Privacy Policy

1. Introduction

This Privacy Policy explains how Worqen OÜ, a private limited company incorporated in Estonia (registered address Juhkentali tn 8, Kesklinna linnaosa, 10132 Tallinn, Harju maakond, Estonia) ("Worqen", "we", "us"), collects, uses, shares and protects personal data when you use the Worqen marketplace, mobile applications, smart contracts and APIs (the "Service").

We are the data controller for personal data we process about Users. This Policy applies in addition to the EU General Data Protection Regulation (GDPR), the Ukrainian Law on Personal Data Protection, the Brazilian Lei Geral de Proteção de Dados (LGPD), the Indian Digital Personal Data Protection Act 2023 (DPDP), and other applicable local laws — see Section 13 for region-specific rights.

2. Data Protection Officer and Contact

Privacy queries, requests to exercise your rights, and complaints can be addressed to our Data Protection Officer at [email protected] or by post to Worqen OÜ — DPO, Juhkentali tn 8, Kesklinna linnaosa, 10132 Tallinn, Harju maakond, Estonia.

3. Personal Data We Collect

Sensitive data: KYC processing involves biometric data (selfie matched to an ID document) and government-issued identifiers. We process this category of data only with your explicit consent and on the basis of compliance with our legal obligations under anti-money-laundering and counter-terrorist-financing law.

4. Purposes and Lawful Bases

Content safety and moderation. We do not generally monitor or pre-moderate your listings, profiles or messages. To keep the Service safe, however, we use targeted detection tools — including automated and AI-assisted tools — to screen communications and shared content for spam, abuse, fraud, sanctioned activity and illegal material, and we act on reports we receive through in-app reporting and trusted-flagger channels. Where the law requires it, this includes detecting and reporting child sexual abuse material to the competent authorities. Our lawful basis is our legitimate interest in protecting Users and preventing abuse and fraud and, for the detection and reporting of illegal content, compliance with a legal obligation. Any resulting adverse decision about your account is reviewed by a person before it takes effect — we do not take such decisions by solely automated means. See our Acceptable Use Policy, our Digital Services Act information and our AI Use Policy for how content moderation and our internal AI tools work.

Off-platform contact-detail screening. Because Section 6 of our Terms of Service restricts moving an engagement off-platform to avoid our commission, we automatically screen job-chat messages for contact details commonly used to do that — for example a phone number, email address, or a handle or link for a third-party messaging app. This protects Users who rely on escrow and helps prevent fee circumvention and fraud; our lawful basis is our legitimate interest in doing so. We do not store a copy of the message content for this purpose. What is recorded is: the fact that a detection occurred and the type of contact detail involved; the time; how the message was sent (sent, edited, forwarded, or scheduled); a reference to the message and the chat it was sent in; and a one-way keyed fingerprint of the detected contact detail, used to recognize the same or a shared contact detail across different accounts. This information is kept for as long as needed for a Trust & Safety review, consistent with the chat-message retention period in Section 7. If your account is reviewed under this Section, a member of our Trust & Safety team may view the message itself as part of that review.

5. Service Providers and Recipients

We share personal data only with the following categories of recipients, each under written data-processing terms where applicable:

• Persona (Persona Identities, Inc., USA) — KYC and identity verification. Receives ID documents, selfies, biometrics, name, DOB, address.
• Mailgun (Sinch / Mailgun Technologies, USA) — transactional and marketing email delivery. Receives email address and email content.
• Object storage provider (S3-compatible) — file storage for avatars, job photos, CVs and message attachments. Files are stored under URLs that can be guessed only with knowledge of the upload key.
• Sentry (Functional Software, Inc., USA) — error monitoring. Receives stack traces, request metadata and a pseudonymous user identifier.
• Solana RPC providers — used to broadcast and read on-chain transactions. Receives wallet addresses and transaction data (which is, by design, public on the blockchain).
• Google LLC (USA) — Google Calendar and Google Meet, used to create interview events and meeting links when an interview is scheduled through the Service and, if you connect your Google Calendar, to read your availability. Receives the interview title and time and the participants' email addresses. See Section 5A.
• Google Analytics (Google Ireland Limited / Google LLC, USA) — product analytics, only if you accept analytics cookies. Receives the pages you view, how you arrived (including campaign parameters), device and browser details, approximate location derived from your IP address, and product events such as sign-up and escrow funding with amounts and an internal escrow record number. It does not receive your name, email address or account ID.
• Microsoft Clarity (Microsoft Corporation, USA) — usability analytics, only if you accept analytics cookies. Receives clicks, scrolling, mouse movement and page views, which it uses for heatmaps and session replays that can include content shown on the pages you visit, together with device and browser details and approximate location derived from your IP address.
• Cloudflare (Cloudflare, Inc., USA) — our network provider. Delivers the Service, protects it against attacks and automated abuse (including the Turnstile check on the sign-up form) and tells us the country each request comes from. Receives your IP address and request details such as the page address and your browser's user agent.
• Hosting and infrastructure providers — operate the servers that run the Service.
• Professional advisers — lawyers, auditors, accountants, on a confidential basis as needed.
• Authorities — courts, law-enforcement and regulators, where we are legally required to disclose data.
• Buyers and successors — in the event of a merger, acquisition, reorganisation or insolvency, subject to appropriate confidentiality obligations.

User-authorized AI connections

If you connect a third-party AI client to Worqen through the Worqen Workspace MCP integration at your request, the connection can transfer the selected profile, contract, conversation and message data to the AI provider you choose. If you grant write access, the client can send messages in existing conversations and mark selected messages as read. The AI provider processes data under its own privacy policy and terms. Revoking the connection stops future access through that connection; it does not delete data already shared with the provider or copies the provider may have retained.

Public profile. Information you choose to put on your public profile, listings or reviews is visible to other Users and, where listings are public, to anyone on the internet.

On-chain data. Transactions you sign with your Solana wallet — including wallet addresses, amounts, escrow program interactions and timestamps — are recorded on a public blockchain. We cannot delete or alter on-chain data. You should not transact on- chain with information you wish to remain private.

5A. Google user data and Limited Use

Interview scheduling can use Google Calendar and Google Meet. If you connect your Google Calendar, Worqen receives through the Google Calendar API your Google account email address, an OAuth refresh token (stored encrypted at rest), the scopes you granted, the free/busy time blocks of your primary calendar, and the identifiers and Google Meet links of the interview events Worqen creates on your calendar. If you take part in an interview that is scheduled on Worqen's own calendar instead, Google receives the interview title and time and your email address as an attendee so that it can send you the invitation.

We use this data only to show availability, to create, reschedule, cancel and send reminders for interviews, and to deliver the meeting link to the participants. Worqen's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Google user data is never used, transferred or sold to create, train or improve any machine-learning or artificial-intelligence model, whether first-party or third-party, and is never sent to any AI service. Worqen's AI-assisted features (résumé import, chat translation and drafting, voice transcription and job-post categorisation) operate only on content you type or upload in the Service. Google user data is not used for advertising and is not sold. Our staff access it only with your consent, for security or abuse investigations, to comply with applicable law, or for internal operations where the data has been aggregated or anonymised.

Disconnecting your Google Calendar in Settings revokes Worqen's access at Google and deletes the connection from our systems; deleting your account does the same. You can also withdraw access at any time from your Google Account permissions page.

6. International Data Transfers

Worqen is established in the European Economic Area. Some of our service providers (such as Mailgun, Sentry, Google, Microsoft and Cloudflare) are established outside the EEA, primarily in the United States. To protect your data when it is transferred outside the EEA, the United Kingdom, Brazil or India, we rely on:

• European Commission adequacy decisions where available;
• EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum;
• Supplementary measures, including encryption in transit and at rest where appropriate;
• For Brazil, ANPD-approved contractual safeguards under LGPD; for India, the notifications issued under the DPDP Act in respect of cross-border transfer.

You can request a copy of the safeguards in place by contacting our DPO.

7. Retention

What anonymisation means. When we anonymise account data, we irreversibly strip or one-way hash the direct identifiers that link that data to you — such as your name, email address, username, avatar and profile details — so that the remaining data can no longer be attributed to you, whether by us or, using means reasonably likely to be used, by anyone else. Once data is anonymised it is no longer personal data, and we may retain it in aggregate or de-identified form for statistical, security and product-improvement purposes.

No re-identification. We do not attempt to re-identify data that has been anonymised, and we require our service providers not to do so, except to verify that the anonymisation process is working as intended or where we are required to re-identify data by law.

On-chain and legally-retained data. Anonymisation applies to off-chain account data only. Information recorded on the public Solana blockchain — wallet addresses, escrow interactions, transaction signatures and amounts — is permanent and public by design and cannot be anonymised, altered or deleted by us or anyone else (see the "On-chain data" note in Section 5 and the "Escrow transaction records" row above). Data we must keep for anti-money-laundering, tax, audit or the establishment, exercise or defence of legal claims is likewise retained in identifiable form for the periods set out above rather than anonymised.

8. Security

We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration or unauthorised access. These include TLS encryption in transit, encryption of sensitive credentials at rest (AES-256/Fernet), role-based access control, audit logging, multi-factor authentication for our staff, vendor due diligence, and a documented incident response plan.

Device security telemetry. To protect your account and the platform from fraud, account takeover and abuse, we automatically collect a technical fingerprint of the devices you use to access the Service — including browser, operating system, device type, hardware characteristics (such as screen, CPU cores and GPU), language and timezone, and derived canvas, audio and WebGL rendering signatures — together with the IP address and the approximate location derived from it. We store this fingerprint only as a salted, one-way hash used to detect and block devices associated with fraud or serious violations of our Terms; the raw fingerprint is not retained. Our lawful basis is our legitimate interest in the security of the Service and the prevention of fraud and abuse (GDPR Art. 6(1)(f)). This security telemetry is always on and is not governed by the analytics cookie setting. You can review the devices linked to your account in your account settings.

No system is perfectly secure. You are responsible for keeping your account credentials and any self-custodial wallet keys safe. If you suspect your account or wallet has been compromised, contact us immediately at [email protected].

9. Breach Notification

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and we will inform affected Users without undue delay where the breach is likely to result in a high risk to those Users.

10. Your Rights

Subject to local law, you have the right to:

• access the personal data we hold about you and obtain a copy;
• have inaccurate or incomplete data corrected;
• have your data deleted, subject to retention required for AML, tax, audit, on-chain immutability and the establishment, exercise or defence of legal claims;
• receive your data in a portable, machine-readable format and request transmission to another controller where technically feasible;
• restrict or object to processing, including processing based on legitimate interest and direct marketing;
• withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you (we do not currently engage in such automated decision-making);
• lodge a complaint with a supervisory authority (see Section 13).

To exercise any of these rights, contact our DPO at [email protected]. We will respond within one month and without undue delay; the period may be extended by two further months where the request is complex or numerous.

Free of charge. Exercising these rights is free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may either charge a reasonable fee reflecting the administrative cost of responding, or refuse to act on the request. If we do, we will tell you why, and you can complain to a supervisory authority (see Section 13) or seek a judicial remedy.

Confirming your identity. Where we have reasonable doubts about the identity of the person making a request, we may ask for additional information to confirm it before we disclose, correct or delete any data. This protects you: a request can unlock KYC records, biometric data and wallet information, and we will not release or erase that data for anyone who cannot show that the account is theirs.

Deleting your account yourself. You can delete your account at any time from your account settings, without contacting us. Deletion is subject to the retention and on- chain-immutability limits described in the list above and in Section 7; see our Terms of Service for details.

11. Children

The Service is intended for users 18 years and older, or 16 and older with verifiable parental consent where local law permits. We do not knowingly collect personal data from younger children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Cookies and Similar Technologies

See our Cookie Policy for full details. You can manage cookie preferences at any time through the cookie banner or your browser settings.

13. Region-Specific Information

13.1 European Economic Area, United Kingdom and Switzerland

The lead supervisory authority for cross-border processing is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) aki.ee. You may also lodge a complaint with the supervisory authority of your habitual residence or place of alleged infringement. UK users may complain to the Information Commissioner's Office (ICO) ico.org.uk.

13.2 Ukraine

Processing complies with the Law of Ukraine "On Personal Data Protection". Complaints may be made to the Ukrainian Parliament Commissioner for Human Rights (Verkhovna Rada Commissioner) at ombudsman.gov.ua.

13.3 Brazil

Processing complies with the Lei Geral de Proteção de Dados (Law No. 13.709/2018). The national authority is the Autoridade Nacional de Proteção de Dados (ANPD) gov.br/anpd. Brazilian Users have the rights of confirmation, access, correction, anonymisation, blocking, deletion, portability, information about sharing, withdrawal of consent and review of automated decisions, in addition to the rights set out in Section 10.

13.4 India

Processing complies with the Digital Personal Data Protection Act 2023. Indian Data Principals have rights to access, correction, completion, updating, erasure of personal data, and grievance redressal. Grievances should first be raised with our DPO at [email protected]; you may then escalate to the Data Protection Board of India established under the DPDP Act.

13.5 United States

This sub-section applies to residents of United States states that have comprehensive privacy laws (such as California under the CCPA/CPRA), and only where and to the extent those laws apply to Worqen. Where they apply, you have the right to know what personal data we collect and how we use and disclose it, to request a copy, to have inaccurate data corrected, and to request deletion — subject to the same anti-money-laundering, tax, audit, on-chain immutability and legal-claim exceptions described in Section 10.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising, as those terms are defined under United States state privacy law. We do not use advertising cookies, Google Analytics and Microsoft Clarity run only with your consent, our own measurement of which channels bring new users is used only by Worqen and is never sent to advertising platforms (see our Cookie Policy), and we have not sold or shared personal data in the preceding twelve months.

Sensitive personal information. The government-issued identifiers and facial biometrics collected during identity verification (see Section 3) are used only to confirm your identity and to meet our anti-money-laundering and counter-terrorist-financing obligations. We do not use this data to infer characteristics about you, and we do not sell or share it. You may ask us to limit its use to these purposes at any time.

We will not discriminate against you for exercising any of these rights. To make a request, contact our DPO at [email protected]; we will verify your request against the information we hold and respond within the time limits set by applicable law, and you may use an authorised agent where the law permits. Because we honour the Global Privacy Control (GPC) browser signal where applicable (see our Cookie Policy), enabling GPC communicates your opt-out preference to us automatically.

13.6 UK and Brazil Representatives

Worqen is established in the European Economic Area, so under the EU GDPR we are not required to appoint an Article 27 representative in the EEA. Because we offer the Service to data subjects in the United Kingdom without being established there, Article 27 of the UK GDPR requires us to designate a UK representative. We are completing that appointment and will publish the representative's name and contact details here once it is in place. Until then, UK Users and the Information Commissioner's Office (ICO) may raise UK data-protection matters with our Data Protection Officer at [email protected]. The UK representative is a separate role from, and does not replace, our Data Protection Officer, and appointing one does not affect your right to complain to the ICO (see Section 13.1).

For Brazil, our Data Protection Officer (encarregado) at [email protected] acts as the point of contact for Brazilian Users and the Autoridade Nacional de Proteção de Dados (ANPD). Where the LGPD or ANPD guidance requires us to appoint a representative established in Brazil, we will designate one and update this Policy with their details.

14. Changes to this Policy

We may update this Policy from time to time. If changes are material, we will provide notice in the Service and, where appropriate, by email at least 14 days before the changes take effect.

15. How to Contact Us

Worqen OÜ — Tallinn, Estonia
Data Protection Officer: [email protected]
General privacy enquiries: [email protected]
Postal address: Juhkentali tn 8, Kesklinna linnaosa, 10132 Tallinn, Harju maakond, Estonia