Privacy Policy

The protection of your data is very important to us! That is why we comply with the legal provisions on data protection (GDPR) and go above and beyond to protect your data. The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states of the European Union (EU) as well as other data protection provisions is:

Jobwork GmbH
Friedrichstraße 23a
10969 Berlin

If you have any questions about data protection, you can reach us at hello@jobwork.com.

This version of the privacy policy is effective as of 30 October 2026.

I. General

When we refer to data processing, we always mean your personal data. In the GDPR, these are defined in Art. 4 No. 1 as information relating to an identified or identifiable person. This means all data that have a connection (whether direct or indirect) to you, e.g. first name, surname, addresses, email addresses, user behaviour, etc. Data in connection with online websites or services that do not belong to us or that we do not control are not part of this privacy policy.

1. Why do we process personal data?

In order to offer you free or paid services, it is absolutely necessary to collect personal data. At the same time, this is the only way we can ensure the best possible user experience and optimise our services. We only process personal data in compliance with the statutory provisions. In addition, we process data when we have consent or when we have a legitimate interest in processing (e.g. interest in analysis, optimisation, economic operation, security of our online offering, in particular in measuring reach and collecting access data and using the services of third-party providers).

2. When and to what extent do we process personal data?

2.1 Contacting us

If you contact us by email, the data will be processed insofar as it is necessary to answer your questions. Contacting us via our chat is carried out through the services of Intercom and requires visiting our website.

2.2 Visiting our website

When you visit our website and our web app, we use cookies and comparable technologies. We only use what is not strictly necessary with your consent. We obtain your consent through our cookie banner; you can change or withdraw it at any time via the “Cookies” link in the footer. Part II describes the individual services we use.

2.3 Provision of contractual services

We process master data and contract data in order to fulfil our contractual obligations and service provisions. (Art. 6 para. 1 lit. b GDPR).

On our website, we offer you the option of registering by providing personal data. The data is entered into an input form, transmitted to us and stored.

2.3.1 Personal data of registered employees

When registering as an employee, only first and last name as well as email address are initially required. In connection with your user profile, further personal data that are an expression of physical, physiological, genetic, psychological, economic, cultural or social identity may be collected.

2.3.2 Personal data of registered clients

When registering as a client, certain personal data is also collected, initially first and last name as well as company name, (business) email address and (business) telephone number. In connection with the company profile on Jobwork, further data may be collected.

2.4 Sign-in and account

We provide sign-in to Jobwork (with a password, with a code sent by e-mail or via social login) through the service Clerk of Clerk, Inc. (USA). For this, Clerk processes your e-mail address, your name, your sign-in times, device and browser data and your IP address. The legal basis is Art. 6(1)(b) GDPR, because we cannot provide your account without sign-in. On transfers to the USA, see section I.6.

2.5 Social Login / Single Sign-On

We offer you the option of registering and logging in via your existing accounts on social networks and other platforms. For this purpose, we use the so-called "Single Sign-On" (SSO) technology of the following providers, provided technically through Clerk (see 2.4):

2.5.1 Facebook Login

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Scope of data processing: When you log in via Facebook, we receive the following information from Facebook:

  • Your public profile ID on Facebook
  • Your name (first and last name)
  • Your email address stored on Facebook
  • Your profile picture (if public)

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract) as well as Art. 6 para. 1 lit. f GDPR (legitimate interest in simplifying the registration process)

2.5.2 Google Login

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Scope of data processing: When you log in via Google, we receive the following information from Google:

  • Your Google user ID
  • Your name (first and last name)
  • Your email address stored on Google
  • Your profile picture (if available)

2.5.3 LinkedIn Login

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

Scope of data processing: When you log in via LinkedIn, we receive the following information from LinkedIn:

  • Your LinkedIn member ID
  • Your name (first and last name)
  • Your email address stored on LinkedIn
  • Your profile picture
  • Basic information about your professional activity (position, company)

2.5.4 TikTok Login

Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

Scope of data processing: When you log in via TikTok, we receive the following information from TikTok:

  • Your TikTok user ID
  • Your username
  • Your email address stored on TikTok (if available)
  • Your profile picture

2.5.5 General information on Social Login

Data transfer: When using Social Login services, connections to the servers of the respective providers are automatically established. Technical data such as your IP address is also transmitted in the process.

Control over transmitted data: You can revoke the authorisation for our app at any time in the settings of the respective social media account.

No linking of your Jobwork activities: We do not transfer any information about your use of Jobwork back to the Social Login providers, unless it is technically necessary for authentication.

Deletion upon account deletion: If you delete your Jobwork account, all data received via Social Login will also be deleted.

Privacy policies of the providers:

2.6 How you came to us

When you sign up to Jobwork, we store with your account which campaign and which kind of page brought you to us:

  • the campaign tags of the link you came through (utm_source, utm_medium, utm_campaign, utm_content), if any;
  • the kind of page you entered www.jobwork.com on, for example the home page, a job page or the job list, and for a job page its public job number, never the exact address of the page;
  • the domain of the website you came from (for example www.google.com), never the exact page;
  • the day you signed up and your choice in the cookie banner at that time.

We store nothing on your device for this: the information travels in the address (URL) of our links during your visit.

Purpose: we analyse which channels, campaigns and jobs lead to sign-ups and later upgrades, so that we can target our advertising better. The information stays with Jobwork; in particular, we do not pass it on to advertising platforms.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to measure the effectiveness of our advertising.

Storage period: 12 months after you sign up, we detach the information from your account. What remains is an anonymous record that only contains the month of sign-up, the campaign and the kind of entry page; we replace the domains of smaller websites with “other”.

Browser signals: if your browser sends a “Global Privacy Control” or “Do Not Track” signal when you sign up, we store no campaign tags and no referring domain with your account, but only count anonymously how many sign-ups per week came through a campaign.

Objection: You can object to this processing at any time without any particular form, for example by e-mail to hello@jobwork.com. We then delete the information and store none for your account in future.

3. Legal basis for the processing of personal data

Insofar as we obtain consent of the data subject for processing operations of personal data, Art. 6 para. 1 lit. a GDPR serves as the legal basis. For the processing of personal data that is necessary for the performance of a contract, Art. 6 para. 1 lit. b GDPR serves as the legal basis. Insofar as processing is necessary for compliance with a legal obligation, Art. 6 para. 1 lit. c GDPR serves as the legal basis. If processing is necessary for the purposes of a legitimate interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis.

Storing information on your device and reading information stored there (for example through cookies) is governed by Section 25 TDDDG: where this is strictly necessary for a service you have expressly requested, Section 25(2) TDDDG applies; otherwise we obtain your consent under Section 25(1) TDDDG.

4. Data deletion and storage duration

The data stored by us will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory retention obligations. According to statutory requirements, retention is for 6 years pursuant to § 257 para. 1 HGB and for 10 years pursuant to § 147 para. 1 AO.

5. How do we protect your personal data?

We implement physical, technical and administrative security measures to adequately protect your personal data against loss, misuse, unauthorised access, disclosure and alteration. These security measures include firewalls, data encryption and access controls.

6. When do we share your data?

We assure you that we do not sell, lend or rent your personal data. Data is only shared if this is essential, for example, to provide our service or fulfil contractual obligations, if we have a legitimate interest or if you have given us your consent.

We use service providers who process data on our behalf (for example for hosting, sending e-mails or payments). We conclude data processing agreements with them under Art. 28 GDPR. Part II describes which service providers we use.

Some of these service providers are located outside the EU or the EEA, mainly in the USA. Where a provider is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR); otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

7. Your rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights:

  • Right of access
  • Right to rectification or erasure
  • Right to restriction of processing
  • Right to object to processing
  • Right to data portability

Right to object: Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. An informal notice is enough, for example by e-mail to hello@jobwork.com.

Withdrawing consent: You can withdraw any consent you have given at any time with effect for the future; for cookies and comparable technologies via the “Cookies” link in the footer.

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

II. Cookies, Services and Other Technologies

1. Provision of the website

1.1 Description and scope of data processing

As soon as you access our website, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:

  • Information about the browser type and version used
  • The user's operating system
  • The user's IP address
  • Date and time of access
  • Websites from which the user's system reached our website

1.2 Legal basis

The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.

1.3 Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, your IP address must remain stored for the duration of the session. Storage in log files is carried out to ensure the functionality of the website. In addition, the data serves us for optimisation of the website and for ensuring the security of our information technology systems.

1.4 Duration of storage

The data is deleted as soon as it is no longer required for the purpose of its collection. In the case of data collection for the provision of the website, this is the case when the respective session has ended. In the case of storage of data in log files, this is the case after no more than seven days.

1.5 Right to object and removal

The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Consequently, there is no right of objection on the part of the user.

1.6 Hosting and infrastructure

Our website and our web app are delivered by Vercel Inc. (USA). Our server interface (API) is operated by Railway Corporation (USA), background processes such as sending e-mails by Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg). We store some files with Cloudflare, Inc. (USA). These providers process the data on our behalf; the legal basis is Art. 6(1)(f) GDPR, our interest in secure and reliable operation. On transfers to the USA, see section I.6.

2. Cookies and consent

Cookies are small text files that your browser stores on your device. Besides cookies, there are comparable technologies such as the browser’s local storage; the following applies to them accordingly.

We manage your consent with the consent banner of Usercentrics GmbH (Munich). Usercentrics stores your choice and the time of your decision so that we can respect it and prove it (Art. 6(1)(c) GDPR). In the banner, the services are grouped into categories:

  • Essential: sign-in, security, spam protection, chat, payment, error monitoring and the delivery of media. We use these services without consent, because our offering does not work without them (Section 25(2) TDDDG).
  • Functional, Statistics andMarketing: we only use these services with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

You can change or withdraw your choice at any time via the “Cookies” link in the footer. You can also restrict or delete cookies in your browser; some functions of our offering may then not work.

3. Google Analytics

On www.jobwork.com we use Google Analytics 4 of Google Ireland Limited (Ireland), but only if you consent in the “Statistics” category; without consent the script is not loaded. Google Analytics records which pages are viewed, where visitors come from and how long they stay, and sets cookies for this. According to Google, Google Analytics 4 does not store IP addresses. Data may be transferred to Google LLC in the USA (see section I.6).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The data is deleted after 14 months at the latest.

4. Google Ads: conversion measurement

Only if you consent to Google Ads in the “Marketing” category do we load the Google Ads tag of Google Ireland Limited (Ireland) on www.jobwork.com and in our web app. Without consent, nothing is sent to Google. We use the tag to measure whether an ad led to a sign-up (conversion measurement), not for remarketing.

For this, the click identifier from the ad, the page viewed without personal details from its address, and a pseudonymous identifier of your account are transmitted. This identifier prevents a sign-up from being counted twice; neither your name nor your e-mail address can be derived from it. Data may be transferred to Google LLC in the USA (see section I.6).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

5. PostHog

For product analytics we use PostHog of PostHog Inc. (USA); the data is stored on PostHog’s EU instance. Only if you consent in the “Statistics” category does PostHog record page views and the use of features, so that we can improve our offering. Personal details such as sign-in links or referral codes are filtered out of page addresses.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

6. Ahrefs Web Analytics

To measure the reach of www.jobwork.com we use Ahrefs Web Analytics of Ahrefs Pte. Ltd. (Singapore). Ahrefs sets no cookies and stores nothing on your device. Ahrefs only receives from us the domain and path of the page viewed, without parameters, and the technical data of your request (IP address, browser).

The legal basis is Art. 6(1)(f) GDPR, our interest in a data-minimising reach measurement. The transfer to Singapore is covered by the European Commission’s standard contractual clauses.

7. Sending e-mails: Resend and SendGrid

We send our e-mails, such as confirmations, notifications, the daily summary of applications and the job update, through Resend of Plus Five Five, Inc. (USA). They are sent through servers in the EU (Ireland). Open and click tracking is switched off: we do not measure whether or when you open an e-mail or click a link in it.

We still send some of our e-mails through SendGrid of Twilio Inc. (USA) until the move to Resend is complete.

Your e-mail address, your name and the content of the e-mail are transmitted. The legal basis is Art. 6(1)(b) GDPR for contractual messages, otherwise Art. 6(1)(f) GDPR. You can unsubscribe from the job update and other notifications at any time in your e-mail settings or via the unsubscribe link in every e-mail. On transfers to the USA, see section I.6.

8. Intercom

For our chat, for messages and for managing customer enquiries we use Intercom of Intercom R&D Unlimited Company (Ireland) or Intercom, Inc. (USA). Your e-mail address, your name, your phone number, contract master data, the content of your messages and information about the page you last viewed are processed; Intercom sets cookies for this.

The legal basis is Art. 6(1)(f) GDPR, our interest in answering enquiries quickly and managing our customer contact. We delete the data of prospects who contacted us through the chat after 9 months at the latest. On transfers to the USA, see section I.6.

9. Error monitoring: Better Stack

To detect and fix technical errors quickly, we use Better Stack of Better Stack, Inc. (USA); the data is stored in Germany. If an error occurs in our web app or on our servers, we receive a report with the error description, browser and operating system, the page address (credentials in it are removed), your user ID and your IP address.

The legal basis is Art. 6(1)(f) GDPR, our interest in stable and secure operation.

10. Payments: Chargebee

We handle subscriptions and payments through Chargebee of Chargebee, Inc. (USA). Your name, your e-mail address, your billing details and the payment details you enter in the payment window are processed. The legal basis is Art. 6(1)(b) GDPR and, for billing details, Art. 6(1)(c) GDPR. On transfers to the USA, see section I.6.

11. Referral programme: Cello

For our referral programme we use Cello of Powerplay GmbH (Munich). If you share a referral link or come to us through such a link, the referral code and the name of the referring person are processed so that we can attribute the referral. The legal basis is Art. 6(1)(b) GDPR.

12. Media: Uploadcare

Uploadcare of Uploadcare Inc. (USA) stores and delivers the images and videos you upload. The upload tool is loaded through the content delivery network jsDelivr, which receives your IP address. The legal basis is Art. 6(1)(b) GDPR. On transfers to the USA, see section I.6.

13. Spam protection: Cloudflare Turnstile

In the cancellation form, Cloudflare Turnstile of Cloudflare, Inc. (USA) protects us against automated submissions. For this, Turnstile checks technical characteristics of your browser and your IP address. The legal basis is Art. 6(1)(f) GDPR, our interest in protection against abuse.

14. Embedded content and third-party services

We embed content and services of other providers. For technical reasons the provider receives your IP address, because it could not otherwise send the content to your browser. Unless stated otherwise, the legal basis is Art. 6(1)(f) GDPR, our interest in an appealing and functional presentation.

  • YouTube (Google Ireland Limited, Ireland) for videos in profiles, in privacy-enhanced mode (youtube-nocookie.com).
  • Vimeo (Vimeo.com, Inc., USA) for videos in profiles.
  • Google Maps (Google Ireland Limited, Ireland) for the location search in forms of our web app.
  • Sanity (Sanity AS, Norway): images on www.jobwork.com are loaded from Sanity’s content delivery network.
  • Plyr: the video player of our web app loads its icons from cdn.plyr.io.