Version 2026-09-11
Privacy and Personal Data Protection Policy
This policy explains what personal data JXBS S.A.S. processes, what it uses it for, who it shares it with, how long it keeps it, and what you can require of us. It is written to be understood without being a lawyer. Everything concerning your data is handled at [email protected].
1. Who processes your data
The controller is JXBS S.A.S., tax ID 0195153892001, domiciled at Víctor Manuel Albornoz 555 and Daniel Muñoz, Cuenca, Ecuador, telephone 0995284006, legally represented by Juan Martín Cordero Matovelle, General Manager, national ID 0103691648. Website: https://jxbs.ai JXBS is the controller: it decides what your data is used for and how. It does not act on anyone else's behalf with respect to your data as a candidate. Data Protection Officer. JXBS has a Data Protection Officer appointed on 15 December 2025 and registered with the Superintendency of Personal Data Protection on 26 December 2025: Julio Edmundo Jara Arévalo, national ID 0102573367. He is reached at [email protected]. We do not publish his home address or personal telephone: Article 12 requires that you be able to communicate with him, and that address is the channel enabled for it. What you write there reaches him. One address for everything. Everything concerning your data is handled at [email protected]. If you find another address in an older JXBS document on data protection, this is the one that applies. The law calls for a simplified, easily accessible channel; several addresses scattered around is the opposite.
2. We process data at large scale, and we are telling you
JXBS expressly declares that it processes personal data at large scale. This is not a formality: it is a legal classification that imposes stricter obligations on us, and you have the right to know it. If you did not register your data yourself. Some profiles on the platform come from earlier JXBS systems and from partner university databases. If that is your case, this policy is the information the law obliges us to give you about what we hold and what we use it for. You have the right to request a copy, to correct it, to object, and to ask us to erase it. See section 9. What we process at large scale. Candidate profiles with identification and contact data, academic and work history, résumé, job preferences, psychometric results — which are sensitive data —, the interview recording and its transcript, data derived by artificial intelligence, and platform activity. For four purposes, detailed in section 4. What that means. That we are subject to a stricter regime: prior impact assessment, a Data Protection Officer, privacy by design, and periodic auditing. JXBS holds its impact assessment on artificial-intelligence processing and the analysis of risks, threats and vulnerabilities the law requires, along with the appointed and registered Officer named in section 1.
3. What data we process
Identification and contact: first names, surnames, email, secondary email, telephone, national ID, document type, date of birth, gender, nationality, marital status, city, country, address, social media, photograph. Job preferences: profile summary, expected salary, ideal position, work mode, schedule, travel availability, willingness to relocate, preferred locations. History: work experience, education, certifications, skills, languages, personal references. Files: your résumé. Sensitive data: answers and result of the DISC psychometric questionnaire, its interpretation generated by artificial intelligence and its PDF report; answers, results and interpretation of the technical assessments. Interview recording: the video and audio of your interview answers, the transcript of that audio, and the analysis artificial intelligence performs on the transcript. Data the system computes about you: normalised profile, numerical representation of your profile, and your match score for each vacancy together with its explanation: strengths, gaps, recommendations and missing skills. Activity: last sign-in, number of sign-ins, last activity, and which recruiter viewed your profile and for which vacancy. Academic progress: completed modules, total modules, percentage of progress, source platform. Institutional link: university, faculty, programme, enrolment, student or graduate status. Graduate employment: employer, position, salary. Record of your consent: purpose accepted, document version, text fingerprint, capture method, date, time, IP address, browser and revocation date. Technical data: IP address, browser, operating system, activity logs, cookies. Sensitive data requires a separate permission. The law prohibits processing sensitive data unless you give explicit consent in which the purposes are clearly specified. It is not that there is a "better" basis to look for: it is a prohibition with closed exceptions, and the one that applies is your express permission. Your psychometric results are sensitive data: a personality profile used to decide who gets hired can give rise to discrimination, and that is why the law treats it under that regime. Practical consequence: without your explicit consent, JXBS cannot process your psychometric data. That is why the permission is requested separately, not inside the general package. About the interview recording, precisely. The platform DOES record your interview answers as video with audio, stores them, and sends that file to an external provider that extracts the audio and returns a written transcript. The automated analysis reads only that transcript: it assesses how you communicate — clarity, energy, structure and concision — and is expressly instructed to judge the words alone and to say nothing about your voice or your appearance. The recording is visible to you, to authorised JXBS staff, and to the company whose vacancy you apply to. And why we do not call it biometric data. Data is biometric when it is subjected to specific technical processing directed at uniquely identifying a person. Recording your image and your voice, storing them and transcribing what you said is not that: nothing on the platform recognises faces, matches voiceprints, or analyses facial expressions. The recording is therefore treated as personal data — with your permission, informing you, and with the safeguards in this policy — and not under the sensitive-data regime. Telling you we apply a stricter regime than we actually do would be as inaccurate as falling short. If facial recognition, voice identification or expression analysis were ever introduced, that would indeed be biometric and sensitive data, and you would be asked for your own explicit permission before it was processed. Other people's data that you give us. When you list personal references or mention managers and contacts in your résumé, you give us third parties' data. Those people also have rights over that data. By giving it to us, you confirm that you have their authorisation to do so. Those people may exercise their rights by writing to [email protected], and if they ask us to erase their data, we erase it.
4. What we use your data for: four separate purposes
Each purpose is accepted and withdrawn separately. A single checkbox covering everything would not be valid: the law requires your permission to be recorded for each specific purpose. A. Job placement. Creating and administering your account, building your profile, structuring your résumé, matching you with vacancies and computing your score, showing your profile to the company whose vacancy you apply to, and informing you of progress. Basis: performance of the service you requested. It is not consent, so it is not "withdrawn": what you exercise is objection or erasure. It is mandatory, because it is the service. If you say no, we cannot manage your candidacy. B. Courses and employability. Enrolling you in courses, measuring your progress, recommending content. Basis: your consent. Not mandatory. If you say no, you keep using placement normally and only lose the courses. C. Marketing communications. Webinar invitations, partner promotions, benefits and news that are not part of your selection process. Basis: your consent, with the box unchecked by default. Not mandatory. If you say no, you do not receive those emails; you do keep receiving notices about your own processes, which are not marketing. D. Labour-market analytics that JXBS sells. Using your data as an input to produce aggregate indicators — skills demand, employability by programme, sector and geography — which JXBS commercialises to universities and institutions. Basis: your consent. Not mandatory. If you say no, your data stays out of that product and your candidacy is unaffected. And three permissions kept separate because the law or prudence requires it: the processing of your sensitive psychometric data, which the law prohibits except with explicit consent for specified purposes; the recording of your interview, requested before it is stored and sent; and the international transfer of your data, which requires explicit consent given after you are informed of the risks, detailed in section 6. Why we do not use "legitimate interest". In Ecuador legitimate interest is not an open clause: it is a closed list of cases and requires a prior, reasoned balancing test. JXBS does not invoke that basis for any purpose. For marketing it asks for your consent, which is a more demanding and clearer basis for you. About aggregate analytics, precisely. The published indicator is not personal data, but the process of arriving at it does use your data. That is why purpose D exists separately and needs your permission. Concrete commitments: inputs that identify you are used only during the computation and deleted afterwards; no psychometric variable feeds that product; and no indicator built on fewer than 30 people is published, because programme, graduation year, city and salary together can identify a person in small groups.
5. Artificial intelligence and decisions about you
What artificial intelligence does with your data: Reading your résumé: converts it into structured fields and pre-fills your profile. Uses your full résumé, as text. Normalising your profile: orders and standardises your profile so it can be compared with vacancies. Uses your profile and your résumé. Psychometric interpretation: generates the interpretation of your DISC and your assessments, and their report. Uses sensitive data: your answers and results. Transcribing your interview: converts the audio of your answers into text. Receives the video file you recorded; the provider extracts the audio and returns the written transcript. Analysing your interview: assesses how you communicate and writes your feedback. Reads only the transcript, never the image, and is expressly instructed to judge the words alone and to say nothing about your voice or your appearance. Representing your profile: converts it into numbers so it can be searched by meaning. Uses your normalised profile. Matching with vacancies: computes your match score and writes the explanation, the strengths, the gaps and the skills you are missing. Uses your full profile and the vacancy's. What data travels to the artificial-intelligence providers. To read your résumé, the full text of the document is sent to the model provider, so it may include any data contained in it. To transcribe your interview, the video file with your audio is sent to the provider that performs the transcription. Enterprise versions of those services are used, which do not train their models on your data. Who decides. Artificial intelligence orders, scores and explains. It does not hire. The decision to advance, interview, reject or hire is made by a person at the employing company. That said, your score influences the order in which you appear to a recruiter, and appearing lower has real effects on your opportunities. That is why the law gives you the rights below even though JXBS is not the one hiring. Your right regarding automated processing. You have the right not to be subject to a decision based solely on automated processing that produces legal effects on you or infringes your rights; to request a reasoned explanation of how your score was computed; to submit your observations and ask for them to be reviewed; to request human intervention and challenge the outcome; and to know where the data used came from. How to exercise it: by writing to [email protected]. Requests are handled within the time limits in section 9. Criteria the matching uses. Your score is built on the overlap between what the vacancy asks for and what your profile states: skills, experience, education, languages, location and work mode. No psychometric variable enters that score. This right cannot be waived in advance, and no adhesion contract may ask you to do so. If you are a teenager. If you are between 15 and 17 and use the platform to look for work, everything above applies equally, and all the more so: the law gives minors' data reinforced protection. Minors' data is not used for marketing.
6. Who we share your data with, and where it goes
Providers that process data on JXBS's behalf. These providers process data following JXBS's instructions, not for their own purposes: Amazon Web Services, for platform hosting, the database and files, in the United States. Clerk, for authentication and your sign-in, in the United States. Cloudflare, for protection against automated traffic and content delivery, in the United States. OpenRouter, for routing calls to artificial-intelligence models, in the United States. OpenAI, for language models and for transcribing the audio of your interview, in the United States. Google, for language models and platform usage statistics via Google Analytics, in the United States. Mistral, for language models and document reading, in the European Union. UserGuiding, for in-portal usage guides, in the United States. Brevo, for visit-origin attribution and email automation on the training sites, in the European Union. The training sites. The courses under purpose B are not delivered inside the candidate portal but on JXBS's own sites, one per partner institution plus the general training site. They are built on WordPress and load different providers from the portal's, so they are declared separately: Brevo, which records how you reached the site and manages email delivery for the general training site, in the European Union; WonderPush, for browser notifications, which receives technical data from your browser although it installs no cookies, in the European Union; and Google, for usage statistics on the general training site via Google Analytics, in the United States. If you also purchase a course, the site stores your cart state in your browser, and your user session when you sign in. These providers may only process your data to deliver the service we contracted, not for their own purposes, and they are bound by confidentiality and security duties. Since some of them operate outside Ecuador, your explicit consent for the international transfer is requested separately. Third parties that receive your data and decide for themselves. These do not follow JXBS's instructions: they use the data for their own purposes and answer for their own processing. The company whose vacancy you apply to receives your profile, your résumé, your interview recording and your match score for its vacancy, when you apply. The university you are linked to receives your academic progress and your employability status through the university panel, if you are a student or graduate of a partner university. Meta receives your IP address, its cookie identifier and your navigation through the portal, which it uses for its own advertising purposes, when you open the portal and while the consent mechanism in section 11 does not exist. Microsoft receives your IP address, its cookie identifier and the recording of your interaction with the screens via Clarity, which it also uses for its own advertising services, under the same conditions. And the authorities receive whatever a lawful order requires, only upon legal request. About the university panel. If you are a student or graduate of a partner university, your academic progress and employability status are visible to your institution in a panel. That communication is governed by the agreement between JXBS and your university, and your university answers for what it does with that information. When you correct or erase, we tell the others. If you correct or erase your data, JXBS communicates that change to the providers and recipients that received it, so no outdated versions remain in circulation. International transfer: the risks, unadorned. Your data leaves Ecuador, for the United States and the European Union. The United States does not have a declaration of adequate level of protection from the Ecuadorian authority. Concretely, that means: that the legal protection of your data there is not equivalent to what Ecuadorian law gives you; that complaining to a data protection authority in that country, or going to its courts, is harder and more expensive for you than doing so in Ecuador; and that the authorities of the destination country may have data access powers that Ecuadorian law does not contemplate. That is why that permission is requested explicitly and after you read this.
7. How long we keep your data
Your profile, while your account is active: as long as you keep it active. Your profile, if you stop using the platform: 24 months from your last activity, after which it is erased or anonymised. Your résumé and the files you upload: the same as your profile, then erased. Psychometric results and assessments: kept while your account is active, because they form part of your profile and recruiters consult them when you apply. If you retake a test, the new result overwrites the previous one and no historical versions are kept. If you stop using the platform, they are erased with your profile under the same 24-month period from your last activity. Your interview recording and its transcript: the same treatment. Kept while your account is active, overwritten if you record again, and erased with your profile. Records of your applications: 36 months from the close of the process, then anonymised keeping only the aggregate. Graduate enrolment and employment records: 180 days from receipt, then erased. Record of your consent and its revocation: 10 years. It is kept because it is the proof that we acted with your permission, and it is used for no other purpose. Encrypted backups: rotated every 15 days, with secure purge on rotation. Accounting and tax records: whatever tax law requires, of mandatory retention. Once the applicable period expires, data is erased or anonymised. If you need to know what we hold about you at a given moment, you can request it through the channel in section 9.
8. What happens when you ask to delete your account
When you ask, you immediately lose access to the portal and stop appearing in company searches. Your information is then erased, and whatever can be kept without identifying you remains only as aggregate statistics. If any law obliges us to keep something specific, we tell you what it is and for how long. When the erasure is executed, you are given a certificate that it occurred.
9. Your rights and how to exercise them
You have the right to information, that is, to know what data we hold and what we do with it — this document is part of that right —; to access, to request a copy of everything we hold about you; to rectification and updating, to correct what is wrong or out of date; to erasure, to ask us to delete your data; to objection, to ask us to stop processing it; to portability, to receive your data in a format you can take to another platform; to suspension, to ask us to pause processing while a dispute about your data is resolved; and not to be subject to automated decisions, on the terms of section 5. Your rights cannot be waived. Any clause saying otherwise, in any document, is void. How to exercise them. Write to [email protected] stating which right you want to exercise. We may ask you to verify your identity, so as not to hand your data to someone else. Time limits. We reply within a maximum of 15 days from receiving your request. If we need you to clarify or expand something, we ask within 5 days and you have 10 days to reply. For the prior request preceding a complaint to the authority, the legal period is 10 business days. From the portal you can do two things without writing to anyone: download your data — in two versions, everything we hold and only what you provided — and request the deletion of your account. Withdrawing your consent. You may withdraw at any time, without giving reasons and separately, the permissions for courses, marketing, market analytics, your psychometric data, your interview recording and the international transfer. Write to the single channel. Withdrawal has no retroactive effect: what was done with your permission before you withdrew it remained lawful at that time, but from the moment you withdraw it stops. The job-placement purpose is not withdrawn because it does not rest on your consent but on the service you requested; there what you exercise is objection or erasure. If you are not satisfied. You may first complain to us directly. If we do not reply, or if the reply does not satisfy you, you may file a complaint with the Superintendency of Personal Data Protection. That right is yours and this policy does not limit it.
10. Security of your data
The platform's security measures are determined from the analysis of risks, threats and vulnerabilities the law requires, and are reviewed when that analysis changes. Your data travels encrypted. The database sits on a private network, with no direct exposure to the internet. Administrative access goes through authentication and is limited to those who need it for their role. Passwords and sign-in are managed by a specialist provider, not by JXBS, so your password is not stored on our systems. Staff who process personal data are bound by confidentiality duties. If an incident occurs. If there is a breach that could affect your data, JXBS notifies the Superintendency of Personal Data Protection and, where the risk to you is high, notifies you too, describing what happened, what data was affected, what we are doing and what you can do.
11. Cookies and equivalent technologies
A cookie is a small file the portal stores in your browser to recognise it later. Alongside them, equivalent technologies such as browser local storage are used. Everything this section says about cookies applies to those technologies too. What is installed depends on which JXBS surface you are on: they are not the same, which is why they are declared separately. The full inventory by domain, with the name, provider, purpose and duration of each cookie, is in the cookie policy of each site: jxbs.ai/legal/cookies for the public site and applicant.jxbs.ai/cookies for the candidate portal. What follows was verified on 10 August 2026. On the candidate portal, applicant.jxbs.ai. No analytics and no advertising are loaded: no measurement tool and no advertising pixel is downloaded there. All of its cookies are necessary. jxbs-cookie-consent, from JXBS, stores the decision you made in the portal cookie notice, 12 months. jxbs-locale, from JXBS, remembers whether you prefer Spanish or English, 1 year. And __session, __client and __client_uat, from Clerk, are your signed-in session and renew while you browse. On the public site jxbs.ai and on the earlier portal app.jxbs.ai. Third parties are involved there. PHPSESSID, from JXBS, necessary, keeps your session signed in, session, only on app.jxbs.ai. AWSALB and AWSALBCORS, from JXBS via AWS, necessary, keep your connection to the same server during the visit, 1 day, only on app.jxbs.ai. _fbp, from Meta, advertising and cross-site tracking, identifies your browser to measure campaigns and build Meta advertising audiences, 90 days. _ga and _ga_23MV3DGK08, from Google, analytics, distinguish unique browsers and keep session state in Google Analytics 4, 400 days. _clck and _clsk, from Microsoft Clarity, behavioural analytics, link your visits in session recordings and heatmaps, 365 days and 1 day. _ugeuid, from UserGuiding, product, identifies your browser to show you the portal guides and not repeat them, 92 days, only on app.jxbs.ai. As a consequence of loading Microsoft Clarity on those two surfaces, Microsoft also installs cookies on its own domains — clarity.ms and bing.com — among them MUID, lasting 390 days, which it associates with its advertising identifier. Those cookies are not under the control of JXBS and are governed by the privacy policy of Microsoft. How to control them. You can block or delete them from your browser settings; if you block the necessary ones, the portal will not be able to keep your session. Each provider also offers its own opt-out route: the ad settings in your Meta account, the official opt-out add-on of Google Analytics, and the opt-out pages of Microsoft. If you would rather we handled it, write to the single channel and we process it as an exercise of your rights. On the training sites. The sites where courses are delivered install a different set, verified on the same date: the seven cookies beginning with sbjs_, from Brevo, attribution, store how you reached the site, the date of that visit and how many pages you viewed, for the browser session; sib_cuid, from Brevo, marketing, identifies your browser for email automation, only on the general training site, 181 days; and _ga and _ga_5JEF1TSHYJ, from Google, analytics, usage statistics, only on the general training site, 400 days. Those sites also load WonderPush, for browser notifications, which installs no cookies but does store technical data in your browser and receives your IP address. If you sign in or purchase a course, the platform adds its own session and cart cookies, which are necessary for the service to work.
12. If you do not provide your data, or if it is inaccurate
If you do not provide the minimum data — your name, your email and the essentials of your profile — we cannot manage your candidacy or submit you for roles. It is not a penalty: it is that the service consists precisely of that. If you decline the optional purposes of courses, marketing and analytics, you lose nothing of the placement service. If your data is inaccurate, your profile performs worse in the automated matching: you may be left out of vacancies that suited you or appear in others that did not. Keeping it correct is in your interest, and you can correct it whenever you want.
13. Changes to this policy
If we change this policy substantially, we tell you by email and in the portal before the change applies. Continued use of the platform does not amount to accepting a new version. If a change requires your consent, we ask you again, expressly. Inaction is not read as permission. What changed in this version 5.5, against version 5.4 of 26 August 2026. Only section 11 changes. It declared a single cookie list for "the portal", and that list was the one for the earlier portal app.jxbs.ai and for the public site: it attributed to the applicant.jxbs.ai portal cookies from Meta, Google Analytics, Microsoft Clarity and UserGuiding that are not installed there, and 7-day load-balancing cookies that portal does not install either. The list now goes surface by surface, with what each one actually installs, and points to the cookie policy of each domain for the full inventory. No other fact in this policy changes: no processing, purpose or recipient is added or removed. What changed in version 5.4, against version 5.3 of 17 August 2026. The previous version stated that the platform does not record or analyse video interviews, and that if it ever did, your image and voice would be biometric data. Both statements are corrected there: the platform does record the interview, and that recording does not constitute biometric data because it is not subjected to any processing directed at uniquely identifying you. Sections 3, 5 and 6 declare the recording, its storage, the transcription of the audio by an external provider, and the exact limit of what the automated analysis reads. In addition, section 7 stopped counting the retention of psychometric and interview results from the moment they were taken: they are kept while your account is active, overwritten if you retake them, and erased with your profile.