1. Name and contact details of the controller
1.1 The Plato website (www.platoapp.ai) and the Plato Services are offered and operated by DM Technologies GmbH, with its registered office at Monbijouplatz 4, 10178 Berlin, Germany, registered with the commercial register of the Charlottenburg Local Court (Berlin) under HRB 252844 B ("Plato", "we", "us", and "our").
1.2 This notice gives you a straightforward overview of what happens to your personal data when you visit our website or otherwise get in touch with us. We're glad to explain how we process your personal data and how we keep it protected.
1.3 In connection with the Plato Services, we don't process certain personal data as the controller that decides on the purposes and means of processing — instead, we act as a processor on behalf of our customers. In that role, we process data solely on the customer's instructions and under a separate data processing agreement. In those cases, only that data processing agreement and the relevant customer's own privacy notice apply.
1.4 For any questions on this, you can reach our privacy team (Privacy Office) by post at the address above or by email (contact@platoapp.ai).
1.5 We process personal data in accordance with applicable data protection law, in particular the General Data Protection Regulation (GDPR). Terms defined in the GDPR carry the same meaning in this notice.
1.6 This notice replaces all previous versions. We may change it at any time to reflect legal developments or changes to our processes. Any change applies only to future processing of your data. You can view the current version of this notice on the Plato website at any time.
2. Processing of personal data
2.1 We may process personal data that you provide to us directly, or that we collect from you for other reasons in connection with our services — for example, data you enter into a contact form. We may also process personal data from other sources, such as external service providers, public registers, or publicly available sources. Personal data may also be collected automatically, or with your consent, by our IT systems when you visit our website.
2.2 We may process the following categories of personal data:
Contact data (e.g. first and last name, email and postal addresses, and phone numbers);
Professional data (e.g. job title, role, and employer, and, for job applications, CVs and cover letters with references);
Communication data (e.g. personal data used in or embedded in any form of communication or interaction, including contact forms, calls, chats, emails, or attachments to such communications);
Marketing data (e.g. personal data including contact and communication preferences, or webinar/event registrations, attendance, and participation information);
Technical usage data (e.g. information about the device and browser used, operating system, IP address, date, time and duration of access, and information on your use of the relevant Plato Services).
2.3 We give you the option to apply to join our team (e.g. by email). Where necessary, this involves processing applicants' contact, professional, and communication data (e.g. together with their employment and education history, references, or certificates).
2.4 If you communicate or interact with us — including via our website contact form, by email, or by phone — we may process contact, professional, communication, and technical usage data.
2.5 In preparing and planning our contractual services, and in connection with access to and use of the Plato Services, we process the contact and professional data of the person concerned, and, in individual cases, communication, marketing, and technical usage data.
2.6 We may process marketing and technical usage data based on your consent to receive marketing communications, or, for example, when you request marketing materials from Plato. Personal data is also processed when you register for one of our webinars. If you sign up for our newsletter, we process contact data as well as professional, communication, and technical usage data. To verify the email address you provide and confirm that you agree to receive it, we send an automatic confirmation email once we receive your signup request (double opt-in). Once confirmed, your contact data is added to our internal newsletter distribution list.
2.7 The Plato website is hosted externally. Personal data collected on this website is stored on our hosting provider's servers. This is mainly technical usage data, but may also include contact or communication data generated through our website. Our hosting provider only processes your data to the extent required to fulfil its contractual obligations.
3. Use of cookies
3.1 When you visit or browse the Plato website, we may collect technical usage data. We may use cookies and similar technologies, such as pixel tags, web beacons, mobile identifiers, or JavaScript (collectively, "cookies") to do so. Cookies are small data files stored on your device so it can be recognized on later visits. There are two types: session cookies, which expire once you leave our website, and persistent cookies, which remain on your device and can be managed through your browser settings.
3.2 There's also a distinction between first-party cookies, which we set as the operator of the Plato website, and third-party cookies, which come from external providers. Third-party cookies can enable certain features on our website, such as advertising, interactive content, or social sharing. These cookies can also recognize your device when you visit other websites that work with the same third-party providers.
3.3 The cookies we use fall into two categories: those that don't require consent and those that do. You can manage these cookies through our consent management platform, which is shown automatically when you visit the Plato website. There, you'll also find detailed information on the relevant data processing and can adjust your settings at any time.
3.4 Cookies that don't require consent are technically necessary for the safe and proper operation of our website — to provide basic functions and to detect and defend against faults or cyberattacks. Cookies that do require consent make your visit to our website more user-friendly: they let us tailor content to your interests, analyze errors, and evaluate the use of our services statistically. Some of these cookies also help manage advertising.
3.5 You can set your browser to notify you when cookies are set, to only accept cookies on a case-by-case basis, to block certain cookies, or to automatically delete all cookies when you close your browser. Please note that fully disabling cookies may limit the functionality of the Plato website.
4. Social media presence
4.1 We maintain publicly accessible profiles on social networks (e.g. LinkedIn). These networks can extensively analyze your usage behavior when you visit websites with embedded social media content. If you're logged into your social media account, the network operator can link that activity to your profile. Even if you're not logged in, or don't have an account, technical usage data may still be collected.
4.2 Social media network operators use this data to build user profiles, so they can show you personalized advertising both on and off their networks. If you have a social media account, this interest-based advertising can appear on any device on which you're logged in or have been logged in. We don't have full visibility into all of the processing activities carried out by these social networks. For more information on how they process data, please refer to the relevant provider's own privacy policy and terms of use.
5. Purpose and legal basis of processing
5.1 We process all categories of personal data so that we can provide our services accurately, in response to your request. This processing is based on Art. 6(1)(b) GDPR, for the performance of a contract with our prospective and existing customers (entering into and performing a contract), and on our legitimate interests (Art. 6(1)(f) GDPR). We also recognize the legitimate interest of our prospective and existing customers (Art. 6(1)(f) GDPR) in being able to find out about our services on our website safely, quickly, and efficiently. Where processing is based on legitimate interests under Art. 6(1)(f) GDPR, we've carried out and documented a corresponding balancing-of-interests test. This is done in line with the case law of the Court of Justice of the European Union (CJEU) and Recital 47 GDPR, and covers in particular: (i) the legitimate interests we pursue, (ii) whether the processing is necessary in light of the principle of data minimization, and (iii) a balancing of those interests against the fundamental rights and freedoms of the individuals concerned.
5.2 We also optimize our services and aim to tailor our offering more closely to the needs of prospective customers and customers. Here, we rely on our legitimate interest in developing, promoting, and improving the services we offer, and in identifying future business opportunities (Art. 6(1)(f) GDPR). Your consent may also serve as the legal basis for this processing (Art. 6(1)(a) GDPR).
5.3 We secure our systems and ensure they function properly. Here, we rely on our legitimate interest in ensuring the security of our IT systems, particularly in connection with our contractual relationships with customers (Art. 6(1)(b) and (f) GDPR).
5.4 We communicate with you and process personal data as part of that correspondence (e.g. via our contact form, or to respond to your enquiries). The legal basis for processing personal data in connection with communicating with you is the joint entering into and performance of a contract, or our legitimate interests (Art. 6(1)(b) and (f) GDPR). Your consent may also serve as the legal basis for this processing (Art. 6(1)(a) GDPR).
5.5 We inform you about new content, webinars, and relevant offers. The legal basis for our marketing activities is our legitimate interest (Art. 6(1)(f) GDPR) in promoting our services. We also rely on your consent (Art. 6(1)(a) GDPR) for specific marketing communications. The same applies to our social media presence, which is intended to ensure the broadest possible presence online (Art. 6(1)(f) GDPR). Any analytics processes initiated by the social networks themselves may rely on a different legal basis, as specified by the operators of those networks (e.g. your consent under Art. 6(1)(a) GDPR).
5.6 We may process personal data based on your consent (Art. 6(1)(a) GDPR; Section 25(1) TDDDG, Germany's Telecommunications Digital Services Data Protection Act, where consent covers storing cookies or accessing information on your device). You can withdraw your consent at any time, without affecting the lawfulness of processing already carried out based on your consent. To that end, we include an unsubscribe link in our emails and newsletters. Where storing your consent is itself necessary for processing your personal data, the legal basis for that storage is Art. 6(1)(c) GDPR.
5.7 If you send us an application, we process the related personal data to the extent necessary to decide on establishing an employment relationship. The legal basis for this is Section 26 of the German Federal Data Protection Act (BDSG) (entering into an employment relationship), Art. 6(1)(b) GDPR (entering into a contract), and, where you've given consent, Art. 6(1)(a) GDPR. If your application is successful, the data you submitted is stored in our data processing systems under Section 26 BDSG and Art. 6(1)(b) GDPR, for the purpose of carrying out the employment relationship.
6. Storage and deletion
6.1 Your personal data is stored for as long as necessary to fulfil the purposes described above, until the legal basis for processing no longer applies, and until the applicable retention periods (in particular under tax, commercial, and civil law) have expired. Once the contractual relationship ends, or once statutory retention periods expire, your data is deleted — unless you've consented to longer storage (Art. 6(1)(a) GDPR) or further statutory retention obligations apply (Art. 6(1)(c) GDPR). Until personal data can be fully deleted, it's pseudonymized or anonymized wherever possible, and access to it is restricted.
6.2 For applications where we unfortunately can't offer you a position, where you decline an offer, or where you withdraw your application, we reserve the right to retain the data you submitted for up to six months from the end of the application process, for evidentiary purposes, based on our legitimate interests (Art. 6(1)(f) GDPR). After that, the data is deleted and any physical application documents are destroyed. If it's apparent that the data will still be needed after that six-month period (for example, because of a threatened or pending legal dispute), we won't delete it until the purpose for continued retention no longer applies. We may also retain data for longer where you've given corresponding consent (Art. 6(1)(a) GDPR), or where statutory retention obligations prevent deletion.
6.3 In connection with our newsletter, we store your contact data only for as long as the newsletter is actively sent. If you unsubscribe, or if we discontinue the newsletter, your data is deleted from the relevant systems without delay.
6.4 Technical usage data is generally deleted or anonymized within a short period after your visit to the Plato website — typically within 7 to 30 days — unless longer storage is required for technical, legal, or security reasons.
7. Disclosure of data to recipients or third parties
We treat personal data as strictly confidential and only disclose it where necessary to provide our services, to comply with legal obligations, or based on your consent. Internally, access is limited to employees who need it to carry out their tasks. Beyond that, we work with carefully selected external service providers — for example, for hosting and IT infrastructure, customer support software, marketing and analytics tools, or recruiting solutions. We enter into data processing agreements with all such providers under Art. 28 GDPR, ensuring that they process data solely on our instructions and in line with high data protection standards.
8. Data processing in the EU/EEA; exception
As a rule, your personal data is processed within the EU/EEA member states. In exceptional cases, it may be necessary to transfer personal data to recipients outside the EU/EEA — for example, where this is necessary to provide or perform our services, or where required by law. This only happens subject to an adequacy decision by the European Commission, or where standard contractual clauses and, where necessary, additional appropriate safeguards are in place. On request, we'll provide the data subject with a copy of these standard contractual clauses. Where you've given explicit consent to the transfer of personal data to third countries, that processing may take place on the basis of Art. 49(1)(a) GDPR. That said, we want to point out that countries outside the EU/EEA generally can't guarantee a comparable level of data protection — for example, companies in the US may be required to disclose personal data to security authorities without you, as the data subject, having any means of legal recourse against this.
9. No automated decision-making
We don't make decisions based solely on automated individual decision-making or profiling within the meaning of Art. 22 GDPR. If we were to use such methods, we'd inform you separately, as required by law.
10. Protecting your personal data
10.1 We use comprehensive technical and organizational measures to protect your data from unauthorized access, loss, or misuse. In particular, we store personal data on secure networks and use encryption technologies. Access to personal data within our company is strictly controlled and limited to employees directly responsible for handling the relevant matter (e.g. planning and carrying out your project, or processing your application). Every member of our team is expressly bound to confidentiality, is subject to our data protection guidelines, and is informed of and trained on them.
10.2 If a personal data breach occurs, we'll notify you and the competent supervisory authority without undue delay, as required by law. Every incident is documented, including all relevant information on its causes, effects, and the countermeasures taken.
11. Overview of your rights
11.1 In addition to the right to withdraw your consent at any time (Art. 7(3) GDPR), you have the following rights, where the relevant statutory requirements are met:
Right of access (Art. 15 GDPR);
Right to rectification (Art. 16 GDPR);
Right to erasure ("right to be forgotten") (Art. 17 GDPR);
Right to restriction of processing (Art. 18 GDPR);
Right to data portability (Art. 20 GDPR);
Right to object (Art. 21 GDPR).
11.2 You can contact our privacy team (Privacy Office) at the address given above at any time to exercise these rights. You can also lodge a complaint with the competent supervisory authority (Art. 77 GDPR).
11.3 If you visit one of our social media presences (e.g. LinkedIn), we may be jointly responsible, together with the operator of that social media platform, for the data processing triggered by that visit. You can assert the rights listed above against both us and the operator of the social media platform. Please note that, despite this joint responsibility, we don't have full control over the data processing carried out by the relevant social media platforms — our options are largely determined by the platform operator's own policies.
11.4 Finally, please note that we may continue to process personal data even after receiving your request, where this serves our legitimate interests and is necessary to comply with our legal obligations. These purposes may include resolving disputes, enforcing our contractual rights, and complying with statutory retention obligations.