Privacy policy

This policy explains how JOB AND SKILLED, S.L. processes the personal data it collects through this website and in the course of its business, in accordance with Regulation (EU) 2016/679 (GDPR) and with Ley Orgánica 3/2018, on the protection of personal data and the guarantee of digital rights (LOPDGDD 3/2018, Spain's data protection act).

1. Data controller

No Data Protection Officer has been appointed, because none of the circumstances set out in article 37 of the GDPR apply.

2. What data we process and for what purpose

2.1 Business enquiries and commercial contact

• Data: first name and surname, company, telephone, email, service requested, location and description of the project.
• Purpose: to deal with the enquiry, prepare the proposal and maintain the commercial relationship.
• Legal basis: your consent (art. 6.1.a GDPR) and, where there is a contractual or pre-contractual relationship, performance of a contract (art. 6.1.b).

2.2 Applications from trades professionals

• Data: first name and surname, DNI (Spanish national ID) or NIE (foreigner's ID number), telephone, email, trade, experience, emergency contact and the documentation you provide to us (PRL training — occupational risk prevention — certificates and medical fitness assessment).
• Purpose: to manage your application, assess your profile for vacancies and, if you are taken on, to process your registration and the associated employment obligations.
• Legal basis: your consent (art. 6.1.a) for handling the application; performance of the contract (art. 6.1.b) and compliance with legal employment and social security obligations (art. 6.1.c) if you are taken on.
• Note on the DNI/NIE: we ask for it because it is required in order to register you with the Seguridad Social (the Spanish social security system) and for the coordinación de actividades empresariales (the statutory coordination of health and safety between the companies working on a site). It is not published and is not passed on for any other purpose.

2.3 Employed staff: working-time records and location

• Data: clock-in and clock-out times, the site assigned, and geolocation coordinates at the moment of clocking in or out, together with their accuracy margin.
• Purpose: to comply with the obligation to keep a daily record of working time and to verify that clocking takes place at the workplace.
• Legal basis: compliance with a legal obligation (art. 6.1.c GDPR), in relation to article 34.9 of the Estatuto de los Trabajadores (the Spanish Workers' Statute), introduced by Real Decreto-ley 8/2019 (RD-ley 8/2019, which introduced mandatory daily working-time records).
• Scope: location is not tracked continuously. The position is read only when clocking in and clocking out. Every member of staff is given prior written information about this processing before they start.

2.4 Access to the client portal and the management panel

• Data: user identifier, encrypted credentials and access logs.
• Purpose: authentication, security and traceability of operations.
• Legal basis: performance of the contract (art. 6.1.b) and legitimate interest in the security of our systems (art. 6.1.f).

2.5 Job & Skilled app (Android and web)

• Location: only when you clock in or out, with the app open. The app does not access your location in the background or track you continuously (see 2.3).
• Camera and photos: to scan the site QR code, photograph your documents (health and safety training, certificates, ID when needed for registration) and add work photos to daily reports. They are kept in private storage; work photos may be shared with the client of that site within the reports. They are never published on the website without office review, which excludes faces and personal data.
• Notifications: to tell you about shifts, messages and documents we use Firebase Cloud Messaging (Google), which gives your phone a technical identifier. You can turn them off in your phone settings.
• Fingerprint or face unlock: biometric unlock is handled entirely by your phone. The app only receives whether the check succeeded; we never receive or store your fingerprint or face.
• Session: the app keeps a session identifier on the phone so it does not ask for your password every time. Your password is stored encrypted on our servers, not on the phone.
• No advertising or tracking: the app shows no ads, uses no third-party analytics and does not sell or share your data.
• Deleting your account: in the app (Help & support → Delete my account) or at jobandskilled.com/en/eliminar-cuenta. Only the data the law requires us to keep is retained, locked (section 3).

3. Retention periods

4. Recipients and processors

We do not sell or transfer personal data for commercial purposes. The following suppliers, which are necessary in order to deliver the service, may access the data as processors under a contract compliant with article 28 of the GDPR:

• Cloud infrastructure and database provider, with servers in the European Union.
• Website hosting and content delivery provider.
• Corporate email provider.
• Google (Firebase Cloud Messaging), to send notifications to the app.
• Cloudflare, Inc. (Cloudflare Web Analytics), for aggregated, cookie-free measurement of visits to the public website.
• Employment and tax advisers, for payroll and statutory obligations.

In addition, data may be disclosed to public authorities where there is a legal obligation to do so (Seguridad Social, the Agencia Tributaria — the Spanish tax authority — and the labour inspectorate) and to principal contractors, limited strictly to the documentation required by the coordinación de actividades empresariales on the site in question.

Some technology providers (website hosting and audience measurement) are companies based in the United States, so technical browsing data may be transferred internationally. In those cases the chapter V GDPR safeguards set out in their data processing agreements apply (European Commission standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework).

5. Automated decision-making

No automated decisions are taken and no profiling with legal effects on data subjects is carried out.

6. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and your right to withdraw consent previously given, without this affecting the lawfulness of processing carried out beforehand.

To exercise them, write to info@jobandskilled.com stating the right you wish to exercise and attaching a copy of a document proving your identity. We will reply within a maximum of one month.

If you consider that the processing does not comply with the applicable rules, you may lodge a complaint with the Agencia Española de Protección de Datos (the Spanish data protection authority) (www.aepd.es).

7. Security

We apply appropriate technical and organisational measures in accordance with article 32 of the GDPR, including encryption in transit, storage of credentials using key derivation functions, role-based access control, audit logging of sensitive operations and backups. We review these measures periodically.

8. Changes to this policy

This policy may be updated to reflect changes in the law or in the services provided. The date of the last update appears at the top of the page.

9. Governing version

This translation is provided for convenience. In the event of any discrepancy between language versions, the Spanish version of this document prevails.