This Cookies Policy explains what information we store on your device when you use joboapp.es (the “Platform”), for what purpose, for how long, and how you can decide about it at any time.

This information is provided pursuant to article 22.2 of Spanish Law 34/2002 on information society services (LSSI-CE), Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and the Guide on the use of cookies of the Spanish Data Protection Agency (AEPD) in its current edition. This policy complements the Privacy Policy, the Legal Notice and the list of subprocessors.

1. Who the controller is

The data controller is JOBO PEOPLE TECHNOLOGIES, S.L. (Sociedad Unipersonal (sole-shareholder company)), tax ID B88736665, registered at Calle Barrau 1, Bloque H, Portal 6, 1.º A, 41018 Sevilla, España.

Data Protection Officer: dpo@joboapp.es.

2. What a cookie is, and what equivalent technologies we use

A cookie is a small text file that a website stores in your browser to remember information about your visit.

The law does not speak only of cookies: it protects any storage of, or access to, information on your device, whatever it is called. The European Data Protection Board confirmed this in its Guidelines 2/2023, adopted on 16 October 2024. That is why we also inform you about:

• Browser local storage (localStorage): data that stays stored until you delete it.
• Session storage (sessionStorage): data that disappears when you close the tab.
• IndexedDB: browser database used by the sign-in system.
• Third-party pixels and measurement tags.

When this document says “cookies”, it means all of them.

3. Where this policy applies, and where we never measure

This policy covers all of joboapp.es: both the public pages and the private area you access with an account. Two guarantees we want on the record:

• Audience measurement and advertising only run on the public pages. They are blocked by design — not by configuration, but in the code itself — across the whole signed-in product and, most notably, in the candidate assessment journey: dashboard, interview, tests and challenges within a process, company onboarding, profile onboarding, team, sign-in, email verification and password reset. While you are taking the interview, a test or a challenge within a selection process, no audience-measurement or advertising tool is running. Note the difference: the open tests we offer as free resources (cognitive test, behavioural profile and the like) are public pages and are measured, with your permission.
• Error monitoring does run across the whole Platform, including during assessment — and here is why. Sentry (section 5.2) does not distinguish public from private pages: if you accepted “Analytics”, it is active on all of them. That is deliberate: without it, a failure while uploading your interview video would be invisible to us and you would lose your application without anyone noticing. In exchange, it records with all text and all form fields masked (what you type and your answers are not recorded), only if you accept that category, and it can be switched off at any time from “Manage cookies”. It does not measure audience, does not profile and does not feed advertising.
• Outside production. The Meta pixel only exists in the production environment: in our internal development and testing environments its identifier is not configured and it never loads. The remaining tools obey exactly the same permission wherever they run, and only the JOBO team accesses those internal environments.

The private area does use the cookies and storage that are strictly necessary for the application to work (keeping your session, not losing your answers, remembering your language). All of them are listed in section 5.1.

4. How we ask for, store and let you withdraw your permission

4.1. The cookie notice

On your first visit a notice appears with three options: Accept all, Reject all and Customise. Accepting and rejecting are presented at the same level — same colour, same size and same placement — so that rejecting is no more costly and takes no more clicks than accepting. “Customise” is also one click away.

Until you decide, nothing loads beyond what is strictly necessary: not a single connection to Google, Meta, LinkedIn or PostHog. We do not treat continued browsing or scrolling as consent.

4.2. Your decision expires after 24 months

After 24 months from your decision, your choice is no longer considered valid and the notice reappears so you can decide again. This is the maximum period recommended by the AEPD cookie guide.

4.3. How to change your mind

You can review or change your decision at any time from the “Manage cookies” link in the footer, without deleting anything or writing to us.

Withdrawing consent is as easy as giving it, and takes effect immediately (art. 7.3 GDPR): analytics and advertising tools stop collecting data at once, any session recording in progress is stopped, and the campaign of origin stored in your browser is deleted (withdrawing Advertising stops it being read at once, and it is erased as soon as both categories are withdrawn or when you close the tab). You can also delete already-installed cookies from your browser (section 7).

4.4. The receipt of your decision

So that we can demonstrate we respect your choice — art. 7.1 GDPR requires it — we keep a receipt of every decision you make in the cookie notice. That receipt contains:

• The categories you accepted or rejected and the action taken (accept all, reject all or customise).
• Where you made it (the first-visit notice or the preferences panel).
• The version of this policy in force at that moment.
• A random identifier of your browser, plus your IP address and browser transformed with an irreversible cryptographic function: we keep a fingerprint that allows verification, not the original data.
• Your user identifier, only if you were signed in.

These receipts are kept for 24 months and are then deleted automatically.

4.5. We use no cookie walls and no “consent or pay” models

You can use the Platform while rejecting all non-necessary cookies, with the same functionality and at no extra cost. We do not condition access on your acceptance, nor do we offer payment as an alternative to consenting.

5. What exactly we store

We use three categories. Only the first works without your permission.

5.1. Strictly necessary: no consent required

They are indispensable for the Platform to work, or for you to use a service you expressly requested. Without them we could not keep your session, take payment securely or protect you from fraud. They cannot be switched off from the notice, but you can block them in your browser, accepting that the Platform will stop working properly. Unless stated otherwise, the owner is JOBO and they are stored on the joboapp.es domain; the only exception in the table is the Firebase Authentication session, managed by Google as our identity provider on our behalf.

Remembering the language preference is a technical function and does not require your consent, as the AEPD cookie guide states. On your first visit we store the language the page is served in, and from then on whichever you choose; it is never used for profiling and identifies no one: it is two letters.

In addition, these strictly necessary third parties intervene at specific moments:

5.2. Analytics and error monitoring: your consent required

They help us understand how the public pages are used and detect failures. All three load only if you accept the “Analytics” category, but their scope is NOT the same: Google Analytics and PostHog run only on the public pages; Sentry, being error monitoring, runs across the whole Platform (section 3).

• Google Analytics 4 (googletagmanager.com). Measures audience and use of the public pages — visits, funnels, traffic sources — with the IP address anonymised. It runs with Consent Mode v2: storage starts denied and is only enabled if you accept. Data is retained for 14 months (the shortest configurable period, for minimisation). Google Signals is enabled on this property, a feature that — only for people signed in to their Google account who have allowed ad personalisation — adds estimated demographic data (age range, gender, interests) and allows recognising the same person across devices. Google Signals is NOT enabled by this category: it depends on the advertising permissions, which are denied by default and only granted if you also accept the Advertising and marketing category. If you accept only Analytics, there is no demographic profiling and no cross-device tracking.
• PostHog (European Union region, eu.i.posthog.com). Product analytics, funnels and session recording. Data is hosted in the European Union. Recordings are made with all text and all form fields masked: what you type and any personal data you enter is not recorded.
• Sentry (sentry.io). Captures JavaScript errors, performance traces and session replays — also with text and fields masked — so failures can be diagnosed. Approximately 1 in 10 sessions is recorded, plus 100% of those in which an error occurs. Unlike the previous two, it runs across the whole Platform, including during the interview and the tests — the reason is in section 3. The browser component only loads if you accept this category. Error monitoring on our servers relies on legitimate interest and installs nothing on your device.

More information: Google · PostHog · Sentry.

5.3. Advertising and marketing: your consent required

They measure the effectiveness of our campaigns and build remarketing audiences. They only load if you accept the “Advertising and marketing” category and only on the public pages.

• Meta Pixel (facebook.net / facebook.com): measures conversions and enables Meta audiences (Facebook and Instagram).
• LinkedIn Insight Tag (snap.licdn.com / linkedin.com): measures campaigns and enables LinkedIn audiences.
• Google Ads (googletagmanager.com / google.com / doubleclick.net): measures whether a visit that came from a Google ad ends up booking a demo. Conversion measurement only: the tag is configured without ad-personalisation signals, so we do not use it to build audiences or to personalise advertising. The only thing Google receives when you book is an internal booking identifier, so it is not counted twice; never your name, your email or your company.
• JOBO first-party attribution: if you arrive through a partner, someone’s referral or an ad, we store that origin so the referral can be credited or the campaign attributed correctly. Without this permission we store none of that: attribution only works if you sign up within the same navigation.

More information: Meta · LinkedIn.

5.4. Tag manager

We use Google Tag Manager (container GTM-WS6LST5J) as our tag manager.

• The container is only downloaded if you accept Analytics or Advertising. If you reject both, it is neither downloaded nor executed, not even to sit waiting.
• The tools described in 5.2 and 5.3 do not depend on the container: they load directly from our site, each behind its own category permission.
• Inside the container, Consent Mode v2 acts as a second barrier, tag by tag.
• Any tag added to the container is subject to the same consent and is declared in this policy, in all four languages, before it goes live.

6. International data transfers

Some of the tools above involve transfers to the United States: Google (Google Analytics 4, Google Ads and Google Tag Manager), Meta (Meta Pixel), LinkedIn (Insight Tag) and Sentry. All of them rely on the EU-US Data Privacy Framework and/or the Standard Contractual Clauses of Decision (EU) 2021/914.

PostHog processes analytics data in the European Union region, so it involves no international transfer. The full detail is in the Privacy Policy and in the list of subprocessors.

7. How to manage cookies from your browser

Besides JOBO’s preferences panel, you can configure and delete cookies from your browser. Note that blocking the strictly necessary ones may prevent the Platform from working properly.

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

To clear local and session storage, use your browser’s option to delete “website data” or “cookies and other site data”.

8. Your rights

You may exercise at any time the rights of access, rectification, erasure, objection, restriction of processing and portability, as well as withdraw your consent, which will not affect the lawfulness of processing carried out before the withdrawal.

• How: by writing to dpo@joboapp.es.
• For cookies specifically, the quickest route is the “Manage cookies” link in the footer (section 4.3).
• Complaint: if you believe we have not handled your rights properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Updates to this policy

We may update this policy to reflect technical or legislative changes. The version in force will always be published at this same address, with its version number and effective date visible in the header.

We verify this policy’s inventory whenever we change anything the site loads, and in any case through periodic review. If we add a new tool, it is declared here — in all four languages — before it is enabled. If a change affected the purposes or introduced new tools requiring consent, we will ask you again.

10. Contact

For questions about this Cookies Policy or about how the preferences panel works: hola@joboapp.es.

To exercise your rights over your personal data or to withdraw your consent: dpo@joboapp.es, the mailbox of the Data Protection Officer.

JOBO PEOPLE TECHNOLOGIES, S.L. · Sociedad Unipersonal (sole-shareholder company) · CIF B88736665 · Calle Barrau 1, Bloque H, Portal 6, 1.º A, 41018 Sevilla, España