Privacy Policy Careers Portal / Information about our application process

A. General

CureVac attaches great importance to the protection of your personal data and collects, processes and uses your personal data on the Careers Portal in accordance with the principles described below and in compliance with applicable data protection laws.

The entity responsible for the operation of the careers website including adapted versions for mobile devices such as smartphones (hereinafter "Careers Portal") is CureVac AG (hereinafter "Curevac, "we", "us"). Please note that some functions of the careers portal may not be available on mobile devices (e.g. smartphones).

Data controller

CureVac AG (and all affiliated companies)

Friedrich-Miescher-Str. 15

D-72076 Tübingen / Germany

Tel.: +49-7071-9883-0

Fax: +49-7071-9883-1101



Data Protection Officer of the Data Controller

Daniel Babka

CureVac AG

Friedrich-Miescher-Str. 15

D-72076 Tübingen / Germany

Tel.: +49-7071-9883-1611


This privacy policy explicitly applies only to the CureVac Careers Portal.

The general data protection provisions of all CureVac companies can be viewed at

B. Your personal data

Personal data is any information that relates to an identified or identifiable natural person. CureVac collects, processes and uses your personal data only insofar as this is permitted by law or you have given your consent to do so, e.g. for the purpose of contact through our recruiting team.

C. Application to CureVac

To apply for a job at CureVac, you need to register via our Careers Portal.

After registration and the associated creation of a candidate account (hereinafter referred to as "Account") with CureVac, the second step is to apply for a specific vacancy/position (see section D.). You have the possibility to update your data in your account at any time and to add further information on a voluntary basis.

Furthermore, we process the following personal data as part of the recruitment process:

  • Basic data (e.g.: Name, contact details, marital status, date of birth, gender, nationality or citizenship);
  • Sensitive data such as religious affiliation or denomination or any severe disability (only if stated by you);
  • Education, work history, references, skills, competences and other information from your documents;
  • Willingness to possibly relocate if hired;
  • Driving licence class, if applicable, including any training and certificates for the management and use of company cars or vehicles for official use;
  • If applicable, information from a certificate of good conduct, depending on the position for which you are applying;
  • Personal data contained in log files or security reports (in particular IP address, user name, password, location and time of access to our network) for the purpose of system protection and monitoring and logging the use of our network to be able to ensure its security;

By registering with CureVac, you consent to the above data (mandatory data, voluntary data, automatically collected data) being accessed and used for statistical and analytical purposes by CureVac and its affiliates worldwide. If you have consented, this data may be used by employees of CureVac and its affiliated companies worldwide to contact you.

You can find more information about the locations and affiliated companies of CureVac at

Some of the companies affiliated with CureVac are based in countries outside the EU or the EEA, which do not offer a level of protection for personal data comparable to that in Germany.You can revoke this consent at any time with effect for the future. In this case, however, your account with CureVac will be deleted. You also have the option to delete your account with CureVac at any time (see section I).

D. Applying for jobs

In order to apply for a job, in addition to registering and creating an account in the applicant management system, you must provide further data, such as your place of residence. To make it easier for you to handle the accounts, the registration data (e-mail address and password) for the account in the applicant management system will be saved, so that you can log in at any time with this data in the applicant management system. Likewise, the other data you provide during registration is transferred automatically into the applicant management system.

Your personal data and attachments (such as CV) that you enter in the applicant management system after registration will only be stored and used for the purpose of an application process or its initiation. In case of transfer of your personal data to affiliates of CureVac, your data will be stored and processed in accordance with the applicable law. You are responsible for ensuring that your data is correct and true. We would like to point out that false statements in the application process may still have consequences under labour law even after you have been hired. Your data will be made available to all CureVac companies for the purpose of filling vacancies.

The relevant employees of the human resources department and the persons involved in filling the position of the respective company or companies have access to your data. In addition, selected employees of data controllers have access to your data for administrative purposes. You have the option at any time to adjust the selections you have made and to change your personal details. Likewise, you can completely delete your account in the applicant management system at any time. In this case, your current applications with CureVac will also be completely deleted.

After the end of the application process, all data relating to a specific application will be deleted in accordance with the applicable statutory provisions. Depending on the country in which you have applied, this period may vary.

The following retention period applies after the end of the application process: 3 months. If you are hired, your data will be stored and processed as employee data.

E. Legal basis for the processing of your personal data

The legal basis is generally Article 6(1)(b) of the General Data Protection Regulation EU 2016/679 (GDPR), which authorises the processing of your personal data for the purpose of fulfilling pre-contractual measures with us.

If information about you is not required for this purpose, we will only process it with your consent according to Article 6(1)(a) GDPR. With regard to possible compliance activities, the legal basis is Article 6(1)(c) and Article 6(1)(f) GDPR, as the processing of the respective personal data may be necessary for our legitimate interests. Such legitimate interests aim to ensure that relevant breaches are reported to us and that compliance with applicable laws is being examined.

To the extent that we transfer your personal data to companies in our group other than our own group-wide IT service provider and do not do so within the scope of commissioned processing, the legal basis for such transfers is again Article 6(1)(f) GDPR. Our legitimate interests in this regard are (i) a centralised global IT approach with harmonised processes and (ii) cost savings resulting from the operation of centralised IT.

Furthermore, Article 6(1)(c) can be applied as a legal basis, insofar as we need to process your personal data in order to comply with a legal obligation.

F. Further information on data processing

The constant development of the internet makes it necessary to adapt our privacy policy from time to time. We reserve the right to make appropriate changes at any time. Should you wish to contact us by e-mail outside of the applicant management system, we would like to point out that the confidentiality of the information transmitted is not guaranteed, as the content of e-mails can be viewed by third parties due to the system.

The provision of your personal data is a prerequisite for the application process and for your recruitment. If you do not provide us with the information we need, we will not be able to take your application into account for the positions we have advertised.

We do not make automated decisions solely via automated processing, including profiling, which has legal effects for you. The criteria used to determine the applicable retention periods are that we retain your personal data (i) for as long as is necessary for the application process, or (ii) beyond the duration of the application process, provided that this is required or if you have consented thereto, (iii) in accordance with applicable statutory retention laws, or (iv) for as long as you have not withdrawn any consent. In order to be able to advise you on career opportunities, based on your consent, your profile data will be stored in a talent pool, if not deleted my yourself, and until deleted by you in Furthermore, your profile will be deleted or made inactive if you do not use it for a certain period of time. This period may vary depending on the country you have applied to.

The following retention period applies after the end of the application process: 3 months.

G. Use of service providers / disclosure of personal data to third parties

For the provision of support and administrative tasks of CureVac AG and the applicant management system, CureVac uses selected external service providers within the EU/the EEA. In addition, CureVac and its affiliated companies may commission external service providers for services within the scope of the selection and processing of applications. These service providers process your personal data exclusively on behalf of and in accordance with the instructions of CureVac and the affiliated companies in compliance with this Privacy Policy and applicable laws. An adequate level of data protection is ensured and your personal data are protected from unauthorised access by means of required security measures (encryption, physical security measures of the servers, etc.).

A transfer of your data to the following categories of recipients is possible:

  • Group companies of CureVac
  • IT service providers
  • Disposal service providers
  • Authorities, offices, banks
  • Other service providers who support us, e.g. with regard to the recruitment process.


H. Cookies

Some of our websites use what is known as cookie technology. A cookie is information that is sent from our web server to your computer (strictly speaking: in your browser directory) as soon as you visit the website.
We use the following cookies on some of our websites:

  • Session cookies. These cookies only persist until you end your internet session and close your browser completely. They do not contain any personal data and are used only for the statistical analysis of interest in our websites.
  • Third party cookies. We allow the following third parties to place cookies on your computer via these web pages:

Strictly necessary cookies:

We use the following session cookies, all of which are necessary for the Careers Portal to function:

  • "route" is used for session stickiness
  • "careerSiteCompanyId" is used to send the request to the correct data centre
  • "JSESSIONID" is placed on the visitor's device during the session so that the server can identify the visitor
  • "Load balancer cookie" (actual cookie name may differ) prevents a visitor from jumping from one instance to another

Functional cookies:

YouTube is a video sharing service where users can create their own profile, upload, watch, like and comment on videos. If you reject the YouTube cookies, you will not be able to watch or interact with YouTube videos.

Cookie policy:

Privacy policy:

Terms of use:

Embedded YouTube videos:

On our websites, we embed videos from the YouTube platform in extended data protection mode, which are not stored on our servers. YouTube is operated by Google Ireland Ltd, Google Building Gordon House, Barrow St, Dublin 4, D04 E5W5, Ireland. When you call up the embedded video, a connection is established to the servers of the provider YouTube in the USA and certain information (e.g. your IP address) is sent to the provider, even if you are not logged in to the provider. We do not obtain knowledge of the type and scope of the data collected by YouTube and have no influence on its use. For details of the purpose and scope of data collection and the further processing and use of the data by YouTube, as well as your rights in this regard and the available settings options for protecting your privacy, please refer to the provider's privacy policy: Privacy policy of Google:

Playing the embedded videos is only possible if you have previously consented to the transmission of your data to YouTube in the USA in accordance with Article 49(1)(a) GDPR. There is no adequate level of data protection in the USA. This entails risks such as the lack of enforcement of data subjects' rights or possible access by state authorities. You can revoke your consent at any time with effect for the future.

I. Reference to lack of confidentiality in internet communication and security

CureVac AG uses technical and organisational security measures in order to protect the data you have made available from accidental or intentional manipulation, loss, destruction or access by unauthorised persons. Our safeguarding measures are continuously revised in line with technological developments. In the case of the collection and processing of personal data, the information is transmitted in unencrypted form.

Please note that complete confidentiality and data security cannot be guaranteed when communicating via the Internet (e.g. by e-mail).

We do not use automated decision-making or profiling.

J. Your rights

(1) You have the following rights in relation to personal data relating to you:

  • In accordance with Article 15 GDPR you can request information about the personal data we process, in particular the purposes of processing, categories of data, recipients, planned storage period, the existence of a right to rectification or erasure or restriction of processing or a right to object to such processing, the existence of a right to lodge a complaint with a supervisory authority if the personal data are not collected from the data subject, any available information about the origin, the existence of automated decision-making and profiling
  • immediate rectification and/or completion under the conditions of Article 16 GDPR, if your personal data are inaccurate or incomplete
  • immediate erasure according to Article 17 GDPR
  • demand the restriction of processing if you dispute the accuracy of the data, the processing is unlawful, you refuse erasure and instead demand restriction of use and we no longer need the data, but you need it for the assertion, exercise or defence of legal claims or you have objected to the processing pursuant to Article 21
  • object to the processing of your personal data in accordance with Article 21 GDPR if it is processed on the legal basis of legitimate interests Article 6(1)(1)(f), for reasons arising from your particular situation
  • In accordance with Article 20, you can request to receive your personal data that you have provided in a structured, common and machine-readable format and to transfer this personal data to another controller (right to data portability)
  • You have the right to revoke your declaration of consent under data protection law at any time. The revocation of consent shall not affect the lawfulness of the consent given on the basis of the consent until revocation
  • If you would like to make use of one or more of these rights, you can contact one of our employees at any time.

(2) You also have the right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 GDPR about the processing of your personal data by us. In particular, you can contact the supervisory authority of your place of residence, your place of work or the alleged infringement. The data protection supervisory authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg

PO Box 102932

70025 Stuttgart

T: +49 711 615541 – 0

F: +49 711 615541 – 15


Effective: December 2021