1. Who we are
[company legal name — to be confirmed] ("Gigvora") is the controller of the personal data described in this policy. Contact for privacy questions: [privacy contact email — to be confirmed]. Data protection officer or representative: [to be confirmed, if appointed].
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email address, password (stored as a hash by our authentication provider), sign-in records | You |
| Profile | Headline, skills, location you choose to share, portfolio links, availability | You |
| Organisation | Organisation name, type, size, country, website, members and roles | Organisation owners and admins |
| Communications | Messages, attachments, reactions and read positions in conversations you take part in | You and the people you message |
| Verification | Information you submit for identity or business checks and their outcome | You and verification providers |
| Usage and security | Device and browser type, IP address, security events, audit records | Automatically |
| Preferences | Notification, contact and marketing choices | You |
We do not ask for special category data (for example health information) in normal use of the Platform.
3. How we use data and our lawful bases
- To provide the Platform and the features you ask for (contract): creating your account, showing your profile, delivering messages, running your workspaces.
- To keep the Platform safe (legitimate interests and legal obligation): preventing fraud and abuse, enforcing our policies, keeping security and audit records.
- To send product news (consent): only if you opt in. You can withdraw consent at any time in your settings.
- To meet legal requirements (legal obligation): for example tax and accounting records once paid features exist.
4. Who can see your data
- Other users see what you choose to show on your profile and what you send them. Organisation members see organisation data according to their role.
- Gigvora staff access personal data only when needed for a specific purpose, such as a support case you opened. Access to private messages is limited to case-specific, time-limited, audited grants.
- Service providers that host and operate the Platform for us under contract (for example database and authentication hosting, file storage, email delivery and payment processing). [List of sub-processors and their locations — to be confirmed.]
We do not sell personal data.
5. International transfers
Some providers may process data outside the UK. Where they do, we use safeguards recognised by UK law, such as adequacy regulations or the International Data Transfer Agreement. [Confirm transfer mechanisms per provider.]
6. How long we keep data
We keep account data while your account is open and for a limited period afterwards to handle disputes, fraud prevention and legal obligations. Messages are kept while the conversation exists for at least one participant. [Specific retention periods — to be confirmed in the Data Retention Policy.]
7. Your rights
You can ask to access, correct, delete or export your data, to restrict or object to some processing, and to withdraw consent. Many of these you can do directly in your settings. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
8. Security
We use encryption in transit and at rest provided by our hosting partners, role-based access controls, row-level security in our database, multi-factor authentication for staff, and audit logs. No system is perfectly secure; if we become aware of a breach affecting you we will tell you where the law requires it.
9. Changes
We will tell you about material changes to this policy. Earlier versions are listed below.