Privacy Policy

Jobo – Jobs von nebenan — Last updated

Data Controller

Jobo – Jobs von nebenan Oltion MOLI Fischergasse 31 8010 Graz, Österreich [email protected]

1. General Information

This privacy policy informs you pursuant to Art. 13 GDPR about the processing of your personal data when using the Jobo app, a hyperlocal peer-to-peer platform for everyday assistance and micro-services in Austria.

2. Nature and Scope of Data Collection

2.1 Required Data at Registration

• First and last name
• Email address (for verification and communication)
• Password (hashed using bcrypt, never stored in plain text)

First name, last name, email address and password are mandatory. Without these, account creation is not possible. All other data mentioned in this notice (e.g. location, profile picture, short description) is voluntary; if not provided, you can still use the app, but without the corresponding additional feature (e.g. no GPS-based matching without location sharing).

2.2 Location Data

• GPS coordinates (only with your explicit consent)
• Display is anonymized by 500–1000 m – exact coordinates are never shown publicly
• Location data from completed tasks is automatically deleted after 30 days

2.3 Profile Data (voluntary)

• Profile picture
• Brief description of your skills/services

2.4 Technical Data

• Push token (for notifications – automatically deleted after 30 days of inactivity)
• Device name and platform (iOS / Android / Web – for push delivery and display optimization)
• IP address (temporarily in memory for abuse prevention / rate-limiting; not persistently stored)

2.5 Communication

• Direct messages between users (content, sender, recipient, timestamp, read status)
• Contact form requests (name, email, message content)

2.6 Activity and Behavioral Data

• Likes on tasks and services
• Ratings and votes
• Content reports
• Verification requests including ID/passport documents (for voluntary identity verification)

2.7 Security and Access Data

• Time of last login
• Number of failed login attempts (for account lockout on brute-force)
• Account locked until (timestamp when attempt limit exceeded)

3. Purposes of Data Processing

3.1 Provision of the Platform

• Account creation and management
• GPS-based display of local jobs and services
• Matching between help seekers and providers
• Notifications about new messages and offers

3.2 AI Assistant "Jobot"

When using the AI assistant, your requests along with relevant platform data (approximate location, available tasks and services, user IDs) are transmitted to OpenAI (San Francisco, USA). The transfer is based on standard contractual clauses (Art. 46 GDPR).

4. Legal Bases for Processing

Consent (Art. 6(1)(a) GDPR)

Location data for GPS-based matching; push notifications

Contract performance (Art. 6(1)(b) GDPR)

Account registration, user profile, task and service matching

Legitimate interests (Art. 6(1)(f) GDPR)

Security logging, abuse and fraud prevention, rate-limiting

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place that produces legal effects concerning you or similarly significantly affects you. (This also applies to the "Jobot" AI assistant, which only answers requests without making automated decisions about users – to be reviewed by the operator if the assistant's functionality changes.)

5. Data Processors and Third Parties

Jobo uses the following technical service providers. A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with all of them:

DigitalOcean (Spaces)

File and image storage (incl. profile pictures, verification documents)

Location: EU server (Frankfurt, fra1)

Mailjet (Sinch)

Transactional emails (verification, password reset, welcome emails)

Location: EU

OpenAI

AI assistant Jobot – receives approximate location, task/service data and user IDs

Location: USA – standard contractual clauses (Art. 46 GDPR)

Expo (Expo Push)

Mobile push notifications

Location: USA – standard contractual clauses

OpenStreetMap / Nominatim

Reverse geocoding: GPS coordinates are transmitted for address lookup

Location: United Kingdom (OSM Foundation) – third country, covered by the EU Commission's UK adequacy decision

Cloudflare Turnstile

Bot protection during registration

Location: USA – standard contractual clauses

Google / Apple

Optional OAuth login; app distribution

Location: Per respective privacy policy

Firebase Analytics (Google)

Pseudonymized usage and event statistics (e.g. screen views, feature usage); data categories: usage/event data, device or app instance identifier. Only activated after your explicit consent (Art. 6(1)(a) GDPR) and can be withdrawn at any time in the privacy settings. Retention: 14 months (placeholder – to be confirmed by the operator against the current Firebase configuration).

Location: USA/Ireland – standard contractual clauses (Art. 46 GDPR)

Sentry

Crash and error diagnostics; data categories: device/OS version, error messages, possibly an anonymized user identifier. Only activated after your explicit consent (Art. 6(1)(a) GDPR) and can be withdrawn at any time in the privacy settings. Retention: 90 days (placeholder – to be confirmed by the operator).

Location: Data region to be confirmed by the operator – standard contractual clauses (Art. 46 GDPR) if hosted outside the EU/EEA

Your data is never sold to third parties or shared for advertising purposes.

You can request a copy of the safeguards for transfers to third countries (e.g. standard contractual clauses) at any time at [email protected].

6. Retention Periods (Art. 13(2)(a) GDPR)

• User account & profile: until account deletion by you
• Direct messages: until account deletion; if a conversation partner's account is deleted, their messages are anonymized
• Location coordinates in tasks/services: 30 days after completion, then automatically deleted
• Push tokens and device name: automatically deleted after 30 days of inactivity
• Verification documents: until the decision on the request, then deleted
• Transactional emails: logs max. 90 days
• Security logs (login attempts, failed logins): max. 90 days
• After account deletion: immediate anonymization of all identifying fields

7. Your Rights under GDPR

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Portability (Art. 20)
• Restriction (Art. 18)
• Objection (Art. 21)

Any consent given (e.g. for location data) can be withdrawn at any time without giving reasons – either in device settings or by email to [email protected]. Withdrawal does not affect the lawfulness of processing carried out prior to it (Art. 7(3) GDPR).

8. Contact and Complaints

Privacy Requests

<a href="mailto:[email protected]">[email protected]</a>

Response time: within one month of receipt of your request (Art. 12(3) GDPR); this may be extended by up to two further months for complex or numerous requests.

Complaint to the supervisory authority (Art. 13(2)(d) GDPR)

You have the right to lodge a complaint with the Austrian Data Protection Authority (DSB):

Data Protection Authority (DSB)

Barichgasse 40–42, 1030 Vienna, Austria

<a href="https://www.dsb.gv.at">www.dsb.gv.at</a> — <a href="mailto:[email protected]">[email protected]</a>