The jobson.cloud website and JOBSON user accounts
The Czech version is binding. This English translation is provided for information only; in case of any discrepancy the Czech version prevails.
1. Who is the controller and how to contact us
The controller of the personal data described in this policy is:
BePositive Group s.r.o., Company ID (IČO) 05232317, Tax ID (DIČ) CZ05232317, with its registered office at Jičínská 1786/49, Žižkov, 130 00 Prague 3, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, File 260372 ("we" or the "controller").
- E-mail: info@jobson.cloud (for data protection matters, please put "GDPR" in the subject line)
- Phone: +420 771 259 562
- We have not appointed a data protection officer.
2. What this policy covers – and what it does not
It covers processing for which we determine the purpose:
- visitors to the jobson.cloud website (including its language versions),
- people who contact us via the contact form, e-mail or phone,
- newsletter subscribers,
- people who register an agency for the JOBSON service, and users of the service (employees and collaborators of agencies) – to the extent of account management, invoicing, security and support,
- contact persons of our customers and business partners,
- people who communicate with us on social networks.
It does not cover personal data of candidates, employees and other persons that employment agencies store in the JOBSON service. We process this data as a processor on the agency's instructions; the agency is its controller. If you are a candidate or an employee of an agency, please direct your questions and requests to the agency, which will give you information about the processing. If you write to us, we will forward your request to the agency.
3. What data, why, on what legal basis and for how long
3.1 Visiting the website
| Data | IP address, browser and device data, pages visited, time, referring page, technical server logs |
| Purpose | operation and security of the website, protection against misuse, troubleshooting |
| Legal basis | legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR) |
| Period | for as long as necessary to ensure the operation and security of the website |
We use cookies and similar technologies for measuring traffic and for marketing only with your consent – see the Cookie Policy for details.
3.2 Contact form and enquiries
| Data | first name and surname, agency name, e-mail, phone, message text, website language |
| Purpose | handling the enquiry, offering the service, arranging a demonstration |
| Legal basis | steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering the enquiry (Art. 6(1)(f) GDPR) |
| Period | for as long as the enquiry is being handled and then for no longer than 24 months from the last communication, unless a contract is concluded |
| Recipients | our processors for website operation and e-mail delivery (see the List of Subcontractors, section B) |
Submitting the contact form does not subscribe you to the newsletter. You can subscribe to the newsletter separately.
3.3 Newsletter
| Data | e-mail, language, where applicable name and company, record of consent (time, source), data on delivery, e-mail opens and link clicks |
| Purpose | sending news about the JOBSON service and about digitalisation and AI in employment agencies |
| Legal basis | your consent (Art. 6(1)(a) GDPR, Section 7(2) of Czech Act No. 480/2004 Coll., on certain information society services) |
| Period | until consent is withdrawn; we keep the record of granting and withdrawing consent for as long as necessary to prove it, for no longer than 3 years |
| Recipients | Ecomail.cz, s.r.o. (Czech Republic) |
You can withdraw your consent at any time via the "unsubscribe" link in every e-mail or at info@jobson.cloud. Withdrawal does not affect the lawfulness of processing before it.
We may send customers information about similar services even without consent, to the e-mail address obtained in connection with the service (Section 7(3) of Act No. 480/2004 Coll.); you can refuse such messages at any time.
3.4 Agency registration and user accounts
| Purpose | Data | Legal basis | Period |
|---|---|---|---|
| conclusion and performance of the contract with the agency, setting up and managing the account | country, company ID and name of the agency, name, e-mail and password (in hashed form) of the founding person and other users, roles and permissions | performance of a contract (Art. 6(1)(b) GDPR) with the agency; for users who are not a party to the contract, our legitimate interest in performing the contract with the agency (point (f)) | for the term of the contract and the transition period; then for the limitation periods for possible claims (usually 3 years) |
| proof of consent to the Terms of Service and the Data Processing Agreement | versions of the documents, time, IP address, person | legitimate interest in proving the conclusion of the contract (point (f)) | for the term of the contract and the limitation periods |
| invoicing and accounting | billing details of the agency, contact person, number of active users, AI credit consumption, payments | legal obligation (point (c)) – Czech Accounting Act, Czech VAT Act | for the period laid down by accounting and tax legislation (up to 10 years) |
| card payments | the payment is processed by Stripe; we only see limited card data (e.g. brand, last 4 digits and expiry), never the full card number | performance of a contract (point (b)) | for as long as the card is stored |
| security of the service | logins, IP addresses, devices, security events | legitimate interest in securing the service and preventing misuse (point (f)) | for as long as necessary to ensure security, no longer than 12 months, unless the record is needed to handle an incident |
| support and operational messages | content of communication, support requests, e-mails about changes to the service, terms, prices and outages | performance of a contract (point (b)) and legitimate interest (point (f)) | for the term of the contract and then for the limitation periods |
| measuring and improving the service | data on use of features, performance and errors | legitimate interest in developing the service and keeping it stable (point (f)) | for as long as necessary; in the long term only in aggregated form without personal data |
AI assistant and other AI features in the application. The content of queries and the data that AI works with are the agency's data and we process them as a processor. As a controller, we keep a record of AI credit consumption (who, which operation, how many credits), used for billing and as an overview for the agency. We keep conversations with the AI assistant for 90 days. AI processing takes place via Google Cloud Vertex AI in the EU (Frankfurt); the data is not used to train models. AI only makes suggestions; a human decides and confirms.
3.5 Sample agency
After sign-up, every agency account includes a sample agency with fictional data. It is part of the agency's account and we process the data in it like any other agency data in the service (as a processor). Do not enter real personal data in it. The agency can delete it and create it again at any time.
3.6 Business partners and customer contact persons
Name, work contact details, position and communication – for performing contracts and managing business relationships (legitimate interest, point (f)), for the duration of the cooperation and then for the limitation periods.
3.7 Social networks
We run profiles on social networks (e.g. LinkedIn and Instagram). If you communicate with us there, we process the data you make available to us there (legitimate interest in communication). For page statistics we are joint controllers with the network operators; the main responsibility lies with the network operator under its own policies (LinkedIn Ireland Unlimited Company, Meta Platforms Ireland Limited).
3.8 Establishing, exercising and defending legal claims
We may use data from the categories above to the necessary extent to recover receivables and defend claims (legitimate interest, point (f)), for the duration of the limitation periods and of any proceedings.
4. Who we share data with
The data is processed only by our authorised staff and by processors with whom we have a contract under Art. 28 GDPR. The current list of processors is available in the List of Subcontractors (section B for the website, invoicing, payments and newsletter; section A for operating the application, including application error monitoring).
We also share data where required by law (e.g. with tax authorities, courts, the Police of the Czech Republic on the basis of a lawful request), with our legal, tax and accounting advisers bound by confidentiality and, in the event of a sale or transformation of the business, with the acquirer.
We do not sell data.
5. Transfers outside the EU / EEA
Some of our processors belong to groups based in the USA or process data in the USA. Transfers to the USA are based on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise on standard contractual clauses approved by the Commission. We will provide information about the safeguards on request.
6. Your rights
You have the right:
- of access to your data and to a copy (Art. 15 GDPR),
- to rectification of inaccurate data (Art. 16),
- to erasure, where we no longer need the data or the processing is not lawful (Art. 17),
- to restriction of processing (Art. 18),
- to data portability for data you provided to us on the basis of consent or a contract (Art. 20),
- to object to processing based on legitimate interest (Art. 21); you may object to direct marketing at any time and we will then stop using the data for that purpose,
- to withdraw consent at any time, without affecting the lawfulness of prior processing,
- not to be subject to a decision based solely on automated processing with legal effects (Art. 22) – we do not carry out such decision-making.
Send your request to info@jobson.cloud or by post to our registered office. We will reply without undue delay and at the latest within one month (in complex cases this period may be extended by a further two months; we will inform you). We may ask you to verify your identity.
Complaint to a supervisory authority
You may lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz, or with the supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement, e.g.:
- Slovakia: Úrad na ochranu osobných údajov Slovenskej republiky, www.dataprotection.gov.sk
- Poland: Prezes Urzędu Ochrony Danych Osobowych (UODO), www.uodo.gov.pl
- Austria: Österreichische Datenschutzbehörde, www.dsb.gv.at
- Germany: the competent data protection authority of the federal state (Land)
7. Obligation to provide data
The data in the contact form and at registration is necessary to handle the enquiry or to conclude the contract; without it we cannot handle the enquiry or set up the account. Consent to the newsletter and cookies is voluntary and refusing it does not affect your use of the website or the service.
8. Security
We protect data with technical and organisational measures appropriate to the risk, in particular encrypted transmission (HTTPS), access control, separation of customer data, audit trail, backups and hosting in the EU. An overview of the measures for data in the application is in Annex 2 to the Data Processing Agreement.
9. Children
The website and the service are not intended for persons under 16 and we do not knowingly process their data.
10. Changes to this policy
We may update this policy. The current version is always on this page with its effective date; we inform registered users of material changes by e-mail or in the application.
BePositive Group s.r.o. · Company ID 05232317 · Jičínská 1786/49, Žižkov, 130 00 Prague 3, Czech Republic · info@jobson.cloud