TALOS NETWORK PRIVACY NOTICE
For applicants, fellows, alumni, community members, staff and contractors, partners, supporters and website visitors
Talos Network gUG (haftungsbeschränkt)
This Privacy Notice explains how Talos Network gUG (“Talos”, “we”, “us” or “our”) collects, uses and protects your personal data. It covers our fellowships and programmes, our events, summits and retreats, our alumni and community spaces such as Slack, the people who work for us as employees and contractors, our dealings with partner, host and funder organisations, our donors and supporters, and visitors to our website.
If you work for Talos as an employee or contractor, section 7 sets out what we hold about you in that capacity. The rest of this notice applies to you too, wherever you take part in our programmes or community as an individual.
We are Talos Network gUG (haftungsbeschränkt), a charitable company registered in Berlin, Germany at Müllerstraße 138D, 13353 Berlin. We work to build the talent and institutions Europe needs to govern advanced AI well, mainly by running fellowships, placements, training and convenings for people moving into AI governance and policy roles. We are not fiscally sponsored: Talos is the data controller for the personal data described in this notice, which means we decide what is collected and why, and we are accountable for it.
We process your data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws: in our case the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), and the UK GDPR where we process the personal data of people in the United Kingdom.
What data we collect and why
As the “data controller”, we’re the ones who decide how and why your personal data is used. We run our own programmes, events and platforms, so it is our job to handle your data responsibly and transparently. We collect the minimum personal data necessary to deliver our mission and community services.
Some organisations we work with are not acting on our instructions and decide for themselves what to do with your data: a host organisation that supports a fellow during a placement, for example, or a funder we report to. Where that is the case we say so below, and that organisation's own privacy notice applies alongside this one.
1. Programme applications & participation
When you apply to one of our programmes (whether it’s a fellowship, workshop, retreat or recurring course), we collect the details we need to understand who you are and how we can best support you. This may include:
Your name, email and basic contact info.
Your background or affiliation (e.g. student, researcher, professional).
Your responses to application questions, including motivation statements or CVs.
Your preferences for programme topics and tracks.
Your general availability for calls, mentoring or events, arranged through our scheduling and video tools.
Your responses to work tests and assessment exercises, and the notes and scores our reviewers record against them.
Any accessibility, dietary or similar requirements you tell us about so we can make an event or placement work for you.
Where you reach the placement or contracting stage: the details we need to contract with you and pay you, such as your address, date of birth, bank details and right-to-work or visa information.
If you claim expenses or a reimbursement from us: your bank details, the receipts and supporting documents you upload, and what you tell us the spend was for. Where the claim is for food or drink for more than one person, the receipt also names everyone present, because German tax law requires it.
Why we collect this: so we can select participants fairly, coordinate logistics, and design our programmes around what participants actually need. We also use application and cohort data, usually aggregated, to understand who our programmes reach and to report on that to our funders.
Accessibility, dietary and health-related information is treated as a special category of data under Article 9 GDPR. We ask for it only where we need it to run an event or placement well, we use it only for that purpose, we rely on your explicit consent, and we delete it within 6 months of the event or placement ending.
When you claim expenses, we use software that includes an AI tool to check the claim is complete: that the receipts you uploaded add up to the amount claimed, and that nothing required is missing. It does not judge whether the spend was appropriate and it does not decide whether you are paid. No payment is set up until a person at Talos has reviewed and approved the claim.
2. Event & community participation
If you attend our events or join our online spaces, we’ll collect some basic data to help things run smoothly and make the experience better for everyone. This might include:
Your RSVP and attendance for things like meetups, hackathons or retreats.
Your profile and general activity in our community spaces (for example your Slack profile, which channels you join and roughly how active you are).
Feedback you give in post-event surveys or check-ins, where collecting it in an anonymous format is not feasible.
Details of your career progression (for example whether you move into an AI governance or policy role, where and when), which we collect through surveys, check-ins and publicly available sources as part of our monitoring and evaluation work.
Recordings, transcripts and AI-generated notes of meetings and calls, where we use a note-taking tool. We will tell you at the start of a call if it is being recorded, and you can ask us not to record.
Photographs and video taken at our events, where you have agreed to this.
Why we collect this: It helps us manage logistics, understand what’s working, and improve inclusivity and community engagement. We also use this data (often in anonymised form) to report on reach and impact, for ourselves and sometimes for funders.
3. Ongoing career support & referrals
If you’re receiving career advice or ongoing support from us, we may keep track of a few things to better tailor that support. This could include:
Notes from 1:1 conversations, mentoring calls and placement check-ins (always with your awareness).
Your stated interests, skills and long-term career goals.
A record of any introductions we have made, to placement host organisations, employers, mentors, job boards or funding opportunities.
Why we collect this: so we can support your career journey more effectively, match you with a placement that fits, and, where you have agreed to it, refer you to relevant people, organisations or opportunities in AI governance and policy.
4. Donations (if applicable)
If you choose to donate to support our work, we’ll collect a few details to handle that properly:
Your name, email and the amount and date of your donation.
Metadata from the payment, such as the method used, processed through our bank and payment providers. We never see or store your full card details.
Why we collect this: to issue receipts and donation confirmations, to meet German tax and accounting requirements, and to keep you in the loop about the impact of your support.
5. Partner, host, funder and supplier contacts
If you work for an organisation we deal with (a placement host, a funder, a venue, an evaluator, a mentor or an advisor), we keep working contact records in our CRM. This includes your name, work email address and phone number, your organisation and role, notes and a history of our interactions with you, and sometimes publicly available information about your organisation added automatically by the CRM.
Why we collect this: so we can manage our relationships, arrange placements and events, and meet our reporting obligations to funders. We rely on our legitimate interest in running the organisation, and you can object to this at any time.
6. Website visitors
When you visit our website we collect limited technical and analytics data, such as your IP address (which is deleted automatically after a short period), the pages you view and how you arrived. We use cookies and similar technologies for this. Non-essential cookies are set only where you consent to them, and you can change or withdraw that choice at any time through the cookie banner.
Why we collect this: to keep the site working and to understand, in aggregate, what people find useful.
7. Staff and contractors
If you work for Talos (as an employee, an intern or a contractor, whether engaged directly or through an employer-of-record arrangement), we hold the records we need to recruit you, pay you and manage the working relationship. This includes:
Recruitment records: your application, CV, work test, interview and reference notes, and the reasons for our decision.
Identity and eligibility records: your name, date of birth, home address, nationality, photograph, identity or passport documents, and right-to-work or visa status.
Contract and payroll records: your contract and any amendments, salary and payment history, bank details, tax and social security identifiers, pension and benefits information, and your invoices where you contract with us.
Working records: leave requests and balances, sickness absence, working time, expenses, equipment issued to you, and the accounts and access rights we give you.
Performance and development records: objectives, 1:1 and review notes, feedback, training, and any grievance or disciplinary matters.
Work account content: the email, files, calendar entries, messages and documents you create in the course of your work.
Sickness absence records, and anything you tell us about a health condition, disability or adjustment, are special category data. We process them only where employment, social security and social protection law allows it (Article 9(2)(b) GDPR and § 26(3) BDSG) or with your explicit consent, and we keep access to them to the people who need it.
Why we collect this: to employ or engage you lawfully, pay you, meet our obligations as an employer and to the tax and social security authorities, manage the working relationship, and run and protect the organisation.
Our lawful bases for staff data are the employment or contractor relationship itself (Article 6(1)(b) GDPR and § 26(1) BDSG), our legal obligations under tax, social security and employment law, and our legitimate interests in running and protecting the organisation. Where we rely on your consent (a photograph on our website, say), you are free to refuse and free to withdraw it later, and nothing about your job depends on either.
We do not routinely monitor your messages, browsing or activity, and we do not make decisions about you by automated means.
Lawful basis for processing
Under the GDPR, we need a legal basis to process your personal data. Depending on the context, we rely on the following:
Legitimate interests – Most of our day-to-day processing falls under this. For example:
Running events, courses and fellowships smoothly.
Sharing limited participant information (such as your name or topic preference) with the facilitators, mentors, host organisations and course partners we work with.
Using anonymised or aggregated insights to understand what works, improve future programming, and guide our outreach to others with similar interests.
Keeping in touch with alumni, and tracking in aggregate what happens to people after a programme, so we can tell whether our work has any effect.
Maintaining the internal systems we use to run the organisation (email and file storage, our applicant tracking, CRM and programme records, and our community and messaging tools).
Consent – We’ll always ask before:
Referring you to an external organisation, job or funding opportunity (we usually ask you to confirm that you want us to refer you to external organisations in our Expression of Interest form, or during conversations about your career goals).
Featuring you in a testimonial, case study, photograph or video.
Collecting accessibility, dietary or health-related information so we can make an event or placement work for you (explicit consent, Article 9(2)(a) GDPR).
Recording or transcribing a call you take part in.
Adding you to ongoing communications that aren’t strictly necessary (e.g. newsletters or alumni Slack groups).
Contractual necessity – When you formally join one of our programmes (for example by signing a fellowship or stipend agreement), we need to process your data to deliver what we promised and to meet our obligations to you under that agreement.
Legal obligation – We have to keep certain records (donations, stipend and contractor payments, invoices) to meet German tax and commercial law requirements (§ 147 Abgabenordnung, § 257 Handelsgesetzbuch) and to maintain our charitable status. As an employer we also have obligations under employment, tax and social security law, and we process staff data on the basis of the employment relationship itself (Article 6(1)(b) GDPR and § 26(1) BDSG).
If you ever want to opt out of optional data use or have questions about how we’re applying these bases, just reach out. For newsletters and mailing lists, you will have an “unsubscribe” option at the end of our email updates.
Data sharing
We do not sell or commercialise your data. We share it only in the specific, limited circumstances below:
A. Trusted processors
We use a small number of widely adopted services to run our work. We keep an internal register of every tool that holds personal data (what it holds, where it is hosted and on what terms), and we review it regularly. We group them into seven categories:
Email, file storage, calendars and documents (e.g. Google Workspace)
Community and internal messaging (e.g. Slack)
Video calls, scheduling, and meeting notes and transcription (including AI note-taking tools)
Application forms, applicant tracking, CRM and programme records (e.g. online form tools, Airtable, Notion, our CRM)
Payments, contracting, payroll and HR records, including fellowship stipends, expenses, donations, and leave and absence tracking (our bank, HR platform and leave system)
Our website and its analytics
AI assistants used by our team to help with drafting and administration, under terms that prohibit the provider from training its models on our data
Each of these providers acts only on our instructions, and we require a data processing agreement with each provider. Some of them store data outside the European Economic Area, mainly in the United States. Where they do, the transfer is covered by the European Commission's Standard Contractual Clauses or by the EU–US Data Privacy Framework. You can ask us for details of the safeguards that apply to a particular provider.
B. Referrals within the AI Safety ecosystem
With your explicit consent, we may share your name, profile and career goals with:
Host organisations considering you for a placement, and other organisations running fellowships, grants or jobs
Researchers or mentors relevant to your interests
Employers and hiring platforms working in AI governance, policy and safety
Consent is always sought before any such referral.
C. Others who decide for themselves what to do with your data
Some organisations we share data with are not acting on our instructions; they are separate controllers, and their own privacy notices apply. These are:
Placement host organisations, which employ or host fellows during a placement.
Our accountants and payroll providers, who prepare our books, payroll and statutory accounts.
Employer-of-record and professional-employer providers, who are the legal employer of some of the people who work with us and decide for themselves what they must hold and report.
Funders, to whom we report on our programmes, normally in aggregate, and about you individually only where you have agreed or where we have told you in advance.
Evaluators and researchers we commission to assess the impact of our work.
Professional advisors (lawyers, auditors, insurers), where we need advice or have to establish or defend a legal claim.
Public authorities (including the tax office, social security and health insurance bodies, and statutory accident insurance), where the law requires it.
Data retention
The periods below are the outer limits we work to. They are set by the relevant statutory retention rule, or by the period in which a claim could still be brought against us, and in many cases we delete sooner. Where more than one period applies to the same record, the longer one governs.
Unsuccessful job applications, including work tests and interview notes: 6 months from the decision, which covers the period in which a discrimination claim can be brought and filed (§ 15(4) AGG, § 61b ArbGG). Longer only if you ask us to keep you on file for future roles.
Unsuccessful programme applications, including work tests and reviewer notes: until the end of the third calendar year after the decision, so that we can explain the decision, compare cohorts over time and consider you for later rounds (§§ 195, 199 BGB).
Programme and event data: until the end of the third calendar year after your last engagement with us, which is the general limitation period for claims under German law, and longer where a funder requires us to keep programme records for a set period after a grant ends.
Fellowship and placement records, including agreements and stipend payments: 10 years from the end of the year in which the agreement ended, because they form part of our accounting records (§ 147 AO, § 257 HGB).
Employment and contractor files: until the end of the third calendar year after the engagement ends (§§ 195, 199 BGB), except where a particular record carries its own statutory period.
Payroll and payroll tax records: 6 years from the end of the year (§ 41(1) EStG), and 10 years where they form part of our accounts.
Sickness absence and other health-related staff records: until the end of the third calendar year after the engagement ends, and sooner wherever we no longer need them.
Meeting recordings and transcripts: 24 months, unless the notes form part of a programme, placement or employment record, in which case they follow that record.
Slack and community participation: messages and files remain for as long as the workspace exists; we deactivate and remove your profile on request, or after 3 years of inactivity.
Donations, invoices and other financial records: 10 years from the end of the year for books, accounts and donation records; 8 years for supporting vouchers, including expense receipts, and 6 years for business correspondence, where those shorter periods apply (§ 147 AO, § 257 HGB).
Referral and coaching notes: until the end of the third calendar year after your last engagement with us, or sooner on request.
Survey and monitoring data: aggregated or anonymised within 24 months; anonymised results are kept indefinitely and are no longer personal data.
Accessibility, dietary and health-related information about participants: deleted within 6 months of the event or placement it was given for ending.
Partner, funder and supplier contact records: for as long as the relationship is live, and until the end of the third calendar year after it ends; contracts and invoices follow the financial periods above.
Website analytics: IP addresses deleted within days; aggregated analytics kept for up to 14 months.
Anything needed for an ongoing or anticipated legal claim, an audit, or a funder's reporting requirement: until that matter is resolved or the period above that would otherwise apply ends, whichever is later.
We may send you a reminder before deleting inactive profiles.
Your rights under GDPR
As someone whose data we process, you have rights under the GDPR. These include the right to:
Access the personal data we hold about you
Correct anything that’s inaccurate or out of date
Ask us to delete your data (“the right to be forgotten”), when it’s no longer needed
Limit or object to how we use your data in certain situations
Receive a copy of your data in a portable format, where technically feasible
Withdraw your consent at any time where we rely on consent. This does not affect anything we did before you withdrew it
Complain to a data protection authority (see below)
If you’d like to exercise any of these rights, or if you have any other questions about how we process your personal data, just email us at privacy@talosnetwork.org.
We’ll get back to you within one month.
Supervisory authority
If you have concerns about how we process your personal data, we encourage you to reach out to us directly first. However, you also have the right to lodge a complaint with our supervisory authority in Berlin, or with the authority in the EU country where you live or work:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
Telephone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
Updates to this Privacy Notice
We may update this Privacy Notice from time to time. Significant changes will be announced via email or Slack. The latest version will always be available on our website.
Last updated: 7th October 2026