Privacy Notice

Effective Date: October 2023 

Last Updated: August 13, 2026

This Privacy Notice (“Notice”) describes how Taktile GmbH, Taktile LLC, Taktile Ltd, and Taktile SRL (collectively, “Taktile,” “we,” “us,” or “our”) collect, use, disclose, and protect Personal Data. In this Notice, “Personal Data” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual.

This Notice applies when you:

Please note that this Notice does not apply to Personal Data that our customers provide or otherwise make available to us for processing on their behalf, in our role as Service Provider and Data Processor, in connection with the delivery of our products and services to them (“Covered Personal Information”). Our processing of Covered Personal Information is governed by our customer Data Processing Agreement (“DPA”).

If you are a Taktile customer, you may access our Global Data Processing Addendum at [taktile.com/dpa].

If you are an end user of a Taktile customer and have questions about how your data is processed on our customer's behalf, please contact that organization directly and refer to their privacy notice.

The Taktile entity responsible for your Personal Data depends on your location and the nature of your relationship with us:

For all website-related processing (cookies, analytics, web forms), Taktile GmbH is the controller regardless of your location, in conjunction with Taktile LLC for visitors identified as North American residents.

Carl Gottlieb, c/o Taktile LLC, 200 Vesey Street, Brookfield Place, New York, NY 10281, USA. Email: carl.gottlieb@taktile.com 

For all privacy inquiries, rights requests, or complaints: privacy@taktile.com

We collect the categories of personal information (as defined in the California Consumer Privacy Act, “CCPA”) listed in the table below. This notice is provided pursuant to California Civil Code § 1798.100.

We collect and use the above-listed categories of personal information to provide and manage the Services and achieve the business and commercial purposes described in this Notice. We retain each category of personal information for as long as necessary to fulfill those purposes, as detailed in Section 7.

We do not use or disclose sensitive personal information for any purpose outside of the limited permissible purposes set forth in the CCPA regulations.

As noted in the table above, we “share” (as defined in the CCPA) certain categories of personal information for cross-context behavioral advertising. You may exercise your right to opt out by clicking the “Do Not Sell or Share My Personal Information” link in our website footer, or by enabling Global Privacy Control (GPC) in your browser.

More information, including a description of your California legal rights, can be found in Section 11 (“California Privacy Rights”).

We may collect Personal Data about you from various sources, as described below.

Where applicable, we may indicate whether and why you must provide us with your Personal Data as well as the consequences of failing to do so.

When you visit and interact with our website, we (and our service providers and partners) may use cookies and other similar technologies to collect certain data automatically:

We also use third-party analytics and tracking tools to better understand who is using our website, how visitors interact with it, and how to improve its effectiveness. We may also use these tools to help us or our third-party partners serve interest-based advertisements. These tools may include cookies, pixel tags, or similar technologies. Our third-party partners and providers may combine data collected from your interactions with our website with data they collect from other sources.

Server log data is anonymized by IP address truncation after seven days and is not combined with other data sources.

To learn more about your interest-based advertising choices, please see Section 10 (“Your Choices”).

We may obtain Personal Data about you from third parties, including:

We may combine the Personal Data that we collect from and about you, including data you provide to us, data we automatically collect through the website, and data we receive from third-party sources, and use the combined data for the purposes described in this Notice.

For detailed information about how we process personal data of job applicants, please see Appendix A: Applicant Privacy Policy below. A separate Employee Privacy Notice is provided to employees at the time of onboarding.

We use the Personal Data we collect for the following purposes:

We will also use your Personal Data as described to you at the point of data collection or with your consent.

Applicable law in certain jurisdictions requires us to set out the legal basis upon which we process your Personal Data. Where applicable, the legal bases are as follows:

Before we disclose your Personal Data to a non-agent third party, or before we use it for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by you, we will offer you the opportunity to opt out of such disclosure or use.

For sensitive information (e.g., health data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, data concerning sex life), we will obtain your affirmative, express (opt-in) consent before disclosing it to a non-agent third party or using it for a purpose other than those for which it was originally collected or subsequently authorized.

We may disclose Personal Data to the following categories of recipients:

Taktile Affiliates. We may disclose your Personal Data to Taktile LLC, Taktile GmbH, Taktile Ltd, and Taktile SRL for any of the purposes described in this Notice, subject to the transfer safeguards described in Section 9.

Service Providers. We engage third-party service providers, such as hosting, security, and analytics providers, to assist us in operating our business. Each provider processes data under our instructions and is bound by a data processing agreement.

Analytics and Advertising Partners. We disclose Personal Data to analytics and advertising partners, including social media networks, third-party advertising networks, and other parties that assist us in serving and optimizing our advertisements. These disclosures may constitute “sharing” under the CCPA (see Section 11).

Professional Advisors. Legal counsel, auditors, and insurance providers, as needed for the operation of our business.

Governmental and Public Authorities. Where required by law, regulation, court order, or legal process, or to protect the rights, safety, or property of Taktile, its employees, or third parties. Taktile may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Business Transaction Parties. In connection with a merger, acquisition, reorganization, or sale of assets, your Personal Data may be transferred to the acquiring entity, subject to continued protection under this Notice or a successor notice.

Other Parties. We will disclose your Personal Data to other parties as we believe necessary or appropriate to: (i) comply with applicable law; (ii) protect our operations and those of our affiliates; (iii) investigate and prevent fraud; (iv) protect our rights, privacy, safety, property, and those of others; or (v) pursue available remedies or limit damages.

We may de-identify, anonymize, or aggregate Personal Data and disclose such information to third parties for various purposes as permitted by law. Where we de-identify data, we will maintain and use the data in de-identified form and will not attempt to re-identify the data except as required or permitted by law.

Taktile uses the following automated tools:

We do not make decisions with legal or similarly significant effects based solely on automated processing without human review. If this changes, we will update this Notice and provide appropriate notice, opt-out mechanisms, and the right to human intervention as required by applicable law.

Taktile operates in the United States, Germany, the United Kingdom, Romania, and Brazil. Depending on your country of residence, your Personal Data may be transferred to countries or regions with data protection and privacy laws that differ from those in your country of residence.

For transfers from the European Economic Area to countries without an EU adequacy decision, we rely on:

For transfers from the United Kingdom:

Romania is an EU/EEA member state. Transfers from Taktile SRL to other Taktile entities within the EEA do not require additional safeguards. Transfers from Taktile SRL to Taktile LLC and Taktile Ltd are subject to the safeguards in Sections 9.1 and 9.2.

For Personal Data of Brazilian contractors and candidates, Taktile relies on:

For transfers from Switzerland, Taktile LLC participates in the Swiss-U.S. Data Privacy Framework. See Section 13 for details. Where the Swiss-U.S. DPF does not apply, we use SCCs recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC).

We ensure that our service providers who process Personal Data outside the EEA, UK, Switzerland, or Brazil maintain appropriate transfer mechanisms (DPF certification, SCCs, or adequacy decisions) and data processing agreements. You may request details of the specific safeguards by contacting privacy@taktile.com.

We provide you with the ability to exercise control over our use of your Personal Data.

Marketing and Promotional Communications. You can opt out of receiving marketing and promotional communications from us at any time by following the unsubscribe instructions included in any marketing communication or by contacting privacy@taktile.com. Opting out does not affect transactional or service-related communications.

Interest-Based Advertising. You may opt out of receiving interest-based advertising using the browser opt-out tools and consumer choice mechanisms provided by:

You will need to opt out separately on all of your browsers and devices. If you delete or reset cookies, change browsers, or use a different device, any opt-out cookie may no longer work, and you will need to opt out again.

Cookie Preferences. You may adjust your cookie preferences at any time by clicking “Cookie Settings” in the website footer. You may also adjust your browser settings to limit tracking or decline cookies. Please refer to your browser's help section for instructions. To learn more about cookies, including how to manage them, please visit https://allaboutcookies.org/.

Global Privacy Control (GPC). We honor GPC and other legally recognized universal opt-out preference signals. When we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of Personal Data and of targeted advertising.

“Do Not Sell or Share My Personal Information.” Available in the website footer for all visitors.

You have the right to:

This section applies to residents of US states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. For California-specific rights, see Section 11.3.

Your rights under applicable state laws may include:

The California Consumer Privacy Act (CCPA) provides California residents with certain rights in relation to their “personal information” (as defined in the CCPA).

The following table details the categories of personal information we have collected from and about California residents in the past twelve (12) months, the source(s) of each category, the categories of third parties to whom we have disclosed each category for a business purpose, and the categories of third parties to whom we have “sold” or with whom we have “shared” each category (as such terms are defined in the CCPA).

Purposes for Collection. We collect personal information to provide and manage our services and achieve the business and commercial purposes described in this Notice.

Sale and Sharing. We “share” (as defined in the CCPA) certain categories of personal information with advertising and analytics partners through cookies and similar tracking technologies for cross-context behavioral advertising. We do not “sell” personal information for monetary consideration. We do not sell or share the personal information of minors we know to be under the age of 16.

Use and Disclosure of Sensitive Personal Information. We do not use or disclose sensitive personal information for any purpose outside of the limited permissible purposes set forth in the CCPA regulations. These purposes include providing our services, preventing security incidents, and verifying account access.

Your California Rights. You have the right to request that we:

We will not discriminate against you if you decide to exercise your rights under the CCPA.

Exercising Your Rights. You can submit a request by emailing privacy@taktile.com or writing to us at Taktile, 200 Vesey Street, Brookfield Place, New York, NY 10281, USA. To protect your privacy, we will verify your identity by matching up to three pieces of personal information you provide with information we maintain. Where applicable, we will use the requested information for verification purposes only. We may decline a request where we are unable to verify your identity and confirm the personal information we maintain relates to you.

Authorized Agent. You may authorize someone to submit a privacy rights request on your behalf. An authorized agent will need to demonstrate that you have authorized them to act on your behalf, unless the agent has been granted power of attorney under applicable probate law. We may also contact you to verify your identity or confirm the agent's authority.

Exercising Your Sale and Sharing Opt-Out Right. To opt out of the “sharing” of your personal information, click the “Do Not Sell or Share My Personal Information” link in the website footer. You may also opt out via cookies by clicking “Cookie Settings” in the website footer. If you enable a browser-based opt-out preference signal that complies with the CCPA, such as Global Privacy Control (GPC), we will treat the signal as a valid request to opt out of the sale or sharing of personal information linked to that browser and any consumer profile we have associated with that browser.

If you are located in Brazil (including contractors engaged by Taktile), you have the right under the Lei Geral de Proteção de Dados (LGPD) to:

You may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

To exercise any of the rights described above, contact us at:

We will respond within 30 days (GDPR/UK GDPR), 45 days (US state laws), or 15 days (LGPD), with extensions as permitted by applicable law.

Identity Verification. To protect your privacy, we will require verification of your identity before processing a rights request. We may request specific information from you to help confirm your identity. Where applicable, we will use the requested information for verification purposes only. We may decline a request where we are unable to verify that you are the individual whose data is the subject of the request.

Authorized Agents. You may designate an authorized agent to submit a privacy rights request on your behalf. An authorized agent will need to demonstrate that you have authorized them to act on your behalf, unless the agent has been granted power of attorney under applicable law. We may also contact you to verify your identity or confirm the agent's authority.

We take measures to delete, de-identify, or anonymize your Personal Data when it is no longer necessary for the purposes for which we process it, unless we are required by law to keep it for a longer period. When determining the retention period, we take into account the type of services provided to you, the nature and length of our relationship, mandatory retention periods, and applicable statutes of limitations.

After the applicable retention period, data is securely deleted or anonymized. If we de-identify data, we will maintain and use the data in de-identified form and not attempt to re-identify the data except as required or permitted by law.

Taktile LLC complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.

Taktile LLC has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Taktile LLC has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.

If there is any conflict between the terms in this Notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.

To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Independent Recourse Mechanism. In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Taktile LLC commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF should first contact Taktile at: privacy@taktile.com.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Taktile LLC commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Binding Arbitration. Individuals have the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. For additional information, see Annex I of the DPF Principles.

Onward Transfer Liability. Taktile LLC has responsibility for the processing of personal information it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on its behalf. Taktile LLC shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless Taktile LLC proves that it is not responsible for the event giving rise to the damage.

Enforcement. The Federal Trade Commission has jurisdiction over Taktile LLC's compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

Government Access. Taktile LLC may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

We use physical, managerial, and technical safeguards designed to improve the integrity and security of Personal Data that we collect, maintain, and process, including:

No method of electronic transmission or storage is completely secure. If you have reason to believe your interaction with us is no longer secure, please contact privacy@taktile.com immediately.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

Breach notifications will include the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach.

We use cookies and similar technologies on our website. For detailed information about the cookies we use, their purposes, categories, lifespans, and your choices, please see our Cookie Policy.

Key points:

Our website and communications may contain features or links to websites and services operated by third parties, including social media widgets and plugins. Any Personal Data you provide to the owner or operator of a third-party service is subject to that third party's privacy notice, even if accessed through our website. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy notices of any third-party service before providing your Personal Data.

Our services are not intended for or directed to children under the age of 16, and we do not knowingly collect Personal Data from children under the age of 16. Taktile does not have actual knowledge that it sells or shares Personal Data of consumers under 16 years of age. If we become aware that we have collected Personal Data from a child under 16, we will take steps to delete it.

We may update this Notice from time to time to reflect changes in our privacy practices. The “Last Updated” date at the top indicates when this Notice was last revised. If we make material changes to how we process Personal Data, we will notify you through our website, by email, or other appropriate means before the changes take effect. We will follow applicable laws and regulations regarding notification of changes to this Notice.

Taktile LLC is the entity responsible for the processing of your Personal Data in North America. Taktile GmbH is the entity responsible for the processing of your Personal Data in Germany and all other locations except the UK and Romania, where Taktile Ltd and Taktile SRL are responsible, respectively.

If you have any questions or comments about this Notice or our privacy practices, please contact us:

Email: privacy@taktile.com Phone: +49 89 250039222 Mail: Taktile, 200 Vesey Street, Brookfield Place, New York, NY 10281, USA

Data Protection Officer: Carl Gottlieb, c/o Taktile LLC, 200 Vesey Street, Brookfield Place, New York, NY 10281, USA. Email: carl.gottlieb@taktile.com.

Last Updated: August 13, 2026

This Appendix explains how Taktile collects, uses, stores, and shares your Personal Data when you apply for a role with us. It applies to all candidates who apply through our careers page, job boards, recruitment platforms, or any other channel.

Taktile's recruitment process is managed by Taktile LLC (US) and Taktile GmbH (Germany), which are the joint controllers of your Personal Data during the application process. Depending on the role, your local employing entity may be one of the following:

Taktile LLC and Taktile GmbH jointly determine the purposes and means of processing your applicant data. Your employing entity (if different) receives your data as needed to manage the local hiring and onboarding process.

We collect the following categories of Personal Data during the recruitment process:

We collect Personal Data directly from you, from publicly available sources, from recruitment agencies (if applicable), and from individuals you identify as references.

Processing That Does Not Require Your Consent

These activities are necessary to evaluate your application or are justified by our legitimate interests or legal obligations. You do not need to consent, and your application will not be affected.

Where we rely on legitimate interest, we have assessed that our interests do not override your rights and freedoms. You may request details of this assessment by contacting us.

Processing That Requires Your Separate Consent

For the following activities, we request your consent separately from your application. You are under no obligation to consent, and declining will not affect your candidacy or any future application.

California applicants: Under the CCPA/CPRA, the purposes above constitute “business purposes.” We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

Background Checks (US Candidates)

Taktile uses Checkr to conduct background checks for US-based candidates. Before obtaining any consumer report, we will provide a standalone written disclosure (as required by the Fair Credit Reporting Act) and obtain your written authorization on a standalone form. If we consider taking adverse action based on the results, we will provide pre-adverse action notice, a copy of the report, and a Summary of Your Rights before making a final decision.

For EU/UK-based candidates, background checks are conducted only where relevant to the role and based on legitimate interest (Art. 6(1)(f)), limited to information proportionate to the position.

To ensure that consent is freely given, specific, informed, and unambiguous as required by GDPR Article 7, we separate consent from the application process:

Withdrawing consent. You may withdraw any consent at any time by emailing privacy@taktile.com. Withdrawal does not affect the lawfulness of processing performed before withdrawal. If you withdraw talent pool consent, your data will be deleted within 30 days (or at the end of the default retention period for your jurisdiction, whichever is sooner).

Notice to referees: When you provide the names of references, we will inform each referee of our identity, the purpose of processing, and how they can exercise their rights under applicable law (GDPR Art. 14).

We do not sell your Personal Data to third parties.

Other Retention Scenarios

After the applicable retention period, data is securely deleted or anonymized.

We use automated tools to assist in screening and organizing applications. These tools may sort, rank, or filter applications based on criteria defined by our hiring team.

No hiring decision is made solely by automated means. A human reviewer is involved in every decision that affects your candidacy.

If we use any AI-powered tool that evaluates, scores, or ranks candidates, we will:

Jurisdiction-specific protections:

EU, UK, and Romanian applicants: You have all rights described in Section 11.1 of the main Privacy Notice. You may lodge a complaint with:

US applicants: You have all rights described in Sections 11.2 and 11.3 of the main Privacy Notice.

Brazilian applicants and contractor candidates: You have all rights described in Section 11.4 of the main Privacy Notice.

We will respond to verifiable requests within 30 days (GDPR/UK GDPR), 45 days (CCPA), or 15 days (LGPD).

Your Personal Data may be transferred to and processed in the United States, Germany, the United Kingdom, or Romania. We rely on the transfer mechanisms described in Sections 9 and 13 of the main Privacy Notice.

Taktile does not request or consider salary history during the recruitment process, in compliance with applicable state and local salary history bans.

To exercise any of your rights, withdraw consent, or ask questions: