Privacy policy

Last updated: 11 October 2026

This is a translation for your convenience. The German version is the authoritative one.

This policy applies to the website jointhenation.at and to the application process we run through it. Join the Nation is the recruiting and employer brand presence of Spedination GmbH and not a separate company. The company website spedination.com has its own privacy policy.

1. Who is responsible (controller)

Spedination GmbH, Sportplatzweg 5a, 6336 Langkampfen, Austria
Phone +43 5372 21960, e-mail office@spedination.com

We have not appointed a data protection officer; we are not obliged to do so under Art. 37 GDPR. For any question about data protection, a message to the address above is sufficient.

This website also lists positions at Spedination Zillertal GmbH (Uderns, Austria), Spedination Deutschland GmbH (Kiefersfelden, Germany) and Spedination Poland Sp. z o.o. (Kielce, Poland). Spedination GmbH runs the application process for all of these positions. If you apply for a position at one of these companies, the people responsible for the selection there can view and assess your application.

2. When you visit this website

Delivery of the page

The website runs on the platform of our service provider Lovable and is delivered through the Cloudflare network. Technically necessary connection data is processed in the course of this: your IP address, the time, the address requested, the referring page and your browser identification. A website cannot be delivered, or protected against overload and attacks, without this data. The providers have not published a fixed retention period for these logs, so we cannot state one here. Legal basis: our legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).

Our own counter – without cookies

We keep our own count of how often the start pages, the job pages and the application form are opened. Only daily totals are stored: date, page, position, language, a rough origin (for example search engine, job portal, direct visit) and individual events such as a click on “Apply”. This counter sets no cookie and stores nothing in your browser. No profile is created, and two visits by the same person cannot be linked to each other.

Your IP address is neither stored nor logged in this process. It is held in memory only temporarily: for an abuse limit of no more than 60 reports per minute and so that visits from our own offices are not counted. Legal basis: our legitimate interest in measuring reach with as little data as possible (Art. 6(1)(f) GDPR).

Visitor statistics of the hosting platform

We use the visitor statistics of the Lovable platform only with your consent. We ask for it on your first visit. As long as you have not agreed, the page holds back the two scripts of the statistics: no statistics cookie is set and nothing is reported to the statistics. If you agree, they record the address opened, the referring page, browser identification and language setting, the device type, a country derived from your browser’s time zone, the length of the visit and technical measurements such as loading times and errors.

To group the page views of one visit, the statistics then set the cookie session-id with a random identifier. It expires 30 minutes after the last page view. According to Lovable, the statistics measure overall use, do not build profiles and do not recognise visitors on a later visit. Lovable has not published how long it keeps the statistical data.

Legal basis: your consent (Art. 6(1)(a) GDPR, Section 165(3) of the Austrian Telecommunications Act 2021). You can change or withdraw it at any time under “Cookie settings” at the bottom of the page; the statistics are then no longer run and the cookie is deleted. The website works just the same without consent.

Cookies and browser storage

We do not use advertising cookies, advertising networks or embedded social media content. Links to our profiles on Instagram, LinkedIn and Facebook are plain links; the terms of these providers apply only once you click them.

Images and fonts

The photos on the start pages are loaded from the server static.wixstatic.com, because they are kept in the media library of our company website at Wix; this also happens when you open the application form. For technical reasons Wix receives your IP address in the process. Fonts are delivered from our own address; no fonts are loaded from Google.

3. When you apply

Which data we collect

From the application form: first name, last name, e-mail address, phone number, desired position, your message, the language chosen and the position. If you upload documents, these as well (up to five files, PDF, JPG, PNG or DOCX). Only name, phone number and e-mail address are mandatory; without them we cannot process your application.

We also store the time, the form through which the application arrived and – as far as the link or the referring page shows it – how you found us (for example a job portal or a campaign). We compare your e-mail address and phone number with earlier applications in order to recognise multiple applications.

If your application reaches us in another way, for example by e-mail, by phone or through a job portal, we record it in the same system; this policy then applies in the same way. Until it is switched off on 31 October 2026 we also still use the applicant system Recruitee; we transfer applications from there into our own system.

Purpose and legal basis

We use your data to review your application, to contact you and to carry out the selection process. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). Retention after the decision is based on our legitimate interest in being able to defend ourselves against claims under the Austrian Equal Treatment Act and to link a repeat application to the earlier one (Art. 6(1)(f) GDPR).

Please do not send us information that is not needed for the position – for example about health, religion or family planning.

E-mails about your application

We send confirmations and other messages about your application through the e-mail service of our platform (sender address at notify.jointhenation.at). We log the recipient, the type of message, the time and the delivery status. If a message comes back as undeliverable, is reported as unwanted, or you unsubscribe from our messages, we block the address for further automatic messages.

Automatic reading of your documents with AI

Uploaded application documents may be processed automatically in order to extract contact and CV details. This includes the use of an AI service. Decisions on rejection or invitation are made by people only.

In detail: the text is extracted from your documents and sent to the AI interface of our platform Lovable, where a language model from Google processes it. If the documents contain images, up to three of them are sent along – usually in reduced size – so that an application photo can be recognised. What is read out: contact details, place of residence and date of birth, the stages of your career, languages, qualifications and driving licence, and a short summary. Career history and summary are shown in your applicant profile; the summary is marked there as an assessment by the AI. Details for your master data (such as name and contact details) are only adopted if a member of staff confirms them. If exactly one application photo is found and we do not have one yet, it is shown in your applicant profile.

The AI awards no scores, does not rank applications and makes no decision; no automated decision within the meaning of Art. 22 GDPR takes place. Processing by the language model may take place in the USA. According to Lovable, this data is not used to train AI models. Legal basis: Art. 6(1)(b) GDPR and our legitimate interest in quick and accurate data entry (Art. 6(1)(f) GDPR).

Later in the process

During the process the following is added: dates for the interview and the trial day, internal notes, assessments of your documents, of the interview and of the trial day by the people involved in the selection, and the decision with its reasons. If documents are missing, we send you a personal link through which you can submit files and a cover letter; we can see whether the link has been opened.

If you are hired, we ask you via a personal link for an employee data sheet with the details we need for the employment contract, payroll and social insurance registration. We provide separate information about processing during employment.

Talent pool

Only if you expressly agree do we keep your application in our talent pool in order to contact you again about suitable positions – for 24 months from your consent. You can withdraw your consent informally at any time. Legal basis: Art. 6(1)(a) GDPR.

4. Protecting the form against abuse

To prevent the application form from being misused for mass submissions, we limit the number of submissions: no more than two per IP address and hour, three per e-mail address and day, and three per e-mail address, position and day.

For this purpose we do not store your IP address or your e-mail address in plain text, but a cryptographic hash (SHA-256) of each. For IP addresses, reversing the hash is technically not impossible; we therefore treat these values as personal data. If a submission is rejected because of the limit per IP address, we additionally record the e-mail address given, so that we can trace a rejection made in error. These entries are deleted automatically after 30 days.

Legal basis: our legitimate interest in protection against abuse (Art. 6(1)(f) GDPR).

5. Who receives your data

Within the Spedination companies, only people involved in recruiting and selection have access. We do not sell data and do not pass it on for advertising purposes. The following service providers process data on our behalf:

Transfers to countries outside the EU

Lovable operates our database and the file storage containing your application documents in the Europe region. However, Lovable Labs Incorporated is based in the USA, and individual parts of the processing – in particular the AI evaluation, e-mail delivery and the technical monitoring of the platform – may, according to Lovable’s list, take place in the USA or the United Kingdom. The standard contractual clauses of the European Commission apply to this. For Israel (Wix) there is an adequacy decision of the European Commission.

6. How long we keep data

The period of seven months covers the six-month period for claims under the Austrian Equal Treatment Act plus one month for a claim to be served. Deletions run automatically every day.

7. Do you have to provide data?

You can visit the website without providing any information. For an application we need your name, phone number and e-mail address; everything else is voluntary.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing that we base on a legitimate interest (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. An informal message to office@spedination.com is sufficient; you change your consent to the visitor statistics directly under “Cookie settings” at the bottom of the page.

You can also lodge a complaint with the supervisory authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, phone +43 1 52 152-0, dsb@dsb.gv.at, dsb.gv.at.

9. Changes to this policy

We update this policy when the website or the application process changes. The version published here, with the date given above, applies.