Privacy Policy
Privacy Policy — upjobs.cz
The Czech version is decisive; this English translation is for information only.
1. Introductory information
1. This Privacy Policy is issued by StartupJobs.com s.r.o., Company ID (IČO): 291 53 786, with its registered office at Šostakovičovo náměstí 1515/5, Stodůlky, 155 00 Prague 5, registered in the Commercial Register under file No. C 204709 kept by the Municipal Court in Prague (the "Operator", "we", "us" or "our"), as the operator of the upjobs.cz portal.
2. These rules govern the principles of personal data processing for all users of the website www.upjobs.cz and its English version at www.upjobs.cz/en.
3. We process personal data in accordance with the GDPR (Regulation (EU) 2016/679), Act No. 110/2019 Coll., Act No. 480/2004 Coll. and other regulations.
4. The Operator acts as both a controller and a processor. It is a controller with respect to the data entered when creating and managing a profile. In cases where you provide data to another party through upjobs.cz (e.g. when responding to a job posting), you are the controller and the Operator acts as a processor.
5.–6. The Operator takes care of data security; access is granted only to persons who necessarily need it; security is regularly tested.
7. The Data Protection Officer is Hana Mikschiková, [email protected].
8.–11. AI candidate profile _(optional feature; may not be active during the MVP phase)_: upjobs.cz may offer advertising Customers an optional feature analysing the match between a candidate's profile and a specific job posting using artificial-intelligence tools. The feature applies solely to Applicants responding to a specific posting, serves only as informational support, does not carry out automated individual decision-making within the meaning of Article 22 GDPR, and final decisions belong to the Customer. Sub-processors of the AI services guarantee that the data is not used to train models; any transfer outside the EEA takes place only on the basis of appropriate safeguards under the GDPR.
2. What personal data we process
We use data solely for the purposes for which it was collected. Categories of data by your role:
User
You are a User if you register. The legal basis is performance of a contract (except for activity on the platform, where the basis is consent). If you respond to a Customer's job posting, the Customer becomes the controller and we act as a processor.
| Category | Data | Purpose |
|---|---|---|
| Identification | Email address | Creation and management of the profile |
| Contact | Phone, first name, surname, photograph | Contact between the User and employers |
| Career information | Job-search status, "About me", motivation, LinkedIn, attachments (CV, cover letters, portfolios), links | Presentation of the User to employers |
| Preferences | Field, way of working, location, remuneration, seniority, workload, form of cooperation, benefits | Recommending relevant offers and presentation |
| Skills | Languages, soft and hard skills | Matching skills to employers' requirements |
| Platform activity* | Searches, viewed postings/companies, responses | Platform improvement and personalisation |
*Also applies to non-registered users, if consent is given by tracking activity.
Applicant
You are an Applicant if you apply for a specific job posting. We transfer your data to the Customer whose posting you apply for. Legal basis: performance of a contract.
| Category | Data | Purpose |
|---|---|---|
| Identification | First name, surname | Identification of the applicant |
| Contact | Email, phone | Communication |
| Career information | "About me", motivation, current position, LinkedIn, attachments (CV…), links | Presentation to employers, assessment of suitability, possibly AI candidate profile |
| Preferences | Field, way of working, location, remuneration, seniority, workload, benefits | Presentation, possibly AI candidate profile |
| Skills | Languages, soft and hard skills | Matching with requirements |
| Communication content | Messages from the form | Support, possibly AI candidate profile |
Positions taken over from the StartupJobs portal: some postings on upjobs.cz come from the StartupJobs portal (operated by the same Operator). If you respond to such a position, your response is transferred to the StartupJobs system for the purpose of processing it; this fact is stated with the relevant posting.
Customer (Company / recruitment agency)
You are a Customer if you register a company. Among other things, you become the controller of the data we process for you. Legal basis: performance of a contract. Data of legal entities is not personal data.
| Category | Data | Purpose |
|---|---|---|
| Identification | Company name, Company ID (IČO), VAT ID (DIČ) | Identification of the company |
| Contact | Registered-office address, contact email, phone | Contact with the company |
| Payment | Bank details | Ensuring payments for services |
| Company representatives | First name, surname, position, email, phone | Communication with responsible persons |
| Communication content | Messages via the platform | Communication |
3. Commercial communications and withdrawal of consent
You grant consent to marketing communications upon registration/subscription and may withdraw it at any time (link in the footer of the communication, profile settings, or the contact stated in these rules). Consent to references and to the AI candidate profile can be withdrawn at [email protected].
4. How long we retain personal data
1. We retain data only for as long as necessary for the given purposes and to comply with statutory obligations.
2. Data on Customers' contact persons – for the duration of the business relationship (or until updated).
3. Data for processing a response and the selection procedure – until the position is filled (which may be longer than the validity of the posting). With consent, it may be retained in the Customer's database for similar positions for 5 years.
4. Commercial communications – until consent is withdrawn / unsubscribed.
5. Marketing data and cookies – for the duration of consent, or until the relevant cookies expire (see upjobs.cz/cookies).
6. References – by individual agreement, until consent is withdrawn.
7. Outputs of the AI candidate profile – for the duration of consent, at most for the period during which the Customer is entitled to retain data about the candidate (see point 3); thereafter deleted.
5. Your rights
You have the right of access, the right to erasure (right to be forgotten), the right to rectification, the right to object, the right to restriction of processing, the right to data portability, the right to withdraw consent and (for the AI profile) the right to an explanation of the assessment logic. If you believe your data has been processed unlawfully, you may also contact the CEO directly at [email protected] and lodge a complaint with the Office for Personal Data Protection (Czech Republic).
6. Controller–processor relationship, recipients of data
1. The Operator, customers and other third parties act as controllers/processors depending on who determines the purpose and means of processing. Processors act on the controller's instructions, adopt appropriate technical and organisational measures, maintain confidentiality and, after processing ends, destroy the data (or hand it back to the controller). Engagement of further processors only with the controller's consent.
2. To ensure the operation of upjobs.cz, we use the following processors and recipients of personal data:
| Processor / recipient | Purpose of processing | Location / transfer outside the EEA |
|---|---|---|
| Webglobe, s.r.o. | Website and database hosting, outgoing email (SMTP) | Czech Republic / EU — no transfer outside the EEA |
Card payments (Stripe payment gateway) are used solely for corporate (B2B) customers and involve only legal-entity data, not the personal data of Users or Applicants.
3. Positions taken over from the StartupJobs portal: the StartupJobs portal is operated by the same company, StartupJobs.com s.r.o., which is also the controller of data on upjobs.cz. Responses to these positions are, for the purpose of processing them, handled within the systems of the same controller; this is not a transfer to another controller or to a third party. This fact is stated with the relevant posting.
4. The list of processors may be updated over time; the engagement of new processors always takes place under the conditions laid down by the GDPR.
7. Final provisions
1. The services are not intended for persons under 15 years of age.
2. The Operator reserves the right to amend these rules; it will inform registered users of material changes by email.
3. Contact: [email protected].
4. This Privacy Policy takes effect on 1 August 2026.