Candidate Privacy Notice

This notice explains what happens to the personal data you send us when you apply for a role at mailkube. It covers the application form on our careers pages and nothing else. If you are an account holder, a team user, or a visitor to our website, the notice that applies to you is our Privacy Policy.

Who we are

mailkube is operated by Mail Tactic Corporation. For the personal data described on this page, Mail Tactic Corporation is the controller.

You can reach us about this notice at privacy@mailkube.com.

Mail Tactic Corporation has appointed Prighter EU Rep GmbH, Vienna, Austria, as its representative in the European Union pursuant to Article 27 GDPR, as the point of contact for data subjects and supervisory authorities on matters relating to the processing of personal data. The representative may be addressed in addition to or instead of Mail Tactic Corporation, which remains reachable at privacy@mailkube.com. Contact details are on our EU Representation page.

What we collect

The application form asks you for:

• Your name.
• Your email address.
• Your country.
• Your phone number.
• The address of your LinkedIn profile.
• A cover note, which is optional and free text.
• Your CV, as a PDF file.

We also record which role you applied for. We collect nothing else through the form, and we do not buy your details from anyone or add to them from any other source.

Why we use it, and on what basis

We use it to assess your application, to contact you about it, and to keep a record of the decision.

Two lawful bases apply. Assessing your application and talking to you about it are steps taken at your own request before entering into a contract, under Article 6(1)(b) GDPR. Keeping a record of the application and of what we decided rests on our legitimate interest in being able to administer and account for our own hiring, under Article 6(1)(f) GDPR.

Please leave special-category data out

A CV does not need to mention your health, your religious or philosophical beliefs, your racial or ethnic origin, your political opinions, your trade union membership, your sex life or sexual orientation, or your genetic or biometric data. Please leave all of it out. We do not ask for it and it plays no part in how we assess you.

If some of it reaches us anyway, because it was in a document you attached, we do not extract it, index it, or use it. It stays where you put it, inside the application, and it is deleted on the same schedule as the rest of the application. If you would rather we deleted it sooner, write to privacy@mailkube.com and we will.

Who sees it, and where it goes

Your application is read by the people at mailkube involved in hiring for the role you applied for.

It is stored as a ticket in Jira, with your CV attached to it. Jira is hosted by Atlassian, and the contracting entity is Atlassian Pty Ltd, Level 6, 341 George Street, Sydney NSW 2000, Australia. That transfer is governed by Standard Contractual Clauses concluded between mailkube and Atlassian. We name the safeguard rather than a storage region, because the regional configuration of the Jira project behind this form has not been independently verified on our side, and we would rather say so than assert something we have not confirmed.

We do not share your application with anyone else.

How long we keep it

We keep your application for twelve months from the date you send it, and then delete it.

If we would like to keep it longer so we can consider you for a future role, we will ask you first, and we will only do it if you agree. You can change your mind at any time.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it if it is wrong, ask us to delete it, ask us to restrict what we do with it, or ask for a copy in a portable format. You can object to the processing we carry out on the legitimate-interest basis described above.

Write to privacy@mailkube.com and we will deal with it. We may ask you to confirm who you are before we do.

You also have the right to complain to a data protection authority. If you are in the European Economic Area, you can go to the authority where you live, where you work, or where you think the problem happened.

Bot protection on the form

The application form is protected by Cloudflare Turnstile, which is what keeps it from being flooded with automated submissions. It replaced Google reCAPTCHA Enterprise in August 2026, so Google is no longer involved in this form at all. Turnstile receives your IP address, the technical fingerprint of your connection, your browser’s user-agent string, and the identifier of the form. It sets no cookies and stores nothing on your device, and nothing loads until you start filling the form in. A form that anyone can flood with automated submissions is not a form we can offer you, so protecting this one is strictly necessary to the service you came here for, and securing the site is in any event a purpose that needs no consent in its own right. Because its signals serve only the job of telling a person from a script, it runs whenever you use the form rather than asking your permission first. Cloudflare’s account of what it does with those signals is in its Turnstile privacy addendum.

Changes to this notice

If we change this notice we will post the new version on this page and update the date at the top.