How Facthory protects, processes, and safeguards your data in full compliance with GDPR and international privacy standards.
This privacy statement is effective as of November 17, 2025. It will be updated from time to time to reflect any changes in the way we handle your personal data or any changes in applicable laws.
Unless stated otherwise, this privacy statement applies to all externally facing applications, services, tools, websites, and other data processing activities offered under the Facthory product and operated by Bandpey GmbH (“Bandpey”, “Facthory”, “we”, “us”).
If you have specific accessibility needs to access the content of this statement, we recommend that you, or someone on your behalf, consult our Accessibility Statement and related recommendations.
This page and its sub-pages explain how Bandpey GmbH, as the operator of Facthory, protects the personal data we process and control relating to you (“your personal data”; “your data”) and which rights you have in relation to the processing of your personal data.
Below, we first give a general description of how we protect your personal data. Further below, we also include specific information on the following:
We attach great importance to your right to privacy and the protection of your personal data. We want you to feel secure that, when you use Facthory or otherwise interact with Bandpey GmbH, your personal data are in good hands.
We protect your personal data in accordance with applicable data protection laws and our internal data privacy policies. In addition, we maintain appropriate technical and organizational measures to protect your personal data against:
The following sections provide further details as to how we process your personal data:
We collect personal data of:
If the data we collect are not listed in this privacy statement, we will, where required by law, give individuals appropriate notice of which additional data will be collected and how they will be used.
The personal data we collect includes the categories of personal data described in the sections:
as well as any other categories of personal data referred to in this privacy statement or in other notices you have received.
Below is a chart describing categories of personal data we may collect and process:
| Category of personal information | Types of personal information captured by category |
|---|---|
| Personal details, contact details, and identifiers | Name, pronoun, all types of identifiers and contact details (such as e-mail, phone numbers, physical address) and occasionally, when necessary for specific purposes, gender, date of birth, age, place of birth. |
| Commercial information | History and records of the products and services you have obtained from Facthory / Bandpey. Correspondence between you and us when it is sent to a dedicated mailbox or via other electronic communication means (including communication channels supported by artificial intelligence), for the purpose of processing account receivable payments and commercial follow-up. |
| Marketing and research information | 1. Identifiers – the IP address, social media handle or other online identifiers of a person, e-mail address/mobile number if used for direct marketing, and name and address. 2. Demographic data (e.g. income, family status, age bracket, gender, interests, pets, home ownership, health, current service providers). 3. Browser/web history data and preferences expressed through selection/viewing/purchase of goods, services and content; information about your mobile device including (where available) type of device, device identification number, mobile operating system. 4. Social media content – blogs, posts and anything posted by an individual online or which mentions/references an individual. 5. Analytics and profiles of individuals based on the data collected on them. 6. Voice-enabled services (Speech-to-Text engines for search requests) without being recorded or stored by the mobile device. |
| Sensitive data and biometric information | We may also collect certain types of sensitive information, where permitted by local law or with your consent, such as health/medical information (including disability status and dietary requirements/allergies in the framework of events we organize/sponsor) or biometric information, for example when you elect to use fingerprint authentication. |
| Position and professional or employment-related information | Professional or employment-related information, such as description of current position, job title, employer, location, and Bandpey/Facthory contact(s). |
| System and application access data and Internet and electronic network activity information | Where you are provided with access to Bandpey/Facthory systems, we may collect information required to access such systems and applications such as System ID, LAN ID, e-mail account, instant messaging account, mainframe ID, system passwords, and internet or other electronic network activity information, including access logs, activity logs, and electronic content produced using our systems. |
| Cookies and geolocation data | As described in our Cookies Policy, we may collect geolocation data in some circumstances. Please see our Cookies Policy for more details regarding our use of cookies. |
| Alumni-related information (Bandpey alumni) | 1. Information you provide us when you register as a Bandpey alumnus/alumna or update your profile including your name and email address. If you were previously a user of another Bandpey alumni website, additional data you provided there may be automatically added to your profile at the Alumni Site. Your user profile may allow you to provide a wide range of additional data, including postal address, current occupation, industry, education, and personal and business interests. 2. Correspondence between you and us in relation to the Alumni Site. 3. Data you post on the Alumni Site, such as on chat pages. 4. Responses to online surveys that we use for research and quality control purposes. 5. Details on (former) compensation and payroll. 6. Details on (former) position. 7. Birth year when necessary for specific purposes. 8. Personal information we already have in our Bandpey systems such as (former) Enterprise ID, (former) office location, telephone number, home address and education or training – used to verify your identity when registering on our Alumni Site. |
In addition, for recruitment/employment purposes, we may process the personal information set out in the table below.
| Category of personal information | Types of personal information captured by category |
|---|---|
| Additional personal details, contact details and identifiers | In addition to the personal details listed above, we may collect additional personal details for recruitment/employment purposes, such as national identification number, social security number, insurance information, marital/civil partnership status, domestic partners, dependents, emergency contact information, professional/personal calendar availability/scheduling information for meeting/communication purposes. |
| Commercial information | History and records of the products and services you have obtained from Bandpey/Facthory. Correspondence between you and us when it is sent to a dedicated mailbox or via other electronic communication means (including communication channels supported by artificial intelligence), for the purpose of processing account receivable payments and commercial follow-up. |
| Education information and professional or employment-related information | We may collect information about your education and professional or employment-related information, such as your employment history. |
| Sensitive data for recruitment purposes | We may collect certain types of sensitive information when permitted by local law or with your consent, such as health/medical information (including disability status), trade union membership information, religion, race or ethnicity, minority flag, and information on criminal convictions and offences. This is collected for specific purposes, such as accommodating a disability or illness (subject to legal limits on timing and other applicable limitations) and providing benefits; background checks; and diversity-related personal information (such as race or ethnicity) to comply with legal obligations and internal policies relating to diversity and anti-discrimination. |
| Documentation required under immigration laws | We may collect data on citizenship, passport data, and details of residency or work permit (physical and/or electronic copy). |
| Financial information for payroll/benefits purposes | Your banking and other relevant financial details needed for payroll and benefits administration. |
| Talent management information | Information necessary to complete a background check; details on performance decisions and outcomes; performance feedback and warnings; e-learning/training programs; performance and development reviews (including information you provide when asking for/providing feedback, creating priorities, and updating your input in relevant tools); driver’s license and car ownership information; and information used to populate biographies. |
| Requested recruitment information | Information requested during the recruitment process, to the extent allowed by applicable law. |
| Recruitment information you submit | Information that you submit in résumés/CVs, letters, writing samples, or other written materials (including photographs). |
| Information generated by us during recruitment | Information generated by interviewers and recruiters based on their interactions with you or basic Internet searches where allowed under applicable law. |
| Recruitment information received from third parties | Information related to you provided by third-party placement firms, recruiters, or job-search websites, where applicable. |
| Audiovisual information processed during recruitment | Photograph and images/audio/footage captured in video recruitment interviews. |
| Recommendations | Recommendations related information provided on your behalf by others. |
| Immigration | Documentation and related information required under immigration laws. |
| Employment history and background checks | Information about your prior employment, education, and, where applicable and allowed by law, credit history, criminal records or other information revealed during background screenings. |
| Diversity-related information | Information about race/ethnicity/religion/disability/gender and self‑identified LGBT status, for purposes of government reporting where required by law, as well as to understand the diversity characteristics of the Bandpey workforce, subject to legal limits. |
| Assessment information | Information generated by your participation in psychological, technical or behavioral assessments. You will receive more information about the nature of such assessments before participation. |
We may also derive inferences about you based on the information described above and collect other information about you as described in this privacy statement. If you provide us with personal information of another person (for instance, a potential employee/referral), you are responsible for ensuring that such person is made aware of the information contained in this privacy statement and that the person has given you his/her consent for sharing the information with Bandpey/Facthory.
The above-mentioned categories of personal data are obtained either:
Such third parties include our affiliates, public authorities, public websites and social media, suppliers and vendors.
Except where certain information is required by law or by our internal policies (including management of an employment relationship with Bandpey), your decision to provide any personal data to us is voluntary. Please note that if you do not provide certain information, we may not be able to accomplish some or all of the purposes outlined in this privacy statement, and you may not be able to use certain tools, features, or systems which require the use of such personal data (including specific Facthory functionality).
We use your personal data only where required for specific purposes. The table below sets out:
| Purpose | Legal Basis |
|---|---|
| Managing our contractual and/or employment relationship with you. | Necessary for the performance of a contract to which you are a party. |
| Recruitment. | Justified on the basis of our legitimate interests for ensuring that we recruit the appropriate employees. |
| Facilitating communication with you (including facilitating meetings; communication in case of emergencies; and providing you with requested information). | Justified on the basis of our legitimate interests for ensuring proper communication and emergency handling within the organization. |
| Operating and managing our business operations, including or being part of the provision of our services to our clients and their employees/contractors and customers, for example in collecting their data as part of surveys, data analytics, marketing research or other purposes. | Justified on the basis of our legitimate interests for ensuring the proper functioning of our business operations. |
| Complying with legal requirements. | Necessary for compliance with a legal obligation to which we are subject. |
| Monitoring your use of our systems (including monitoring the use of our website, Facthory, and any apps and tools you use). | Justified on the basis of our legitimate interests of avoiding non-compliance and protecting our reputation and systems. |
| Social listening (identifying and assessing what is being said about Facthory/Bandpey and our clients on social media, using only publicly accessible content, to understand sentiment, intent, mood, market trends and stakeholder needs and thereby improving our services). | Justified on the basis of our legitimate interest in protecting our assets and our brand on social media. |
| Improving the security and functioning of our website, networks and information. | Justified on the basis of our legitimate interests for ensuring that you receive an excellent user experience and that our networks and information are secure. |
| Undertaking data analytics, including applying analytics to business operations and data to describe, predict and improve business performance and/or provide a better user experience (including marketing analytics and analytics related to the organization of events/meetings; more details on how we run analytics on our website can be found in our Cookies Policy). | Justified on the basis of our legitimate interests for ensuring the proper functioning and improvement of our business operations. |
| Marketing our products and services (including Facthory) to you (unless you have objected as further described in the section “How do we use personal data for marketing purposes?”). | Justified on the basis of our legitimate interests for ensuring that we can conduct and grow our business. |
| Using audio/video captured during live/recorded events (including virtual events/webinars) to inform interested stakeholders about the content of such events/recordings (including online publication of such recordings for marketing purposes). | Based on your informed consent obtained prior to the event, where required by law. |
| Specific Recruitment/Employment Purposes | Legal Basis |
|---|---|
| Assess your suitability for employment for the role for which you are applying, as well as future roles that may become available. | Justified on the basis of our legitimate interests of ensuring that we recruit appropriate employees. |
| Manage your application. | Justified on the basis of our legitimate interests of ensuring that we recruit appropriate employees. |
| Facilitate communication with you. | Justified on the basis of our legitimate interests of ensuring proper communication within the organization and with you. |
| Perform administrative functions (e.g. reimburse you for interview-related expenses). | Justified on the basis of our legitimate interests of ensuring that we recruit appropriate employees. |
| Perform data analytics, including analysis of our applicant pool in order to better understand who is applying to positions and how to attract and keep top talent. | Justified on the basis of our legitimate interests of continually improving our recruitment processes. |
| In some cases, record your online interview for review by additional recruiters and hiring managers. | Justified on the basis of our legitimate interests of ensuring appropriate hiring decisions. |
| If you register on our Careers website, enter you into a database to receive future mailings about positions and events, and possibly provide personalized job recommendations. | Justified on the basis of our legitimate interests of ensuring that we recruit appropriate employees. |
| Administration of employee benefits. | Justified on the basis of our legitimate interests of ensuring that our employees receive applicable benefits. |
| Perform legally required reporting and respond to legal process. | Compliance with a legal obligation. |
| Specific Alumni Information-Related Purposes | Legal Basis |
|---|---|
| Manage your application (as an alumnus/alumna). | Justified on the basis of our legitimate interests of maintaining contact with our alumni community. |
| Research and analyze alumni demographics, interests and behavior in aggregated form. | Justified on the basis of our legitimate interests to better understand and serve our users and improve the Alumni Site and its offerings. |
| Contact alumni periodically with communications about events, publications or opportunities which we feel might interest you (unless you ask not to be contacted). | Justified on the basis of our legitimate interests for ensuring proper communication with, and sending relevant marketing to, our alumni. |
Legitimate interest means that we have reasonable grounds to process your personal information. Where the tables above state that we rely on legitimate interests for a given purpose, we are of the opinion that our legitimate interests are not overridden by your interests, rights or freedoms, taking into account:
If you wish to obtain further information on this balancing test, please contact our Data Protection contact at privacy@facthory.com.
We will process your personal information for the purposes mentioned above based on your prior consent where such consent is mandatory under applicable laws.
To the extent you are asked to click on/check “I accept”, “I agree” or similar buttons/checkboxes/functionalities in relation to a privacy statement, doing so will be considered as providing your consent to process your personal information only where such consent is required by mandatory law.
We will not use your personal information for purposes that are incompatible with the purposes of which you have been informed, unless it is required or authorized by law, or it is in your vital interest (e.g. in case of a medical emergency) to do so.
We may transfer personal data to:
Such third parties may be located in other countries. Before we do so, we take necessary steps to ensure that your personal data will be given adequate protection as required by relevant data privacy laws and our internal policies. We may also transfer your personal data to any of our global affiliates/partners in furtherance of any visits to our locations.
For example, we may disclose personal information to third parties for other business purposes as follows:
We may also share your information in connection with a substantial corporate transaction, such as the sale of a website or product line, a merger, consolidation, asset sale, initial public offering, or in the unlikely event of a bankruptcy.
Unless you are otherwise notified, any transfers of your personal data from within the European Economic Area (EEA) to third parties outside the EEA will be based on an adequacy decision or will be governed by standard contractual clauses (a copy of which can be obtained through the contact information included below). Any other non-EEA related transfers of your personal data will take place in accordance with the appropriate international data transfer mechanisms and standards.
We do not generally seek to collect sensitive data (also known as special categories of personal data within the EEA) through the Facthory website or related services. In the limited cases where we do seek to collect such data, we will do so in accordance with applicable data privacy law requirements and/or ask for your explicit consent.
“Sensitive data” refers to various categories of personal data identified by data privacy laws as requiring special treatment, including in some circumstances the need to obtain explicit consent. These categories include:
We maintain organizational, physical, and technical security arrangements for all personal data we hold. We have protocols, controls, and relevant policies, procedures and guidance to maintain these arrangements, taking into account the risks associated with the categories of personal data and the processing we undertake.
We adopt industry-standard security measures to protect your personal data and continuously improve those measures where appropriate.
Your personal data may be processed and stored on servers located in local zones and/or other jurisdictions where we or our service providers operate, always subject to applicable data protection requirements and adequate safeguards.
If we do not obtain your personal information directly from you, we may obtain it from the following sources:
Additional information on the sources of your personal information for marketing purposes can be found in section 4 (“How do we use personal data for marketing purposes?”).
We will retain your personal data only for as long as is necessary for the purposes for which it is processed. We maintain specific records management and retention policies and procedures, so that personal data are deleted after a reasonable time according to the following criteria:
Subject to applicable law, you may have the following rights in relation to your personal data:
To the extent that the processing of your personal data is based on your consent, you have the right to withdraw such consent at any time by contacting us at privacy@facthory.com. Please note that this will not affect our right to process personal data obtained prior to the withdrawal of your consent, nor our right to continue certain processing based on other legal bases.
If, despite our efforts to protect your personal data, you believe that your data privacy rights have been violated, you have the right at all times to:
You can also contact us to exercise any of your rights. If you would like to exercise your erasure, rectification, or access rights in reference to your data as a job applicant, you may also contact us via the channels indicated below.
In addition to the information set out above, the following sections describe how we use personal data when you visit Facthory’s websites:
We collect personal data on our websites in two ways:
We may collect and process the following personal data:
Our websites may include:
Where this is the case, such third parties may process your personal data collected through such programs for their own purposes. We do not accept any responsibility or liability for such third parties’ sites or programs. Please check such third parties’ terms of use and privacy statements before using and providing any information to such third parties’ sites and programs.
We use personal data for the purposes described in the section “For which purposes and on which legal basis do we use your personal data?” above, as well as to:
We analyze your IP and browser information to determine what is most effective about our website, to help us identify ways to improve it and make it more effective. Please see the Cookies section and our Cookies Policy for more information.
In addition to the information set out above, this section describes how we use cookies and other tracking technologies.
We analyze your IP address and browser information to determine what is most effective about our website, to help us identify ways to improve it and, ultimately, to determine how we can tailor our website to make it a more positive and relevant user experience.
Please see our Cookies Policy for more details, including information about your choices with respect to advertising and social media cookies and for access to our cookie consent manager. By using our website, you agree that we can place cookies and other similar technologies on your device as explained in our Cookies Policy, to the extent permitted by applicable law and your cookie settings.
In addition to the information set out above, the following sections describe how we use personal data for marketing purposes:
The bulk of the personal data we collect and use for marketing purposes relates to individual employees of our clients and other companies with which we have an existing business relationship, or would like to develop one. We may also obtain contact information from public sources, including content made public on social media websites, to make an initial contact with a relevant individual at a client or other company.
We may send commercial and informational email to individuals at our clients or other companies with whom we want to develop or maintain a business relationship, in accordance with applicable marketing laws.
Our targeted email messages may include web beacons, cookies, and similar technologies that allow us to know whether you open, read, or delete the message, and which links you click. When you click a link in a marketing email you receive from us, we may also use a cookie to log which pages you view and which content you download from our websites, even if you are not registered at or signed into our site.
Targeted emails from Facthory/Bandpey may include additional data privacy information, as required by applicable laws.
Where available, you may adapt your contact, content and data preferences in our preference center at any time or use the unsubscribe link in our emails.
If you use our mobile applications, you may receive notifications such as alerts about Facthory functionality, industry topics you selected to follow, or live event information. With your consent, provided through app permissions/settings, we may send push notifications or alerts to your mobile device even when you are not logged in.
You can manage your push notification preferences or deactivate these notifications at any time by turning off the notification settings in the mobile app or in the device settings/app permissions of your mobile device.
Like most companies, we use customer relationship management (CRM) database technology to manage and track our marketing efforts. Our CRM databases may include personal data belonging to individuals at our client and other companies with whom we already have a business relationship or want to develop one.
The personal data used for these purposes includes relevant business information, such as:
We may combine data from publicly available sources and from our different email, website, and personal interactions with you. This includes information collected across our different websites (such as careers and corporate sites) and information collected when you sign up or log in to our sites, or connect to our sites using your social media credentials (such as LinkedIn).
We combine this data to better assess your experience with Facthory and Bandpey and to perform the other activities described throughout this privacy statement.
In addition to the third parties mentioned in the section “Will we share your personal data with third parties?”, we may share your personal data with marketing agencies or other service providers who support our marketing campaigns, subject to appropriate contractual safeguards.
You can exercise your right to prevent marketing communications by:
In such cases, we will retain minimal personal data to record that you opted out, in order to avoid contacting you again for marketing purposes.
In addition to the information set out above, the following sections describe other specific uses of personal data by some Bandpey affiliates, including content creation and production activities.
Some Bandpey entities are engaged in content production (e.g. TV, film, marketing, advertising or other related content creation, production, and distribution).
We may process your personal data in connection with these activities, for example:
If you have any questions on data privacy aspects of our production activities, please contact us using the details below.
Please contact us if:
You can contact us as data controller of your personal data via:
