Help category
Controller and processor roles, data rights, cookies, marketing and breach handling.
General information only. Jobaro does not provide legal, tax, accounting, employment, tenancy or health-and-safety advice. Your circumstances and location matter.
Jobaro is generally responsible for deciding how its own account, billing, security and support data is used. The final Privacy Notice must reflect the completed data map.
The uploading organisation may be the controller, with Jobaro acting as processor for particular activities. The actual role depends on who determines the purpose and means.
Potential categories include identity, contact, account, company, job, property, payment, document, image, message, location, security and usage information. The public list must match the real system.
Only for documented purposes supported by an appropriate lawful basis, such as providing the service, performing a contract, meeting legal obligations, protecting security or pursuing a properly assessed legitimate interest.
Only where they have a lawful reason and provide any required information to those people. An account does not give unlimited permission to upload customer, staff or tenant data.
Only where necessary and lawful. Access controls, additional security and a valid condition for any special-category information may be required.
The standard platform should be restricted to adults. Any feature likely to involve children's information must receive additional design and privacy assessment.
Access depends on role, organisation, job and sharing settings. Jobaro must not expose one company's customers, tenants or documents to unrelated organisations.
Likely yes for areas such as hosting, storage, email, payments, analytics or AI. The public list must identify the actual providers and relevant purposes.
It may be, depending on the configured providers and regions. Any restricted transfer must use an appropriate transfer mechanism.
Retention depends on the purpose, legal requirements, disputes, fraud prevention and customer instructions. A retention schedule must replace vague as-long-as-necessary wording.
Yes. Submit a data-rights request through the privacy portal. Jobaro may need to confirm identity and may lawfully withhold information relating to others or an applicable exemption.
Yes. Users should be able to edit ordinary profile information and submit a formal correction request where direct editing is not appropriate.
Yes, but deletion is not an absolute right. Jobaro must explain any information retained and the reason for doing so.
Jobaro must assess the incident, contain it, document it and make any legally required notifications. Not every security event is automatically reportable.
The cookie panel must list each technology, provider, purpose, duration and category. Do not populate it with generic examples that do not match the site.
Yes. Rejecting optional technology must be as easy as accepting it, although strictly necessary and legally exempt technologies may operate where the conditions are satisfied.
Yes. Marketing preferences must be accessible from account settings and each relevant message. Necessary account, security and transaction messages are separate.
Use the dedicated privacy complaint form. Jobaro must acknowledge the complaint within 30 days, investigate it and communicate the outcome without undue delay.
