Effective from 2026-10-19
Privacy policy
This policy explains how jajob.dk processes personal data when you look for a job, hire, or simply visit the site. We only process the data the service needs, we never sell personal data, and we never show employers how you behave on the site. You decide who can see your profile and when your contact details are shared.
1. Data controller
LynBro ApS, CVR no. 46321499 (Danish company registration number)
Rødovre Parkvej 276, 2610 Rødovre, Denmark
Email: info@jajob.dk
Write to us if you have questions or want to exercise your rights.
2. Who does what
- jajob.dk (LynBro ApS) is the controller for accounts, profiles, job search, matching, invitations, the AI assistant, payments and the security of the site.
- When you apply for a job or accept an invitation, the employer receives the information you share and becomes an independent controller of it. The employer's own privacy policy then applies to its recruitment.
- When an employer uses our hiring tools (pipeline, notes, scorecards, interviews), the employer decides how candidates are assessed. For that processing the employer is the controller and LynBro ApS is its processor under our data processing agreement.
- Job ads imported from an employer's own recruitment system (ATS) are published on the employer's instruction and with its consent; the employer is responsible for their content.
- Job ads from public sources. Some job ads are collected automatically from the careers pages and job boards where the employer has itself published them. We show the ad with a link to the original, and applications go to the employer's own site. Such an ad normally contains no personal data except a contact person the employer has named in it. The employer can ask us to correct or remove its ads, or take the company over by claiming it, by writing to info@jajob.dk.
3. You control your profile
Your profile is hidden when you create it. You choose for each part who can see it:
| Part of the profile | Who can see it (you choose) |
|---|---|
| Headline, skills, languages | Nobody · employers you apply to · employers with CV database access · everyone (anonymous card) |
| Summary and CV text | Nobody · employers you apply to · employers with CV database access |
| Name | Only employers you apply to or whose invitation you accept · employers with CV database access |
| Contact details (email, phone, links) | Only employers you apply to or whose invitation you accept |
Employers who can find you may send you an invitation. You can accept it (your contact details are then shared with that employer), decline it, or block the employer. We never share your contact details just because an employer viewed your profile.
4. What we process, why, and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Your account | Email, password (stored only as a hash), role, language | Contract, GDPR Art. 6(1)(b) | While the account is active. You can close it yourself; data is deleted or anonymised within 30 days |
| Job seeker profile | Headline, summary, skills, languages and level, Danish ability, availability, city, and — if you add them — name, phone and links; your visibility choices | Contract, Art. 6(1)(b) | While the profile is active. After 6 months without activity we remind you, and you can extend by 6 months with one click. If you don't, the profile is hidden from employers (not deleted). It is deleted when you close your account |
| Applications and invitations | Your application, screening answers, status history, messages, invitations and your answers to them | Contract, Art. 6(1)(b) | Up to 6 months after the recruitment has ended, unless you agree to a longer period (talent pool, renewable for 6 months at a time) |
| Matching and search | Your profile and job ads converted into numeric vectors, to show how well a job fits and why | Contract, Art. 6(1)(b), and legitimate interest, Art. 6(1)(f) | As long as the profile or job ad exists |
| AI assistant | What you write to the assistant, the page you are on, and the information the assistant fetches for you within your own access | Contract, Art. 6(1)(b) | Conversations 90 days |
| Employer accounts and job ads | Company name, CVR number, address, team members' names and email, job ads, including ads imported from the company's ATS | Contract, Art. 6(1)(b) | While the account exists; closed job ads up to 3 years |
| Employer transparency | Public data from the Danish Central Business Register (CVR), including names of owners and management, and how quickly the company answers applicants | Legitimate interest, Art. 6(1)(f): helping job seekers know who they apply to | While the company has a page on jajob.dk |
| Payments, campaigns and bookkeeping | Plan, campaign status (e.g. Founding employer), invoices, payment status (card details are handled by Stripe) | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c), under the Danish Bookkeeping Act | 5 years from the end of the financial year |
| Service emails and reminders | Email address, type of message | Contract, Art. 6(1)(b) | Up to 12 months |
| Job ads from public sources | Company name, CVR number, the job ad as the employer published it (may name a contact person), link to the original | Legitimate interest, Art. 6(1)(f): helping job seekers find open jobs | While the ad is open at the source; closed ads up to 3 years |
| Sign-in codes, password reset and bot protection | Email address, one-time code or reset link (stored only as a hash, valid for a short time), IP address, browser and device signals, time, number of attempts | Contract, Art. 6(1)(b) (codes and reset); legitimate interest, Art. 6(1)(f), and security of processing, Art. 32 (protection against bots and abuse) | Codes and reset links until used or expired (20 minutes); security events up to 12 months |
| Security and operation | IP address, browser, pages, time, error reports, sign-in attempts | Legitimate interest, Art. 6(1)(f), and security of processing, Art. 32 | Server logs up to 90 days; security events up to 12 months |
| Statistics without cookies | Country, browser and device type, pages visited, under a pseudonym that changes every day (we never store your raw IP address for this) | Legitimate interest, Art. 6(1)(f) | Daily visit data 35 days; aggregated counts up to 400 days; product events up to 24 months |
| Audit log for companies | Who in the company did what (e.g. changed a status, sent an invitation) | Legitimate interest, Art. 6(1)(f), and accountability, Art. 5(2) | Up to 3 years |
You do not have to give us any data. Without an email address and password we cannot create an account, and without an application the employer cannot consider you.
Sensitive data. Do not put information about health, religion, ethnicity, trade union membership or similar in your profile, CV or chat. We do not ask for age, gender, CPR number or photos.
5. AI and automated processing
jajob.dk uses AI to help, never to decide:
- Matching shows how well your profile fits a job and explains why.
- The AI assistant answers questions about the site, helps you search and drafts texts. It only sees what you yourself have access to. Anything that changes your data (for example making your profile visible or sending an application) is proposed to you, and nothing happens until you confirm.
- Employers can get AI summaries of applications, help writing job ads and suggestions for interview questions.
A person always makes the hiring decision. We never reject candidates automatically, and we do not score candidates or rate how suitable they are. When an employer with CV database access searches, the results are simply ordered by how relevant they are to that search. We therefore do not make decisions based solely on automated processing that have legal or similarly significant effects for you (GDPR Art. 22). AI answers can be wrong, and they are marked as AI. You can object to matching at any time by hiding your profile.
6. Who we share data with
- Employers — only what your visibility settings allow, what you send in an application, or what you share by accepting an invitation.
- Processors that may only use the data on our instructions:
- netcup GmbH — servers and database (Germany, EU).
- Contabo GmbH — our own email server for service emails (Germany, EU).
- Google Ireland Ltd. — off-site backup copies, and a copy of emails sent to info@jajob.dk (EU; group companies in the USA).
- OpenAI Ireland Ltd. — AI features: matching texts, summaries, translation and the assistant (Ireland, EU; processing in the USA). Data sent through the API is not used to train OpenAI's models. OpenAI may keep it for up to 30 days to detect abuse and then deletes it.
- Stripe Payments Europe Ltd. — payments (Ireland, EU; group companies in the USA).
- Authorities, when the law requires it, or where necessary to establish, exercise or defend legal claims.
7. Transfers outside the EU/EEA
Google, OpenAI and Stripe have group companies in the USA. Transfers rely on the EU-US Data Privacy Framework (adequacy decision) and the European Commission's Standard Contractual Clauses (Art. 46).
8. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability, and to object to processing based on legitimate interest. As a job seeker you can change your visibility, download your data and close your account yourself in your account settings. Employers can close the company account themselves and get an export of the company's data by writing to us. For anything else write to info@jajob.dk; we answer within one month.
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.
9. Security
Passwords are stored only as hashes, all traffic is encrypted (HTTPS), access to data is limited by role, companies are separated from each other, and actions in company accounts are logged. If a breach affects your data and is likely to put you at high risk, we tell you without undue delay.
Signing in may require a one-time code sent to your email address, and our forms are protected against bots. The check is technical: it looks at how a request is made (for example IP address and browser signals), is used only to keep the service secure, and is not used for hiring decisions or marketing. If a check wrongly blocks you, write to info@jajob.dk. The device you sign up on, and any device you keep trusted when entering a code, gets a random identifier for 30 days so that we do not ask for a code every time. Resetting your password or signing out everywhere removes it.
10. Cookies
We only use the cookies needed to keep you signed in and to keep sign-in secure. Read more in our cookie policy.
11. Changes
We update this policy when the service changes. The current version and date are always on this page; we notify registered users by email of material changes.