GDPR information

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the data controller for personal data processed through Jobsite Exchange ("JSE") is:

• Jobsite Exchange, LLC
• Colorado, United States
• Contact: privacy contact form

JSE is a small operation. We have not appointed a Data Protection Officer (DPO). For any GDPR-related request, use the contact link above and put GDPR request in your message.

Day-to-day processing details (what we collect, who we share with, and retention) are in our Privacy Policy. This GDPR page explains how that processing maps to EU/UK law.

When you post a listing, you may provide: listing text, material category, quantity, optional photo, jobsite address (geocoded to coordinates), and optional contact fields (name, phone, email). You choose what to publish; published fields are visible to anyone on the internet.

When you browse JSE without posting, we do not ask you to identify yourself. Our servers and hosting providers still process technical data (such as IP address and user-agent) in server logs as part of delivering the site - the same as any website.

When you subscribe to the newsletter, we store your email and any optional name or company you provide on the subscribe page. We use that only to send the weekly digest until you unsubscribe.

When you use /manage, your manage code is verified server-side. We store only a one-way hash of the code, not the plaintext. Your browser may remember past manage codes in localStorage on your device.

We process personal data only where we have a lawful basis:

• Performance of a contract / steps at your request - when you post a listing, you ask us to host it on the public board. Processing your listing content, address, and contact details is necessary to provide that service.
• Legitimate interests - securing the site (including manage-code hashing), preventing abuse, responding to reports, and operating server logs. We balance these interests against your rights; you may object where applicable (see Section 05).
• Consent - for the optional newsletter, and for text messages. Text messages are sent only to a mobile number you gave us yourself after checking an unchecked consent box on the listing form or on Book a Haul, or after you texted START to us. You can withdraw consent anytime: reply STOP to any text, use the unsubscribe link in each email, or contact us. We do not sell or share your mobile number or your SMS opt-in and consent data with third parties or affiliates for marketing or promotional purposes. See our SMS messaging terms and the published opt-in call to action.
• Legal obligation - if we must retain or disclose information to comply with valid legal process.

We do not rely on consent for listing hosting: posting is a deliberate, public act. Do not put information on a listing you are not willing to make public.

Personal data is stored and processed primarily in the United States. Our processors include Supabase (database/storage) and Netlify (hosting and serverless functions), as described in the Privacy Policy.

Geocoding requests are proxied server-side to Photon (Germany), the U.S. Census Geocoder, and Nominatim (UK). Map tiles may be loaded from CARTO when you open the map; that provider sees your IP address as part of normal web delivery.

Where the GDPR requires safeguards for transfers outside the EEA/UK, we rely on appropriate mechanisms available at the time of transfer (such as the EU Standard Contractual Clauses and the UK International Data Transfer Agreement / Addendum where our providers offer them). You may request more detail about a specific transfer by contacting us.

If you are in the EEA, UK, or Switzerland, you generally have the right to:

• Access - obtain a copy of personal data we hold about you.
• Rectification - ask us to correct inaccurate data. For your own listing, use /manage with your manage code.
• Erasure - ask us to delete data when it is no longer needed or you withdraw consent (where consent was the basis).
• Restriction - ask us to limit processing in certain cases.
• Objection - object to processing based on legitimate interests.
• Data portability - receive data you provided in a structured, commonly used format where the processing is automated and based on contract or consent.
• Withdraw consent - for newsletter processing, at any time, without affecting prior lawful processing.

To exercise any right, use the contact form with enough detail to find your listing or subscription (URL, email, or description). We respond within one month, which may be extended by two further months for complex requests as permitted by law.

You also have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where an alleged infringement occurred. Examples:

• UK: Information Commissioner's Office (ICO)
• Ireland (EU lead for many US tech disputes): Data Protection Commission
• EU member states: list of EU data protection authorities

Optional analytics and advertising cookies - full Google Analytics and Google Ads cookies apply only after you enable those categories and click Save preferences or Accept All on the cookie banner. Legal basis: consent (GDPR Art. 6(1)(a)). You can withdraw or change your choices anytime via Cookie settings in the site footer.

If you decline analytics, Google may still receive limited, cookieless measurement for aggregated modeling (Google Advanced Consent Mode). That does not use analytics cookies or identify you across sessions.

JSE also uses browser storage (localStorage) for strictly necessary purposes: caching listings for faster loads and remembering your manage codes on your device. These are not used to track you across sites and do not rely on marketing consent.

See the Privacy Policy for provider names and the Google Analytics measurement ID (G-FSZT4WBRCB).

We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you. Haul-distance estimates and map pins are tools for your judgment, not automated decisions about your legal rights.

Retention periods match the Privacy Policy: active listings until you delete them; soft-deleted listings up to about 90 days; newsletter data until you unsubscribe; server logs per our hosts' defaults.

JSE is for adult professionals in construction and hauling. We do not knowingly collect data from children under 16 in the EU/UK sense. If you believe a child's data was posted, contact us for removal.

We may update this page when our processing or the law changes. Material updates appear in the "Last updated" date in the hero above. Continued use after an update means you have read the revised page; for newsletter subscribers we will use email if a change materially affects how we use subscriber data.

GDPR questions or requests: contact support. Related policies: Privacy Policy, Terms of Service, Acceptable Use.