Your privacy is important to us!
In this privacy policy, we inform you about the key aspects of data processing on our website. We want you to know exactly how we handle your data.
Across all use cases, Nejo follows a strict data minimization principle: we request and process only the minimum information necessary to provide the explicitly requested function and do not collect data ‘just in case’ or for unrelated purposes.
Last updated: 08.01.2026
Who we are and who this policy applies to
Nejo FlexCo (referred to as: "Nejo", "we" or "us") is responsible for processing your personal data when you use our products and services.
This privacy policy is addressed to various groups of people:
- Website visitors: Anyone who visits our website
- Employers: Contact persons of our customers and business contacts
This privacy policy applies to https://mynejo.com as well as to all websites that link to this privacy policy.
Using Nejo via Third-Party Platforms (e.g., ChatGPT)
Nejo can also be used via third-party platforms, e.g., AI platforms like ChatGPT. When you use Nejo via such a third-party platform, we process your inputs and the information derived from them to provide you with the desired functionality (e.g., job search, job recommendations, application assistance).
Nejo only processes the specific content snippets that are intentionally transmitted by the third-party platform for the requested function. We do not request, reconstruct, infer, or store the full conversation history or any other contextual data from the platform beyond what is explicitly provided for the task.
When you use Nejo via ChatGPT or a similar third-party platform, we generally process the inputs without association to a Nejo user account. We do not attempt to identify you, and we do not merge this data with existing Nejo profiles.
In this context, Nejo does not transmit any personal data to the third-party platform provider. The return of results (e.g., job suggestions) is done exclusively in the form of content responses within the platform.
Nejo does not collect, solicit, or process restricted data when used via third-party platforms. This includes, in particular, payment card information, government identifiers, health data, authentication credentials (such as passwords, API keys, or one-time codes), or other data categories prohibited under applicable platform policies.
Please note: The privacy policies and terms of use of the respective third-party platform (e.g., ChatGPT/OpenAI) additionally apply to the processing of your data by that platform. Nejo is responsible for processing the data that we receive and process as part of the Nejo functionality; the third-party provider is responsible for data processing within its platform.
Details on the specific categories of data processed, storage periods, and deletion rules when using Nejo via ChatGPT are described below under ‘What data do we process – Using Nejo via ChatGPT or similar third-party platforms’.
What is personal data?
Personal data refers to all information that relates to you as an identifiable person. Which of your data we process depends on:
- which of our services you use
- which voluntary consents you have given us
- which data you enter yourself
Basis of our data processing
We take the protection of your data very seriously. Your personal data is treated confidentially and in accordance with legal regulations.
We collect and process your personal data only on the basis of legal provisions (in particular the General Data Protection Regulation and the Telecommunications Act 2003 and the GDPR).
If we do not explain certain technical terms in this privacy policy, the definitions of the EU General Data Protection Regulation (GDPR) apply. This is REGULATION (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.
Purpose and Legal Basis
We process your personal data for the following purposes and on the following legal bases:
- To create and manage your user account. Legal basis: Art. 6(1)(b) GDPR (contract performance)
- To analyze your resume to create personalized job recommendations and for the "1-Click Application" functionality. Legal basis: Art. 6(1)(a) GDPR (consent)
- To improve our AI algorithms (only anonymized data). Legal basis: Not applicable, as no personal data (see Recital 26 GDPR)
- To send email notifications (e.g., job alerts, tips). Legal basis: Art. 6(1)(a) GDPR (consent)
- For abuse detection and security of our services. Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
- To analyze usage data for product improvement and further development of our platform. For non-logged-in users, this is done only with consent via our cookie banner (Art. 6(1)(a) GDPR). For logged-in users, we process usage data based on our legitimate interest in improving our product (Art. 6(1)(f) GDPR). We ensure that your rights and freedoms are preserved – particularly through pseudonymization and data minimization.
For contact persons of our business customers and contacts, we process data for:
- Support in the recruiting process
- Support with employer branding strategy
What data do we process
Here you can find details about which personal data we process in the various areas of our platform, why we need it, and how long we store it.
Profile creation and account data - Required information
Create & manage account
When you create a Nejo account, we process your first name, your email address, and a password you set, which we store encrypted. We use this data to create your account, log you in, and send you operationally necessary information about your account (e.g., registration confirmation, password reset).
Registration logs
For security purposes and to document your registration, we store the time of confirmation and the associated IP address.
Social Login (Google, LinkedIn, Facebook, Apple)
If you log in via one of these providers, we typically receive your name and email address from them. You then do not need a password for Nejo. Changing your email address within Nejo is not possible for social login accounts; please use the respective provider’s change functions if needed.
Legal basis
Contract performance or pre-contractual measures (Art. 6(1)(b) GDPR); security and fraud prevention legitimate interest (Art. 6(1)(f) GDPR).
Storage duration
As long as your account is active. If you are inactive for 24 months, we will remind you by email. If you do not respond, we will irrevocably delete your account (including registration logs) after another 6 months, unless legal obligations prevent this.
Profile creation and account data – Voluntary information
Voluntary profile data for job search & application
You can store additional information in your profile to improve your job search or fill out applications more quickly. This includes, for example, phone number, address, date of birth, nationality, education, work experience, skills, certificates (and other professional information).
For job recommendations, we only use job-related information such as education, work experience, skills and certificates, and language skills. We do not use: name, address, email, phone number, nationality, date of birth/age, or other identifying contact information for algorithmic matching.
1-Click Application
When you apply, we show you before sending which data from your profile will be transmitted to the employer. You actively confirm this transmission.
Search with Resume
When you upload your resume, we store the file encrypted in our EU cloud (Azure Germany). We extract only the matching-relevant information mentioned above and do not store sensitive categories separately. Please do not upload confidential or sensitive data that is not required for your application.
Search with AI Chat
To use this function, we ask for your separate consent. Important note: The "Search with AI Chat" function is classified as a high-risk AI system under the EU AI Act. As the provider of this system, Nejo FlexCo is responsible for compliance with all regulations.
What data do we process?
As part of the AI chat function, we only process job-related information that you share in the chat conversation with our AI assistant:
- Career path and career trajectory
- Education and qualifications
- Skills and competencies
- Language skills
- IT and technical knowledge
- Project and industry experience
- Desired work location
Important: We NEVER ask for personal identification data such as name, phone number, email address, nationality, date of birth, age, or home address. Please do not share such information in the AI chat.
Recipients, data processing, and data locations
For processing your chat inputs, we use selected service providers as part of data processing pursuant to Art. 28 GDPR. Your data is processed exclusively on servers within the European Union.
We currently engage:
- Microsoft Azure (EU) for hosting and data processing
- OpenAI, L.L.C. as a sub-processor of Microsoft in connection with Azure OpenAI
- Google Cloud (EU) for AI-powered analysis and processing functions
- Anthropic (EU) for AI-powered analysis and processing functions
Data processing agreements exist with both service providers to ensure GDPR-compliant processing. We configure processing to occur within the EU. If in individual cases (e.g., for support/error analysis or depending on the service/deployment used) a transfer to third countries cannot be excluded, this only occurs on the basis of appropriate safeguards (e.g., standard contractual clauses).
Legal basis
Processing is based exclusively on your explicit consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time.
Storage duration
You can delete your chat data at any time via your profile settings on Nejo. All personal data will then be immediately and irrevocably deleted by us. Even if you do not revoke your consent, we only store your data for a certain maximum period:
- Chat history and extracted data: 18 months after last use of the AI chat function
- Anonymized training data: Unlimited (as there is no longer any personal reference)
The storage periods start anew each time you use the AI chat function.
You can find out how the AI chat function works in detail and how job recommendations are made based on it in our Terms of Use.
Important: No automated decisions
Our job recommendations are based on automated evaluations of your chat information (profiling). These recommendations serve solely for your orientation – you make every final decision yourself.
Legal basis
Insofar as the information is required to provide your desired functions (job search, application): contract performance / pre-contractual measures (Art. 6(1)(b) GDPR). For additional, purely voluntary data: your consent or usage action (Art. 6(1)(a) GDPR).
Storage duration
As long as your account exists; when you delete your account, we delete your profile data and CV files (see deletion periods below).
System notifications (non-optional)
We send you certain emails that are necessary for using your account – e.g., registration confirmation, password reset, notification when your resume has been processed and personalized suggestions are ready, as well as security or legally relevant communications (e.g., changes to terms of use or privacy policy).
You cannot unsubscribe from these system emails.
We do not collect opening or click data. To ensure deliverability, we store sending times and technical status information as long as your account exists.
Sending & Hosting
These system-relevant emails are sent via:
- Azure Communication Services (Germany region) for certain transactional emails such as password reset and job notifications
- Customer.io for other system-relevant emails#h4
In doing so, we transmit your email address to the respective service providers as processors pursuant to Art. 28 GDPR. Data processing takes place exclusively on EU servers. Data processing agreements have been concluded with both service providers.
Legal basis
Contract performance (Art. 6(1)(b) GDPR) and legitimate interest in the secure and reliable provision of our services (Art. 6(1)(f) GDPR).
"Search with Resume (CV)" and "1-Click Application" functions
To use these two functions, you must upload your resume. For this, we ask for your separate consent when uploading.
Important note: The "Search with Resume" function is classified as a high-risk AI system under the EU AI Act. As the provider of this system, Nejo FlexCo is responsible for compliance with all regulations.
What data do we analyze from your resume?
- Career path and career trajectory
- Education and qualifications
- Skills and competencies
- Language skills
- IT and technical knowledge
- Project and industry experience
- Place of residence (if stated in CV)
Additional data captured if included in the resume:
- Name, phone number, nationality, date of birth, address
- Important: This data is NEVER used for job recommendations, but is only securely stored in your profile for the "1-Click Application" function.
Recipients, data processing, and data locations
For the analysis and processing of your resume, we use selected service providers as part of data processing pursuant to Art. 28 GDPR. Your data is processed exclusively on servers within the European Union.
We currently engage:
- Microsoft Azure (EU) for hosting and data processing of our AI systems
- Google Cloud (EU) for AI-powered analysis and processing functions
- Anthropic (EU) for AI-powered analysis and processing functions
Data processing agreements exist with both service providers to ensure GDPR-compliant processing. Data transfer to third countries does not occur unless required for support purposes. In such cases, we rely on appropriate safeguards such as standard contractual clauses.
Storage duration
You can delete your data at any time via your profile settings on Nejo. All personal data will then be immediately and irrevocably deleted by us.
Even if you do not revoke your consent, we only store your data for a certain maximum period:
- CV raw data: 12 months after last use of the CV search function
- Extracted profile data: 18 months after last use of the CV search function
- Anonymized training data: Unlimited (as there is no longer any personal reference)
The storage periods start anew each time you use the CV search function.
You can find out how the AI analysis of your resume works in detail and how job recommendations are made based on it in our Terms of Use.
Important: No automated decisions
Important: Our job recommendations are based on automated evaluations of your profile (profiling). These recommendations serve solely for your orientation – you make every final decision yourself.
Job alerts and email notifications
What data do we process?
For job alerts:
- Email address for sending
- Saved search criteria (keywords, location, industry, etc.)
- Sending preferences (frequency, timing)
- Interaction data (opens, clicks)
For marketing emails (e.g., job search tips & tricks):
- Email address
- Registration time
- Consent status
- Interaction behavior
- Usage behavior from PostHog (e.g., features used, pages visited, activity patterns)
Personalization of marketing emails
If you consent to receiving marketing emails, we combine your pseudonymized usage data from PostHog (e.g., which features you use, which pages you visit) with your email address in Customer.io. This allows us to send you more relevant content better tailored to your interests. This linking only occurs with your explicit consent for marketing emails.
Email sending via Customer.io
For sending job alerts and marketing emails, we use Customer.io as a processor. In doing so, we transmit your email address as well as relevant sending preferences and – with consent for marketing emails – selected usage data to Customer.io. Data processing takes place exclusively on EU servers. A data processing agreement pursuant to Art. 28 GDPR has been concluded.
Storage duration
- Active email alerts: for a maximum of 3 months
- Newsletter: Automatic deletion after 12 months without email interaction
- Sending history: 3 months for technical tracking
We only send you marketing emails (e.g., job alerts, job search tips and tricks) after your explicit and voluntary consent pursuant to § 174(3) TKG in conjunction with Art. 6(1)(a) GDPR. You can give this consent either during registration or later in your profile settings. You can revoke your consent at any time by:
- clicking the "Unsubscribe" link in the email, or
- changing the setting in your profile settings on Nejo
Upon revocation, no further usage data will be linked to your email address and no more marketing emails will be sent.
Certain messages that are system-required or legally necessary are sent pursuant to Art. 6(1)(f) GDPR based on our legitimate interest. These cannot be unsubscribed as they are necessary for the operation of our service.
What we mean by system-required messages are, for example, confirmations of your registration, information about changes to our terms of use, or security-related notifications about your account.
Using Nejo via ChatGPT or similar third-party platforms
When you use Nejo via a third-party platform (e.g., ChatGPT), the content you enter there (prompts/messages) may be transmitted to Nejo and processed by us to the extent necessary to provide the function.
What data do we process?
- Chat content that you share as part of using the Nejo function (particularly job-related information such as education, work experience, skills, job preferences).
- Technical metadata strictly necessary for secure operation and abuse prevention (e.g., timestamps, system status information, pseudonymous session or request identifiers, and error messages). This metadata is not used for tracking, profiling, behavioral analysis, or analytics within third-party platforms.
Nejo does not export, forward, or disclose this data to any additional third parties, nor does it create publicly visible content or external communications based on third-party platform inputs.
Important: Please do not share sensitive or confidential information via third-party platforms that is not required for the function (particularly special categories of personal data under Art. 9 GDPR).
Storage duration and deletion
When using Nejo via third-party platforms (e.g., ChatGPT), processing occurs without association to an identifiable person or a Nejo user account.
Since no identifying characteristics are available to us, individual association, information, or deletion upon request is technically not possible (Art. 11 GDPR). In these cases, we are not obligated to collect additional information to enable identification.
Instead, the following fixed storage and deletion periods apply:
- Chat content (prompts and responses): Storage for a maximum of 30 days after processing, then automatic deletion.
- Technical operational and security logs (e.g., timestamps, status and error messages): Storage for a maximum of 30 days, exclusively for system security, error analysis, and abuse prevention purposes.
- Anonymized and aggregated usage data: can be stored without time limit, as there is no longer any personal reference.
- After the respective periods expire, the data is automatically deleted or irreversibly anonymized.
Usage analysis for product improvement
What we do and why
To improve our platform, we use the product analytics tool PostHog Cloud EU to understand how our services are used – e.g., which features are used, where drop-offs occur, or which pages are particularly popular. This allows us to fix errors, improve user-friendliness, and prioritize development.
- Non-logged-in users: Analysis is done only with your consent via our cookie banner (Art. 6(1)(a) GDPR).
- Logged-in users: Analysis is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. We pay particular attention to pseudonymization, data minimization, and transparency.
Even for logged-in users, no directly identifying data (such as name or email address) is transmitted to PostHog, but rather a pseudonymous user ID. Additionally, we use technical safeguards to exclude sensitive content (e.g., masking, client-side filters).
Legal basis for logged-in users
Processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR to provide and continuously improve our service in a functional, secure, and user-oriented manner. For this purpose, we conduct a balancing of interests: our development and quality interests are weighed against the potential impact on our users’ privacy. Key criteria include registered users’ expectations, pseudonymization, data minimization, technical and organizational safeguards, transparency, and easy opt-out options.
Revocation / Opt-out
You can object to the processing of your personal data for product analysis purposes at any time. In the application, you will find a toggle under [Profile > Settings > Usage Analytics]; when you deactivate it, we stop further collection and transmission of usage events to PostHog. Alternatively, you can also send your objection to us by email; we will then implement the opt-out technically for you. Upon request, we will review the deletion of already collected data.
What data we transmit
Typical data collected includes:
- pseudonymous user ID (for logged-in users)
- Event name (e.g., click, page view, feature used, …)
- Timestamp and URL context
- Device and browser information
- Campaign/referrer data (e.g., UTM tags)
Recipients, data processing, and data locations
Service provider: PostHog, Inc. as processor. We use PostHog Cloud EU; this instance is operated in the AWS region eu-central-1 (Frankfurt, Germany), and usage data remains in the EU. A data processing agreement has been concluded.
Storage duration and deletion
For usage analysis in PostHog, we use a pseudonymous user identifier (distinct_id). When your user profile is deleted, the connection between your account and this identifier is irrevocably deleted. Additionally, we delete or empty – where applicable – the corresponding person profile in PostHog (including identifying properties). Already collected usage events are retained but are no longer attributable to an identifiable account and are only evaluated in aggregated form for product statistics.
Hosting & Cloud Infrastructure (incl. Resume Processing)
We operate our platform – including the AI-based "Search with Resume" and the resulting job suggestions – on Microsoft Azure in the EU region Germany. For AI-powered analysis and processing functions, we also use Google Cloud (EU) and Anthropic (EU).
Legal basis
- Basic operation (account management, website, system emails): Contract performance or pre-contractual measures (Art. 6(1)(b) GDPR) as well as legitimate interest in security, availability, and performance (Art. 6(1)(f) GDPR).
- CV processing & job suggestions: Your explicit consent (Art. 6(1)(a) GDPR). We process your resume and generate personalized job suggestions only after your consent.
- Data processing: Microsoft Azure, Google Cloud, and Anthropic are processors pursuant to Art. 28 GDPR. Corresponding agreements are in place. All processing operations take place in the EU (Azure DE, Google Cloud EU), encrypted and secured in accordance with Art. 32 GDPR.
Consent
- No consent is required for basic operation.
- For AI-powered processing of your resume and generating personalized job suggestions with AI chat, separate consent is required, which you can revoke at any time.
Storage duration & deletion
- Basic data: As long as your account is active; after 24 months of inactivity, reminder, after another 6 months, deletion.
- CV processing data & logs: according to your consent, identical lifecycle as account data.
- You can perform the complete and irrevocable deletion of your profile yourself at any time via your profile settings.
Technical & organizational measures
- All processing operations take place in Azure DE (EU region), encrypted and secured in accordance with Art. 32 GDPR.
- For the AI system "Search with Resume," a Data Protection Impact Assessment (DPIA) was conducted and technical filters were implemented to prevent extraction or disclosure of sensitive data (Art. 9).
Website usage and cookies
We want your visit to our website to be as pleasant as possible. To understand what is really important to you, we use appropriate technologies, especially cookies.
With our cookie box, you can determine for yourself how much we may know about you and adjust your selection at any time.
Blocking certain types of cookies may result in not all functions being fully available.
Our website is accessible via all common browsers. You can also make settings for cookie usage directly in your browser.
Depending on your individual cookie settings, we process the following personal data:
- Browser type
- Cookie data
- Device type
- Scroll behavior
- Identification ID (UUID)
- Click behavior
More information about our cookie usage can be found in our Cookie Policy.
What technical data do we automatically collect?
When you visit our website, we automatically collect certain information in so-called "server log files". This is technical data that is generated with every website visit:
- IP address or hostname
- Browser used
- Time spent on the website
- Date and time of visit
- Pages of our website accessed
- Language settings and operating system
- "Leaving page" (which URL you left our website from)
- ISP (Internet Service Provider)
This information is not processed in a personally identifiable manner and is not linked to other personal data. It helps us to technically optimize our website and ensure its security.
Who is responsible for your data?
Nejo collects your personal data exclusively from you.
Responsible for the processing of your personal data within the meaning of Art. 4(7) GDPR is:
Nejo FlexCo
Meldemannstraße 18
1200 Vienna
Austria
hi@mynejo.com
You can reach our Data Protection Officer at hi@mynejo.com.
Forwarding of application data
When you click the "Apply Now" button on Nejo, we always redirect you to the employer’s original job posting. When you then submit your application there, the company to which you send your data is responsible for the further processing of your data.
Who do we share your data with?
In some cases, we need to share your data with others. We only share your personal data with:
Authorities and public bodies
This only happens to the extent required by law (for example, data protection authority, courts, or labor chamber).
Software and service providers (processors pursuant to Art. 28 GDPR)
These providers support us with email services, administrative activities, and data center and cloud services.
- Microsoft Azure: Hosting of our AI systems and data processing, based on your explicit consent
- OpenAI (as a sub-processor in connection with Azure OpenAI)
- Google Cloud: AI-powered analysis and processing functions, based on your explicit consent
- Email services: for managing and conducting our newsletter, based on your explicit consent.
- Customer.io: Email sending for transactional system emails (Art. 6(1)(b) GDPR) as well as marketing emails based on your explicit consent (Art. 6(1)(a) GDPR)
- Data centers and cloud services: to ensure the availability and security of our website.
- Database providers
- Cookie consent management
Processing of your data takes place exclusively on EU servers. There is no data transfer to Microsoft, Google, Customer.io, or other third parties outside the EU. Data processing agreements pursuant to Art. 28 GDPR have been concluded with all service providers.
The sharing of any data is based exclusively on contractual agreements and in compliance with legal data protection regulations.
Data transfer abroad
If we transfer your personal data to a country outside the EU/EEA (third country) for which no adequacy decision within the meaning of Art. 45 GDPR exists, we ensure the protection of your data through appropriate safeguards within the meaning of Art. 46 GDPR.
Google Fonts
For an appealing and consistent presentation of our website, we use fonts from Google Fonts. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Tel: +353 1 543 1000).
When you visit our website, your browser loads the required fonts and stores them in the cache. Google may set cookies on your device in the process.
The use of Google Fonts serves the optimal presentation of our content and a consistent design of our website. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.
Google also processes data in the USA but has submitted to the EU-US Data Privacy Framework
.
More information about Google Fonts
and the Google Privacy Policy can be found here.
Your rights
You have various rights regarding your data stored with us:
- Right to access: You can inquire at any time which data we have stored about you.
- Right to erasure: You can request the deletion of your data, unless legal retention obligations prevent this.
- Right to rectification: If your data is incorrect, you can request a correction at any time.
- Right to data portability: You can request that we transmit your data in a common format to you or another controller.
- Right to revocation and objection: You can revoke consents at any time and object to data processing.
- Right to restriction: You can request that we restrict the processing of your data.
AI-specific rights
In addition to GDPR rights, you have the following rights for the "Search with Resume" and "Apply with Resume" functions:
- Information about AI logic: Information about how our algorithms work
- Bias complaint: Report suspected discriminatory treatment by the AI system
- Human review: Request a manual review of AI recommendations
- Transparency: Detailed information about capabilities and limitations of the AI system
- Revocation of AI processing including deletion of your resume and any data extracted from it
Where personal data is processed without identifiability (e.g., in anonymous use via third-party platforms such as ChatGPT), certain rights (e.g., access or deletion on an individual level) cannot be technically implemented. In these cases, the provisions of Art. 11 GDPR apply.
Right to complain
If you suspect that your data processing violates data protection law, you have the right to complain:
- Directly to us by email at: hi@mynejo.com
- To the competent data protection authority: Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna.
You can reach the authority here.
- EU AI Act: Corresponding national supervisory authority for AI systems (details will be updated upon entry into force)
We take your concerns seriously and strive to process your inquiries as quickly as possible.
Thank you for trusting us with your data!
