Your Privacy, Protected with Care

Definitions.
General principles.
Organisation of the Personal Data protection system.
Profiling and automated decision-making, including profiling.
Personal Data security.
Personal Data breach.
Exercising the rights of Data Subjects.
Contact with the Data Subject.
Disclosure and entrustment of Personal Data.
Transfer of Personal Data to a third country.
Ensuring continuous compliance.
Final provisions.

I. Definitions

Controller — Daniel’s Green Technology , plac Lotników 3B/1, 70-414 Szczecin, Poland, Tax Identification Number NIP 8512550162, with whom the User may contact by e-mail at: support@tradevetted.co.uk or by telephone at: +44 073459 17358.

Personal Data — information relating to an identified or identifiable natural person, identifiable by one or more specific factors determining their identity, including image, contact details, location data and information contained in correspondence.

Supervisory Authority — the President of the Personal Data Protection Office or, where applicable, the competent supervisory authority for Personal Data designated by another Member State of the European Union.

Data Subject — a natural person whose Personal Data is processed by the Controller.

Policy — this Personal Data Protection Policy.

Employee — a natural person employed by the Controller under an employment contract.

GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC, the General Data Protection Regulation.

Co-worker — a natural person providing services to the Controller under a civil law agreement, for example a mandate contract or a contract for specific work.

II. General Principles

This Policy constitutes the basic document regulating the rules for processing Personal Data by the Controller.

The implementation of this Policy is intended to ensure that the Controller’s Personal Data processing operations comply with the GDPR, regardless of the form, electronic or paper, in which such processing takes place.

In connection with the conducted activity, the Controller collects and processes Personal Data in accordance with the applicable provisions of law, including in particular the GDPR, and the processing principles set out therein, namely:

a) the Controller ensures that the processing of Personal Data is lawful and is based on one of the processing grounds specified in the GDPR, i.e. Article 6(1), Article 9(2) or Article 10;

b) the Controller ensures fairness and transparency of Personal Data processing, in particular by informing about the processing of Personal Data at the time of its collection, including the purpose and legal basis of processing;

c) the Controller ensures that Personal Data is collected for specific, explicit and legally justified purposes and is not further processed in a manner incompatible with those purposes;

d) the Controller processes Personal Data only to the extent necessary to achieve the purpose for which the Personal Data was collected;

e) the Controller ensures that the Personal Data processed by the Controller is updated where necessary and that all reasonable steps are taken to ensure that Personal Data which is inaccurate in relation to the purposes of processing is promptly deleted or rectified;

f) the Controller ensures that Personal Data is processed only for the period necessary to achieve the purposes of processing;

g) the Controller ensures the security of Personal Data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by implementing appropriate technical or organisational measures.

Through appropriate technical and organisational measures, the Controller ensures the ability to demonstrate compliance of Personal Data processing with the GDPR and other regulations concerning the protection of Personal Data.

The Controller ensures compliance with the Privacy Policy by all Employees and Co-workers of the Controller.

III. Organisation of the Personal Data Protection System

Before granting access to the processing of Personal Data, the Controller familiarises each Employee, Co-worker or other person processing Personal Data under the Controller’s authorisation with this Policy, including the procedures and rules concerning the protection of Personal Data applicable in the Controller’s organisation.

Processing of Personal Data by Employees and Co-workers may take place only on the basis of authorisation granted by the Controller.

The Controller obliges authorised persons to maintain the confidentiality of Personal Data and information concerning the security of Personal Data, as well as to comply with this Policy, including the procedures and rules concerning the processing of Personal Data applicable at the Controller.

Employees and Co-workers processing Personal Data are obliged in particular to:

a) process Personal Data in accordance with the authorisation granted and with due care;

b) immediately inform their direct superior if they observe an event that may constitute a Personal Data breach;

c) participate in organised training sessions concerning the protection of Personal Data;

d) maintain the confidentiality of Personal Data and information concerning the manner in which it is secured.

IV. Profiling and Automated Decision-Making, Including Profiling

In order to provide services, the Controller uses automated data processing technology, including profiling, which may lead to automated decisions significantly affecting the situation of Users using the TradeVetted Service.

Automated decision-making, including profiling, is necessary for the proper performance of the agreement for the provision of electronic services.

The expected effects of the automated decision-making system, as anticipated by the Controller, include providing Clients with Business Profiles of Contractors that are best matched to the Clients’ needs and increasing Users’ chances of finding a Contractor who will perform the Service according to the Client’s requirements.

The search engine available in the TradeVetted Service operates by displaying listings sorted on the basis of region, type of services provided and the professional’s reviews.

Within the algorithm responsible for displaying the list of Business Profiles, the position of the Contractor’s Business Profile in search results depends on:

a) in the case of Contractors who already have a Review or Reviews, the final position on the search results list is influenced 60% by Reviews and 40% by randomness. For example, for a Contractor who has 20 Reviews in the Service and a Score of 6/10, the ranking result will be determined on the basis of the search algorithm;

b) in the case of Contractors who do not have Reviews — 100% by the operation of the randomisation system.

Since the operation of the automated decision-making system may lead to limiting Clients’ ability to view the content of Business Profiles, the Controller has implemented appropriate measures to protect the interests of Users. These measures include, among others:

a) regular audits and reviews of the operation of algorithms responsible for automated decision-making, including User profiling;

b) taking into account, within the operation of the algorithm, the principle of randomness so that Contractors with fewer reviews or without reviews have a chance to be noticed by the Client.

In connection with the provision of the service of displaying Contractors on the list of Business Profiles under the rules provided for in the Terms and Conditions, Contractors are profiled based, among other things, on the category of services provided and/or the location in which a given Contractor operates, the average rating, received reviews and the number of reviews.

This profiling is necessary for the proper performance of the service; however, it will not lead to automated decision-making that may produce legal effects concerning Users or similarly significantly affect Users — Clients still have the option to choose a Contractor according to their own criteria.

V. Personal Data Security

The Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk of infringement of the rights or freedoms of natural persons whose Personal Data is processed.

When assessing whether the level of security is appropriate, the Controller takes into account, in particular, the risks associated with processing, especially those resulting from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or unauthorised access to Personal Data transmitted, stored or otherwise processed.

In order to ensure the confidentiality of Personal Data, the Controller provides access to the Data only to authorised persons and only to the extent necessary due to the tasks performed by them. This does not apply to the publication in the Service of Personal Data for which the Data Subject has given consent to publication.

The Controller continuously analyses the risk associated with the processing of Personal Data and monitors the adequacy of the Personal Data safeguards used in relation to identified threats. If necessary, the Controller implements additional measures to increase the security of Personal Data.

VI. Personal Data Breach

The Controller ensures that Personal Data breaches are reported to the Supervisory Authority, unless the breach is unlikely to result in a risk to the rights or freedoms of natural persons.

The Controller obliges all persons processing Personal Data to immediately inform the Controller of any observed Personal Data breach.

The Controller notifies Data Subjects of a Personal Data breach without undue delay if the breach may result in a risk to their rights and freedoms.

In each case, the Controller examines the breach and implements appropriate organisational and technical remedial measures.

The Controller documents all Personal Data breaches, including the circumstances of the breach, its effects and the remedial actions taken.

VII. Exercising the Rights of Data Subjects

If you are a Data Subject whose Personal Data is processed by the Controller, you have the right to:

Information about the processing of Personal Data — the Controller provides the person submitting the request with information about the processing of Personal Data, including in particular the purposes and legal bases of processing, the scope of Personal Data held, the entities to whom the data is disclosed and the planned date of deletion of Personal Data.

Obtain a copy of the data — the Controller provides the person submitting the request with copies of Personal Data concerning them.

Rectification of data — at the request of the Data Subject, the Controller removes any inconsistencies or errors in the processed Personal Data and completes the data if it is incomplete.

Deletion of data — at the request of the Data Subject, the Controller deletes or anonymises Personal Data whose processing is no longer necessary for any of the purposes for which it was collected.

Restriction of processing — at the request of the Data Subject, the Controller stops carrying out operations on Personal Data, except for operations to which the Data Subject has consented, and stops storing it in accordance with the adopted retention rules or until the reasons for restricting the processing of Personal Data cease to exist, for example until a decision of the Supervisory Authority permitting further processing is issued.

Data portability — to the extent that Personal Data is processed by automated means in connection with a concluded agreement or consent given, the Controller, at the request of the Data Subject, provides the Personal Data supplied by that person in a format allowing the Personal Data to be read by a computer.

Objection to the processing of Personal Data — the Data Subject may object to the processing of data at any time, without the need to justify such objection. In such a situation, the Controller may process Personal Data only to ensure the performance of the Controller’s obligations arising from provisions of law or for the establishment, exercise or defence of claims.

Withdrawal of consent — if Personal Data is processed on the basis of consent, the Data Subject has the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

VIII. Contact with the Data Subject

The Controller provides Data Subjects with information in writing or by other means, including electronically.

The Controller ensures that communication with the Data Subject is carried out in a concise, transparent and easily accessible form, using clear and plain language.

The Controller facilitates the exercise by Data Subjects of the rights granted to them under applicable provisions concerning the protection of Personal Data, in particular the GDPR.

The Controller promptly provides Data Subjects with information about actions taken in connection with a request for access to data, rectification, deletion, restriction of processing, portability or objection to processing.

IX. Disclosure and Entrustment of Personal Data

The Controller discloses Personal Data to another controller only if one of the conditions referred to in Article 6(1) or Article 9(2) of the GDPR is met.

Entrustment of Personal Data processing by the Controller takes place on the basis of a data processing agreement or another legal instrument referred to in Article 28 of the GDPR.

Entrustment of Personal Data processing by the Controller takes place after verification that the processor provides sufficient guarantees for the implementation of appropriate technical and organisational measures so that the processing meets the requirements of the GDPR and protects the rights of Data Subjects.

The Controller also takes all necessary actions to ensure that subcontractors and other cooperating entities provide guarantees of applying appropriate security measures in every case where they process Personal Data on behalf of the Controller.

X. Transfer of Personal Data to a Third Country

The Controller of Personal Data will not transfer Data to countries outside the European Economic Area, EEA.

XI. Ensuring Continuous Compliance

The Controller ensures the continuous compliance of the organisation’s operations with the Personal Data protection requirements provided for in the GDPR, including verifying and optimising the implemented registers and procedures.

The Controller monitors changes in legal regulations, guidelines of national and international Personal Data protection authorities, as well as case law of courts and tribunals, and also takes into account market best practices.

XII. Final Provisions

This Policy enters into force on 09/06/2025.