On this page
1 · Who is responsible
The controller for the processing described here — the organisation that decides what happens to your data and answers for it — is:
We are not required to appoint a Data Protection Officer, and we have not appointed one. Write to the address above and a human being will read it.
2 · The short version
We collect your name, email and phone number when you register — nothing more. Once you are inside, we hold your progress through the courses and your quiz scores, because that is how the courses work. We do not run advertising trackers, we do not set analytics cookies, and we do not sell your data to anyone, ever. You can ask us to delete everything we hold about you and we will.
3 · What we collect and why
When you register for the Academy
The registration form collects your first name, last name, email address and phone number, together with the time you registered and which page you came from. We use this to open your account, give you your login for the members' area, and answer your questions.
Legal basis: Article 6(1)(b) GDPR — performance of a contract with you, and steps taken at your request before entering into one. Providing this data is not required by law, but without it we cannot give you an account.
When you use the members' area
The courses, exercises and quizzes live at academy.jobtayo.com, which runs on a hosted course platform separate from this website. Your account, how far you have got, the answers you save in the exercises and your quiz scores are stored there — so that you can come back to them, and so that the next course opens when you pass. That platform holds the data on our instructions and for no purpose of its own.
Legal basis: Article 6(1)(b) GDPR — this is how we deliver what you subscribed to.
When you pay
The subscription and the exam fee are both handled by our payment provider. The subscribe button is an ordinary link, not an embedded payment form. Nothing belonging to the payment provider loads while you are on this site — your browser contacts them for the first time only when you choose to click through and pay, and from that point their own privacy policy governs what happens on their pages.
What comes back to us is confirmation that a payment succeeded, along with the details we need for our invoice and accounting records and for knowing whether your subscription is still running. We never see or store your full card number.
Legal basis: Article 6(1)(b) GDPR for the contract, and Article 6(1)(c) GDPR for the tax and accounting records German law obliges us to keep.
When you join a live call
The courses are self-paced, but the weekly live call and the specialisation assessments run on a third-party video conferencing service. It processes your name and connection data in order to place you in the meeting. If a call is recorded, we tell you before it starts.
When you take a quiz or sit an assessment
Quizzes are scored automatically. Your answers are compared against a fixed answer key, the result is calculated by the platform rather than read by a person, and that result is what opens the next course. We store your attempts, your answers and your scores. Nothing is inferred about you beyond whether you got the questions right, and you can retake a quiz after 24 hours as often as you like — the best score is the one that counts.
Specialisation assessments are the opposite. Once those courses open, they are live calls with a person, and that person decides the result.
If you pass and choose to be listed in the JobTayo talent pool, the profile information you give us becomes visible to employers there. That step is yours to take — you can decline it and still keep your certificate, and you can ask us to remove your listing at any time.
Legal basis: Article 6(1)(b) GDPR, and Article 6(1)(a) GDPR — consent — for the listing.
When you simply visit the website
Our hosting provider records standard server log data: your IP address, the page requested, the time, the referring page, and your browser and operating system. This is how a web server works and how we detect abuse and faults.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in delivering and securing the site.
Fonts
The typefaces on this site are served from our own servers. Your browser never contacts a font provider, so no third party learns your IP address from visiting us.
Visitor statistics
We count page views so we know which pages are read and which are ignored. The measurement is cookie-free: nothing is stored on your device, no identifier follows you between visits, and you are not tracked across other websites. We see totals — how many people opened a page, which country and which site they arrived from — never individuals.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in understanding whether the site works. Because nothing is stored on your device, no consent banner is required.
4 · Who else receives your data
We use a small number of service providers. Each one processes data only on our instructions under a data processing agreement, and none of them may use it for their own purposes.
- Our hosting provider — delivery of this website
- Our registration platform — receives and stores registrations from the form
- Our course platform — runs the members' area at academy.jobtayo.com, and holds your account, your progress, your exercise answers and your quiz scores
- Our payment provider — taking the subscription and exam payments, and running the recurring billing
- Our video conferencing provider — running the weekly live call and the specialisation assessments
- Our email provider — sending you account and course correspondence
We will name any specific provider on request — write to us and we will tell you exactly who processes what.
Beyond these, we disclose personal data only where we are legally obliged to — for example to a tax authority or a court order. We do not sell personal data and we do not share it with advertising networks.
5 · Data outside the EU
Some of the providers above are based in the United States, and many of our participants are in the Philippines or working abroad, so data necessarily crosses borders. Where a transfer leaves the EEA we rely on an adequacy decision of the European Commission where one exists — including the EU–US Data Privacy Framework for certified US providers — and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply to a specific transfer.
6 · How long we keep it
- Account and course records — for as long as your subscription is active and up to three years after it ends, so we can reissue a certificate or confirm that you passed
- Invoices and accounting records — for as long as German tax and commercial law requires us to keep them
- Marketplace listing — until you ask us to remove it, or after two years of inactivity
- Server logs — a short period for security and diagnostics, then deleted or anonymised
When a retention period ends, we delete the data or anonymise it so it can no longer identify you.
7 · Cookies and tracking
This site sets no cookies. There is no advertising pixel, no cross-site tracker and no consent banner — nothing is stored on your device, so there is nothing to consent to.
We do count page views, and we do it without cookies. What that involves is described under Visitor statistics above.
The same holds for payment. We link out to our payment provider rather than embedding their script, so none of their code runs here and none of it is stored on your device. Your browser contacts them only once you click through to pay.
If we ever add something that does store data on your device, we will ask for your consent first and update this section before anything is switched on.
One piece of housekeeping, so the paragraph above is not overstated. An earlier version of this website did run Google Analytics, and it left cookies on the devices of people who visited back then. Those would otherwise have sat there for about two years. This site now deletes them on your next visit, so nothing from the old setup is left behind on your device.
8 · Your rights
Under the GDPR you can require us to do the following, free of charge:
- Access — get a copy of everything we hold about you
- Rectification — correct anything that is wrong or incomplete
- Erasure — have your data deleted, unless the law requires us to keep it
- Restriction — freeze processing while a dispute is resolved
- Portability — receive your data in a machine-readable form, or have it sent elsewhere
- Objection — object to processing we base on legitimate interest
- Withdraw consent — at any time, without affecting what was lawful beforehand
Write to hello@jobtayo.com. We answer within one month. We may ask you to confirm your identity first, so that nobody else can request your data by pretending to be you.
One decision here is automated, and we would rather say so plainly than leave you to find out: quiz scores are calculated by the platform, not marked by a person, and the score is what decides whether the next course opens for you. It is a comparison against a fixed answer key, so there is no profiling in it — nothing about you is inferred or predicted, and no decision with a legal or similarly significant effect is made about you by a machine. If a score looks wrong, tell us and we will check it; and you can retake the quiz after 24 hours in any case. Specialisation assessments are not automated at all — they are live calls with a person.
9 · How to complain
If you think we have handled your data badly, tell us first — we would rather fix it. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your residence, your workplace, or the place of the alleged infringement. The authority responsible for us is:
10 · Filipino participants
Most of the people we teach are in the Philippines or are Filipinos working abroad. Alongside the GDPR we respect the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). The rights it gives you — to be informed, to access, to correct, to erase or block, to object, to data portability, and to damages — are covered by the same process described above, and you may also contact the National Privacy Commission in the Philippines.
Two commitments specific to the talent pool listing: your profile is shown only to employers who have an account with us, and your data is never sold to third parties. You control your visibility and can withdraw it at any time.
11 · Security
The site is served over HTTPS. Access to your data is limited to the people who need it to run the Academy. We use reputable providers and appropriate technical and organisational measures. No system on the internet is perfectly secure, and we will not pretend otherwise — but if a breach ever put your rights at serious risk, we would notify you and the authority as the law requires.
12 · Age
JobTayo is for adults. You must be at least 18 to register. We do not knowingly collect data from children, and if we learn that we have, we delete it.
13 · Changes
We will update this policy when what we do changes — for example if we add a new provider or a new feature. The date at the top always tells you which version you are reading. If a change materially affects you, we will tell you directly rather than quietly editing the page.
Related pages
- Imprint — who we are and how to reach us
- Terms of Service — the rules that govern using JobTayo
- Refund Policy — cancelling, and what happens to your access
- Acceptable Use Policy — what is not allowed here