Privacy Policy
Version 1.0 · August 2026
1. Data controller
To be completed with the name and registered address of the operator. No data protection officer has been appointed, as none of the circumstances requiring one on a mandatory basis apply.
Contact: privacidad@handnitas.com
2. What data we process
All users: name and surname; email address; password, stored encrypted and inaccessible to us; phone number and profile photograph, if provided; language; address and approximate location, if provided; and the date, IP address and device from which the legal documents were accepted.
Clients: posted requests, photographs of the job, exact address if provided — visible only to the awarded professional — messages and reviews.
Professionals: trading name, activity and experience; categories and areas; declaration of regulatory compliance; quotes submitted; verification documentation voluntarily provided; messages, reviews and job history.
Technical data: device identifier for notifications, and access and error logs.
We do not process payment data, as the platform does not process payments.
3. Why we use the data
| Purpose | Legal basis |
|---|---|
| Creating and managing the account | Performance of the contract |
| Posting requests and quotes and connecting the parties | Performance of the contract |
| Messaging between the parties | Performance of the contract |
| Verifying documentation provided | Consent |
| Publishing reviews | Contract and legitimate interest |
| Notifications about account activity | Performance of the contract |
| Preventing fraud and misuse | Legitimate interest |
| Recording acceptance of legal documents | Legal obligation and evidential interest |
4. Who can see each piece of data
- Public profile: shortened name, photograph if any and average rating. For professionals, also trading name, categories, areas and verification badge.
- Requests: visible to professionals in that category and area, showing only the approximate area. The exact address is disclosed only to the awarded professional.
- Quotes: each professional sees only their own, never those of others.
- Messages: accessible only to the two parties to the conversation.
- Verification documentation: accessible only by the professional concerned and by the staff responsible for review. Never shown to other users.
- Questions and answers: public to all professionals who can see that request.
5. Who we share data with
We do not sell personal data or disclose it for advertising purposes.
Providers acting on our behalf: Supabase (database, authentication and files), Expo (app distribution and notifications), Nominatim / OpenStreetMap (converting addresses into coordinates) and an email provider for automated messages.
Location of the data: the database, authentication and files are hosted on servers located in Ireland (European Union).
International transfers: the notification and app distribution service is operated by an entity established in the United States, which involves an international transfer limited to the device identifier and the content of notifications.
6. How long we keep data
| Data | Retention period |
|---|---|
| Account and profile | While the account is active |
| Requests and quotes not awarded | 12 months from expiry |
| Agreements and published reviews | 6 years from completion |
| Messages | 3 years from completion |
| Verification documentation | Validity of the badge + 2 years |
| Acceptance of legal documents | 6 years from closure |
| Technical logs | 12 months |
After closure, data associated with agreements involving third parties is kept pseudonymised, replacing the full name with a non-identifying reference.
7. Your rights
You may access your data, rectify or erase it, restrict or object to its processing, obtain it in portable form and withdraw any consent given. Write to privacidad@handnitas.com or delete your account from the app.
If you believe your data is not being handled properly, you may complain to the competent supervisory authority. In Gibraltar this is the Gibraltar Regulatory Authority (GRA), acting as Information Commissioner under the Data Protection Act 2004 and the Gibraltar GDPR. Users established in Spain may also contact the authority of their place of residence.
Reviews already published and data needed to evidence agreements between the parties may be kept in dissociated form, as they affect third-party rights.
8. Security
Data is stored on servers with restricted access. The app applies database-level security rules that limit each user's access strictly to the information that concerns them. Photographs and documentation are held in private storage, accessible only through temporary links.
In the event of a security breach posing a risk to your rights, the supervisory authority will be notified within 72 hours and affected users without undue delay where the risk is high.
9. Minors
The platform is not directed at persons under 18. If we detect an account belonging to a minor, we will delete it.
10. Cookies
The mobile app does not use advertising cookies. This website uses only technical local storage to remember acceptance of the cookie notice.
11. Changes to this policy
Any material change will be communicated through the app reasonably in advance.