1. Who we are and how to contact us
Wejobby BV, Patersstraat 100, 2300 Turnhout, Belgium, enterprise/VAT number BE 1038.987.982, operates Wejobby at wejobby.com and its connected mobile app. This notice covers visitors, account holders, candidates, workspace users and people whose information is entered into the service. Contact privacy@wejobby.com or info@wejobby.com, or write to our registered office. Telephone: +32 472 49 88 28.
This notice explains data use; it is not blanket consent to processing. Optional permissions are requested separately. A workspace’s own employee, candidate or patient notice also applies to its processing. Other Wejobby products and third-party websites may have separate notices.
2. Wejobby and workspace privacy roles
Wejobby acts as controller for its own account administration, job-discovery service, customer relationships, billing, support, platform security and legal obligations. When we hold employee, recruitment or practice records solely on a workspace’s documented instructions, that organisation is the controller and Wejobby acts as processor. Actual responsibilities depend on the purpose of each activity, not simply on which screen contains the information.
Employers decide how they evaluate applications, manage employment and retain their own records. Dental practices decide how patient information is used for care and practice administration. Ask the relevant organisation about its purposes, legal bases, recipients and retention rules. We remain responsible for our own legal obligations and assist controllers with requests concerning data we process for them. A data processing agreement is required for that processing; these public pages do not replace it.
3. Information and sources
Account information includes your name, email, profile image, authentication and security information, preferences, workspace memberships and permissions. Candidate information can include your CV, contact details, qualifications, job preferences, saved jobs, applications, answers, application status and uploaded files. We receive information from you, your use of the service, organisations inviting you or entering records, and providers delivering the features you choose.
Workspace records can include employment and emergency-contact details, compensation and payroll preparation, schedules, attendance and corrections, leave, expenses and receipts, performance records, onboarding material, quiz answers and results, offboarding, documents and communications. Where contract features are available, records may include contract versions, delivery and signing status, signatory details, timestamps and associated evidence. The exact information depends on the feature and the organisation’s use.
Activated practice features can contain patient contact information, appointments, tooth findings, clinical notes and treatment plans. These may be health data even when an entry only shows that someone attended a practice. They require a separate lawful basis and additional safeguards. Do not put clinical information into public posts, job applications or general support messages.
Technical and commercial records can include IP addresses, browser or app details, security events, account activity, notification delivery information, support enquiries, billing contact and tax details, subscriptions, invoices and payment status. Full payment-card details are entered into Stripe’s payment interface rather than ordinary Wejobby forms.
4. Purposes and legal bases
Requested personal services: we use account, profile, job-preference and application information to provide the service you request and take steps at your request before a contract (GDPR Article 6(1)(b)). Required fields are identified in the interface; without them we may be unable to create an account, send an application or deliver a requested feature.
Business administration, support and security: we rely on legitimate interests (Article 6(1)(f)) to administer organisational accounts, answer enquiries, prevent misuse, diagnose problems and establish or defend claims, after considering necessity and your rights. The interests are a reliable, secure service and the management of our customer relationships. Where we have a contract directly with you, performance of that contract can apply instead.
Billing and legal duties: subscription administration relies on contract or legitimate interests for business representatives; legally required tax, accounting and regulatory records rely on Article 6(1)(c). Optional maps and other activities requiring permission rely on consent (Article 6(1)(a)). You can withdraw consent for future processing without affecting its prior lawfulness.
Workspace information: the employer or practice must identify its own Article 6 basis and, for health or other special-category data, an applicable Article 9 condition. Creating an account or accepting terms does not constitute employee or patient consent. Consent must not be assumed where it cannot be freely given. We process these records under lawful instructions and the applicable processing agreement.
5. Applications, public content and recipients
Applying for a job makes your submitted information available to the relevant employer and its authorised recruitment team. Withdrawing an application changes its status; it is not the same as erasure. Employers may retain lawful copies and make decisions under their own privacy notices. Deleting your Wejobby account cannot automatically delete information already exported by an employer.
Published jobs, company pages, community posts and their chosen images or videos can be viewed by the public, shared and indexed by search engines. Public reaction totals do not identify the people reacting. Avoid publishing private employee or patient information. Workspace records are subject to membership and role permissions; workspace owners and authorised administrators may export records within their permitted scope.
We disclose information as necessary to our service providers, authorised personnel, professional advisers, or authorities where legally required or justified to protect rights. In a business transfer, relevant information may pass to a prospective or actual successor with appropriate confidentiality and legal safeguards. This notice does not authorise unrelated uses by a recipient.
6. Service providers and international processing
Supabase supports authentication, database and file storage. Hostinger hosts the website. Stripe handles hosted checkout, subscription billing and payments and also processes information for its own payment, security and legal purposes. Resend delivers configured contact and service emails. Contact enquiries are stored for follow-up and forwarded to the Wejobby team at contact@wejobby.com.
Google Maps and Places receive map and address-search requests after optional maps permission. Where mobile push is enabled, Expo and the relevant Apple or Google notification service handle device tokens and notification delivery. Device and operating-system services may also process information when you request location or choose files. Notifications may appear on a locked device; review your device’s preview settings.
Provider infrastructure, support and recipients may be outside Belgium or the European Economic Area, including in the United States. This service does not promise that every copy remains in Belgium or the EEA. Transfers subject to the GDPR require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses with necessary additional measures; exceptions may be used only where their legal conditions are met.
Contact privacy@wejobby.com for the processing locations, recipient details and safeguards applicable to your data, and to request a copy of applicable safeguards with confidential material protected where necessary. Provider privacy notices explain their independent processing: Supabase, Hostinger, Stripe, Resend, Expo and Google. A provider link is not, by itself, proof that a particular transfer arrangement has been completed.
7. Location, permissions and browser storage
Job searches may use a place you enter and a search radius. Device location is requested for the relevant optional feature; you can deny or withdraw it in device settings and use available manual location entry. The mobile onboarding location feature takes a foreground location reading to suggest an area; it does not save precise coordinates in your profile. This does not describe or authorise continuous background tracking.
Browser storage supports sign-in, saved jobs and preferences. Optional Google maps and address suggestions remain blocked until permission is given. Change your choice through Cookie settings. See the Cookie policy for storage names and durations. The current web application does not install advertising pixels or visitor-tracking analytics. Operational reports use service records. Camera, photos, files and notification permissions depend on the feature and device.
8. Automated assistance and human decisions
Search and matching can order available jobs using preferences, location, search filters and the information supplied for a vacancy. Changing your preferences or search changes the results you see. Workplace rules can flag scheduling conflicts, attendance issues or configured thresholds. These results assist users; they are not findings of misconduct, legal advice or a final decision about employment.
Employers must meaningfully review information before hiring, pay, disciplinary or contract decisions. An alert cannot establish that a contract renewal is lawful in every country. We do not describe an unimplemented AI feature as active processing. If processing changes to include a legally significant solely automated decision, the responsible controller must first provide the required information, lawful basis and safeguards. You can contact us to ask about processing of your information or challenge inaccurate inputs.
9. How retention is determined
We keep personal data only for a necessary service purpose, lawful controller instruction, applicable recordkeeping duty or justified legal claim. The criteria below determine retention; they are not a promise of a universal automatic deletion timer.
Accounts, profiles and uploaded content: retained while needed for the account or feature, then subject to the relevant deletion request, lawful retained records and provider backup lifecycle. Applications and workspace records: retention depends on the recruitment or employment purpose, the controller’s instructions and legal duties; merely closing a vacancy, withdrawing an application or cancelling billing does not erase them.
Support and security: retained for resolution, necessary follow-up, incident investigation or substantiation of claims, with the scope limited to that purpose. Billing and tax: retained for the statutory period applicable to the record and any required audit or legal hold. Privacy choices: retained as needed to honour and demonstrate the choice; browser maps choices are valid for 180 days as described in the Cookie policy.
Clinical information: follows the practice’s applicable medical-record obligations. Deletion can be restricted where appointment or clinical history creates a retention hold. A general account-deletion request must not destroy a medical record that the practice is legally required to preserve. Backup copies can expire separately from active records, and recipient exports have their own lifecycle. Ask us or the relevant controller for the period or criteria applying to a particular record.
10. Your rights and how to exercise them
Depending on the processing and applicable law, you can request access and a copy, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time and object to direct marketing at any time. Applicable safeguards for solely automated decisions can include human intervention and the ability to express your view and contest a decision. Contact privacy@wejobby.com; info@wejobby.com is an alternative contact.
Available export and deletion controls are in My account → Data & privacy, with workspace controls subject to owner permissions. These tools supplement your legal rights; an unavailable button or an inactive paid feature does not remove the right to make a request. We may ask for proportionate information to verify identity or authority. Requests are normally free. Any fee, refusal or restriction must have a lawful basis.
For GDPR requests we respond within one month. Where complexity or the number of requests permits an extension, we tell you within that month, give reasons and may take up to two further months. We explain a refusal and the available complaint or court remedies. If your request concerns employer or practice data, contact that controller; we will assist in accordance with our role.
You may complain to the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, Belgium, or the competent authority where you live, work or believe an infringement occurred. You do not have to contact us before making a complaint. Mandatory privacy rights outside the EEA also remain available; identify your location when requesting a right so we can apply the relevant rules.
11. Security, sensitive information and young people
The service uses authenticated access, workspace permissions and protected connections. Clinical access has additional permission and authentication controls. No system is completely secure, and this notice does not claim independent security certification. Use a unique password, protect devices, review access permissions and promptly report suspected misuse to our contact address. We handle personal-data incidents and notifications according to our legal obligations and processing agreements.
Direct account registration is intended for adults aged 18 or older. An organisation holding lawful records about a younger employee, applicant or patient must provide age-appropriate information and satisfy the applicable safeguards. Do not use general recruitment or public-content features to disclose unnecessary health, identity-document or other sensitive information. Contact us if you believe an unauthorised child account or disclosure exists.
12. Changes to this notice
This version is dated 28 September 2026 and describes Wejobby. We will update the notice as the service or its processing changes and provide additional notice where required. A policy update does not create consent for a new optional purpose. The Terms & conditions address use of the service; mandatory data-protection rights prevail.