Privacy Policy
Last updated: 20 July 2026
1. About this policy
Expo Jobs (“Expo Jobs”, “we”, “us”) is an independent job board for roles connected to World Expos. This policy explains what personal data we collect, why, who receives it, and what rights you have over it.
Expo Jobs is not affiliated with, endorsed by, or operated on behalf of the Bureau International des Expositions (BIE) or any Expo organiser, pavilion, or national participant. Listings are either submitted by employers directly or compiled by Expo Jobs from employers’ public postings. Each listing states which.
For any privacy question or request, contact support@jobs-worldexpo.com. Full details of the entity responsible for your data are in Section 12.
2. What we collect
If you browse the site. No account is required. We use a small number of strictly necessary and functional cookies (Section 8).
If you apply for a job. Your name, email address, an optional message, and your CV — either an uploaded file or a link you provide.
If you create a job-seeker account. The above, plus your account email and password. Passwords are stored as one-way hashes and are never visible to us in readable form.
If you register as an employer. Your name, organisation name, email address, and the job listings you submit.
If you contact support. Your name, email address, and the content of your message.
If you ask to be notified about a listing. Your email address, so we can tell you when that employer opens applications on Expo Jobs.
If you report content to us. Your name and email address, the content of your report, and the IP address the report was sent from, to help us detect abuse of this form. You can report content concerning child sexual abuse material without giving us your name or email.
A note on CVs. A CV often contains more than work history — it may reveal health information, religious belief, trade union membership, or ethnic origin. Data protection law treats this as sensitive. We ask for your explicit consent before storing and transmitting your CV, and you can withdraw that consent at any time by emailing support@jobs-worldexpo.com, which will delete our copy. We cannot delete a copy an employer already holds. Please include only what you are comfortable sharing.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Operating the job board and transmitting your application to the employer you selected | Contract / pre-contractual steps at your request — Art. 6(1)(b) GDPR |
| Storing and transmitting your CV, including any sensitive information it contains | Explicit consent — Art. 9(2)(a) GDPR |
| Creating and maintaining your account | Contract — Art. 6(1)(b) |
| Allowing employers to review and manage applications for listings they posted | Legitimate interests — Art. 6(1)(f): operating a functioning recruitment marketplace |
| Keeping the platform secure, and detecting abuse or spam | Legitimate interests — Art. 6(1)(f) |
| Responding to support requests | Legitimate interests / contract — Art. 6(1)(f) / 6(1)(b) |
| Notifying you when an employer opens applications | Consent — Art. 6(1)(a) GDPR |
| Receiving and acting on reports of illegal content | Legal obligation — Art. 6(1)(c) GDPR, and Art. 16 of Regulation (EU) 2022/2065 |
We do not use your data for advertising, and we do not sell it.
Is providing data mandatory? No. You are free to browse without giving us anything. But we cannot transmit an application to an employer without the name, email address, and CV that the employer needs in order to consider it.
Automated decision-making. We do not screen, rank, score, or filter applicants automatically, and we do not make decisions about you by automated means within the meaning of Art. 22 GDPR. Hiring decisions are made by employers.
4. Who receives your data
The employer you applied to. When you submit an application, your name, email address, message, and CV are stored by Expo Jobs and transmitted to the employer for that listing, so they can consider you and contact you. Your application is not shared with any other employer, and it is never made public.
When your application reaches the employer.For most listings this happens straight away. Where an employer is still completing our verification checks, your application is held securely and released to them once those checks are complete. If verification isn’t completed within 60 days, we delete your application and tell you.
Once an employer receives your application, that employer decides independently how to handle it and becomes responsible for it in its own right. Their own privacy notice and retention practices apply to their copy of your data. We cannot delete it on their behalf — if you want an employer to erase your application, contact them directly. We will pass on the request if you ask us to.
Service providers acting on our instructions. A small number of providers run the technical infrastructure behind the site under written data-processing agreements: a database and file-storage provider hosted in the EU, a website hosting provider, an email provider, and a bot-protection provider (Cloudflare) that screens our forms for automated abuse. They process your data only as instructed by us and for no purpose of their own. A current list of these providers is available on request at support@jobs-worldexpo.com.
Nobody else. We do not sell, rent, or trade personal data, and we do not disclose it to third parties for marketing. We may disclose data where we are legally obliged to, or where it is necessary to establish or defend a legal claim.
5. How long we keep it
| Data | Retention |
|---|---|
| Job applications (including CVs) | 12 months from submission, then deleted |
| Job-seeker and employer accounts | For as long as the account is active; deleted after 24 months of inactivity |
| Job listings | Removed from public view when closed or expired; deleted 12 months afterwards |
| Support correspondence | 12 months from the last message |
| Notification requests | Deleted once notified, or 12 months after signup, whichever is first |
| Applications held pending employer verification | Deleted after 60 days if verification is not completed |
| Content reports | 24 months from the decision |
| Employer verification evidence (company register extracts, the named authorised individual and their role) | 24 months after the employer account closes |
You can ask us to delete your data sooner at any time (Section 6), and we will do so unless we are legally required to keep it. These periods apply to our copy — an employer who has already received your application keeps it under their own retention rules.
6. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Eraseyour data (“right to be forgotten”)
- Restrict or object to processing based on our legitimate interests
- Portability — receive your data in a structured, machine-readable format
- Withdraw consent, where processing is based on consent, without affecting prior processing
- Complain to a supervisory authority
To exercise any of these, email support@jobs-worldexpo.com. We will respond within one month, as required by Art. 12(3) GDPR. We may need to verify your identity first.
You can complain to the data protection authority in the EU country where you live or work, or to our lead authority, the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).
7. How we protect it
Data is transmitted over encrypted connections (HTTPS) and stored on access-controlled infrastructure. Passwords are hashed. Access to the applicants database is restricted to authorised administrators and is not open to the public or to search engines. No system is perfectly secure, but if a breach occurs that is likely to result in a high risk to your rights, we will notify you and the competent authority as required by Arts. 33–34 GDPR.
8. Cookies and local storage
We use only cookies that are strictly necessary for the site to work, or that remember a preference you have chosen. We do not use advertising, tracking, or analytics cookies. Under the ePrivacy Directive, the items below do not require your consent because they are essential or are set at your request.
| Item | Purpose | Type |
|---|---|---|
| Login session | Keeps you signed in to your account | Necessary cookie |
| Admin session | Keeps an administrator signed in to the admin panel | Necessary cookie |
Language preference (lang) | Remembers whether you chose English or Serbian | Functional cookie |
| Theme preference | Remembers light or dark mode | Browser local storage |
When you submit a form (for example to apply, sign up, or contact us), we load Cloudflare Turnstile, a privacy-focused anti-bot check. It runs a challenge in your browser to confirm you are a human rather than an automated script, may store a short-lived token for that purpose, and shares limited technical data such as your IP address with Cloudflare. It is not used to profile you or track you across other sites.
If we ever introduce analytics or advertising, we will update this policy and ask for your consent before setting any such cookie.
9. International transfers
Our database and file storage are hosted in the EU. Our website hosting provider and our anti-bot provider (Cloudflare) operate global networks and may process limited technical data (such as your IP address) outside the EU in order to deliver the site and screen forms for abuse. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses. You can request a copy of the safeguards at support@jobs-worldexpo.com.
Employers outside the EU. Some employers who advertise on Expo Jobs are based outside the European Economic Area. If you apply to one of them, your application — including your CV — is transmitted to them in the country where they operate. We only transmit applications to employers in countries the European Commission has decided provide an adequate level of protection, or where an appropriate safeguard such as the Standard Contractual Clauses is in place. Each listing shows the employer and where the role is based, so you can see this before you apply.
10. Children
The site is intended for people old enough to work lawfully in their jurisdiction. It is not directed at children, and we do not knowingly collect their data.
11. Changes
We may update this policy from time to time. The date at the top always reflects the current version. If a change materially affects how we use your data, we will make that clear on the site.
12. Data controller
The controller responsible for the personal data described in this policy is MERTEL RG ČESKÁ REPUBLIKA, s.r.o., IČO 26763567, registered at Holečkova 777/39, 150 00 Praha, Czech Republic. Contact: support@jobs-worldexpo.com.