Privacy Policy

The controller of your personal data is Task On Time, based in Romania.

Currently, TOT does not have a designated Data Protection Officer (DPO). For any requests regarding your personal data, you can contact us at: contact.taskontime@gmail.com.

We only collect data necessary for the Platform to function.

When creating an account (required):

• First and last name
• Email address (automatically verified)
• Chosen account type (Client or Tradesperson)

For completing a Tradesperson profile (required for full Platform use):

• Description of services offered (free text, 10-500 characters)
• Selected service categories
• Cities of operation
• Availability schedule (days and time slots)
• Profile photo and work photos
• Firm name (optional)

For completing a Client profile (optional):

• Profile photo

Data automatically generated through Platform use:

• Reviews and ratings given/received
• Messages sent via the chat system
• Jobs posted and applications submitted
• Account creation date and last update

Each category of data has a specific purpose:

• Identification data — for using the Platform and/or for creating, authenticating, and managing your account
• Profile data — for displaying your profile to other users and connecting you with relevant Clients/Tradespeople (from the same cities and categories)
• Photos — for display on your profile; automatically scanned for inappropriate content
• Messages — for facilitating direct communication between users
• Reviews — for building trust within the community
• Usage data — for improving the Platform and preventing abuse

Under Art. 6 GDPR, we process your data based on the following legal grounds:

Contract performance (Art. 6(1)(b) GDPR) — processing necessary to provide Platform services: account creation, profile display, chat system, job publishing.

Our legitimate interest (Art. 6(1)(f) GDPR) — content moderation, fraud prevention, Platform security, and service improvement. Our legitimate interest is always in accordance with your fundamental rights and freedoms.

Your consent (Art. 6(1)(a) GDPR) — only if you opt in for marketing communications. You can withdraw consent at any time.

Information from your profile (name, description, photos, reviews, categories, cities) is visible to other Platform users — this is the nature of the service.

For Platform operation, we use the following technical providers:

• Amazon Web Services (AWS) — hosting, databases, file storage, content distribution (CloudFront CDN)
• AWS Cognito — account authentication and management
• AWS Rekognition — automatic photo verification for inappropriate content
• AWS GuardDuty — scanning uploaded files for malware

We do not sell or share your data with third parties for advertising or marketing purposes.

All data is stored on Amazon Web Services (AWS) servers in the EU region — eu-central-1 (Frankfurt, Germany). We do not transfer data outside the European Economic Area.

AWS complies with European data protection standards and holds relevant certifications for GDPR compliance.

We keep your data for the entire duration your account is active. Upon request for account deletion:

• Personal profile data is removed within 6 months of account deletion
• Chat messages are anonymized
• Reviews may be retained in anonymized form (without connection to your identity)
• Photos are deleted from our servers

Under Art. 15-22 GDPR, you have the following rights:

• Right of access (Art. 15) — you can request a complete copy of your data
• Right to rectification (Art. 16) — you can correct your profile data at any time
• Right to erasure (Art. 17) — you can request deletion of your account and associated data
• Right to restriction of processing (Art. 18) — you can request temporary limitation of processing
• Right to data portability (Art. 20) — you can request your data in a structured format (JSON)
• Right to object (Art. 21) — you can object to processing based on legitimate interest
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing
• Right not to be subject to automated decision-making (Art. 22) — you will not be subject to a decision based solely on automated processing (profiling)
• Right to lodge a complaint — you can file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), phone: +40.318.059.211 or +40.318.059.212, email: anspdcp@dataprotection.ro

To exercise any right, contact us at contact.taskontime@gmail.com. We will respond within 30 days.

The Platform uses automated processing in the following situations:

• Photo moderation — AWS Rekognition automatically analyzes uploaded photos to detect inappropriate content (nudity, violence, etc.). Photos deemed inappropriate are automatically rejected.
• Malware scanning — AWS GuardDuty automatically checks uploaded files for harmful content.

We do not use automated profiling to make decisions that significantly affect you. Tradesperson search is based on user-selected filters (city, category), not on a profiling algorithm.

We do not use third-party tracking or advertising cookies.

Cookies:

• _tot_vid (analytics, optional) — An anonymous unique identifier (UUID) set only with your explicit consent. Lasts 2 years. Used exclusively to count unique platform visitors and understand which pages are popular. Contains no personal data and is not shared with anyone. You can refuse this cookie without affecting platform functionality.

Local storage (localStorage):

• Authentication token (to keep your session active)
• Language preference (Romanian or English)
• Cookie preferences (your choice from the consent banner)

This data is stored only in your browser, is not accessible to third parties, and is not used for tracking or advertising. You can delete this data anytime from your browser settings or change your cookie preferences from the "Cookie settings" link in the page footer.

The Platform is intended for individuals who are at least 18 years old. We do not currently have an automated age verification mechanism, but by accepting the Terms and Conditions when creating an account, the user confirms they meet this requirement.

If we discover that a minor has created an account, we will take steps to delete the account and associated data.

We protect your data through the following technical and organizational measures:

• All communications are encrypted via HTTPS/TLS
• Authentication is managed by AWS Cognito with mandatory email verification
• Data access is controlled through JWT tokens with automatic expiration
• Photos are securely stored on AWS S3 and distributed via CloudFront CDN
• Uploaded files are automatically scanned for malware and inappropriate content
• Infrastructure is continuously monitored

While we make reasonable efforts to protect data, no system can guarantee absolute security.

We may update this policy when changes occur in our practices or in legislation. The updated version will be published on this page with the date of the last modification.

For significant changes, we will inform you via email or in-Platform notification.

For any request related to your personal data:

Email: contact.taskontime@gmail.com

Response time: maximum 30 days

If you believe your rights have been violated, you have the right to file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP):

• Website: www.dataprotection.ro
• Email: anspdcp@dataprotection.ro