1. Controller
The controller of personal data is TrabajoAbierto. Privacy contact: the email shown in the footer.
2. What data we process
Account: name, email, country, language, password (stored as an irreversible hash). Person profile: city, languages, channels, sectors of interest, skills, availability, payout method and details. Company profile: name, website, description, sector, API key. Activity: jobs taken, clicks on links (with the IP address reduced to an irreversible code), contacts left by end customers (name, contact, business, city, country, message), results, sales, payouts, guarantees and disputes. End customers of guaranteed payment: name, contact, payment reference and dispute communications. Technical: access date and time, browser, server logs for security.
3. Purposes and legal basis
To provide the service (performance of contract): accounts, attribution of results, payments, guarantee and disputes. To send you jobs matching your profile and account notices (performance of contract; you can edit your profile or close the account). For security, fraud prevention and legal compliance (legitimate interest and legal obligation). To improve the service with aggregated statistics (legitimate interest). We make no automated decisions with legal effects without human involvement: disputes are reviewed by a person.
4. Who we share data with
With the Company whose job you take: your public name, country, city, languages, channels, introduction and payout method (to pay you). With the Person who attributed a contact or result: the contact data the customer left. With the end customer of a guarantee: the names of the Company and of the Person who presented the job. With providers strictly necessary to run the service (hosting on the Operator's own servers; payment institutions where they exist). With authorities when the law requires it. We do not sell data or share it with third parties for advertising.
5. International transfers
The Operator's servers are in the European Union. The Platform is planetary: data you share with a Company or Person in another country is transferred to that country as a necessary part of the service you request.
6. Retention
Account data is kept while the account is active and up to 5 years afterwards for legal obligations and defence against claims. Click records are deleted after 400 days, reset tokens when used or expired, anti-abuse throttles after 24 hours and read notices after 90 days. Backups are kept for 30 days.
7. Your rights
You may access, rectify, erase, restrict, object to and port your data, and withdraw consent where it is the legal basis, by writing to the contact above. Most of your data can be edited directly from your profile. If you are in the European Union you may complain to your data protection authority.
8. Security
Passwords are stored as irreversible hashes; communication is encrypted (HTTPS); access and sensitive actions are logged; there are limits against brute force and abuse; the service runs with minimal privileges and with backups encrypted in transit to a second server.
9. Minors
The Platform is for people aged 18 or over. If we detect a minor's account, we will close it.
10. Changes
This policy may be updated; the version in force is the one published here with its date.