Job Applicant Privacy Notice
At ML6, respecting your data protection rights is a top priority. This Privacy Notice explains how we collect, use, and process personal data about you in the context of your job application, as well as your rights regarding this data.
ML6 collects and uses your personal data throughout your job application. This Employee Privacy Notice details how ML6 handles this data. In case of questions or concerns, you can reach out to us via dpo@skyhaus.com.
1. Who is responsible for processing your personal data
This Privacy Notice (“Notice”) applies to the processing of candidate personal data by Skyhaus BV, operating under the trade name ML6, with registered address at Esplanade Oscar Van de Voorde 1, 9000 Ghent, Belgium, and registered under company number 0502.515.626 (“ML6”, “we”, “us”, or “our”). ML6 acts as the data controller for the personal data described in this Notice.
2. Why do we use your personal data?
The types of information we collect and use
We collect and use personal data that concerns you in connection with your job application and the recruitment process at ML6. The application procedure is managed through our recruitment platform available at jobs.ml6.eu.
We may collect the following categories of personal data and other information related to you:
Application data. The information you submit when applying via our recruitment platform Teamtailor (jobs.ml6.eu) or via the "Apply with LinkedIn" integration. This includes your first and last name, email, phone, CV, additional files, cover letter, work permit status, gross yearly salary expectation, potential start date, preferred locations, and the LinkedIn profile data exposed when you apply via LinkedIn (headline, current role, education, employment history, profile picture, public profile URL). Where you choose to record one, this also includes an optional introduction video, which is provided only on your initiative.
Sourcing data. Information we collect proactively when identifying potential candidates from public sources such as LinkedIn, Wiggli, GitHub or similar platforms, together with context provided by referrals or external recruiters where applicable.
Communication data. All correspondence exchanged between you and ML6, including emails, in-platform messages on Teamtailor, calendar invitations and meeting metadata, and notes from phone calls.
Interview and evaluation data. Information generated during the assessment phase, including interview notes, evaluation ratings, hiring committee discussion records, and results from case studies or coding tests. This also includes audio or video recordings of interviews and related transcripts (manual or AI-generated).
Account and technical data. Information related to your use of our recruitment systems, including account credentials, account activity and timestamps, IP address, device and browser information, session and system logs, and authentication events.
Identity verification and right-to-work data. Documents and identifiers we may collect where lawful and necessary to verify your eligibility to work, including passport or national ID copies, work permits, visas, residence permits,diplomas, nationality, and national identification numbers where required.
AI-generated data and insights. Outputs produced by AI systems used in our recruitment process, including CV rankings or scores, extracted skills or summaries, AI-generated transcripts of recorded interviews, and any AI-produced recommendations or analyses that inform a final decision taken by a human reviewer. See the section "Use of AI tools and profiling" below.
Voluntarily provided data. Any other information you choose to share beyond standard application fields, including portfolio links, reference data, personal projects, public profile links, salary history if disclosed, and any free-form information shared during interviews or in correspondence.
Special category of data. ML6 does not request or collect special category data within the meaning of Article 9 GDPR (such as health data, racial or ethnic origin, or trade union membership). We encourage you not to voluntarily disclose any such data to us.
Marketing-adjacent consent data. Where you opt in, your consent to receive ML6 event invitations or recruitment-related communications.
Website data. When you browse ml6.eu before applying, additional data is processed in accordance with our Website Privacy Notice.
Visitors data. When you physically visit ML6 offices for an interview, additional data is processed in accordance with our Visitors Privacy Notice.
3. What purposes do we use your personal data for?
We use your application personal data and other information as described above for the following purposes:
Sourcing and identifying potential candidates. Collecting sourcing data and any voluntarily provided data to identify, approach, and pre-screen candidates through LinkedIn, Wiggli, referrals or spontaneous applications.
Managing your application and your Teamtailor account. Receiving and processing your application data, creating and maintaining your candidate account through account and technical data, exchanging communication data throughout the process, and scheduling interviews and meetings.
Assessing your suitability and conducting interviews. Reviewing your application data and voluntarily provided data, evaluating any introduction video you choose to submit, generating interview and evaluation data (notes, ratings, case study and coding test results). AI-generated data and insights may be produced where AI-assisted screening or ranking is applied (see "Use of AI tools and profiling").
Verifying your eligibility and conducting checks. Processing identity verification and right-to-work data, diplomas, and reference data to verify your right to work and conduct associated checks.
Making hiring decisions and preparing your onboarding. Using your application data, interview and evaluation data, AI-generated data and insights, and communication data for hiring committee review, outcome communication, and handover to HR for onboarding of selected candidates.
Managing our talent pool for future opportunities. Retaining your application data to re-engage you for future relevant roles within ML6.
Complying with our legal obligations, responding to your rights requests, defending legal claims, and deleting or anonymising your data at the end of retention. Processing the relevant categories above to comply with employment, anti-discrimination, and equal-opportunity law, respond to data subject rights requests, respond to public authorities, defend legal claims, and delete or anonymise your data at the end of the retention period.
Ensuring the security and integrity of our recruitment platform and IT systems. Processing account and technical data to maintain system logs, detect and prevent fraud or unauthorised access, and support audit trails.
Conducting recruitment analytics and improving our process. Processing application data and interview and evaluation data to report on time-to-hire, source effectiveness, funnel conversion, and candidate experience.
We only collect the personal data from you that is necessary for the purposes outlined above.
4. What legal basis do we rely on?
Under the GDPR, we must have a valid legal basis to process your personal data. The legal basis we rely on depends on the purpose for which your data is processed and the context in which it is collected.
Pre-contractual measures (Article 6(1)(b) GDPR). We process personal data where necessary to take steps prior to entering into a potential employment relationship with you.
Consent (Article 6(1)(a) GDPR). Where required, we rely on your consent to process specific categories of personal data. For example, by confirming and submitting your application (for example by clicking “Submit application”), you consent to the processing of the personal data included in your application for recruitment purposes. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Legitimate interests (Article 6(1)(f) GDPR). We may process personal data where necessary for our legitimate interests, provided that these interests are not overridden by your rights and freedoms.
Legal obligation (Article 6(1)(c) GDPR). We may process personal data where necessary to comply with applicable legal or regulatory obligations.
5. Consolidated overview of processing
Please find below a consolidated overview of the personal data we process, for which purposes, under what legal basis, and for what period.
#
Purpose
Personal data categories
Legal basis
Retention period
1
Sourcing and identifying potential candidates
Sourcing data
Legitimate interest (Art 6(1)(f))
24 months
2
Managing your application and your Teamtailor account
Application data; Voluntarily provided data; Account and technical data; Communication data
Pre-contractual measures (Art 6(1)(b))
24 months
3
Assessing your suitability and conducting interviews
Application data; Voluntarily provided data; Interview and evaluation data; AI-generated data and insights
Pre-contractual measures (Art 6(1)(b));
Legitimate interest (Art 6(1)(a)) for AI-generated data and insights
24 months
4
Verifying your eligibility and conducting checks
Identity verification and right-to-work data;
Legal obligation (Art 6(1)(c)) for right-to-work data; Legitimate interest (Art 6(1)(f)) for reference checks; Pre-contractual measures (Art 6(1)(b)) for the other data
Right-to-work: 24 months if not hired; employment + 5 years if hired (transferred to Employee records).
5
Making hiring decisions and preparing your onboarding
Application data; Interview and evaluation data; AI-generated data and insights; Communication data
Pre-contractual measures (Art 6(1)(b)); Contract (Art 6(1)(b)) once offer is accepted
24 months for unsuccessful candidates; transfers to Employee records if hired
6
Managing our talent pool for future opportunities
Application data; Communication data; Marketing-adjacent consent data
Legitimate interests (Art 6(1)(f))
24 months
7
Complying with legal obligations, responding to rights requests, defending legal claims, and deleting data at end of retention
All relevant categories above
Legal obligation (Art 6(1)(c)); Legitimate interest (Art 6(1)(f)) for legal claims defence;
DSR records: 2 years; legal claims defence: 5 years; legal-obligation records: 5 years
8
Ensuring the security and integrity of our recruitment platform and IT systems
Account and technical data
Legitimate interest (Art 6(1)(f))
12 to 24 months
9
Conducting recruitment analytics and improving our process
Application data; Interview and evaluation data
Legitimate interest (Art 6(1)(f))
Anonymised: indefinite; identifiable: aligned with source purpose
6. Use of AI tools and profiling
ML6 uses AI-assisted tools during certain stages of the recruitment process, including candidate sourcing, CV screening, video screening, interview transcription, and application assessment support. These tools help identify relevant qualifications, skills, experience, and job-related criteria based on the information you provide.
AI-generated outputs are used only as support for our recruiters and are always subject to human review. No hiring decision is made solely through automated processing or profiling.
Depending on the role and process, the use of these tools may influence how applications are prioritised or reviewed. You may request additional information about the use of AI in your application process, express your point of view, object to such processing, or request a fully manual review of your application by contacting dpo@skyhaus.com.
Internal Tools and Third-Party Platforms
During the recruitment process, ML6 may use various software tools and platforms (e.g. recruitment systems or interview tools) to manage and assess your application. While ML6 controls access to these tools, they may be operated by third-party providers. These platforms may process technical and usage data to ensure service functionality, stability, and security.
7. To whom does ML6 send your personal data?
We only share your personal data with third parties where necessary for the recruitment purposes described above. Recipients may include:
(a) Service Providers (Processors):
Third-party providers supporting our recruitment and IT processes, such as our Applicant Tracking System (Teamtailor) and cloud service providers (e.g. Google Workspace for email, documents, and meetings). These providers process personal data on our behalf under appropriate data processing agreements.
(b) Public Authorities:
Government authorities, supervisory bodies, or law enforcement agencies where disclosure is required by applicable law.
(c) Professional Advisors:
Our auditors, legal advisors, or consultants where necessary for legitimate business purposes.
8. Where do we process your data?
We and our external processors primarily process your data within the EEA. Where we share your personal data with a third party so that it is transferred to or becomes accessible from outside the EU/EEA, we always put adequate safeguards in place (such as Standard Contractual Clauses).
A transfer outside the EEA could take place through the use of global HR or IT tools, such as:
9. How long will we keep your data?
Applicable data protection laws require that we do not retain personal data in an identifiable form for longer than necessary for the purposes for which it is processed.
In line with our retention policies and IT procedures, we ensure that your personal data is deleted or anonymised once the applicable retention period has expired (e.g. after the 24-month consent period or, for sourced or referred candidates where no consent is obtained, after 90 days), unless a longer retention period is required to comply with legal obligations or to establish, exercise, or defend legal claims.
10. What are your rights?
You have the following rights in relation to your personal data:
Data Privacy rights
What it means for you
The right to access
You have the right to request ML6 for copies of your personal data and request some details about the processing of your personal data
The right to correction
You have the right to correct any personal data you believe is inaccurate
The right to erasure (‘right to be forgotten’)
You have the right to have your data erased where one of the conditions in article 17 GDPR is fulfilled
The right to withdraw consent
If we process data based on your consent (e.g., photos), you may withdraw it at any time. This will not affect the lawfulness of processing before withdrawal
The right to object to data processing
You have the right to object to processing based on "legitimate interest".
The right to restrict data processing
You have the right to restrict the processing of your personal data in specific circumstances.
The right to data portability
You have the right to receive your personal data in a structured, machine-readable format for your own purposes, or to request us to share it with a third party.
The right not to be subject to solely automated decision making
You have the right not to be subject to solely automated decision making
The right to lodge a complaint
You have the right to lodge a complaint with the competent supervisory authority
Please note that the rights mentioned above are not absolute, and therefore, your request may not always be fully granted.
11. How can you contact us?
If you have any questions or concerns about how ML6 processes your personal data, or if you would like to exercise your data subject rights, please submit your request at dpo@skyhaus.com.
12. Updates to this document
This Privacy Notice may be updated from time to time. In case of material updates, we will inform you via internal communication channels.
Version Control
Version
Author
Comment
Date/Valid from
1.0
DPO
Initial version
19 Jan 2021
2.0
DPO
Review
20 May 2026
