This page explains how JOBO PEOPLE TECHNOLOGIES, S.L. (“JOBO”) processes the personal data related to its business customers: the customer’s own data where the customer is a natural person, the data of the people the company enables to use the Platform (the “authorised users”), and the data of the professionals we approach commercially. In all of that processing JOBO acts as the controller.

It does not cover the data of the candidates you assess on the Platform: there you are the controller and JOBO is the processor, on the terms of the DPA and the Privacy Policy. Section 14 explains where the boundary between the two documents lies.

1. Controller and how to contact us

Controller: JOBO PEOPLE TECHNOLOGIES, S.L. (Sociedad Unipersonal), tax ID B88736665, with registered and tax address at Calle Barrau 1, Bloque H, Portal 6, 1.º A, 41018 Seville (Spain), registered at the Commercial Registry of Seville, Sheet SE-156075, entry 1. The remaining identifying and registry details are in the Legal Notice.

Data Protection Officer: Norma360 Consultores, S.L., appointed on 29 July 2026 and notified to the Spanish Data Protection Agency on 3 August 2026. You can write to them —and to us about any data protection matter— at dpo@joboapp.es, or by post to the address above marking it “Data Protection”. That mailbox receives rights requests, questions about this document and security incident reports.

2. Who this page applies to and where your data comes from

This page is addressed to four groups of people. For each one we state where we obtained their data, because the data subject does not always give it to us directly (articles 13 and 14 GDPR).

• The client company. Where the customer is a legal entity, the company’s own details are not personal data, but the details of the contact persons it gives us are. Source: the company itself, when contracting and when using the Platform.
• Authorised users. Source: the company that enables your account; we do not ask you for the data. If you are one of them, this document explains what we do with it and what rights you have against JOBO, regardless of your relationship with your employer.
• Professional contacts we approach before any relationship exists. Source: public professional sources (public LinkedIn profiles, partner directories) and B2B data enrichment providers (Apollo.io / ZenLeads Inc.), which fill in missing contact details from their own database. Section 5 develops this.
• People for whom we prepare an account after a JOBO presentation. Source:the person themselves, or someone else at their company, who gave us the email address so that we could send them access to the Platform. If this is you, the email you receive with the activation link contains this same notice, and section 4 explains our legal basis.

Where the customer is a sole trader or self-employed professional, there is no separation between “company data” and “personal data”: everything we process about that account is their personal data and this document applies to them in full, with the particularities of article 19 of the Spanish Data Protection Act (LOPDGDD) for sole traders’ contact details.

3. Data we process

• Company account data: legal name, tax ID, address, contact details, contracted plan and the recorded legal acceptances (document, version, text seal and date).
• Authorised users’ data: name, corporate email, assigned role, any organisational labels you assign to them (for example, a zone), profile picture where uploaded, and access and activity logs.
• Billing data: handled through Stripe. JOBO does not store full card data.
• Usage data: technical and security metrics needed to provide and protect the Service (IP address, session identifiers, timestamps and error logs).
• Case-management activity record of your authorised users: which actions each person on your team takes on the applications in your processes (reviewed, interviewed, hired), with date and process, and the aggregate counts derived from them. You are the controller of this data and JOBO is the processor (section 14).
• Professional prospecting contact data: name, work email, company, job title, public LinkedIn profile, contact and exclusion status, and an internal commercial interest indicator for the company built from public signals (sector, size, age and digital presence).
• Access invitation data, when a company asks us for an account after a presentation: the person’s work email, the language of the invitation, the status and dates of the invitation (expiry, sends, activation or cancellation), a fingerprint —not the key— of the personal link, the account’s identity and access credentials if it is activated, and, in the access log of JOBO administrators, the declaration made by whoever prepared it, with a fingerprint of the email address and not the address in plain text.

Account data and authorised-user data are necessary to provide the Service: without them we cannot open the account or grant access, so providing them is a requirement for contracting and for using the Platform. The rest — a profile picture or a phone number, for example — is optional and there is no consequence to withholding it.

We neither request nor infer, in relation to business users, data in the special categories of article 9 GDPR (health, origin, beliefs, trade union membership, sexual orientation), and we do not want to receive it: please do not include it in free-text fields or in support tickets.

4. Why we process your data and on what legal basis

Where the basis is legitimate interest we say what that interest is, because the GDPR requires it to be identified. The balancing assessment supporting each one is available to you on request.

• Providing the Service and managing the contractual relationship (sign-up, authentication, support and plan billing). Basis: performance of the contract (art. 6.1.b GDPR). For authorised users, whose contract belongs to their company and not to them, the basis is our legitimate interest in performing that contract (art. 6.1.f GDPR).
• Meeting tax and accounting obligations (issuing and keeping invoices and books). Basis: legal obligation (art. 6.1.c GDPR).
• Handling data protection rights and demonstrating compliance. Basis: legal obligation (arts. 12 to 22 and 5.2 GDPR).
• Protecting the Platform: security, fraud prevention, detection of improper access and traceability. Basis: legitimate interest (art. 6.1.f GDPR). Specific interest: keeping the Service available and intact and being able to reconstruct what happened after an incident.
• Auditing compliance with the anti-circumvention clause of the contract. Basis: legitimate interest (art. 6.1.f GDPR). Specific interest: collecting the agreed consideration when a candidate introduced by JOBO is hired. What we look at is the applications introduced and the hires declared, not the individual activity of the people on your team, and only during the periods set by that clause.
• Sending you marketing communications and carrying out prospecting. Basis: legitimate interest (art. 6.1.f GDPR), under the rules and limits of section 5.
• Providing performance panels for your team (counts of your authorised users’ activity). Basis: processing on your behalf (art. 28 GDPR); the legal basis vis-à-vis your staff and the duty to inform them are determined by you as their employer (section 14). These are deterministic aggregations: no artificial intelligence scores, ranks or predicts anyone’s performance.
• Operating and maintaining the Platform from our internal panel and testing changes before releasing them. Basis: performance of the contract and legitimate interest (arts. 6.1.b and 6.1.f GDPR), with the detail and safeguards of section 7.
• Opening your company account when you, or someone else at your company, have asked us for access after a JOBO presentation: sending you the email with the link and creating the account when you press it. Basis: legitimate interest (art. 6.1.f GDPR and art. 19 LOPDGDD). Specific interest: handling that access request. You may object at any time by writing to dpo@joboapp.es or by replying to the email, and we cancel the invitation immediately. Activating the account does not accept any contract on behalf of your company.

Where we process your data on legitimate-interest grounds you may object at any time on grounds relating to your particular situation (art. 21 GDPR): we will stop processing unless we demonstrate compelling legitimate grounds which override yours, or the establishment or defence of legal claims. Where the objection concerns prospecting or marketing communications there is no exception: we always stop. Write to dpo@joboapp.es.

5. Marketing communications and prospecting

If you are already a customer, we send you information about products and services similar to those you have contracted, under article 21.2 of the Spanish e-commerce act (LSSI) and our legitimate interest. Every such message carries a one-click unsubscribe link, and you can also unsubscribe by replying to the message or writing to dpo@joboapp.es.

If we wrote to you before you knew us, that is B2B commercial prospecting: we approach professionals whose role relates to what we offer (human resources, management, recruitment) at active companies, on the basis of our legitimate interest (art. 6.1.f GDPR and recital 47). We do not process special category data, we do not build profiles with legal effects and we do not contact personal addresses. The data comes from the sources set out in section 2, and the detail — providers included — is in the Privacy Policy.

In both cases unsubscribing takes one click and is permanent: when you unsubscribe you are added to a permanent exclusion list and we stop contacting you, even if your details later reappear in another source. We then keep only what is strictly necessary for that exclusion to keep working.

6. How long we keep the data

• Account and authorised-user data: while the relationship is active. When the Service ends, the account and its users are deleted within the period in section 13 (30 days of exportable copy + 30 days). The only things surviving that deletion are those listed in the bullets below.
• Billing and accounting data: six years from the last entry (art. 30 of the Spanish Commercial Code); the tax periods (four years, art. 66 of the General Tax Act) fall within this.
• Security and compliance logs: up to five years, to evidence what happened and defend claims.
• Case-management activity record of your team: up to two years after the relevant process is closed and, in any event, until the authorised user who generated it closes their account, at which point it is deleted in full. For that reason these counts are not suitable as a contractual or remuneration basis (commissions, variable pay): if you need such a basis, keep it in your own records.
• Professional prospecting contact data: until you object or until 36 months without interaction, whichever comes first.
• Cookie consent receipts for our public pages: 24 months, the cycle after which consent must be asked for again.
• Access invitation to an account prepared by JOBO: the link lasts 7 days. If the account is not activated, we delete the email address and the link’s fingerprint 30 days after it expires —or immediately if the invitation is cancelled—, and of the invitation we keep only its status and dates, with no contact data. An account that is activated and never contracts anything (no plan, no processes, no invoices) is deleted in full after 180 days without activity. An account that does contract follows the period in the first bullet.

Once the period expires, the data is deleted or anonymised. What happens to the data of your recruitment processes when the relationship ends is different and is set out in section 13.

7. Who accesses your data inside JOBO and what we do in our internal environments

Inside JOBO, access to an account’s file is restricted to administrator accounts and is verified on the server before each screen is delivered, not only in the browser. The most sensitive operations — user and administrator management, the security panel, the handling of rights requests and breaches, and the impersonation described below — additionally require a second authentication factor. We access for three things: handling the incidents you report, administering accounts, and supervising the quality of the automated assessment. Administrative actions are logged in full; consultations of a file are logged by sampling, and we are extending that coverage.

Only to resolve an incident —never to review your activity, assess your team or for any other purpose—, an administrator can sign in to the Platform as if they were a user of your account, where that is the only way to reproduce the fault you reported. It is an exceptional, bounded tool: when it starts, when it ends and who did it are logged, it requires a second authentication factor, it expires automatically after two hours, and anything written during it is attributed to the administrator’s account, not to the impersonated user’s. You may ask us at any time for the detail of the accesses to your account.

Before releasing a change we test it in internal environments separate from production and with different credentials. Those environments are not fed with your account’s data: the database we use for integration was created from a production copy of 18 April 2026 —before any client company account existed— and has been fed with test data ever since. Even so, any erasure request is executed in those environments too, not only in production.

8. Recipients and sub-processors

We rely on providers that process data on our behalf under article 28 GDPR contracts. The full list — each provider’s legal name, what it is used for and where it processes data — is published on the Sub-processors page and kept up to date; changes are announced there at least 30 days in advance.

That list distinguishes two groups. The Platform providers — Google (Firebase and Gemini), Neon/Databricks for the database, Stripe for payments, LiveKit and ElevenLabs for the video interview, Sentry for errors, Cloudflare and Resend — which are the article 28 sub-processors in respect of your candidates’ data and also appear in the DPA. And the providers of our commercial operation — Attio, Smartlead, Brevo, Apollo.io, NeverBounce, PostHog and Meta in its advertising and measurement role, among others — which process data of professional contacts and of visitors to our pages, not your candidates’ data, and therefore do not appear in the DPA. Meta also appears in the first group for a different function: signing in with Facebook, where someone chooses to register that way.

Beyond those providers, we disclose data only to the tax authorities and other public bodies where a rule requires it, and to our legal advisers, auditors or insurers where necessary to manage or defend the relationship. The applicable security measures are in the Security Policy.

9. International transfers outside the European Economic Area

Some of those providers process data outside the European Economic Area. In those cases we apply the Chapter V GDPR safeguards: an adequacy decision where one exists and, failing that, the Standard Contractual Clauses of Implementing Decision (EU) 2021/914 with any appropriate supplementary measures. You may request a copy of the safeguards applied to a specific provider by writing to dpo@joboapp.es.

These are the main cases, and the list is not exhaustive. United States: Google, Sentry, Cloudflare, Meta, Apollo.io, NeverBounce and Anthropic, under the Standard Contractual Clauses and, where the entity is certified, the EU-US Data Privacy Framework. United Kingdom: Attio, under the adequacy decision. Australia: Smartlead, a country with no adequacy decision, so the transfer relies solely on Standard Contractual Clauses with supplementary measures. With an EU contracting entity and onward transfers outside the EU: Brevo (France, to India and the United States) and OpenAI (Ireland, to the United States).

The processing country of each provider is stated one by one on the Sub-processors page, which is the list kept up to date and the one that prevails over the enumeration above.

10. Automated decisions and profiling

In respect of your company and your authorised users we do not take decisions based solely on automated processing that produce legal effects or similarly significantly affect them within the meaning of article 22 GDPR, nor do we build profiles of that scope. The only automated elements are the anti-fraud and security controls and the limits of the contracted plan; where one of those controls restricts the use of an account, a person reviews it before the restriction becomes final and you can ask us to review it.

Automated assessment using artificial intelligence affects candidates, not you, and follows a different route: we explain it in Automated Decisions. Note that, by using the Platform to assess candidates, it is your company that deploys a high-risk AI system and assumes the obligations corresponding to it as deployer: human oversight, which the Business Terms make an essential condition, and information to the people affected, which the law imposes on it directly (art. 26.7 of Regulation (EU) 2024/1689 and arts. 13 and 14 GDPR).

11. Information security and breach notification

We apply technical and organisational measures proportionate to the risk: encryption in transit and at rest, role-based access control verified on the server, a second factor on critical operations, access logging, environment separation, backups and dependency review. The detail is in the Security Policy.

If a security breach occurs affecting data for which we are the controller, we notify the Spanish Data Protection Agency within 72 hours of becoming aware of it where required, and the people affected without undue delay where the risk is high. If the breach affects your candidates’ data, for which you are the controller, we notify you without undue delay so that you can meet your own obligations, on the terms of the DPA.

12. Your rights and how to exercise them

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to dpo@joboapp.es or by post to the address in section 1. It is free of charge. We may ask you for additional details to confirm that you are who you say you are; we will not use them for anything else.

• Objection. Where we process your data on legitimate-interest grounds, you may object on grounds relating to your particular situation (art. 21 GDPR). Against prospecting and marketing communications the objection is unconditional: we always stop.
• Withdrawal of consent. Where the basis is your consent — cookies and trackers on our public pages, subscription to our communications, and the reporting of the conversion to Meta described in section 15 — you may withdraw it at any time (art. 7.3 GDPR), without affecting the lawfulness of processing carried out beforehand.
• Complaint. You may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), either directly or after contacting us.

We will respond within one month of receiving the request; if the request is particularly complex or several are received together, we may extend that by two further months, telling you within the first month and explaining why (art. 12.3 GDPR).

13. What happens when the relationship ends

When the Service ends we make an exportable copy of your processes’ data available to you for 30 days. After that period, and within a maximum of 30 further days, that data is deleted. The detail is in the DPA, which is the document governing your candidates’ data.

The authorised users’ data is deleted along with the account. The only things surviving are the invoices and the security and compliance logs, on the periods in section 6: they respond to a legal obligation and to the defence of claims. We keep nothing “just in case”: anything without a declared period is deleted.

14. Candidate data and your team’s data: who answers for what

For the data of the candidates you assess on the Platform, you are the controller and JOBO is the processor, on the terms of the DPA and the Privacy Policy. You decide which processes you open, whom you assess and what you do with the result; we process that data following your instructions.

The same allocation applies to the case-management activity record of your authorised users and to the performance panels in sections 3, 4 and 6: you decide to measure your team and you are its controller; JOBO merely records and counts on your behalf. We do not use that record for any purpose of our own and, in particular, the anti-circumvention audit in section 4 does not consult it: it looks at the applications introduced and the hires declared. Nor should it be confused with the technical access and security logs, for which JOBO is indeed the controller on legitimate-interest grounds.

Measuring your staff’s activity is your decision and it has employment-law consequences: it is for you to determine the legal basis vis-à-vis your workers, to inform them in advance in an express, clear and concise manner of the existence and scope of that monitoring, and to inform their legal representatives as well (arts. 20.3 and 64.4.d) of the Spanish Workers’ Statute and arts. 87 to 90 LOPDGDD). JOBO has no relationship or communication channel with your staff and cannot inform them on your behalf.

15. Measurement of our site and demo bookings

This section describes processing in which JOBO acts as controller and which concerns visitors to our public pages or anyone booking a sales demo — not your candidates’ data, which is covered by section 14.

Demo booking. When you book a demo at reservar.getjobo.eu, our server records the booking and reports that fact to PostHog (European Union region) and, from there, to Meta. This is sent from our server: it neither reads nor writes anything on your device, so it does not rely on cookies. What is sent: an internal booking identifier, the date and time, and the originating campaign (utm_* parameters) where one exists. By default we do not send your name, your email address or any other directly identifying data.

Purposes and legal bases. (a) To measure our own sales funnel —how many demos are booked, and from which campaign— on the basis of our legitimate interest (art. 6.1.f GDPR); and (b) to report the conversion to Meta in order to optimise our advertising campaigns, on the basis of your consent to the Advertising category (art. 6.1.a GDPR). The originating campaign is only retained across pages if you have accepted that category. For purpose (b), Meta acts as a joint controller under the terms of its joint-controller addendum.

And one signal from your browser, if you accepted “Advertising”. When the booking is confirmed, the joboapp.es/demo page also reports the conversion to Google Ads (Google Ireland Limited / Google LLC) to measure whether the visit came from a Google ad: only the internal booking identifier, so it is not counted twice, and without ad-personalisation signals. This one does depend on the banner: it only happens if you have accepted the Advertising category (art. 6.1.a GDPR), and the cookies it uses (_gcl_*) are described in the Cookies Policy.

You may object to purpose (a) and withdraw consent for (b) and for the Google Ads signal at any time, without affecting the lawfulness of processing carried out beforehand, by writing to dpo@joboapp.es or through the cookie banner. Details of the cookies on our public pages are in the Cookies Policy.

16. Changes to this page and previous versions

This page carries its version number and the date of the last review in its header. When we change it, we will publish the new version here with its date; and if the change is material — a new purpose, a new recipient or a longer retention period — we will also notify you at the account’s contact address before it takes effect.

If you need a previous version, for instance to evidence what this document said on a given date, ask us at legal@joboapp.es and we will provide it.