Taskora Privacy Policy

1. Who is responsible and how to contact us

Taskora is a marketplace connecting Clients who request tasks with Fixers who provide services. This policy explains how we process personal data about visitors, Clients, Fixers and people who contact us or appear in task-related information. It covers our websites, apps and marketplace support. Staff and recruitment processing require separate notices.

The controller for Taskora's processing is Arora Private Company, trading as Taskora, at DYOVOUNIOTOU 26, Athens 11741, Greece, registration number 193195503000, VAT 803256639. Contact our privacy team at support@taskora.gr or that postal address.

We determine how marketplace accounts, operations, safety and platform records are processed. A professional Fixer may separately act as controller for their own customer records, invoices and legal obligations. Payment providers also have their own responsibilities. This policy does not replace their notices or transfer Taskora's legal duties to users.

2. Where personal data comes from

We obtain information from you when you register, update your profile, request or offer work, make payments, upload content, message others or contact support. Our services also generate records of account access, task activity, payment status and technical events.

Other sources include the Client or Fixer in a task, reviewers, people reporting a concern, payment and verification providers, communication-delivery providers, and campaign or referral links that you use. Regional statistics and campaign datasets may supply context for the analysis described in Section 8. We distinguish these sources from facts you have confirmed yourself.

If someone gives us information about you before you have an account, you still have the rights in Section 13. Where GDPR Article 14 applies, we provide the required information within one month, or earlier at our first communication with you or first disclosure, unless a specific legal exception applies.

3. What we collect

The categories depend on your role, choices and activity; not every category is collected from every person.

We do not need unrelated identity documents, bank statements, passwords or complete card details in task descriptions, chat or AI prompts. Share only what is necessary. Avoid including another person's private details in publicly visible content.

Some content could reveal health, disability or other specially protected information, or allegations about offences. Ordinary acceptance of the Terms does not authorize its processing. A permitted Article 9 condition, such as explicit consent for a suitable optional feature or necessity for legal claims, is needed in addition to an Article 6 basis; Article 10 separately restricts criminal-offence data. Unnecessary sensitive material should be removed or redacted.

4. Why we process data and our legal bases

We apply the GDPR together with Greek Law 4624/2019 and, for relevant electronic communications and device technologies, Law 3471/2006. The legal basis attaches to a particular purpose, not to the whole account. The same transaction record may be needed for both contract performance and a separate accounting obligation.

Where we rely on legitimate interests, you can object based on your circumstances. We must then stop unless the applicable legal test allows continued processing. Objection to direct marketing, including related profiling, is unconditional. You can ask for information about the relevant balancing assessment.

Consent is voluntary, specific and withdrawable at any time, without affecting earlier lawful processing. Accepting the Terms, authorizing a payment or granting an operating-system permission is not blanket privacy consent.

5. Required information, location and device choices

Account contact and security details, task information and the payment details needed for your selected route are necessary to provide the corresponding service. If required information is missing, we may be unable to create an account, arrange the task or payment, or satisfy a particular legal requirement. Optional profile content and optional tracking are separate choices.

You can enter a task address or area directly where the interface offers this. A device-location feature may provide precise coordinates if you permit it; IP-based location is approximate. Using location to find nearby work does not itself authorize using precise location for advertising or general analytics.

Camera, photo-library and microphone access supports uploads or voice features that you choose. You can change permissions in your device settings. Push permission controls whether your device can receive push notifications; it does not by itself authorize marketing. Disabling an optional permission may affect that feature without closing your account.

6. Payments, direct arrangements and Ergosimo

Stripe supports eligible professional Fixer payments and Taskora fee collection. Taskora processes provider references, payment status, billing and transaction information to administer those flows. Enter full card credentials only in the designated payment form. Stripe may collect additional identity, business, bank or verification information directly for its own payment and regulatory responsibilities; its privacy policy explains those activities.

For eligible direct cash or IRIS arrangements, the Client and Fixer arrange the underlying remuneration themselves while Taskora collects its separate fee. Taskora still processes the booking, price, fee, selected route, relevant instructions, payment confirmations and any evidence needed for a dispute. External payment does not make these records anonymous or exempt them from data-protection law.

For non-professional engagements, the Client and Fixer are responsible for the information, lawful issuance and redemption of any required Ergosimo (εργόσημο), declarations and contributions that the law assigns to each of them. Taskora does not issue or redeem Ergosimo or carry out that remuneration process. Necessary information should be supplied through the competent bank or statutory channel; do not upload an Ergosimo, AMKA, tax identifier or identity document to Taskora merely because a task exists. If Taskora separately needs specified information for a legal obligation, it must identify the requirement, purpose and secure collection route.

This allocation does not remove Taskora's own duties, including applicable tax-platform reporting. A payment provider or professional Fixer may need to retain their own legally required records after a Taskora account is closed.

7. Cookies, analytics, attribution and optional replay

Strictly necessary device storage or access may support login, security, a requested payment or remembering your privacy choice. Optional cookies, local storage, SDK identifiers and comparable tracking require prior consent where Article 4(5) of Law 3471/2006 applies. First-party technology, hashing or a statistics label does not automatically create an exemption.

The privacy-choice interface must offer clear purpose-specific choices, a readily accessible rejection option and withdrawal as easy as giving consent. Continued browsing and preselected optional choices do not count as consent.

Usage and attribution systems can associate session activity with your account and with campaign, referral, install-referrer or click information. Interaction analytics can record screen/control identifiers, touch positions and scrolling without needing the text you enter. Account-linked or pseudonymous measurement is still personal data. Consent for analytics is separate from marketing contact and from replay.

First-party mobile replay is not available. If introduced after approval and a fresh notice, it would reconstruct selected screen layouts and interactions using structured events, rather than record a screen video. Its design excludes screenshots, visible text, form values, chat content, addresses and payment details. It requires a separate opt-in, with no disadvantage for refusal, and provides withdrawal and linked-record deletion controls. It is intended for diagnosing approved interface failures and support investigations, not advertising or eligibility decisions. A separate error-monitoring provider's replay would require its own verified disclosure and controls; this paragraph does not authorize it.

8. Recommendations, profiling and automated actions

Taskora can use task category, location, skills, availability, ratings and previous activity to order relevant work or service suggestions and assess marketplace capacity. This can influence which opportunities you see. Internal account summaries can also combine service history, acquisition information and inferred interests to help staff understand service use and resolve problems.

Regional statistics from sources such as Eurostat and ELSTAT, and aggregate trend or campaign datasets, may provide area or cohort context. An area's income, age or employment statistics are not confirmed facts about you. When linked to your account, that context forms part of your personal profile. Advertising-cohort enrichment requires the relevant consent. You can request access, challenge inaccurate associations and object where processing relies on legitimate interests.

Automated rules can affect payment retries, settlement, overdue-fee restrictions, security access and moderation routing. AI may classify or prioritize a support request. These uses must be assessed for their actual effect; calling a system a recommendation does not exclude GDPR Article 22.

You may request human review, explain your position and contest an action affecting you through the privacy contact or support. Any decision based solely on automated processing that has legal or similarly significant effects needs a valid Article 22 exception, the required safeguards, and meaningful information about its logic, significance and likely consequences.

9. AI conversations and assistance

Taskora uses Google's Gemini services for AI assistance, including interpretation of requests, drafting or categorizing task information, support triage and voice transcription. The relevant prompt, conversation context and any image or audio you submit can be sent to that provider. Taskora also stores conversations, transcripts, action confirmations and diagnostic information, which authorized staff may review for support, safety and troubleshooting.

AI output can be inaccurate. Check generated task details and any requested confirmation before proceeding. Avoid unnecessary confidential or sensitive information, and obtain an appropriate basis before supplying another person's personal data.

A provider's no-training term is different from a promise of no storage, abuse review or human access. This policy does not establish that personal conversations may be used to train Taskora's or another provider's models. A new training or other incompatible purpose needs its own assessment, notice and lawful basis before use.

10. Who receives information

Processors must act under appropriate data-processing agreements; some providers act as separate controllers for their own purposes. We do not give other users a right to reuse personal contact details for unrelated marketing. Disclosure of customer lists to advertisers or additional person-level data enrichment is outside this policy and requires a separate assessment and notice before activation.

11. International transfers

Using international providers can involve processing or remote access outside Greece and the European Economic Area, including in the United States. Choosing an EU hosting region does not by itself rule out international transfers.

Transfers require an applicable GDPR Chapter V mechanism, such as a valid adequacy decision covering the recipient and processing, or appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with assessment and supplementary measures where needed. A provider's general privacy-policy link alone is not a transfer safeguard.

Ask our privacy contact for the relevant safeguards, with necessary protection for confidential information. This notice and acceptance of the Terms are not blanket consent to international transfers.

12. How long we keep data and what deletion means

We retain information for the purpose for which it was collected, taking account of active tasks, disputes, legal obligations, security needs and the rights of other people. Account closure does not justify keeping all data indefinitely, and an outstanding payment does not cancel your privacy rights. A legal hold must be limited to the relevant records and reviewed when the reason ends.

The following describes retention periods and criteria. These periods are not universal Greek statutory minimums.

Deletion can involve removing files and identifiers, clearing indexes and caches, and removing or de-identifying personal material in shared records. A record is anonymous only when a person is no longer reasonably identifiable; a hashed identifier or the name “deleted user” is not sufficient on its own. Shared task, message or review records may need to remain in a minimized form to preserve another participant's rights or resolve a claim.

Deletion across systems may take time. Restricted backups must not be used for ordinary processing, and deletion must be reapplied if data is restored. We explain any lawful refusal or retained categories when answering your request. Genuinely anonymous statistics cannot normally be linked back to an individual for deletion.

Request account and associated-data deletion

13. Your rights and how to exercise them

Depending on the applicable conditions, you can:

• Obtain confirmation of processing, access to your personal data and the required information about its use and recipients.
• Correct inaccurate data and complete incomplete information, including challenging inferred profile information.
• Request erasure or restriction of processing.
• Receive data you provided in a structured, commonly used, machine-readable format where processing is automated and based on consent or contract, and request direct transmission where technically feasible.
• Object to processing based on legitimate interests and stop direct marketing, including related profiling.
• Withdraw consent and exercise the protections relating to qualifying automated decisions described in Section 8.

Use support@taskora.gr, the postal contact in Section 1, or the available account controls. You can contact us without access to an active account. We may request proportionate information to verify your identity where reasonably necessary; we do not routinely require a full identity-document copy for every request.

We respond without undue delay and normally within one month of receiving the request. For a complex request or several requests, the GDPR permits an extension of up to two further months; we must explain that extension and its reasons within the first month. Requests are normally free. Any fee or refusal for manifestly unfounded or excessive requests must meet the GDPR test and be explained with available remedies.

An automated account export may not contain every item covered by access rights. Its download limits, security checks and product quotas do not replace or restrict your statutory rights. We protect the rights of other people and applicable confidentiality when providing information, rather than automatically refusing a whole request.

You can complain to the Hellenic Data Protection Authority (HDPA/ΑΠΔΠΧ) through its complaint service. You may also complain to a competent supervisory authority in the country of your habitual residence, workplace or the alleged infringement, and seek a judicial remedy. The HDPA provides guidance on first exercising the relevant right with the controller for rights-related complaints.

14. Security and children

We use measures such as authentication, access permissions, protected storage, logging and controls on administrative access. We assess the measures against the risks of the processing; no service can guarantee absolute security. Report suspected unauthorized access through support or the privacy contact. We assess incidents and make the notifications required by GDPR Articles 33 and 34.

Taskora marketplace accounts are intended for people 18 or older under the Terms. This service age limit is separate from the Greek rules about a child's consent to an information-society service. If we learn that a child has provided data inappropriately, we assess and remove or restrict it as required. Adults arranging a permitted task involving a child should provide only necessary information and avoid public disclosure of the child's identity or sensitive details.

15. Changes to this policy

We publish the effective date and notify you of material changes through appropriate channels before the relevant new processing begins. Where a new purpose requires consent, a revised notice or continued use does not supply that consent. The English and Greek versions must explain the same processing and rights; neither can reduce rights granted by applicable law.