JobJitsu
Get started

Privacy Policy

Effective: August 2026

This is the US English translation of the German "Datenschutzerklärung".
In case of discrepancies, the German version shall prevail.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:

Thomas Gießel, operating under the name "JobJitsu"
Samoastraße 22
13353 Berlin
Germany

Email: privacy@jobjitsu.de

2. Subject Matter and Scope of This Privacy Policy

This Privacy Policy explains how personal data is processed in connection with the use of the JobJitsu platform and the related websites and applications.

It applies in particular to:

  • Visitors to the marketing website
  • Customers (business users) using JobJitsu
  • Applicants who apply for job postings via JobJitsu

JobJitsu is a B2B platform. A contractual relationship exists exclusively between JobJitsu and its customers (companies, small businesses, or self-employed persons acting in a business capacity).

Applicants do not enter into a contractual relationship with JobJitsu. JobJitsu is neither an employer nor a recruitment agency and does not make hiring decisions.

3. Legal Bases for Processing

Personal data is processed in particular on the following legal bases under the GDPR:

  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures
  • Art. 6(1)(c) GDPR – compliance with a legal obligation
  • Art. 6(1)(f) GDPR – legitimate interests
  • Art. 6(1)(a) GDPR – consent (where required)

Where processing is based on consent, consent may be withdrawn at any time with effect for the future.

4. Visiting the Website and Technical Provision

4.1 Server Log Files and Access Data

Purposes of processing

  • Providing the website
  • Ensuring stability and security
  • Detecting and preventing misuse

Categories of data processed

  • IP address
  • date and time of access
  • browser type and operating system
  • referrer URL
  • pages accessed

Retention period
Server log files are deleted automatically after 30 days.

Legal basis
Art. 6(1)(f) GDPR (legitimate interest in operating a secure and functional website)

4.2 Use of Plausible Analytics

Purposes of processing

  • Aggregated analysis of website usage
  • Improving content, structure, and user experience

Categories of data processed

  • aggregated usage data (e.g., page views, events, device type)
  • no cookies set by Plausible
  • no storage of IP addresses
  • no personal identifiers

Legal basis
Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly web analytics)

More information: https://plausible.io/data-policy

4.3 Use of Sentry (Error and Stability Monitoring)

Purposes of processing

  • Detection and analysis of technical errors
  • Ensuring the stability and security of the platform

Categories of data processed

  • technical error data (e.g. error message, timestamp, affected function)
  • technical information about the device and browser environment
  • security reports from the browser about blocked content (e.g. affected page, blocked source)

Known personal data fields are removed automatically, usually before transmission, and for security reports from the browser only at Sentry. IP addresses are not stored; cookie contents are not transmitted.

Provider
Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, San Francisco, CA 94105, USA. Data is processed in Sentry's EU instance (sentry.io, European region).

Retention period
Error data is deleted by Sentry after 90 days.

International data transfers
Sentry is based in the United States; access to the data from the United States therefore cannot be ruled out. The transfer is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which Sentry is certified (Art. 45 GDPR), and additionally on EU standard contractual clauses (Art. 46(2)(c) GDPR).

Legal basis
Art. 6(1)(f) GDPR (legitimate interest in the secure and uninterrupted operation of the platform)

Further information: https://sentry.io/privacy/

4.4 Use of Intercom (Support Chat on the Website)

Purposes of processing

  • Providing a support chat on the website
  • Answering questions before a registration

Categories of data processed

  • Content of your messages
  • Email address, if you provide it for a reply (optional)
  • Address of the page on which you use the chat, and time of use
  • Technical usage data (e.g. IP address, device and browser information)

The chat on the website is anonymous: you do not have to provide your name or your email address. If you prefer not to use the chat, you can also reach JobJitsu by email at support@jobjitsu.de. Emails to this address are also handled by JobJitsu in Intercom; this involves processing your name and email address, the content of your message and any attachments. The information in this section on retention and international transfers applies; if you are a customer, the information in section 5.5 applies.

Storage on your device
Intercom is only loaded when you click "Support" and open the chat; before that, Intercom receives no data from you and stores nothing on your device. From then on, Intercom stores three cookies and entries in your browser's local storage so that you can find your conversation again: a session identifier for seven days, and a visitor identifier and a device identifier for nine months. You can delete them in your browser at any time; your previous conversation will then no longer be visible there. If you later open the chat in the platform as a customer, these cookies are deleted first; a conversation as a visitor is not linked to your customer account. The legal basis for this storage is Section 25(2) no. 2 TDDDG, as it is strictly necessary for the chat you have expressly requested.

Retention period
Your messages and details held by Intercom are deleted three months after your last activity, that is, three months after you last wrote to JobJitsu or JobJitsu last replied to you. JobJitsu deletes them earlier on request.

Provider
Intercom R&D Unlimited Company, 124 St Stephen's Green, Dublin 2, Ireland.

International data transfers
Intercom processes the data in the United States. The transfer is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which Intercom is certified (Art. 45 GDPR), and additionally on EU standard contractual clauses (Art. 46(2)(c) GDPR).

Legal basis
Art. 6(1)(f) GDPR (legitimate interest in answering inquiries from prospective customers); where your inquiry serves to prepare a contract with you, Art. 6(1)(b) GDPR. You may object at any time to processing based on Art. 6(1)(f) GDPR (Art. 21(1) GDPR); JobJitsu will then delete the conversation.

Further information: https://www.intercom.com/legal/privacy

4.5 Notices of Unlawful Content

Purposes of processing

  • Receiving and handling notices of unlawful content
  • Evidence of how notices were handled

Categories of data processed

  • Name and email address of the person submitting the notice
  • Content of the notice, including the address of the reported content

Notices are sent to dsa@jobjitsu.de and handled in JobJitsu's email mailbox. The company whose content was reported learns the content of the notice, and the name of the person submitting it only where strictly necessary.

Retention period
Three years after the notice has been closed.

Legal basis
Art. 6(1)(c) GDPR in conjunction with Art. 16 of Regulation (EU) 2022/2065 on digital services; for retention, Art. 6(1)(f) GDPR (legitimate interest in being able to show that notices were handled properly)

5. Processing of Customer Data

5.1 Customer Account and Use of the Platform

Purposes of processing

  • Providing platform functionality
  • Performing the contract
  • Communication related to use of the platform

Categories of data processed

  • name
  • business contact details
  • company affiliation
  • usage and log data

Providing this data is required to conclude the contract; without it, JobJitsu cannot provide a customer account. No automated decision-making takes place.

Retention period
Until the customer account is terminated; thereafter, the data is deleted or anonymized within 30 days, unless statutory retention obligations apply. Registrations that were never completed are anonymized after 30 days, confirmed registrations without a company after six months without activity.

Legal basis
Art. 6(1)(b) GDPR; where you are not yourself a party to the contract (e.g. as an invited team member), Art. 6(1)(f) GDPR

5.2 Use of Plausible Analytics

Purposes of processing

  • Aggregated analysis of platform usage
  • Improving features, user flows, and performance

Categories of data processed

  • aggregated usage data (e.g., page views, events, device type)
  • no cookies set by Plausible
  • no storage of IP addresses
  • no personal identifiers

Legal basis
Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly usage analytics)

More information: https://plausible.io/data-policy

5.3 Use of Bird

Purposes of processing

  • Sending transactional emails
  • Communication within the platform

Categories of data processed

  • email address
  • communication content (e.g. system messages, notifications)

JobJitsu uses Bird as a service provider for the technical delivery of emails. No further processing for own purposes takes place.

Retention period
Bird stores the content of sent emails for up to 30 days. The email address remains stored at Bird until the customer account is closed.

Legal basis
Art. 6(1)(b) GDPR (performance of a contract)

More information: https://bird.com/legal/privacy

5.4 Payment processing

Payments are processed via Stripe (Stripe Payments Europe Ltd., Ireland). Depending on the payment method you select during checkout, a further payment service provider is involved (see below).

Purposes of processing

  • Processing payments
  • Billing paid services
  • Storing your payment method for future payments, if you expressly request this during checkout

Categories of data processed

  • payment and transaction data (processed by the payment service provider)
  • when a subscription is canceled, which of the given reasons was selected, if a reason is selected
  • in the event of a chargeback or a buyer protection claim, the reason, the deadline for responding and the payment method used, and for a payment made via PayPal additionally the case number held there

JobJitsu does not store credit card or bank account details. If you agree during checkout to have your payment method stored, it is stored by Stripe and not by JobJitsu. You can remove it there at any time via the payment portal, which you can reach in your JobJitsu account under Billing.

Payment via PayPal
If you select PayPal during checkout, you are redirected to PayPal. PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) processes the data of your PayPal account as an independent controller under its own privacy terms; JobJitsu has no influence over this and receives from there only the information required to process the payment. If you have authorized PayPal for recurring payments, you can revoke that authorization at any time in your PayPal account.

Retention period
Invoices and accounting records are retained for eight years (Sec. 147 German Fiscal Code (AO), Sec. 257 German Commercial Code (HGB), Sec. 14b German VAT Act (UStG)). A stored payment method remains stored at Stripe until you remove it.

Legal basis
Art. 6(1)(b) GDPR; for retaining invoices and accounting records, Art. 6(1)(c) GDPR; for storing your payment method for future payments, Art. 6(1)(a) GDPR (consent)

More information: https://stripe.com/privacy and https://www.paypal.com/en/webapps/mpp/ua/privacy-full

5.5 Use of Intercom

Purposes of processing

  • Providing an in-app support chat
  • Handling support requests
  • Communication with users

Categories of data processed

  • Email address
  • Name
  • Account details (e.g. company, subscribed plan, customer number)
  • Content of support requests
  • Usage data within the platform (e.g. pages viewed and time of viewing)
  • Technical usage data (e.g. IP address, device information)

Storage on your device
Intercom is only loaded when you open the chat; before that, Intercom receives no data from you. From then on, Intercom stores cookies and entries in your browser's local storage that link the chat to your account. They are deleted as soon as you sign out. The legal basis for this storage is Section 25(2) no. 2 TDDDG, as it is strictly necessary for the chat you have expressly requested.

Retention period
Conversations and the other data held by Intercom are stored for as long as your customer account exists and are deleted when it is closed. JobJitsu deletes individual conversations earlier on request. Only JobJitsu's internal customer number remains there, without a name or any other details.

Provider
Intercom R&D Unlimited Company, 124 St Stephen's Green, Dublin 2, Ireland.

International data transfers
Intercom processes the data in the United States. The transfer is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which Intercom is certified (Art. 45 GDPR), and additionally on EU standard contractual clauses (Art. 46(2)(c) GDPR).

Legal basis
Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient customer support)

Further information: https://www.intercom.com/legal/privacy

5.6 Promotional Email

Purposes of processing

  • Information about new features and product news
  • Practical tips on using the platform
  • Offers and discounts for JobJitsu's own services
  • Surveys on the further development of the platform

Categories of data processed

  • Email address
  • Name
  • Language of communication
  • Time, version of the consent wording and place it was given, as well as any withdrawal

These emails are sent only to users who have expressly consented beforehand. Consent is voluntary and is a precondition neither for registration nor for use of the platform. Only JobJitsu's own services are advertised; the email address is not passed on to third parties for advertising purposes. No channel other than email is used for promotional communication.

Consent may be withdrawn at any time with effect for the future – in the settings of the platform or via the unsubscribe link in every promotional email. The lawfulness of processing carried out up to the withdrawal remains unaffected.

To demonstrate consent pursuant to Art. 7(1) GDPR, the time, the version of the consent wording and the place it was given are stored; a withdrawal is recorded in the same way. This information is deleted when the customer account is closed.

Technical delivery is handled by Bird (see section 5.3).

Legal basis
Art. 6(1)(a) GDPR (consent) in conjunction with Sec. 7(2) no. 2 of the German Act against Unfair Competition (UWG)

5.7 Aggregate Analysis of Platform Usage

Purposes of processing

  • Analysis of JobJitsu's own business development in aggregate form

Categories of data processed

  • usage and contract data (timestamps and status)

The result is always an aggregate and permits no conclusions about individual persons. You may object to this processing at any time (Art. 21(1) GDPR).

Retention period
The data in sections 5.1 and 5.4 is analyzed for as long as it is retained; the result contains no personal data.

Legal basis
Art. 6(1)(f) GDPR (legitimate interest in analyzing JobJitsu's own business development)

5.8 Origin of the Registration

Purposes of processing

  • Measuring the effectiveness of JobJitsu's own advertising
  • Managing JobJitsu's own marketing budget

Categories of data processed

  • origin identifiers of the visit (source and campaign identifier from the link that was followed)

These identifiers are taken solely from the parameters of the link that was followed and are stored upon registration. No information is stored on your terminal equipment for this purpose and none is read from it. You may object to this processing at any time (Art. 21(1) GDPR).

Retention period
Until the customer account is closed; thereafter the identifiers are kept only without reference to a person.

Legal basis
Art. 6(1)(f) GDPR (legitimate interest in measuring the effectiveness of JobJitsu's own advertising)

5.9 Publication of Job Advertisements

Purposes of processing

  • Publishing the customer's job advertisements
  • Informing applicants who is responsible for their application

Categories of data processed

  • company details provided by the customer (e.g. name, location, website, phone number, social media profiles)
  • in the privacy notice for the respective job advertisement, also the customer's address

Recipients
The public: job advertisements and the related privacy notices are freely accessible.

Duration of publication
For as long as the job advertisement is published. The details themselves remain part of the customer account and are deleted in accordance with section 5.1.

Legal basis
Art. 6(1)(b) GDPR

6. Processing of Applicant Data

6.1 Submitting Applications via JobJitsu

Purposes of processing

  • Receiving and transmitting the application for technical processing
  • Forwarding application materials to the company that published the respective job advertisement (employer or commercial recruitment agency)

Categories of data processed

  • name
  • contact details
  • application materials and information submitted via the application form

The specific fields requested depend on the respective job posting.

In the application procedure, JobJitsu processes applications solely as a technical service provider; for the evaluation described in 6.3, see there. No automated evaluation, classification, or profiling within the meaning of Art. 4(4) GDPR takes place.

Application documents are forwarded exclusively to the company that published the respective job advertisement. That company is the controller for the processing of the application data under data protection law. JobJitsu does not forward application data beyond this recipient.

That company provides its information under Art. 13 GDPR in the privacy notice for the respective job advertisement, which is available before an application is submitted.

Retention period
Application data is anonymized six months after receipt; details are set out in the privacy notice for the respective job advertisement.

Legal basis
Art. 6(1)(b) GDPR (pre-contractual measures at the request of the data subject)

6.2 Use of Plausible Analytics

Purposes of processing

  • Aggregated analysis of usage of the pages used to submit an application
  • Improving user flows, clarity, and conversion

Categories of data processed

  • aggregated usage data (e.g., page views, events, device type)
  • no cookies set by Plausible
  • no storage of IP addresses
  • no personal identifiers

Legal basis
Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly usage analytics)

More information: https://plausible.io/data-policy

6.3 Analysis and Optimization of Job Postings

Purposes of processing

  • Measuring the effectiveness of job postings
  • Optimizing job postings
  • Improving reach, quality, and conversion

Categories of data processed

  • from applications: number, processing status, time of receipt and the route by which the posting was reached – not name, contact details or application documents
  • from advertising campaigns: aggregated metrics from the advertising platforms (reach, clicks, cost)
  • no personal evaluations
  • no profiling
  • no linking of a person across several job postings

The result is always an aggregate. It is not disclosed – not even to the customer whose job posting it concerns – and does not serve any decision about a person. Applicants may object to this processing at any time (Art. 21(1) GDPR); their application is then excluded from the statistics.

Retention period
Application data is analyzed for as long as it is retained (section 6.1); the result contains no personal data.

Legal basis
Art. 6(1)(f) GDPR (legitimate interest in measuring and optimizing the services offered)

7. Use of External Service Providers

External service providers are used to deliver the services, in particular in the areas of:

  • hosting and infrastructure
  • email communication
  • file storage
  • monitoring and IT security
  • payment processing
  • advertising platforms

Where required, processing is carried out on the basis of data processing agreements pursuant to Art. 28 GDPR.

A detailed overview of the service providers used, including the respective purposes of processing, is available in the service provider list:
Service Provider List

The service provider list is updated regularly. The most current version applies.

8. Transfers to Third Countries

Where personal data is transferred to countries outside the European Union or the European Economic Area, this is done only in compliance with the requirements of the GDPR, in particular through:

  • adequacy decisions of the European Commission
  • the use of EU Standard Contractual Clauses

The EU Standard Contractual Clauses are available on the website of the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Which service provider transfers data on which basis is stated in the service provider list.

9. Retention Period

Personal data is stored only for as long as necessary for the respective purposes of processing or as required by statutory retention obligations.

Once the purpose no longer applies, the data will be deleted or—where legally permissible—anonymized.

10. Data Subject Rights

Data subjects have, in particular, the right to:

  • access (Art. 15 GDPR)
  • rectification (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection (Art. 21 GDPR)
  • withdrawal of consent given (Art. 7(3) GDPR)
  • lodge a complaint with a supervisory authority (Art. 77 GDPR)

If you send JobJitsu a request concerning your rights, JobJitsu processes the information it contains in order to answer it and to be able to show that this has been done (Art. 6(1)(c) GDPR in conjunction with Art. 12 et seq. GDPR). JobJitsu keeps the request and the reply for three years after the request has been closed and then deletes them. If your request concerns the processing of your application by the company that published the job advertisement, that company is the controller: JobJitsu forwards the request to it and then deletes its own copy.

11. Right to Object

Where JobJitsu processes personal data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to that processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR).

No particular form is required; an email to privacy@jobjitsu.de is sufficient.

Following an objection, JobJitsu will no longer process the data concerned, unless JobJitsu can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. For processing that serves the secure operation of the platform and the prevention of abuse this will regularly be the case. JobJitsu will inform you of the outcome of the assessment.

12. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect legal or technical changes.
The current version is available on the websites and within the platform.