Privacy Notice for Applicants to the Perfect Pitch Music Business Challenge

Effective date: 1 October 2026

This Privacy Notice explains how TBG and MML jointly collect, exchange and process personal data in connection with applications for the Perfect Pitch Music Business Challenge. It also explains the use of automated scoring and artificial-intelligence-assisted tools in the assessment process.

The Event is organised with Munich Music Labs e.V. ("MML"). TUM Business Club e.V., acting through its TUM Business Game initiative ("TBG"), and MML are equal joint controllers for applicant and accepted-participant data. TBG leads initial collection and processing, the application platform, selection and the related AI systems.

1. Joint Controllers and Contact Details

The joint controllers responsible for the processing of your personal data are TBG and MML. TBG's contact details and primary applicant contact are:

TUM Business Club e.V. Arcisstraße 21 80333 Munich Germany Email: info.tumbg@tum-businessclub.de

For questions concerning the processing of your personal data, to exercise your data-protection rights or to raise a concern about an assessment, please contact the same email address.

TBG and MML act as equal joint controllers under Article 26 GDPR for all applicant and accepted-participant data described here. TBG first collects and processes the data and manages the platform, application intake, eligibility checks, selection and AI-assisted workflow. TBG is the primary contact, but you may exercise your rights against either joint controller.

MML joint-controller contact: Munich Music Labs e.V. c/o Kai Chan Pfarrer-Seeanner Straße 40a 85748 Garching bei München, Germany Email: management@munichmusiclabs.com.

2. Personal Data We Collect

TBG and MML may jointly collect, exchange and process the following categories of personal data in connection with your application:

• Identification and contact data, including your name and email address.
• Eligibility and application-profile data, including your nationality, country of residence, university, field of study, expected graduation date and language proficiency.
• Educational and professional data, including information contained in your CV, such as your educational background, employment and internship experience, extracurricular activities, skills, qualifications and achievements.
• Application content, including your answers to motivational questions, responses to multiple-choice questions and submitted voice responses.
• Assessment and selection data, including automatically calculated multiple-choice results, transcripts of voice responses, AI-generated assessments and explanatory reasoning, human-review notes, corrections or overrides, overall assessment results and the final selection outcome.
• Technical and security data, which may include IP address, browser and device information, submission timestamps, system and error logs, and other information necessary to operate, secure and troubleshoot the application platform.
• Consent and communication records, including records of consent to CV sharing and any subsequent withdrawal of that consent, objections concerning the processing of personal data, requests for human reconsideration, data-protection requests and related communications.
• Event-operation data, for selected participants only, including team assignment, attendance, scheduling, communications, roles, availability, access requirements, judging-administration data, prize and payment records, and necessary safety or incident records.

Most personal data is collected directly from you when you complete the application, upload your CV, submit your responses or communicate with us. Assessment data is also generated during the application process by the platform, AI-assisted tools and authorised human reviewers. Technical data may be generated automatically when you access or use the platform.

TBG performs the initial collection and first processing through the application platform. All categories of applicant and accepted-participant data may then be exchanged between TBG and MML and processed by authorised team members for the stated purposes.

Please do not include unnecessary personal data relating to other individuals in your CV or responses. In particular, do not provide referees' contact details or other third-party personal data unless this is necessary and you are authorised to do so.

2.1 Special Categories of Personal Data

We do not request or require special categories of personal data within the meaning of Article 9(1) GDPR. Please do not include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used for identification, health information, or information concerning sex life or sexual orientation in your CV, voice responses or written answers.

Such information is not an assessment criterion and should not be submitted unless it is strictly necessary for the application. If we become aware that such information has been submitted incidentally, we will not intentionally use it to evaluate the application and will take reasonable steps to remove, redact or restrict access to it where reasonably possible.

Voice recordings are processed to transcribe and assess the content of the response. They are not processed for the purpose of uniquely identifying an applicant through biometric analysis.

After acceptance, a participant may voluntarily provide necessary accessibility, dietary, or safety information. Special-category data is processed only where an Article 9 GDPR condition is documented, access is restricted, and the information is not used to assess the application.

3. Purposes and Legal Bases for Processing

We process personal data for the following purposes and on the following legal bases:

• Administering the application, checking eligibility, conducting the assessment, communicating with applicants, and organising participation for selected applicants: Article 6(1)(b) GDPR, because the processing is necessary to take steps at your request in connection with your potential participation in the Perfect Pitch Music Business Challenge and, if selected, to organise that participation.
• Exchanging all categories of applicant and accepted-participant data between TBG and MML and jointly processing that data for application assessment, selection, and event administration: Article 6(1)(b) GDPR where necessary to assess or organise requested participation; otherwise Article 6(1)(f) GDPR where proportionate processing is necessary for consistent selection and coordinated event delivery and is not overridden by the person's rights and interests.
• Providing final participants with free tool credits through identified tool providers: Article 6(1)(b) GDPR where the disclosure is necessary to provide the credits; otherwise, Article 6(1)(a) GDPR based on voluntary consent.
• AI-assisted processing of relevant application content: Article 6(1)(f) GDPR, based on our legitimate interests in conducting a consistent, efficient and accountable selection process. AI-generated assessments are used as decision-support tools, are subject to meaningful human review and are not the sole basis for any final selection or rejection decision.
• Operating and protecting the application platform: Article 6(1)(f) GDPR, based on our legitimate interests in maintaining platform security, preventing misuse, investigating errors and ensuring reliable operation.
• Documenting the review process and establishing, exercising or defending legal claims: Article 6(1)(f) GDPR, based on our legitimate interests in conducting a fair and accountable selection process and responding to disputes or legal claims.
• Preparing internal planning information and anonymised statistics: Article 6(1)(f) GDPR, based on our legitimate interests in planning future events and reporting aggregate applicant statistics. Once information has been effectively anonymised and can no longer be linked to an identifiable individual, it is no longer personal data under the GDPR.
• Sharing selected participants’ CVs with identified partner companies for recruitment purposes: Article 6(1)(a) GDPR, based on the participant’s separate and voluntary consent.
• Complying with legal obligations or responding to competent authorities: Article 6(1)(c) GDPR where processing is required by applicable law.
• Where processing is based on Article 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation, as explained in Section 9.

4. Required Data and Processing Choices

4.1 Information Required for the Application

Certain information is required so that we can verify eligibility, evaluate the application, administer the selection process and communicate the result. Required fields are identified in the application platform.

If you do not provide the information required for the application and assessment process, we may be unable to consider your application. Information that is not necessary for these purposes is voluntary.

4.2 Use of AI-Assisted Assessment

AI-assisted processing forms part of the standard selection process and is used for all applications. TUM Business Club e.V. does not currently offer a separate application process that completely excludes AI-assisted processing.

AI-generated assessments are used only as decision-support tools. Each application is subject to meaningful review by an authorised human reviewer. The reviewer considers the relevant application materials and the AI-generated assessment, may disagree with, correct or override the AI-generated assessment, and remains responsible for the final decision. No applicant is selected or rejected solely on the basis of an AI-generated assessment.

You may raise concerns about AI-assisted processing, object to processing based on legitimate interests, report an inaccurate transcription or another suspected assessment error, and request reconsideration by a human reviewer by contacting info.tumbg@tum-businessclub.de.

Any objection will be assessed in accordance with Article 21 GDPR. Requesting reconsideration by a human reviewer does not mean that the relevant application materials were not previously processed through the AI-assisted tools. If we uphold an objection to AI-assisted processing and cannot lawfully continue that processing, we may be unable to continue assessing the application because an AI-free assessment route is not currently available.

4.3 Voluntary CV Sharing with Partner Companies

If you are selected to participate in the Perfect Pitch Music Business Challenge, you may be separately invited to consent to the sharing of your CV with identified partner companies for recruitment and potential interview invitations.

Consent to CV sharing is separate from the AI-assisted assessment used in the application process. Refusing to share your CV will not affect your selection, eligibility, assessment or participation in the event.

You may withdraw consent before disclosure at any time. If you withdraw consent after a CV has already been disclosed, we will stop any further disclosure and explain how you may contact the relevant partner company regarding data it has already received.

4.4 Sharing Names and Email Addresses for Tool Credits

After final selection, TBG and MML may share a participant's name and email address with an identified tool provider so that the provider can issue free tool credits. Participants will be informed before their data is shared. Where consent is required, sharing will take place only with the participant's voluntary consent, and refusal will not affect selection or participation.

5. Assessment, AI Assistance and Human Review

5.1 Assessment Structure

The application assessment consists of:

• CV assessment: 40% of the overall assessment;
• motivational-question assessment: 20%;
• multiple-choice assessment: 16%; and
• voice-response assessment: 24%.

AI-assisted tools are used to assess the CV, motivational questions, the multiple-choice assessment, and voice-response components of all applications.

The AI-generated assessments and scores are decision-support tools. Authorised human reviewers have access to the relevant original application materials and the AI-generated assessment and reasoning. They review the results, may correct or override the AI-generated assessments and remain responsible for the final selection decision.

5.2 How AI-Assisted Processing Works

The application platform uses GroqCloud, an external AI inference service, to access hosted AI models for transcription and AI-assisted assessment.

The following application materials are transmitted to GroqCloud:

• the applicant’s complete CV as extracted plain text (parsed from the uploaded PDF format);
• the applicant’s answers to the motivational questions; and
• the applicant's answers to multiple-choice questions;
• the original audio recordings submitted in response to the voice questions.

The information entered separately in the Personal Information section of the application form, such as the applicant’s name, email address, nationality, country of residence, university, field of study, expected graduation date and language proficiency, is not separately transmitted to GroqCloud. However, some of the same information may appear in the applicant’s CV, motivational answers or voice responses and may therefore be contained in the materials transmitted to GroqCloud.

The transmitted application materials are accompanied by the instructions, prompts, predefined evaluation criteria and other technical context required to perform the relevant transcription or assessment task. No other application-form fields are transmitted to GroqCloud.

AI-assisted tools may be used to:

• process, extract, structure and assess relevant information contained in the applicant’s CV;
• assess the applicant’s answers to the motivational questions against predefined evaluation criteria;
• assess the answers of multiple-choice questions;
• transcribe and assess the content of the applicant’s voice responses;
• produce criterion-level assessments and explanatory reasoning; and
• produce indicative scores for consideration by authorised human reviewers.

The current technical configuration uses GroqCloud-hosted models, including whisper-large-v3-turbo for speech transcription and one or more language models from the GPT-OSS and Qwen model families for text-based assessment. The precise model may change where necessary for reliability, availability or quality, provided that the purposes and safeguards described in this Notice remain unchanged.

GroqCloud is configured with Inference APIs Zero Data Retention. Groq processes the submitted inputs and generated outputs to provide the requested transcription or assessment but does not retain those inputs or outputs after completing the inference request. Groq may retain usage metadata that does not contain application content. TUM Business Club e.V. has not authorised Groq to use application inputs or outputs to train or fine-tune AI models.

5.3 Voice Responses

Voice responses are assessed according to the substance of the response, including whether the response addresses the question, the structure and clarity of the content, the reasoning and examples provided, and correspondence with the predefined assessment criteria.

The system is not intended to identify applicants through their voice or to infer or assess nationality, racial or ethnic origin, gender, health status or disability, emotional state, personality or confidence. Accent, non-native pronunciation and speaking speed are not assessment criteria and must not, by themselves, result in a lower assessment.

5.4 Profiling and Automated Decision-Making

Because AI-assisted tools evaluate aspects of an applicant’s qualifications, experience and responses and produce assessments or scores relating to the applicant, this processing may constitute profiling within the meaning of Article 4(4) GDPR.

TUM Business Club e.V. does not make final selection or rejection decisions solely by automated means within the meaning of Article 22 GDPR. AI-generated assessments, scores and summaries are advisory decision-support tools and are not the sole basis for accepting or rejecting an applicant.

5.5 Meaningful Human Review and Reconsideration

Each application is subject to meaningful review by an authorised human reviewer. Reviewers consider the relevant original application materials as well as the AI-generated assessment and reasoning. They have the authority to disagree with, correct or override an AI-generated assessment and remain responsible for the final selection decision. Rejection decisions are confirmed through human review.

You may report an inaccurate transcription, incorrect personal information or another suspected assessment error and request reconsideration by a human reviewer by contacting info.tumbg@tum-businessclub.de.

A request for reconsideration does not mean that the relevant application materials were not previously processed through the AI-assisted tools.

6. Recipients and Service Providers

Access to personal data is limited to persons and service providers that require it for the application process, event organisation or technical operation of the platform.

6.1 Internal Recipients

Personal data may be accessed by:

• authorised members of the Talent Development Team responsible for reviewing and assessing applications;
• the Presidents responsible for supervising and approving selection decisions; and
• authorised technical administrators, only to the extent necessary to maintain, secure and troubleshoot the platform.

Access is limited according to each person's responsibilities.

6.2 Joint Control and Information Exchange between TBG and MML

As equal joint controllers, TBG and MML may exchange all information concerning successful and unsuccessful applicants and accepted participants, including identity and contact details, eligibility and profile data, CVs, application answers, voice recordings and transcripts, AI assessments and reasoning, human-review notes, outcomes, communications, technical data and Event-operation records.

TBG carries out the first collection and processing and manages the platform, intake, eligibility checks, assessment, selection, and the AI systems and providers used for transcription and assessment. MML may access, receive and use the same information for the joint purposes. TBG's operational lead does not reduce either Party's equal joint-controller status.

Under their Article 26 arrangement, TBG leads collection notices, platform and AI compliance, vendors, selection records and request intake. MML leads its Event-operation records. Each Party secures its systems and providers, and both cooperate on decisions, rights requests, deletion and incidents.

The Parties may exchange the full information described above, but access is limited to authorised personnel and remains subject to purpose, legal-basis, data-minimisation, security, confidentiality and retention rules. Unrelated mailing-list use, external recruitment without required consent, sponsor lead generation and sale are prohibited.

6.3 Application Platform, Hosting and Storage

The application platform is built, published and hosted using services provided by Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, United States ("Lovable"). Lovable acts as a processor of application data on behalf of TUM Business Club e.V.

Lovable Cloud provides the platform's backend, database and file-storage functions. Lovable's documentation states that Lovable Cloud stores and processes customer data on Supabase infrastructure. Data stored through the platform may include identification and contact information, uploaded CV files, extracted CV text, written responses, voice recordings, transcripts, assessment results, human-review records and related application records.

Lovable and its authorised subprocessors may also process technical information necessary to provide, maintain and secure the service, including hosting information, system and error logs, security monitoring, backup data and information used to detect or prevent misuse. Lovable publishes a Data Processing Agreement and an up-to-date subprocessor list. Under that DPA, Lovable does not use customer personal data to train, retrain or fine-tune AI or machine-learning models.

6.4 Voice Transcription and AI Assessment

Applicants’ complete CV PDF files, answers to motivational questions, answers to multiple-choice questions, and original voice-response recordings are processed through GroqCloud for the relevant transcription and AI-assisted assessment tasks. The separately completed Personal Information section of the application form is not transmitted to GroqCloud, although the CV, motivational answers or voice recordings may themselves contain identifying or other personal information.

The language and speech models used for the assessment are hosted and operated through GroqCloud. The developers of the underlying models are not intended to receive applicants’ application content through this configuration.

6.5 Email and Communications

Our email and communication service providers may process applicants' names, email addresses, message content, attachments and related communication records for the purpose of transmitting, receiving and storing application-related and data-protection communications.

6.6 Legal and Public Authorities

Personal data may be disclosed to competent courts, data-protection supervisory authorities, law-enforcement authorities, legal advisers or other competent public bodies where required by law or necessary for the establishment, exercise or defence of legal claims.

6.7 Other Partner Companies and Sponsors

Other partner companies do not receive access to the applications or CVs of unsuccessful applicants.

After the selection process, the CVs of approximately 60 selected participants may be shared with identified partner companies for recruitment and potential interview invitations, but only where the participant has separately consented. Before consent is requested, participants will be informed of the identity of the intended recipients, the recruitment purpose, the categories of data shared, relevant international transfers and where to find further information about the partner company's processing.

Other partner companies receiving CVs for their own recruitment purposes may act as independent controllers and are responsible for their subsequent processing and retention. We do not provide partners with motivational answers, multiple-choice responses, voice recordings, transcripts, AI-generated assessments or internal review notes unless this is separately disclosed and supported by an appropriate legal basis.

Except for the limited sharing of names and email addresses with identified tool providers for free tool credits described in Section 4.4, sponsors and supporters that are not identified recruitment partners do not receive applicants' or participants' personal data or application materials.

7. International Data Transfers

The use of Lovable and Groq involves processing outside the European Union and European Economic Area, including in the United States.

Lovable Labs Incorporated is established in the United States. Lovable and its subprocessors may process application and technical data in the United States and other jurisdictions. Lovable's Data Processing Agreement incorporates the European Commission's Standard Contractual Clauses, including Module Two for controller-to-processor transfers, for restricted transfers not covered by an adequacy decision.

For EEA customers, GroqCloud is contractually provided by Groq UK Limited. The United Kingdom is currently recognised by the European Commission as providing an adequate level of data protection. Groq's service nevertheless involves processing in the United States and potentially other countries in which Groq or its subprocessors operate. Groq's Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses, including Module Two for controller-to-processor transfers. Inference APIs Zero Data Retention reduces storage in the United States but does not eliminate the international transfer required to process an AI request.

You may contact us for further information about the safeguards applicable to international transfers and, where available, to obtain a copy of the relevant safeguards.

Where a selected participant separately consents to CV sharing with a partner company, any international transfer by or to that partner will be disclosed before consent is requested.

8. Retention and Deletion

Application data stored in active systems under the control of TBG or MML, including CVs, written responses, voice recordings, transcripts, assessment results and human-review records, will be deleted no later than 30 days after the conclusion of the Perfect Pitch Music Business Challenge, unless longer retention is necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.

Accepted-participant operational data held by either Party is deleted or anonymised within six months after the Event, unless longer retention is necessary for a documented legal obligation, incident, prize or accounting record, or legal claim. This does not extend the 30-day deletion period for the application data listed above.

GroqCloud is configured with Inference APIs Zero Data Retention and therefore does not retain application inputs and outputs after completing the relevant inference request. Groq may retain non-content usage metadata and information that it is legally required to retain.

After deletion from Lovable Cloud’s active systems, residual copies may remain in protected backups for up to 90 additional days before being automatically overwritten or deleted in accordance with Lovable’s backup and deletion procedures. During this period, backup data is not available for ordinary application processing and will only be accessed where necessary for security, disaster recovery or compliance purposes.

Records of consent to CV sharing and any subsequent withdrawal, records of objections concerning processing based on legitimate interests, requests for human reconsideration and records concerning data-protection requests may be retained for an appropriate period where necessary to demonstrate GDPR compliance or address legal claims.

Anonymised and aggregated statistics that can no longer be linked to an identifiable person may be retained for longer-term planning and reporting.

Partner companies acting as independent controllers apply their own retention periods to CVs received with consent. Their relevant privacy information will be provided before consent is requested.

9. Your Data-Protection Rights

Subject to the conditions and limitations of the GDPR, you may have the right to:

• obtain confirmation as to whether your personal data is processed and request access to it;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object, on grounds relating to your particular situation, to processing based on legitimate interests;
• receive personal data you have provided in a structured, commonly used and machine-readable format where the right to data portability applies; and
• withdraw consent at any time where processing is based on consent, including consent to CV sharing with partner companies, without affecting the lawfulness of processing carried out before withdrawal.

You may also raise concerns about AI-assisted assessment, request correction of an inaccurate voice transcript, report suspected errors in assessment data and request reconsideration by a human reviewer.

To exercise these rights, contact info.tumbg@tum-businessclub.de. We may request reasonable information necessary to verify your identity.

For administrative convenience, TBG coordinates request intake with MML. This does not reduce MML's equal joint-controller status, and you may contact MML directly at management@munichmusiclabs.com.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a data-protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

The supervisory authority generally responsible for private organisations and associations established in Bavaria is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach Germany Website: https://www.lda.bayern.de Online complaint form: https://www.lda.bayern.de/de/beschwerde.html

You may also contact another competent supervisory authority, in particular the authority in the EU or EEA Member State of your habitual residence, place of work or the place of the alleged infringement.

11. Updates to This Privacy Notice

We may update this Privacy Notice where the application process, service providers, assessment methods or other processing activities change.

Where a material change affects applicants whose personal data has already been collected, we will provide additional information and, where required, obtain new consent before carrying out the changed processing.