Privacy policy

1. Who is responsible

eddison.io and the Eddison application process are run by:

Hess Family Invest GmbH
Kachelsteinstraße 14
83334 Inzell, Germany
Managing director: Samuel Hess
Email: samuel@hess.capital

We have not appointed a data protection officer, because we are not legally required to. For any privacy question, write to the email address above.

2. The short version

• Google Analytics measures public-page visits and successful applications only if you accept analytics cookies. Separately, with marketing consent, Meta Pixel measures ad results, including successful applications. You can reject either category or withdraw in Cookie settings.
• Fonts and images are served from our own server. Your browser does not contact Google Fonts or similar services when you visit.
• If you apply, we review your application and contact you about it. Only if you separately opt in do we keep it for future roles in our talent pool.
• Only the hiring team (Samuel Hess and Marcus Yap) reads applications.
• We never sell your data.

3. Visiting the website

Our website runs on our own server, operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre in Germany. To deliver the pages, the server necessarily processes your IP address and technical request data (browser, requested page, time). Our web server does not write access logs. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running a secure website).

The site stores settings in your browser’s local storage, never on our server: your cookie choices (version, categories and time, expiring after 180 days), your choice of black-and-white or colour photos, and a draft of your application while you are filling it in, so you don’t lose your text. The draft is deleted from your browser once you send the application. You can clear these at any time in your browser settings. Legal basis: § 25(2) TDDDG (strictly necessary for a function you asked for).

4. Applying to Eddison

What we collect: name, email, city, the role or track you apply for, your work and video links, social profiles you choose to share (Instagram, TikTok, YouTube), your letter, an optional PDF (CV or portfolio), how you heard about us, and your answers to the test-task and consent checkboxes. As the process continues, we also store notes from our review, call dates, test-task submissions, agreed fees and payment status.

Why: to review your application, contact you, run the interview, paid test task and trial days, and decide whether we work together. Legal basis: § 26(1) BDSG for employment applications, and Art. 6(1)(b) GDPR for steps towards other possible contracts at your request. The required form acknowledgement is not consent to optional tracking or future-role retention. The optional talent pool uses your separate consent under Art. 6(1)(a) GDPR and, where applicable, § 26(2) BDSG.

Where it is stored: on our own server at Hetzner in Germany, in a private database that is not publicly accessible. The hiring team reaches the private review inbox through a secured remote-access connection (bb, getbb.app) that requires our login.

Your status page: after applying you get a private link to see the status of your application. Anyone with that link can see it, so keep it to yourself. We do not send that link anywhere else.

Spam protection: to limit abuse, our server briefly keeps a count of submissions per IP address in memory. It is not saved to disk.

How long: we keep data while your application is being considered. After a rejection or withdrawal, we retain necessary application records for up to six months to defend possible legal claims (Art. 6(1)(f) GDPR). A specific dispute may require relevant evidence for longer, until it is finally resolved; it does not justify keeping everything indefinitely.

Optional talent pool: if you tick the separate box, Hess Family Invest GmbH may retain your application, work links and relevant assessment information and contact you about future Eddison roles for 24 months from your consent. We review whether the data is still needed and accurate. You can actively renew for another 24 months in your private application page. There is no automatic renewal: without fresh consent, talent-pool use stops at expiry. You can withdraw there or email us at any time, without affecting your current application or the lawfulness of earlier processing. On expiry or withdrawal, we delete data no longer needed for a current application, legal claims or statutory duties. Consent to our talent pool does not authorise disclosure to an unnamed future company for its own talent pool.

If we work together: only relevant records enter the contract or personnel file and follow the retention periods for that relationship. Payment and tax documents are kept only as required by law (Art. 6(1)(c) GDPR): typically eight years for accounting vouchers, ten years for books and annual accounts, and six years for relevant business correspondence, generally from the end of the relevant calendar year; statutory extensions may apply. These duties do not cover your entire application. Records kept solely for legal duties or claims are restricted to those purposes.

5. Emails

We send emails (your application confirmation, invitations, updates) from samuel@hess.capital through Google Workspace, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google may process data on servers outside the EU; transfers are covered by the EU–US Data Privacy Framework and Google’s standard contractual clauses. Legal basis: Art. 6(1)(b) GDPR.

6. Booking a call

If we invite you to a call, we may send you a booking link to Google Calendar appointment scheduling (Google Ireland Limited). When you book, Google processes your name, email and chosen time under Google’s privacy policy. Calls may take place via an online video tool we name in the invitation. We only record a call if you agree to it beforehand.

7. Contacting us directly

If you message our founder on WhatsApp or by phone, WhatsApp Ireland Limited (Merrion Road, Dublin 4, Ireland) processes that message under its own privacy policy. We use what you send only to answer you. Legal basis: Art. 6(1)(b) and (f) GDPR.

8. Our ads on Meta

We advertise open roles on Instagram and Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). If you see or click an ad, Meta processes that under its own privacy policy. Campaign parameters in our links help attribute visits to ads. When linked to a browser or application, this attribution can be personal data.

Only with marketing consent: Meta Pixel measures visits to public pages (PageView), views of job pages (ViewContent) and successful applications (SubmitApplication). We use this to understand which ads lead to applications and improve advertising. Rejecting marketing does not affect your application. Legal basis: Art. 6(1)(a) GDPR and, for optional storage or access on your device, § 25(1) TDDDG.

Data sent: the browser Pixel can transmit page URLs, campaign and click identifiers, event times, browser/device information, cookie identifiers and your IP address. It is blocked on the private application portal and on URLs with fragments or unrecognised query fields. Successful-application events include an opaque event ID. Server-side Conversions API tracking is not active, and we do not send email addresses or email hashes to Meta. We do not send application letters, answers, work samples, attachments or private application links to Meta. Automatic advanced matching is disabled.

Storage and withdrawal: the Pixel may set first-party advertising cookies such as _fbp and _fbc. No Pixel request is sent without marketing consent. Cookie settings lets you stop future events; withdrawal removes these cookies accessible to our site and reloads the page to unload the Pixel. It cannot recall data already sent to Meta. Your cookie choice is stored in your browser as described in section 9. We do not queue historical applications for later advertising uploads.

Meta’s role and international processing: for collection and transmission of event data through Meta Business Tools, the applicable allocation of responsibilities is described in Meta’s Controller Addendum. Meta processes data for its own purposes under its Privacy Policy, including matching and advertising measurement. Data may be processed outside the EEA, including in the United States; Meta describes applicable transfer safeguards in that policy. See also the Business Tools Terms and Cookie Policy for Meta’s retention and cookie details.

9. Cookie choices and Google Analytics

Our own consent panel records your choice for 180 days in local storage. You can reopen it at any time using “Cookie settings” in the footer. Optional categories start off, and rejecting them does not limit access to the website or applications. Necessary storage is used under § 25(2) TDDDG and Art. 6(1)(f) GDPR to remember your choices and provide requested functions. Optional storage or access requires your consent under § 25(1) TDDDG; optional personal-data processing relies on Art. 6(1)(a) GDPR.

Google Analytics 4: with analytics consent, we use Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to understand which public pages are visited, visits to careers pages and whether an application was successfully submitted. Google receives pseudonymous browser/session identifiers, page paths, event times, browser/device information, approximate location and campaign labels. Your IP address is technically transmitted when your browser contacts Google; Google states that it discards EU, UK and Swiss IP addresses before logging them. We do not send names, email addresses, application answers, attachments, work links or private application links to Analytics. Public page URLs sent by our integration omit query strings and fragments; approved campaign labels are sent separately.

Storage and limits: Analytics uses first-party cookies such as _ga and _ga_* to recognise browsers and sessions. We configure a maximum lifetime of 180 days from creation, without extending it on each visit. Our Google Analytics retention setting is 14 months for event-level and user-level data. New activity restarts the 14-month retention period for the user identifier, so identifiers of returning visitors may be retained longer than 14 months from their first visit. This reset does not extend event-level retention. Google performs deletion in its monthly cycle. Aggregated statistical reports are not subject to that event-level retention setting and can remain available longer. Advertising storage, advertising user-data use and ad personalisation are denied by our tag. We do not send your email for Google matching.

Your choice: no Google Analytics script, request or cookieless measurement ping is sent before opt-in. Rejection does not affect an application. Withdrawal stops future events, clears Analytics cookies accessible to this site and reloads the page to unload the tag. The private application portal stays free of tracking even when you accepted analytics elsewhere. Analytics consent is separate from application processing and talent-pool consent.

International processing: Google and its processors may process analytics data outside the EEA, including in the United States. Google relies on the EU–US Data Privacy Framework for covered transfers to certified US entities and standard contractual clauses where applicable. See Google’s data processing terms, transfer safeguards and how Google uses data from partner sites.

Separate marketing choice: Meta Pixel uses the marketing category described in section 8. Analytics consent alone does not allow Meta tracking, and marketing consent alone does not allow Google Analytics. Neither choice is required to apply or join the talent pool.

Withdrawing through Cookie settings stops future optional processing; it does not undo earlier lawful processing. A changed provider or purpose requires updated information and, where necessary, a fresh choice.

10. Companies being founded and recipients

Separate companies for Eddison and its ventures, including the Eddison media company, are currently being founded (“in Gründung”). Until a responsible new entity takes over, Hess Family Invest GmbH remains your controller. This statement does not mean a particular company has already been incorporated.

Once the relevant company exists, we may transfer only the application and related records it needs to continue the same recruitment or contractual process. We will first establish the appropriate legal basis: Art. 6(1)(b) GDPR where necessary for steps or a contract you request, applicable employment law, or Art. 6(1)(f) GDPR following a documented assessment of our legitimate interest in continuing that process and your interests and reasonable expectations. This is not permission to distribute your application across unrelated ventures.

Before a planned transfer, we will tell you the new controller’s name and contact details, the data and purposes involved, the legal basis and your rights, in accordance with Art. 13–14 GDPR. Your rights, agreed purposes and retention limits remain in place. You may object where legitimate interests are used. If the transfer or a new purpose requires consent, we will ask first; existing talent-pool consent is not blanket consent for new controllers.

Only the people and providers named above: our hiring team, Hetzner (hosting), Google (email, booking and, with consent, analytics), Meta (advertising measurement with marketing consent), and the remote-access service we use to reach the review inbox. Providers acting on our behalf are bound by a data processing agreement where required. Meta’s separate responsibilities are described in section 8. Relevant new companies may receive records only under the conditions above. Where needed, professional legal or tax advisers and competent authorities may receive the limited records necessary for legal obligations or claims.

11. Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, and to receive your data in a portable format (Art. 15–21 GDPR). You can withdraw your consent at any time with effect for the future. Just email samuel@hess.capital.

You can also complain to a data protection authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

12. Changes

We update this policy when what we use changes. The date at the top shows the latest version.