Careers Privacy Notice - eDreams ODIGEO Careers

Last updated: August 2026

This Careers Privacy Notice (hereinafter, “Notice”) describes how we process your personal data in the context of our recruitment activities (such as your application form, your participation in our recruitment events or through our referral program), for how long we retain it, with whom we share it, and how you can exercise your rights.

We process your data in accordance with all applicable data protection laws, including the EU General Data Protection Regulation (EU Regulation 679/2016) (hereinafter, “EU GDPR”).

Who is the data controller of your data?

eDreams International Network, S.L., a Spanish-based company with tax ID number B62443700 (hereinafter, “eDreams ODIGEO” or “the Company”), is the data controller of your personal data processed unless this Notice or any other communication specifically states otherwise.

Who is the Data Protection Officer?

eDreams ODIGEO has appointed a Data Protection Officer (hereinafter, “DPO”) who watches over all processing carried out with respect for your privacy and the applicable regulations at all times.

The DPO is at your disposal to answer all the questions you may have regarding the processing of your personal data. If you want to contact the DPO for any queries regarding the processing of your personal data, or to exercise your rights as described in Section 7 of this Notice (“How can you control the personal data you have given to us?”), click here.

Why do we collect your personal data and which legal basis do we rely on?

In this section, we inform you of the legal basis on which we process data for individual purposes (you can find general information on each lawful basis at the end of this section).

Purpose for processing	Lawful basis
Recruiting and contracting process. We process your personal data to manage the recruitment and selection process, including candidate sourcing, application review, interviews, assessments, internal evaluations, and the extension and management of job offers. When you submit your job application via our website or third party platforms (such as LinkedIn), we will process your data to assess your suitability for the specific role applied for and, where relevant, for other similar vacancies. If hired, this data will be part of your employee file.	This processing is essentially necessary for the performance of the contract or pre-contractual process.
Meeting transcriptions. The Company uses written transcription functionalities to streamline the time spent on note-taking and feedback in our meetings (including job interviews). Transcriptions, used solely by the Talent Acquisition and recruiting team for internal purposes, are deleted as soon as possible and no later than after one week, unless strictly necessary. This processing will not imply any voice or image recording of the call, and it will only involve the transcription of meeting sections related to the essential purpose of the meeting (i.e. in the case of a job interview the transcription will only be focused on that part of the meeting where the integrants will discuss the job position and the candidates’ profile). In any case, the team in charge of the meeting will always inform you when the transcription is going to start, and when it is going to end.	This processing is necessary for our legitimate interest in improving efficiency and effectiveness (it increases the objectiveness of the notes taken and, therefore, also the decisions, it eliminates the focus on taking notes, enriches the meeting with more interactions and follow-up questions, it makes more efficient any decision to be taken after the meeting, speeding the actions and processes), unless consent is legally needed, in which case we will ask for it.
Talent pool. If you are not selected, we may keep your CV and related data for a period of up to two (2) years from the date of your application for the period that has passed, we will contact you by email to request your consent to retain your personal data for a longer period.	This processing is based on the Company’s legitimate interest in contacting prospective candidates about job opportunities similar to those for which they previously applied. You may object to this processing at any time, as described in Section 7 of this Notice (“How can you control the personal data you have given to us?”).After the two (2)-year period, we will continue this processing with your consent. Your consent will remain valid for one (1) year. Additionally, if you access your profile during that period to apply for a new role or you give again your consent, the one-year period will automatically renew from the date of your most recent activity. If no further activity occurs before the end of that period, your personal data will be anonymised.You may withdraw your consent at any time as described in Section 7 of this Notice (“How can you control the personal data you have given to us?”). Please note that the withdrawal of your consent does not affect the lawfulness of any processing activities based on such consent before its withdrawal.
Communications. We process your data to communicate with you regarding your application, including status updates, interview scheduling, request for additional information and related administrative matters. These communications are strictly necessary given their nature.	This processing is mainly based on our pre-contractual relationship understood as the hiring process.
Surveys. We may invite you to complete surveys to evaluate and improve our recruitment processes. Surveys are designed to be anonymous.	This processing is mainly based on our Company’s interest to gather information about your satisfaction and quality perception regarding the process as this information will improve our hiring process. You can oppose the processing of your personal data as described in Section 7 of this Notice (“How can you control the personal data you have given to us?”).
Recruitment events. We frequently host recruitment events and open days. When you register for or attend one of these events, the processing of your personal data (including attendance management and any photography or filming) is governed by our specific Candidate Event Privacy Disclaimer.	For further details concerning our legitimate interest in recruitment events, kindly consult the Candidate Event Privacy Disclaimer.
Contests and referral programmes. We aim to create a collaborative and engaging recruitment environment through contests and our Referral Programme.	Your participation in contests will be subject to the terms of the contest, which will normally be based on your voluntary participation (and, therefore, based on the contractual relationship understood as the acceptance of the terms of the contest). Referees sending others’ personal data within the Referral program are obliged to gather in writing the third party’s consent to provide their personal data for our Referral program. eDreams ODIGEO could eventually ask for proof of the third party’s valid consent as per the EU GDPR. The Referee is responsible for such a purpose.
Legal and compliance purposes. We may process your personal data where necessary to ensure compliance with applicable laws, internal policies and corporate governance standards, as well as to protect our legal position. In particular, personal data may be processed for the following purposes: A) Internal compliance and investigations: To detect, prevent and investigate potential breaches of internal policies, codes of conduct, ethical standards or applicable regulations, including situations involving suspected misconduct, fraud, conflicts of interest or other irregularities related to the recruitment process. B) Regulatory and statutory compliance: To comply with applicable labour, employment, tax, social security, equality, diversity, anti-discrimination or other regulatory requirements. This may include responding to requests, audits or inspections from competent authorities. C) Legal claims and dispute management: To establish, exercise or defend legal claims, whether in judicial, administrative or out-of-court proceedings, and to manage pre-litigation situations or potential disputes arising from the recruitment process.	This processing is necessary for compliance with a legal obligation to which the Company is subject. This processing is necessary for the purposes of the Company’s legitimate interests, in particular ensuring regulatory compliance, mitigating legal and reputational risks, protecting Company assets and personnel, and defending legal claims.

Lawful bases we rely on. We process your personal data only where we have a valid legal basis under Article 6 of the EU GDPR. Depending on the specific purpose of processing, we rely on one or more of the following lawful bases:

Consent: When we process your personal data based on your prior, informed and freely given consent, we will provide clear and transparent information regarding the specific purpose of the processing. Consent requests will be presented in an accessible form and in plain language. You have the right to withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out prior to the withdrawal.
Contract: We process personal data where necessary to take steps at your request prior to entering into a contract (e.g. managing your application) or where processing is necessary for the performance of a contract with you.
Legal Obligation: We may process personal data where necessary to comply with legal or regulatory obligations to which we are subject. This may include obligations under labour, employment, tax, social security, equality or other applicable legislation, as well as responding to requests from competent authorities.
Legitimate Interest: We may process personal data where it is necessary for the purposes of our legitimate interests, provided that such interests are not overridden by your fundamental rights and freedoms. Where we rely on this legal basis, we assess and balance our interests against the potential impact on your rights. Examples may include improving recruitment processes, maintaining a talent pool, ensuring security, preventing fraud, or defending legal claims. You have the right to object to processing based on legitimate interests, as described in Section 7 of this Notice.

Automated Decision-Making. We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects.

Which kind of personal data do we collect?

Personal data can be defined broadly as information that relates to an individual where that individual is directly identified or could be identifiable when that personal data is combined with other information. The personal data that we may collect about you broadly fall into the following categories:

I. Personal and contact details. This may include identification and contact information such as your full name, nationality, postal address, telephone number and email addresses, or date of birth.

II. Recruitment information. We may process information relating to your academic and professional background, including your CV, languages, job application and right to work documentation. We may also process information relating to your employment history, such as start and end dates of previous roles, salary expectations, current place of employment, employment references and details of any secondary employment where relevant.

III. Internal and external communications data. We may process communications for quality control, analytics, staff training, know-how control and legal dispute purposes. Any personal information obtained from you during any communication will be processed in accordance with this Notice.

IV. Other information. We may also process other information you provide to us, such as responses to recruitment or hiring surveys (where not anonymised), participation in competitions or events, and any additional information you choose to share with us on a voluntary basis.

Data sources: We get information about you from the following sources: Directly from you; From recruitment or employment agencies;From your employer, where you are engaged as a secondee; From referees, either external or internal; andFrom online professional networking platforms, such as LinkedIn.

In any case, the information eDreams ODIGEO will process about you will vary depending on the specific role you apply for and your individual circumstances. Please do not include in your CV or any other documents you send us any personal data that you do not want us to use for the purposes described above.

Who will be the recipients of your personal data?

In certain circumstances, we may share your personal data with third parties:

I. Our group companies. Your personal data will be shared within our corporate group for internal administrative purposes, including centralised management and reporting. In any case, they will follow practices that are at least as restrictive within the terms of the applicable law and our internal Group Privacy Policy.

II. Third-party service providers. We will share your personal data with third-party service providers who support us in delivering recruitment and human resources related services, such as providers of recruitment platforms, human resources records and database systems, legal advisers and survey platform suppliers.

III. Competent authorities. We will disclose your personal data to public authorities, regulators, courts, or law enforcement bodies where we are legally required to do so, such as in response to a court order or statutory obligation. This may include disclosure to labour or tax authorities for purposes such as compliance with employment, tax, or social security obligations. This includes further disclosure of personal data to competent authorities to protect and defend our rights or properties, or the rights and properties of third parties (including Courts and Police, when necessary).

IV. Others. We may share your personal data with other parties where you have provided your consent to such disclosure, or where you have been transparently informed in advance and such disclosure is permitted under applicable law.

How do we protect your personal data?

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the EU GDPR. Among other measures, we can regroup the main protection actions we take within the following categories:

I. Security measures. While nobody can guarantee absolute security, we design our systems and devices with your security and privacy in mind. We work to implement appropriate safeguards to protect the confidentiality, integrity and availability of your personal data.

II. Retention procedures. We will retain your personal data for as long as necessary to manage our recruitment process, comply with applicable legal, contractual and internal obligations, exercise appropriate controls, resolve disputes, respond to requests or investigations from competent authorities, and otherwise operate our business, including detecting and preventing fraud or other unlawful activities.

As a general rule, we will retain your personal data for up to two (2) years from the date of your application. If you are hired, your recruitment records will become part of your employee file and will be retained in accordance with our employee data retention policy.

At the end of this initial two (2)-year period, we may retain your candidate profile and use your personal data to contact you about future career opportunities, provided that you have given your consent. In that case, we will retain your data for an additional period of one (1) year. If, during that period, you apply for another role, access or update your profile, or renew your consent, the one (1)-year period will restart from the date of your most recent activity or renewed consent. If there is no further activity or renewed consent before the end of that period, your personal data will be anonymised.

You may withdraw your consent at any time, including by unsubscribing from future career communications. We will always provide a clear and simple way to do so, both when we collect your personal data and in every communication we send.

For processing related to recruitment events, including photographs and recordings, the applicable retention periods are set out in the Candidate Event Privacy Disclaimer.

III. International data transfers. The Company’s servers are located in the European Economic Area (hereinafter, “EEA”), but sharing content on social networks may involve an international transfer of data to third countries whose data protection laws may not be as comprehensive as those of EEA countries. Disclosure of your data will be made, where appropriate, in accordance with applicable law and with appropriate safeguards to ensure an adequate level of protection of privacy and fundamental rights of individuals. Some of the safeguards we rely on to protect personal data transferred internationally include:

European Commission Adequacy Decisions, where applicable. These are decisions adopted by the European Commission under Article 45 of the GDPR (or equivalent decisions under other applicable laws) confirming that a country ensures an adequate level of protection for personal data.
European Commission Standard Contractual Clauses (hereinafter, “SCCs”), where an Adequacy Decision is not available. These contractual safeguards require recipients of personal data to process it in accordance with the GDPR’s data protection standards. Where necessary, we also implement supplementary measures to enhance the level of protection provided by the SCC.

How can you control your data and exercise your Privacy Rights?

We are committed to ensuring fair and transparent processing. That is why it is important to us that persons concerned can exercise the following rights where the respective legal requirements are satisfied:

Access or port your data. You may request information relating to your personal data and copies of such data. You may also be entitled to request copies of your personal information that you have provided to us in a structured, commonly used, and machine-readable format where technically feasible.
Rectify your data. You have the right to ask us to correct inaccurate or incomplete personal information about you that you cannot update yourself in your candidate profile.
Object to the use of your data. You may require us not to process your personal information for certain specific purposes where such processing is based on legitimate interest, such as for non-strictly necessary communications (e.g., notifications regarding relevant job opportunities or informing you about relevant activities like our referral program or other events). If you object to such processing, we will no longer process your personal information for these purposes unless we can demonstrate compelling legitimate grounds for such processing or such processing is required for the establishment, exercise, or defence of legal claims.
Erasure your data. You may request to have your personal information deleted. However, we may not be able to erase it immediately if the data processing is necessary to defend against potential legal claims related to the recruitment process, for our compelling legitimate Company interests, or to comply with our legal obligations (e.g., employment law reporting, auditing obligations). In any case, we will erase it as soon as we are legally able to do so.
Restrict the use of your data. You have the right to request that we suspend or restrict the processing of your personal information in certain scenarios. This applies if you contest the accuracy of your data, if the processing is unlawful but you oppose its erasure, if we no longer need the data but you require it for legal claims, or while we are verifying whether our compelling legitimate grounds override your right to object.

If we are processing your personal information based on your consent you may withdraw your consent at any time, specifying which consent you are withdrawing. Please note that the withdrawal of your consent does not affect the lawfulness of any processing activities based on such consent before its withdrawal.

In order to exercise your rights, or contact our DPO, please contact us by clicking here. In your request, you have to clearly state your personal identity, by indicating your complete name and the email address you used to apply or create an account, and the right(s) you are exercising.

We will come back to you as soon as possible and no later than one month after receipt of your validated request unless we need further time to manage your request, in which case we will inform you.

Please note that we may ask you to verify your identity and request before taking further action on your request. You can also ask the Supervisory Authority on Data Protection (for Spain https://www.aepd.es/) or any other applicable supervisory authority if you wish.