Skip to main content

GDPR Notice

Version 2026-06-30 · Last updated 2026-06-30

This page summarises your rights under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Czech Act No. 110/2019 Coll. on Personal Data Processing, and tells you exactly how to exercise each one inside the Service. Read this alongside our Privacy Policy and Security page.

Our role

JobMistr s.r.o. is the controller for personal data of users who register directly with the Service. For personal data you upload about your own clients, suppliers, or staff — "Customer Data" in our Terms — you are the controller and JobMistr acts as a processor under our Data Processing Agreement ("DPA"), which is published alongside this notice.

How to exercise your rights

Where a self-service option exists in the Service we point to it directly. For anything else, email privacy@jobmistr.com — we respond within one (1) month under Art. 12(3), extendable by two further months for complex requests with notice.

  1. Right of access (Art. 15)

    Confirm whether we process your personal data and obtain a copy. Self-service: Settings → Data & export. The export is a ZIP archive containing JSON files for every category of personal data we hold about you and your workspace, together with a manifest of files and the export timestamp.

  2. Right to rectification (Art. 16)

    Correct inaccurate or incomplete personal data. Self-service: Settings → Profile (personal data) and Settings → Business (your provider profile). For other categories — for example, historical audit-log entries — contact privacy@jobmistr.com.

  3. Right to erasure (Art. 17)

    Request deletion when one of the Art. 17(1) grounds applies. Self-service: Settings → Data & export → Delete workspace. Workspace data enters a thirty (30)-day recovery window before being hard-deleted from our active systems. Some data is retained beyond that period where required by law — most notably, accounting records under Czech Act No. 563/1991 Coll. (the Accounting Act): five (5) years for accounting documents and books and ten (10) years for financial statements, extendable while the records remain needed for tax proceedings.

  4. Right to restriction of processing (Art. 18)

    Ask us to limit processing while a dispute about accuracy, lawfulness, or legitimate interest is resolved. Email privacy@jobmistr.com.

  5. Right to data portability (Art. 20)

    Receive your personal data in a structured, commonly used, machine-readable format. The Settings → Data & export archive returns JSON — directly portable to another system.

  6. Right to object (Art. 21)

    Object to processing based on legitimate interests (Art. 6(1)(f)) by emailing privacy@jobmistr.com. For direct marketing the right is absolute — every marketing email includes a one-click unsubscribe per RFC 8058, and you can also withdraw consent from Settings → Notifications.

  7. Right to withdraw consent (Art. 7(3))

    Where processing relies on consent (marketing, optional integrations) you can withdraw at any time without affecting the lawfulness of prior processing. Self-service: Settings → Notifications (marketing) and Settings → Integrations (calendar / OAuth connections).

  8. Right to lodge a complaint (Art. 77)

    You may complain to your local supervisory authority. The authority for the Czech Republic is the Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz. A full list of EU supervisory authorities is published by the European Data Protection Board.

Identification of requesters

To prevent unauthorised access to personal data, we may ask you to confirm your identity before fulfilling a request — typically by replying from the email address associated with your account or by completing a verification step inside the Service. We will limit the verification to what is reasonably necessary under Art. 12(6).

Records and consent log

Under Art. 7(1) we maintain a record of consent — when you accepted the Terms and Privacy Policy (and which version), and any marketing opt-ins or withdrawals. You can review your current marketing preference and the version you accepted in Settings → Account.

International transfers

Some of our sub-processors (notably Stripe and Resend) operate from outside the European Economic Area. Personal data transferred to those processors is covered by Standard Contractual Clauses adopted by the European Commission and, where necessary, supplementary measures aligned with the EDPB's recommendations following Schrems II.

Data Protection Officer

JobMistr is not currently required to appoint a Data Protection Officer under Art. 37 GDPR. Until a DPO is appointed, data-protection enquiries are handled by our Legal team at privacy@jobmistr.com. If we appoint a DPO we will publish their contact details on this page.

EU representative

JobMistr s.r.o. is established in the European Union (Czech Republic) and therefore does not require an EU representative under Art. 27 GDPR. For requests from data subjects outside the EU, please email privacy@jobmistr.com.

Sub-processors and DPA

Our current sub-processor list is in section 4 of the Privacy Policy, and our Data Processing Agreement is published in full. Material changes are announced by email to workspace owners at least thirty (30) days before they take effect; you may object to the appointment of a new sub-processor before that period elapses.

Contact

Data protection enquiries: privacy@jobmistr.com.
General legal questions: legal@jobmistr.com.