. 28 GDPR.

You will receive information about this processing from that company, usually your employer or client. That is also where you exercise your rights. If your request reaches us, we forward it without delay.

Where we are the controller. Independently of this, we process the following under our own responsibility:

• user accounts and sign-in data (Section 3.5),
• logs for platform security and misuse detection,
• the anonymization of platform data for statistical analysis and the further development of our products; after anonymization, the data can no longer be linked to any person.

The legal basis in each case is Art. 6(1)(f) GDPR; our legitimate interest is secure operation and the improvement of our products.

6. Recipients and third countries

Within Pactos, only the people who need access for the respective purpose receive it. We use service providers as processors with a contract under Art. 28 GDPR — in addition to those named above, for email and office applications, internal communication, document storage and electronic signatures as well as AI-assisted tools for drafting, summarizing and analyzing text. These providers do not use the data to train their models. We only pass on data to other third parties if you have consented, we are legally obliged to do so or it is necessary to enforce or defend legal claims.

We base transfers to the USA on the European Commission’s adequacy decision on the EU-US Data Privacy Framework of July 10, 2023 (Art. 45 GDPR), insofar as the recipient is certified (https://www.dataprivacyframework.gov/list), and otherwise on standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards on request.

7. Retention period

We delete data as soon as the purpose no longer applies. Statutory retention obligations take precedence: six years in particular for commercial and business letters (Section 257 HGB, Section 147 AO) and eight years in particular for accounting records (Section 257 HGB, Section 147 AO). Until the respective retention period has expired, we restrict processing to the purposes required by law.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). An informal message to info@pactos.ai or dsb@kertos.io is sufficient.

Right to lodge a complaint. You can lodge a complaint with any data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Postfach 1349, 91504 Ansbach, https://www.lda.bayern.de.

9. Further information

Provision of data. You are not obliged to provide us with data. Without contact details, however, we cannot answer an inquiry, and without account details, we cannot set up an account.

Automated decisions. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place in the context of this privacy policy.

Security. The website is delivered encrypted (TLS). We protect data with technical and organizational measures under Art. 32 GDPR. Our information security management system is certified to ISO/IEC 27001; we provide the scope and validity of the certificate on request.

10. Changes

We update this privacy policy when our website, our services or the legal situation change. The version published here is authoritative.