HandyMan24 Privacy Policy

Here we describe what data we collect about you, why, how long we keep it, who we share it with and what rights you have. This document is for information (Articles 13 and 14 GDPR). It is not a contract and there is nothing in it you have to “accept”.

1. Who is the data controller

The controller of your data is the entrepreneur Oleksandr Chumakov, trading as Oleksandr Chumakov, ul. Zbigniewa Herberta 37 lok. 2, 05-120 Legionowo, NIP (tax ID) 5361994183, REGON 542617070 (“we”).

For personal data matters, write to info@handyman24.eu (subject: “Personal data”) or use the “Help” form. We have not appointed a data protection officer, because the law does not require us to.

2. Where we get data from

• From you: when you create an account, publish a Job, submit an Offer, write a message, go through verification or write to us.
• From your device: IP address, device and browser type, app version, a device identifier for secure login (details in the Cookie Policy).
• From other Users: the Client gives the first name and phone number of the person who will meet the Professional on site. If you are that person, we received your data from the Client (more in section 5).
• From public registers: when verifying a business, we check CEIDG (business register) or KRS (National Court Register), REGON (GUS, Statistics Poland) and the VAT taxpayer list; for qualifications, the relevant professional register.
• From Google: if you log in with a Google account: your name, e-mail address and profile photo. When you type an address: the suggested addresses you pick yours from.
• From Stripe: the payment status, and for a Professional who accepts card payments, the status of their Stripe account.

3. Why we process data, on what basis and for how long

“Contract” means Article 6(1)(b) GDPR (performance of a contract with you or steps taken before entering into it), “legal obligation” means point (c), “legitimate interest” means point (f), and “consent” means point (a).

While a dispute, complaint or proceedings by an authority are ongoing, we put on hold the deletion of data needed for that case.

4. Do you have to provide data

Data marked as required in forms is needed to create an account, publish a Job or submit an Offer – without it we cannot conclude a contract. A Professional must provide DAC7 data by law; if they do not, after 60 days we suspend the ability to submit Offers. Consents (marketing, public page, “before and after” photos) are voluntary and do not affect use of the Platform.

5. Information for the person who meets the Professional

If the Client has entered you as the person who will meet the Professional: we have your first name and phone number from the Client. We pass them only to the Professional chosen for that Job and only until the work is finished. The Client may also save your details in their contact book to use them for future Jobs. You have all the rights in section 9, including the right to object – write to us and we will remove your details from the Client’s contact book.

6. Who we share data with

Other Users – only as much as is needed:

• Professionals see the Job without your surname and phone number, and the address only as a district and approximate distance; only the chosen Professional sees the full details.
• With an Offer, the Client sees the Professional’s first name and the first letter of their surname, their photo, rating, verification level and badges; the full first name, surname and phone number – after the choice.

Our providers (processors acting on our behalf, under a data processing agreement):

We check photos for prohibited content with a tool running on our own servers – we do not send them to an outside company.

Independent controllers:

• Stripe Payments Europe, Ltd. (Ireland) – handling payments for top-ups and card payments to Professionals. Stripe processes card data and the Professional’s verification data under its own rules: stripe.com/pl/privacy. We do not see card data.
• Google: if you log in with a Google account.
• Google (Google Maps, Google Maps Platform) – address suggestions while you type. We send Google only the address text you type, through our server: without your IP address, name or account details. Google processes this data as an independent controller under the Google Privacy Policy.
• Head Office of Geodesy and Cartography (Główny Urząd Geodezji i Kartografii, the public address register) – we use it to find the coordinates of the address you picked. We send only the address, nothing about you.
• The Head of the National Revenue Administration: DAC7 data, and invoices through KSeF.
• Courts, the police, the public prosecutor’s office and other authorities: when they request data under the law.

7. Transfers of data outside the European Economic Area

Some providers operate in the USA or through servers outside the EEA. Grounds for the transfer:

• Cloudflare, Stripe, Apple, Google: the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework), because these companies are certified under it, supplemented by standard contractual clauses;
• Anthropic: standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR) and a transfer impact assessment; we send the model only what the given task requires, without the name, e-mail and phone from your account.
• Twilio (including its sub-processor ElevenLabs): the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework, under which Twilio Inc. is certified), Twilio’s binding corporate rules, supplemented by standard contractual clauses;
• Zadarma: to the United Kingdom, the European Commission’s adequacy decision; data may reach Zadarma’s US company only under standard contractual clauses (Article 46(2)(c) GDPR).

You can get a copy of the safeguards by writing to us.

8. Automated decisions and artificial intelligence

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Article 22 GDPR). Only the following work automatically:

• hiding contact details and removing special categories of data in texts (you can challenge this; a human reverses the hiding of a contact);
• assigning the lowest violation weight when you yourself give a cancellation reason on your own side (Appendix 5 to the Terms of Service);
• the order of Offers and Jobs according to the parameters described on the Display order page.

Account restrictions, refusal of verification and blocking are always approved by a human.

What we use artificial intelligence for

We use artificial intelligence models (provider: Anthropic, Claude model) for a few specific tasks. There is one rule: the model suggests or flags something, and a human or a simple rule decides.

What AI does not do

• it does not rate Professionals and does not set the order of Offers or Jobs;
• it does not assign jobs;
• it does not accept or reject candidate Professionals;
• it does not decide on restricting or blocking an account;
• it does not verify identity and does not compare faces with documents.

Your data

The model receives only what the given task requires: the text to be translated or checked, and in the assistant – your messages, photos and the Job address; on the phone line – the call transcript (section 14). We do not send the name, e-mail or phone from your account. The provider does not use this data to train models. It deletes it automatically within 30 days. It keeps longer, for up to 2 years, only the requests that its security systems have flagged as violating the usage policy of the service. The provider operates in the USA – the grounds for the transfer are described in section 7.

When AI makes a mistake

A translation may be inaccurate – if in doubt, ask the other party. Report wrongly hidden text through “Help”, and a staff member will check it.

9. Your rights

You have the right to:

• access your data and receive a copy of it;
• rectify your data;
• have your data erased (the “right to be forgotten”) – the simplest way is to delete your account;
• restrict processing;
• port the data you have given us, in a machine-readable format;
• object to processing based on legitimate interest – we will then stop, unless we show compelling grounds or the data is needed for claims;
• withdraw consent at any time (without affecting what we did before the withdrawal) – in the account settings or by writing to us;
• lodge a complaint with the President of UODO (Urząd Ochrony Danych Osobowych, the Polish Data Protection Authority), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

We reply to a request within one month. We may ask you to confirm your identity so that we do not hand data over to a stranger.

10. Account deletion – what remains

After an account is deleted, we erase the name, e-mail, phone, photo and contact book. Jobs, messages and reviews stay with the other party, but without your data (“Deleted user”). The following remain longer, for the reasons described in the table in section 3: accounting documents and DAC7 data, proof of acceptance of the Terms of Service, the activity log not linked to you, and – if you were blocked for a serious violation – hashes of identifiers that prevent you from creating a new account.

11. Security

Connections are encrypted. We store PESEL and other sensitive data encrypted. Staff access is limited to what a given case needs and is recorded in a log, a copy of which goes to an external archive where it cannot be changed. We remove the location from photo metadata before anyone else sees the photos. We will inform you without undue delay of a personal data breach that may put you at risk.

12. Children

The Platform is for adults. We do not knowingly collect children’s data.

13. Changes

When we change this policy, we will publish the new version with a date, and we will notify you of significant changes by e-mail or in the app. Previous versions are in the archive.

14. Phone line with an AI assistant

Calls to +48 22 230 48 00 are answered 24 hours a day by an AI assistant, a program based on artificial intelligence. It helps you place a Job for a service. If a Professional calls, the assistant tells them about working with HandyMan24 and sends a sign-up link.

In its first sentence the assistant says that it is an AI assistant and that the call is recorded. Prefer no AI and no recording? Post your Job in the HandyMan24 app. There is no voice call there.

What we keep and for how long

Why and on what basis

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). That interest is to:

• take the Job you ask for during the call;
• have a record of the call if a dispute about the Job arises;
• check that the assistant works properly;
• enforce the line limits (below) so that nobody can block it.

The line cannot work without a phone number. We do not handle calls from withheld numbers.

The assistant makes no decisions about people

The assistant does not rate Clients or Professionals. It does not accept or reject candidates. You publish the Job yourself, after opening the link. There are no decisions based solely on automated processing within the meaning of Art. 22 GDPR here (section 8).

Text messages after the call

We send a text message only if you say “yes” to the assistant’s question during the call. The question and your answer stay in the call transcript.

• A Client gets one link to a draft Job, valid for 72 hours. If the link is not opened, we send one reminder at most.
• A Professional gets a sign-up link.

These messages contain no advertising. You can withdraw your consent by writing to us (section 1).

Line limits

• Calls from withheld numbers and from numbers outside Poland (without the +48 code) are not handled.
• You can call from one number up to 5 times a day.
• A single call lasts up to 15 minutes.

Who processes call data

On our behalf: Twilio (call connection and speech recognition, and through its sub-processor ElevenLabs, the assistant’s voice), Amazon Web Services (storing recordings in Frankfurt), Anthropic (language model) and Zadarma (phone number). Where they operate and on what grounds data is transferred outside the European Economic Area is described in sections 6 and 7.

Your rights

You have all the rights in section 9. For calls with the assistant, people most often want to:

• get a copy of the recording and of the transcript;
• have the data deleted;
• object (Art. 21 GDPR): we will then stop processing the call data unless we show compelling legitimate grounds or need the data for legal claims;
• lodge a complaint with the President of UODO (the Polish Data Protection Authority).

Write to us through the help form in the app or at info@handyman24.eu. Give the phone number and the approximate time of the call.