Privacy Policy

Last updated: July 2026

1. Overview

JoinNow FZCO ("JoinNow", "we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share information about you when you use our platform at joinnow.io and any related services (collectively, the "Platform").

JoinNow FZCO acts as the data controller within the meaning of the EU General Data Protection Regulation (GDPR). This means we determine the purposes and means of processing your personal data.

By using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Platform.

2. Data We Collect

We collect personal data that you provide to us directly, as well as data generated through your use of the Platform. This includes:

Talent profile data:

  • Full name, professional title, and profile photograph
  • Work history, including details of projects undertaken for DACH-based companies
  • Technical skills, certifications, and portfolio links
  • Language proficiencies and communication preferences
  • Preferred engagement type (employment, independent contracting, relocation)
  • Rate expectations and availability
  • Referral submissions: a candidate's name, contact details, and skills provided to us by the person referring them

Contact and account data:

  • Email address and phone number
  • Login credentials (passwords are stored in hashed form and never in plain text)
  • Country of residence and time zone

Usage and technical data:

  • IP address, browser type, and device information
  • Pages visited, session duration, and navigation paths
  • Cookies and similar tracking technologies (see Section 5)
  • Communication logs between talent and our team

We do not collect special categories of personal data (e.g., racial or ethnic origin, health data, biometric data) unless you voluntarily provide such information or it is strictly required by applicable law.

3. How We Use Your Data

We process your personal data on the following legal bases and for the following purposes:

Performance of a contract (Art. 6(1)(b) GDPR):

  • Creating and managing your account on the Platform
  • Matching talent profiles with relevant opportunities at DACH companies
  • Facilitating introductions, interviews, and placement processes
  • Processing payments and issuing invoices where applicable

Legitimate interests (Art. 6(1)(f) GDPR):

  • Improving and personalising the Platform experience
  • Sending relevant platform updates, role alerts, and service communications
  • Fraud prevention and platform security
  • Internal analytics and performance measurement

Legal obligations (Art. 6(1)(c) GDPR):

  • Retaining records for tax, accounting, and regulatory compliance purposes
  • Responding to lawful requests from public authorities

Consent (Art. 6(1)(a) GDPR):

  • Sending marketing communications (where you have opted in)
  • Placing non-essential cookies (as described in Section 5)

4. Data Sharing

We share your personal data only in the circumstances described below. We do not sell your personal data to third parties.

With DACH client companies:

When presenting talent to prospective clients, profiles are initially shared in anonymised form — omitting full name and contact details — to allow companies to assess fit. Full profile details are only disclosed after you have been informed and have not objected, or where you have actively expressed interest in a specific opportunity.

With compliance and infrastructure partners:

  • Our partner company in Bangalore, India, which employs or contracts talent for engagements (contractually bound to confidentiality and data protection obligations)
  • Cloud infrastructure providers (data processing agreements in place, EU data residency where applicable)
  • Payment processors and accounting platforms for invoicing and payroll
  • Background verification partners for credential checks (only with your prior consent)
  • Legal and tax advisors bound by professional confidentiality obligations

All third-party processors with whom we share data are bound by data processing agreements compliant with Art. 28 GDPR. As a company established in the United Arab Emirates working with a partner company in India, we process personal data outside the European Economic Area; where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).

5. Cookies, Analytics & Third-Party Services

We use cookies and third-party services to operate, secure, and improve the Platform. Non-essential cookies and analytics or marketing tags are only loaded after you have given consent via our cookie banner. Until you consent, storage and measurement are set to "denied" by default (Google Consent Mode v2). You can change or withdraw your choices at any time through the cookie settings on the site.

Google Tag Manager:

We use Google Tag Manager, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to manage and deploy the tags on our website. Google Tag Manager itself does not set cookies or collect personal data; it acts as a container that loads other tags (such as Google Analytics) only in accordance with the consent you have given. The tags it manages are described below.

Google Analytics:

We use Google Analytics, a web-analytics service provided by Google Ireland Limited, to understand how visitors use the Platform. Where you consent, Google Analytics sets cookies (e.g. _ga) and processes pseudonymous usage data — including a shortened IP address, device and browser information, pages visited, and session behaviour — to generate aggregated statistics. IP addresses are truncated within the EU before further processing. This processing is based on your consent (Art. 6(1)(a) GDPR). Data may be transferred to Google LLC in the United States; such transfers are safeguarded by the EU Standard Contractual Clauses and Google's participation in the EU–US Data Privacy Framework. You can prevent Google Analytics processing by declining analytics cookies in our banner, or by installing Google's browser opt-out add-on at tools.google.com/dlpage/gaoptout.

Cloudflare (reverse proxy, CDN & form handling):

Our website is served through Cloudflare, a reverse proxy, content-delivery, and security service provided by Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA). As all traffic is routed through Cloudflare, it processes technical data such as your IP address, request headers, and browser information to deliver content, mitigate attacks (e.g. DDoS), and ensure the security and availability of the Platform. Cloudflare also processes data you submit through our contact, application, and referral forms in order to transmit them to us and filter spam. This processing is based on our legitimate interest in a secure and performant website (Art. 6(1)(f) GDPR), and, for form submissions, on the processing necessary to respond to your enquiry. Cloudflare may set strictly necessary security cookies. A data processing agreement including the EU Standard Contractual Clauses is in place for transfers to the United States.

Netlify (hosting & form handling):

The Platform is hosted by Netlify, Inc. (44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA). When you access the site, Netlify automatically processes server log data — including your IP address, the requested URL, date and time of access, and browser/device information — for the purpose of delivering the website and maintaining its stability and security. Netlify also processes the data you submit through our contact, application, and referral forms (Netlify Forms) in order to transmit it to us and filter spam. This is based on our legitimate interest (Art. 6(1)(f) GDPR) and, for form submissions, on the processing necessary to handle your enquiry or application. A data processing agreement including the EU Standard Contractual Clauses is in place for transfers to the United States.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

  • Active profile data: Retained for the duration of your active account plus 12 months following account closure, allowing for account reactivation and dispute resolution.
  • Application and placement data: Retained for 3 years following the end of an engagement to fulfil contractual and legal obligations.
  • Financial and invoicing records: Retained for 7 years in accordance with applicable accounting and tax regulations.
  • Usage and analytics data: Aggregated and anonymised after 24 months.
  • Communication logs: Retained for 2 years for quality assurance and dispute resolution purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised.

7. Your Rights

Under the GDPR, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at [email protected].

  • Right of access (Art. 15 GDPR): You may request a copy of the personal data we hold about you and information about how it is processed.
  • Right to rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete personal data.
  • Right to erasure (Art. 17 GDPR): You may request deletion of your personal data where there is no legitimate reason for us to continue processing it.
  • Right to data portability (Art. 20 GDPR): You may request that we provide your personal data in a structured, commonly used, machine-readable format for transfer to another controller.
  • Right to restriction of processing (Art. 18 GDPR): You may request that we restrict processing of your data in certain circumstances.
  • Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests, including profiling. You may also object at any time to processing for direct marketing purposes.
  • Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

We will respond to all requests within 30 days. In complex cases, this may be extended by a further 60 days, of which we will notify you. You also have the right to lodge a complaint with a data protection supervisory authority in your country of residence.

8. Contact

For all privacy-related enquiries, requests, or concerns, please contact our data protection team:

We will acknowledge receipt of your enquiry promptly and aim to resolve all matters as quickly as possible.