This Privacy Policy describes how JOBO PEOPLE TECHNOLOGIES, S.L., tax ID B88736665, Sociedad Unipersonal (sole-shareholder company), with registered address at Calle Barrau 1, Bloque H, Portal 6, 1.º A, 41018 Seville, Spain (“JOBO”), processes personal data on joboapp.es and related services (the “Platform”). It complies with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD), the LSSI-CE and Regulation (EU) 2024/1689 (AI Act).

1. Data controller

• Legal name: JOBO PEOPLE TECHNOLOGIES, S.L. — Sociedad Unipersonal (sole-shareholder company)
• Tax ID: B88736665
• Address: Calle Barrau 1, Bloque H, Portal 6, 1.º A, 41018 Seville, Spain
• Email: hola@joboapp.es
• DPO: dpo@joboapp.es

Where JOBO processes candidate data on the instructions of a customer company (process publication, applications management, job-contextual assessment), JOBO acts as processor and the company as controller, on the terms of the DPA. Where JOBO processes data for its own purposes (user account, Service marketing, legal compliance), it acts as controller.

2. Data we process

• Identification: first name, surname, email, phone, identity document (Spanish DNI/NIE, passport or another national ID), date of birth (when supplied).
• Professional: CV (PDF/image + structured JSON), experience, education, languages, skills, headline, bio.
• Assessments: cognitive, soft skills (TRCE, SJT), city survival, technicalities, visual interview, final fit scores.
• Audiovisual: interview videos (webm), audio, transcripts.
• Test integrity telemetry (anti-cheat): objective device metrics during the tests — keyboard and paste activity, window focus and tab changes, number of monitors, automation or browser-extension signals, and basic browser/network characteristics. These are device measurements, not AI inferences.
• Company account: legal name, tax ID, address, sector, size, contact email, admin details, billing data managed by Stripe.
• Technical: IP address, selected language (jobo-language), activity timestamps, Firebase Auth identifiers.

Special categories (article 9 GDPR). JOBO does not request sensitive data —racial or ethnic origin, health or disability, sexual orientation, religion or beliefs, trade-union or political affiliation, genetic or biometric data— and never asks for it in any test. Nor is it among the criteria used to score: our assessment rubrics do not contain it. If it nevertheless appears because you mention it in a free-form answer, that text is processed as part of your answer —we do not separate it out or analyse it on its own— and you can ask us to delete it by writing to dpo@joboapp.es. We do not treat that mention as your consentto process sensitive data.

3. Purposes and legal bases

• Service provision (account, assessments, messaging, video calls, support). Basis: contract performance (art. 6.1.b).
• AI assessment. Basis: contract performance and, for customer companies, processor instructions (art. 28).
• Legal compliance (billing, tax, administrative requirements). Basis: legal obligation (art. 6.1.c).
• Security, fraud prevention and audit of anti-circumvention clauses. Basis: legitimate interest (art. 6.1.f).
• Assessment integrity (anti-cheat): processing of the above telemetry to detect signs of fraud during the tests. The system is advisory — no candidate is automatically rejected; the responsible people decide. Basis: JOBO’s legitimate interest (art. 6.1.f GDPR), documented in a balancing test (LIA) reviewed annually. A notice with the monitored categories is shown before each test.
• Statistical analysis and service improvement. We turn assessment results into anonymous statistics —for instance, how a given question behaves, or whether a test turns out harder than expected— to understand how our tests perform and improve them. We declare it here because turning your results into statistics is itself a use of your data: filling that anonymous store requires reading the real results first. From then on the calculations work only on anonymous data, from which you can no longer be traced. Three safeguards: they are stored already aggregated and without your name (no copy of your data is kept for this purpose); a figure only exists when there is a minimum number of people behind it, and below that minimum the cell does not appear at all —not even as a zero—; and it has no bearing on your assessment or on any process you take part in. Once anonymous, that result is no longer personal data and may be retained indefinitely. Basis: JOBO's legitimate interest (art. 6(1)(f) GDPR), with the art. 89(1) GDPR safeguards for statistical purposes. You may object by writing to dpo@joboapp.es.
• Operational communications. Basis: contract performance.
• Marketing. Basis: consent and, for existing customers, legitimate interest in similar services.
• Alerts about jobs that may interest you (candidates). If you have previously applied to a process for a given kind of role, we may email you when a new job of that same kind is published. The criterion is solely your own application history over the last 12 months: neither your evaluation results nor the profile generated by JOBO's AI are used. Basis: legitimate interest (art. 6.1.f GDPR) and art. 21.2 LSSI, given the prior relationship arising from your applications. You may object at any time, without giving reasons and without any effect on your applications: via the unsubscribe link in every such email, or from Profile → Notifications. Opting out stops these alerts entirely, both by email and inside the app. Operational alerts about your processes (outcome, messages, interviews) are not affected.
• Follow-up after signing up without applying (candidates). If you open a candidate account and, three days later, you have not applied to any selection process, we may email you once to ask whether you are still looking and what held you back, and to remind you of the job you arrived from if it is still open. No evaluation is involved: you have no application, and that absence is precisely the sending criterion; the email mentions no scores, rankings or evaluation of any kind. Basis: legitimate interest (art. 6.1.f GDPR) and art. 21.2 LSSI, given the prior relationship arising from your registration on the Platform. You may object at any time, without giving reasons: via the unsubscribe link in the email itself or from Profile → Notifications.
• Free resources (lead magnet). When you request a free test or report by providing your email, we process it to deliver the resource and to send you communications about the JOBO platform related to it. Basis: legitimate interest (art. 6.1.f GDPR), given the prior relationship created by your request. Every email includes a one-click unsubscribe link. Subscribing to the full commercial newsletter is optional and relies on your consent (art. 6.1.a).
• Behavioural Profile Test (free resource, open to anyone). If you take this test we process your name and email, the words you tick in the two lists and the free text of the last question. We use that to compute your behavioural-style profile and email it to you; a copy including your answers reaches an internal JOBO mailbox, which uses it to refine the test. Basis: your consent (art. 6.1.a GDPR), requested through a dedicated, non-pre-ticked box before you answer anything, and withdrawable at any time. It is not a selection test: it does not score, does not rank anyone, plays no part in any hiring decision and is not shared with companies. The calculation is deterministic (a fixed formula, no artificial intelligence) and never leaves our servers. Your answers are deleted automatically after 90 days.
• Behavioural profile inside the platform (cultural fit). This is a different test from the free one in the resources section, even though the questions are the same. If you are enrolled in a process and choose to take it from your dashboard, we process the words you tick in the two lists, the free text of your self-description and how long you take to answer. We use that to compute your style profile (levels per axis, natural and adapted) and a consistency indicator. Unlike the free test, the company running the process you applied to DOES see this result: it sees your levels per axis (natural and adapted), your two dominant axes, the consistency indicator, the words you ticked, the text of your self-description and a summary indicator next to your entry in the process ranking. Basis: performance of the contracted service for the company (art. 6.1.b GDPR in your relationship with JOBO; with respect to the company, which is the controller, JOBO acts as processor under art. 28 GDPR). Taking it is voluntary: you are not required to, and not taking it costs you no points — the company simply will not see that section. The calculation is deterministic (a fixed formula, no artificial intelligence), never leaves our servers and adds nothing to and subtracts nothing from the selection score.
• Web analytics and marketing/retargeting (audience measurement and campaign effectiveness on the public pages of the site). Basis: your consent (art. 6.1.a GDPR; art. 22.2 LSSI-CE), given in the cookie banner and withdrawable at any time. For analytics we use Google Analytics 4 with Google Signals enabled (demographic/cross-device signals from users logged into Google), and PostHog (EU region, with masked session replays). For marketing/retargeting we use Meta Pixel, LinkedIn Insight Tag and the Google Ads conversion tag (conversion measurement only, with the internal identifier of a demo booking and no ad personalisation). In these processing operations JOBO acts as controller and the providers as processors or, in the case of the advertising pixels (Meta/LinkedIn/Google Ads) and certain Google signals, they may act as joint or independent controllers under their own terms. This analytics is limited to the public pages and is not connected to the AI candidate-evaluation pipeline. Cookie and duration details are in the Cookies Policy.

B2B commercial prospecting (outbound)

We keep a database of professional contacts at Spanish companies potentially interested in JOBO (HR, management and talent-acquisition profiles, and technology partners). We process name, professional email, company, job title and public LinkedIn profile for the purpose of contextual B2B marketing, on the basis of legitimate interest (art. 6.1.f GDPR, Recital 47). Source of the data (art. 14 GDPR): public professional sources (public LinkedIn, partner directories, eInforma) and commercial B2B data enrichment providers (Apollo.io), which maintain their own professional contact databases. We have carried out and documented the corresponding balancing test: we only contact professionals whose role is related to JOBO, at active companies, without processing sensitive data or discriminatory profiling, and with a functional one-click opt-out. The first email you receive includes, in its footer, the source of your data, the legal basis, the purpose and the unsubscribe link. You can object at any time (one-click unsubscribe or by writing to dpo@joboapp.es); after opting out, your contact moves to a permanent exclusion list and we stop contacting you. We also keep an internal commercial score of potential companies, combining public signals (sector, size, seniority, digital presence); it is internal, not published or shared, produces no legal effects and can be reviewed on reasoned request via dpo@joboapp.es. The providers that assist us with this prospecting are listed in Section B of the subprocessor list (§5).

4. Automated decisions and AI Act

JOBO operates a high-risk AI system under the AI Act (Annex III, point 4). Information about the logic, automated flows, evaluation criteria and your rights (human intervention, objection, explanation) is set out in Automated Decisions and AI Transparency.

5. Recipients and subprocessors

JOBO uses the following subprocessors:

If you publish or apply to an offer, the customer company that opened that process will access your professional data, answers and generated reports, acting as a controller. Its team may also record internal notes and assessments about your application in JOBO, and log the case-management actions it takes on it (reviewed, interviewed, hired); that company is the controller of those records, and you may exercise your rights over them by contacting it directly.

6. International transfers

Some subprocessors process data outside the EEA (mainly the US). Transfers are based on Standard Contractual Clauses (Decision 2021/914), the EU-US Data Privacy Framework certification or other mechanisms under article 46 GDPR.

In particular, the web analytics and marketing flows involve transfers to the US: Google (Google Analytics 4 and the Google Ads conversion tag, served from googletagmanager.com), Meta (Meta Pixel) and LinkedIn (Insight Tag), all covered by the EU-US Data Privacy Framework and/or Standard Contractual Clauses (Dec. 2021/914). PostHog processes analytics data in the European Union region, so it does not involve an international transfer.

Analytics retention. Google Analytics 4 data is retained for 14 months (minimum configured period, data-minimisation principle). PostHog retains events and session replays per its retention policy; Meta, LinkedIn and Google Ads advertising cookies (_gcl_*, 90 days) expire per their own lifespan (see the Cookies Policy).

7. Retention

• Account and profile: while your account is active. An account is considered inactive after 24 months without signing in: at that point we close it and delete your data. We email you 30 days beforehand, and simply signing in keeps everything as it is.
• Assessments and outputs: while your account is active —so you do not have to retake tests if you apply elsewhere— and deleted when it closes. Before deleting them we turn them into anonymous statistics that can no longer identify you and that we keep to analyse and improve the service. The results of the reusable tests —cognitive, TRCE, City Survival and English level— are retained for 90 days and reused across the positions you apply to during that period, so you do not have to retake them; while they remain valid you cannot retake them at will, and normally you will only have to sit a test again if the position you apply to uses a different version of it. They are deleted once the period ends.
• Technical record of AI evaluations (hashed inputs and outputs, no personal data in the clear): 4 years, pseudonymised when the account is deleted —kept without identifying the person, as required by the EU AI Act (art. 12); purged automatically.
• Interview video: the video file is destroyed 7 days after the process you applied to is closed; after that the company can no longer play it. It is also deleted, in cascade and before that deadline, if you delete your account. The transcript and the evaluation derived from the video are kept along with the rest of your assessment and follow its same lifecycle.
• Integrity telemetry (anti-cheat): kept together with the corresponding test assessment and following its same lifecycle.
• Billing data: 6 years from the close of the financial year, under accounting and commercial law (Art. 30 of the Spanish Commercial Code). The tax obligation is 4 years (Arts. 66 and 70 of the Spanish General Tax Act) and some capital-goods invoices may require up to 10 years for VAT purposes.
• Record of your participation in a process (that your identity document was submitted to that job posting, and when — without your name, your profile or any assessment): for as long as that process exists, so that closing your account is not a way to apply again to the same job with a fresh result. Basis: legitimate interest in the integrity of the selection process (Art. 6.1(f)). You may object by writing to dpo@joboapp.es.
• Security and compliance logs (AccountEventLog, DeletionLog and AdminAccessLog —the record of which JOBO administrator accessed or modified your data, when and for what purpose—): up to 5 years to defend claims; they are then deleted automatically.
• Support tickets: what you write to us when you ask for help, and our reply, are retained for 12 months from the moment the ticket is resolved or closed; they are then deleted automatically. A ticket that is still open is not deleted because of its age.
• Messages with the company, its team’s internal notes about your application and the record of its case-management actions: up to 2 years after the process closes; they are then deleted automatically. They are also deleted if you withdraw your application, if the company deletes the offer, or if you exercise your right to erasure.

After a deletion request, JOBO will erase the data from production systems and operational copies within a maximum of 7 days —the recovery point of our daily backups—, except where retention is legally required or needed to defend claims.

Interview recording — revocation and early deletion: you can revoke your acceptance of the recorded interview at any time (this stops future processing). Revoking does not automatically delete the recording: it follows its lifecycle (destroyed 7 days after the process closes, and earlier if you delete your account). To request early deletion, write to dpo@joboapp.es; we handle it within one month, extendable by two further months if the request is particularly complex, informing you of the reason within the first month (art. 12.3 GDPR).

8. Your rights

You may exercise at any time:

• Access, rectification, erasure, restriction, objection and portability (arts. 15–20 GDPR).
• Not to be subject to decisions based solely on automated processing producing legal effects (art. 22).
• Withdraw consent at any time.
• Lodge a complaint with the Spanish Data Protection Agency (aepd.es).

To exercise these rights: dpo@joboapp.es or Data Deletion. If you want to contest or challenge an automated evaluation you consider inaccurate or unfair (request human intervention, share your point of view or ask for its erasure), use the dedicated channel revision@joboapp.es.

9. Security

We apply appropriate technical and organisational measures: encryption in transit (TLS 1.2+) and at rest, role-based access control, MFA for administrators, environment segregation (production / development / test), logging of sensitive events, Sentry incident monitoring and continuity plans. We will notify the AEPD and affected users of personal data breaches in accordance with article 33 GDPR.

The detail of these measures (article 32 GDPR) is set out in our Security Policy. Where we process data on behalf of a client company, the DPA also applies.

10. Minors

The Service is not addressed to persons under 18. If we detect a minor’s registration we will delete it.

11. Changes

JOBO may update this policy. The current version is always at this URL with the date. Material changes are notified by email.

12. Contact

Support: hola@joboapp.es. Legal: legal@joboapp.es. Data protection: dpo@joboapp.es.