Taskix Privacy Notice
1. Who is responsible for your data
1.1 Platform data. The Operator, SMARTEDTECH SL, is the controller of personal data processed to operate the platform: account, identity verification, acceptance records, payments, security, support, communications and analytics.
1.2 Provider supply data. Where a provider supplies services to a customer through the platform, the provider is an independent controller of the data it needs for that supply (booking, order, clinical, educational or professional records), and the Operator is a controller of the platform-level record of the transaction. Each party complies with its own obligations; neither acts for the other.
1.3 Processor services. Where the Operator processes personal data on behalf of a business customer under the customer's instructions (for example an enterprise tenant's employee data), the Data Processing Agreement (DAT-01) applies and governs; it is signed as part of the order.
1.4 Sharing between SET platforms. Personal data is not shared with any other platform operated by the Operator or its group unless you enable the specific destination in your settings. Enabling one destination does not enable others, and you may disable it at any time.
1.5 International transfers. Personal data is stored in the European Economic Area. Where a processor outside that area is used, the transfer is covered by Standard Contractual Clauses, listed in the subprocessor annex.
1.6 Contact. Operator identity and postal address: see the Legal Notice (PUB-01). Privacy requests: privacy@taskix.net or the rights form at /legal/privacy-rights.
2. What we process, why, and on what basis
| Data class | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Contact and enquiry data (name, email, phone, message) | Answer your enquiry; manage a job request you submit | Art. 6(1)(b) steps prior to a contract; Art. 6(1)(f) for business contacts | Until the enquiry is closed, then C16 ceiling (clause 6) |
| Account data (email, password hash, role, tenant, language) | Create and secure your account; show the right functions to the right role | Art. 6(1)(b) contract | Life of the account + 90 days (clause 6) |
| Job data (job description, photos you upload, job address, preferred dates) | Match your job with professionals; show it to professionals you shortlist or who quote | Art. 6(1)(b) contract | Life of the job record; photos and messages per clause 6.2 |
| Quote, order and completion data (quote, accepted total, change orders, proof-of-completion uploads, invoices) | Form and record the works order between you and the professional; billing of the Operator's own fees | Art. 6(1)(b) contract; Art. 6(1)(c) tax and accounting | 6 years (tax/accounting) |
| Provider verification data (legal identity, tax ID, licence and insurance documents, expiry dates) | Verify that a professional may lawfully offer the listed trades; suspend publishing on expiry (PRO-01 clause 3) | Art. 6(1)(b) contract with the provider; Art. 6(1)(f) protection of customers | Life of the provider account + 5 years as evidence of verification |
| Acceptance and consent records (document ID, version, hash, time, method, hashed IP and user agent) | Prove which terms you accepted and which permissions you gave | Art. 6(1)(c) and 6(1)(f) evidence of compliance | 5 years after the end of the relationship |
| Payment data (payment-provider reference, amount, status; never full card numbers) | Process payment of the Operator's fees; reconcile provider orders | Art. 6(1)(b); Art. 6(1)(c) | 6 years |
| Reviews and ratings | Publish a review after a verified completed job (MKT-01) | Art. 6(1)(f) marketplace transparency | Life of the listing; removed under C10 or on request where the review is yours |
| Security and audit logs | Detect abuse, protect accounts and tenants, investigate incidents | Art. 6(1)(f) | 12 months |
| Optional analytics | Understand how the site is used | Consent (analytics_optional), via the cookie banner | Per PUB-03 |
| Marketing email | Send news about Taskix you asked for | Consent (marketing_email), separate unticked checkbox | Until you unsubscribe |
2.1 Mandatory fields are marked on each form. Accepting the Account Terms is not consent to optional processing; each optional purpose has its own control in your settings.
2.2 Health, biometric and other special-category data are not requested by the platform. Do not include them in job descriptions, photos or messages; if you do, we delete them on notice.
2.3 Persons under 18 may not open an account (ACC-01 clause 1).
3. Automated decisions and AI assistance
3.1 Matching of jobs to professionals uses the ranking parameters stated in the Marketplace Transparency Notice (MKT-01). Matching produces a shortlist; it does not accept a quote, charge you or suspend a professional by itself.
3.2 Where you interact with an AI assistant on the platform, it is labelled as AI at the start of the interaction (ACC-02). AI outputs are information and assistance, not a decision of the Operator; decisions with legal or financial effect (accepting a quote, authorising a change order, suspending a provider) are taken by you or by a person at the Operator.
3.3 You may request human review of any automated step at support@taskix.net.
4. Recipients
4.1 Professionals you shortlist or who quote receive your job description, photos, job address area and the contact details needed to arrange the visit. The professional whose quote you accept receives the full job address and contact details and is an independent controller of them (clause 1.2).
4.2 Processors acting on the Operator's instructions: hosting and database, authentication, transactional email, payment service provider, electronic signature provider, error monitoring and (if you consent) analytics. The current list with function, location and transfer mechanism is published at /legal/subprocessors and maintained under DAT-01 Annex C.
4.3 Authorities, courts and professional insurers receive data where the law requires it or where a claim about a job makes it necessary.
4.4 No data is sold. No data is used to train models unless you separately enable research_contribution in settings, which Taskix does not currently offer.
5. Your rights
5.1 You may request access, rectification, erasure, restriction, portability and objection, and you may withdraw any consent prospectively as easily as you gave it. Use /legal/privacy-rights, privacy@taskix.net or the postal address in the Legal Notice.
5.2 The Operator verifies identity proportionately (normally by confirming the request from the account email) and answers within one month; where an extension is lawful it tells you the reason within the first month.
5.3 Erasure may be limited by tax, accounting or claim-evidence duties; the Operator tells you the scope and duration of any such limitation.
5.4 You may complain to the Agencia Española de Protección de Datos (www.aepd.es) or to the supervisory authority of your residence.
6. Retention and deletion
6.1 Account data is kept for the life of the account and deleted or anonymised within 90 days after closure, except where a longer period is required by law (tax and accounting records: 6 years; acceptance and consent records: 5 years after the end of the relationship, as evidence of compliance; records subject to a legal hold: until the hold ends).
6.2 Conversation logs, recordings and uploads not linked to an active contract are deleted no later than 12 months after the last interaction, and earlier on your request, unless a legal hold applies.
6.3 Backups are rotated on a cycle not exceeding 35 days; data deleted from production is removed from backups at the end of the cycle.
6.4 Where a provider is an independent controller, its own retention rules apply to its records.
7. Security
7.1 The Operator applies tenant isolation, role-based access, multi-factor authentication for privileged access, encryption in transit, encrypted storage of credentials and append-only audit of privileged actions. Personal-data breaches affecting you are notified to the AEPD within 72 hours where required and to you without undue delay where the risk to you is high.
8. Changes to this notice
8.1 The Operator may amend this notice for legitimate reasons: changes in law, in the service, in security or fraud prevention, in the payment provider, or to clarify wording. The Operator notifies you of material changes by email and in-product at least 30 days before they take effect (immediately where required by law or security).
8.2 A later version does not broaden a consent you gave under an earlier version; a new purpose is presented to you as a new control before it is enabled.
8.3 Every version is archived with its date and content hash at /legal/privacy/v/.