Privacy Policy

1. Data controller

The controller is:

SixApp has not appointed a data protection officer as of the Effective Date. If that changes, current contact details will be published in this Policy.

2. Personal data we process

Depending on how you use the Platform, SixApp may process the following data.

2.1. Account identity and contact data

• legal name, profile name, email address and telephone number;
• date of birth or confirmation that you are at least 18;
• country of residence, primary address and preferred language;
• profile photograph, User ID, credentials, authentication method and session information; and
• Account status, settings, accepted Terms version and consent or acknowledgement records.

2.2. Business and status data

• Consumer or Business Customer capacity;
• Trader or Non-Trader declaration;
• company name, registration number, registered address, authorised representative and authority;
• VAT number, licences, qualifications or insurance information where relevant; and
• verification outcome and date.

2.3. Tasks, Offers and transaction data

• Task Description, category, location, deadline and status;
• Offers, Performer Amount, Platform Fee, Customer Total and approved expenses;
• selected Performer, formation and completion timestamps;
• cancellation, refund, payout, chargeback and Dispute status; and
• reviews and ratings.

2.4. Communications, support and moderation data

• in-app messages and attachments;
• communications with support;
• complaints, DSA notices, appeals and responses;
• moderation decisions, reasons and enforcement history; and
• reports about safety, fraud or prohibited conduct.

2.5. Location, camera and evidence data

• Task address and map coordinates provided by a User;
• device location while the relevant feature is actively used and permission is enabled;
• check-in or task-stage location where required;
• photographs and short videos captured through the camera-only evidence flow;
• receipts, checklists, handover confirmation and metadata such as capture time; and
• evidence submitted for a cancellation, safety report, Dispute or appeal.

SixApp does not intend to collect continuous off-task location. Users should not capture faces, identity documents, children, private communications, health information or sensitive areas unless genuinely necessary and lawful for the Task or a legal claim.

2.6. Payment and payout data

• payment-provider customer and connected-account identifiers;
• payment method type and limited card information such as brand and last digits, where supplied by the provider;
• transaction, authorisation, capture, refund, payout and chargeback identifiers and status;
• amounts, currency and financial-account information required for payout or reporting; and
• fraud, sanctions and payment-verification results.

Full card details are normally collected directly by the payment provider and are not stored by SixApp.

2.7. Identity, tax and DAC7 data

• identity document and verification result where required;
• selfie, facial image or liveness result where an enabled identity provider requires it, subject to the provider's notice and an applicable legal basis;
• legal name, primary address, date and place of birth where required;
• tax identification number, issuing state and tax residence;
• business, entity and VAT registration data;
• financial-account identifier and account-holder information; and
• quarterly consideration, Task count, fees, commissions and taxes required for reporting.

2.8. Device usage and security data

• IP address, device and operating-system information, app version and language;
• login, authentication, session and security logs;
• crash, performance, diagnostic and feature-interaction data;
• push-notification tokens and communication-delivery status; and
• fraud, abuse and integrity signals, including links reasonably indicating duplicate Accounts.

2.9. Promotions and marketing data

• referral code and attribution;
• qualifying milestone, bonus balance, reward, reversal and fraud-review information;
• marketing preferences and consent records; and
• engagement with promotional messages.

2.10. Special-category and criminal-offence data

SixApp does not request special-category data for ordinary use. Such data, or information relating to alleged offences, may appear incidentally in User Content, safety reports or evidence. SixApp processes it only where necessary and supported by an applicable GDPR condition and safeguards, including legal claims, vital interests or substantial public-interest law. Do not upload unnecessary sensitive data.

3. Sources of personal data

SixApp obtains personal data:

• directly from you when you register, post or accept a Task, submit an Offer, pay, communicate, upload evidence, request support, use a Promotion or exercise a right;
• from another User, for example where the User includes you in Task information, a message, evidence, review or complaint;
• automatically from your device and use of the Platform;
• from payment, identity, authentication, communication and fraud-prevention providers, including Stripe, Apple, Google or Firebase, Twilio and Ably where those services are enabled;
• from competent authorities, sanctions lists, business or VAT registers and other lawful public sources where verification is required; and
• from a referrer where you use a referral code.

Where Article 14 GDPR applies because data was obtained indirectly, this Policy provides the relevant categories and sources. SixApp will provide additional individual notice within the required period where this Policy is not sufficient or an exception does not apply.

4. Purposes and legal bases

SixApp processes personal data only where it has a lawful basis. More than one basis may apply to different elements of the same workflow.

4.1. Platform and contract performance

SixApp processes Account, Task, Offer, communication, payment-status and support data to create and administer Accounts, match Users, form and record platform contracts, facilitate Task Agreements, operate Checkout, process instructions through the payment provider, provide support, administer completion and provide agreed Promotions. The basis is Article 6(1)(b) GDPR where processing is necessary for the User's contract with SixApp.

4.2. Legal obligations

SixApp processes identity, transaction, accounting, consumer-complaint, DSA, authority-request, tax and DAC7 data where necessary to comply with EU or Latvian law. The basis is Article 6(1)(c) GDPR. Where sensitive data is involved, SixApp also identifies the applicable Article 9 or Article 10 condition.

4.3. Legitimate interests

SixApp processes proportionate data to prevent fraud and duplicate Accounts, secure the Platform, investigate safety incidents and Disputes, enforce these Terms, moderate illegal or prohibited content, improve reliability and features, establish or defend legal claims and maintain business records. The basis is Article 6(1)(f) GDPR after balancing these interests against the affected person's rights. You may request information about the relevant balancing assessment and may object as described in Section 15.

4.4. Consent

SixApp relies on Article 6(1)(a) GDPR where consent is appropriate, for example optional marketing, non-essential analytics or device permissions where consent is legally required. Device permission alone is not treated as GDPR consent where a separate consent is required. Consent may be withdrawn at any time without affecting earlier lawful processing.

4.5. Vital interests and legal claims

In an emergency, SixApp may process limited data to protect a person's vital interests under Article 6(1)(d) and, where applicable, Article 9(2)(c) GDPR. Evidence may be processed where necessary for legal claims under Article 9(2)(f) GDPR.

4.6. Platform improvement and analytics

SixApp may use aggregated or appropriately minimised device, performance and usage data to diagnose faults, measure reliability and improve features. Strictly necessary processing relies on contract or legitimate interests. Optional analytics rely on consent where required.

4.7. Direct marketing

SixApp sends electronic direct marketing only with consent or another permission available under applicable electronic-communications law. Each marketing message provides a simple opt-out. Service, security, payment and legal notices are not marketing and may still be sent where necessary.

5. Required and optional data

Name, contact, age eligibility, credentials and acceptance records are required to create and secure an Account. Without them, SixApp cannot provide an Account.

Task, Offer, status and payment data are required to enter into and administer the relevant transaction. Without them, the Task cannot be posted, accepted or paid through the Platform.

Identity, connected payout-account and tax information may be contractually or legally required for payouts, Trader verification or DAC7. Failure to provide it may result in reminders, withholding of payouts, feature restriction, Account closure or inability to re-register, to the extent permitted or required by law.

Camera, photograph, video or location data are required only for Tasks or features that expressly require them. You may deny device permission, but the relevant feature or Task evidence function may then be unavailable. SixApp does not require unrelated sensitive content.

Profile photographs, optional profile details, marketing and non-essential analytics are voluntary. Refusal does not prevent use of unrelated core functions.

6. Information displayed to other Users

The Platform is designed to facilitate interaction between Customers and Performers. Depending on the relevant Platform functionality, certain information may be visible to other Users, including: name or profile name; profile photograph, where provided; relevant profile information; Trader or Non-Trader status; Task information; Offer information; ratings and reviews; and information necessary to facilitate a particular Task.

Before a Task Agreement is formed, Checkout displays the Performer's declared Trader or Non-Trader status, legally required Trader details, the warning applicable to a Non-Trader and the allocation of obligations between the Performer and SixApp.

Users should not include unnecessary personal or confidential information in publicly or User-visible Task descriptions, Offers, reviews or other User Content.

7. User Content and third-party personal data

Users may upload photographs, videos, documents, receipts or other User Content containing another person's data. The uploading User must have a lawful reason and must minimise the content. SixApp may process it only as reasonably necessary to operate the Task, assess completion, investigate a Dispute or safety report, prevent fraud, comply with law or establish legal claims. Users must not upload another person's identity document, face, private communication, home interior or sensitive data when a less intrusive form of evidence is sufficient.

SixApp does not permit Users to use the Platform to unlawfully disclose another person's personal data.

8. Recipients and service providers

SixApp discloses only data reasonably necessary for the relevant purpose.

8.1. Other Users

Customers and Performers receive the profile, status, Task, Offer, communication and transaction information necessary to evaluate and perform a Task. Precise addresses should be revealed only when necessary for the selected Task.

Once another User receives personal data for the User's own Task, legal, tax or safety purposes, that User may act as an independent controller for that processing and is responsible for using the data lawfully, securely and only as necessary. SixApp remains responsible for its own disclosure and processing.

8.2. Stripe and payment providers

Stripe processes card, identity, connected-account, fraud, refund, payout and chargeback data where enabled. Stripe may act as an independent controller for its regulatory and service purposes and as a processor for limited Platform instructions, as described in its privacy documentation and the applicable agreement.

8.3. Identity and compliance providers

Verification providers may receive identity, document, business, tax, sanctions and fraud-prevention information. SixApp does not receive full identity-document data where the provider can return only the necessary verification result.

8.4. Technology providers

SixApp may use hosting and cloud infrastructure, Apple and Google or Firebase for sign-in, push notifications or app services, Twilio for communications, Ably for real-time messaging, and providers of email, analytics, crash reporting, cybersecurity and customer support, where enabled. These providers process data under applicable contracts and access controls. The actual vendor inventory is reviewed and this Policy will be updated if a material recipient changes.

8.5. Authorities and advisers

SixApp may disclose data to the State Revenue Service, Data State Inspectorate, PTAC, police, courts, payment regulators or another competent authority where legally required or necessary for a lawful claim. Lawyers, accountants, auditors and insurers may receive data subject to professional or contractual confidentiality.

8.6. Corporate transactions

Data may be disclosed in a merger, financing, acquisition, restructuring or sale of the Platform subject to confidentiality, due diligence, notice and data-protection requirements. User data will not be sold as an independent advertising asset.

9. DAC7 and tax reporting

To the extent SixApp is a reporting platform operator, it collects, verifies and reports information about reportable Performers and personal services under DAC7 and Latvian implementing rules. Reporting may apply even where the Performer completes fewer than 30 Tasks or receives no more than EUR 2,000, because that exclusion is limited to qualifying sales of goods.

Data may include legal name, address, date and place of birth where required, tax identification number and issuing state, tax residence, business and VAT registration details, financial-account identifier and account holder, quarterly consideration and transaction count, and fees, commissions or taxes withheld or charged.

SixApp verifies required information using documents, lawful registers, EU or national electronic interfaces and qualified providers. A third party may perform checks, but SixApp remains responsible for platform-operator due diligence.

Required information is reported to the Latvian State Revenue Service or another competent authority and provided to the relevant Performer within the statutory timetable. DAC7 reporting does not itself determine the Performer's employment, Trader or tax-registration status and does not create a new tax.

Where a Performer does not provide required information, SixApp may send reminders and, after the legally prescribed period, restrict the Account, prevent re-registration or withhold payout until compliance.

10. International data transfers

Some providers may process data outside Latvia or the European Economic Area. The destination depends on the selected provider, its infrastructure and the User's location.

Where the destination does not benefit from an applicable adequacy decision, SixApp uses an authorised transfer mechanism, normally the European Commission's Standard Contractual Clauses, and carries out any required transfer-risk assessment and supplementary safeguards. SixApp also applies data minimisation, access control and encryption where appropriate.

You may request information about relevant destinations and a copy or summary of the applicable safeguard at info@sixapp.eu. Confidential or security-sensitive terms may be redacted as permitted by law.

11. Data retention

SixApp applies the following retention schedule, subject to a legal hold, an unresolved transaction or Dispute, fraud prevention, a binding authority request or a longer mandatory period. When a period expires, data is deleted, anonymised or access-restricted.

11.1. Account and profile data

Account and public profile data are retained while the Account is active. Following a valid closure request, the public profile is deleted or anonymised within 30 days, except for information that must be retained under another category below.

11.2. Messages

In-app messages and ordinary attachments are retained for two years after the relevant Task is completed or cancelled, or two years after the message where it is not linked to a Task. A message forming part of a Dispute, safety investigation or legal claim follows the longer applicable period.

11.3. Task and completion records

Task Descriptions, Offers, acceptance and ordinary completion records are retained for two years after completion or cancellation unless needed for accounting, fraud, a Dispute or a legal claim. Raw Completion Evidence that is not disputed may be deleted or de-identified earlier once payment and a reasonable fraud-review period have ended.

11.4. Dispute and appeal evidence

Evidence and decision records material to a Dispute, appeal, safety incident or legal claim may be retained for up to 10 years after final resolution, reflecting applicable limitation and defence periods. Access is restricted and unnecessary duplicate or irrelevant sensitive material is removed earlier where practicable.

11.5. Payment, accounting and tax records

Transaction, invoice, refund, payout and accounting records are retained for the period required by Latvian accounting and tax law. Full card data remains with the payment provider.

11.6. DAC7 records

Records of DAC7 due diligence and reporting are retained for the period selected under applicable law, not less than five and not more than 10 years after the end of the relevant reporting period.

11.7. Verification, security and support

Verification results are retained while required for payment, tax, safety or legal compliance. Routine security logs are normally retained for up to 12 months; records connected to an incident may be retained for up to two years or the legal-claim period. Support records are normally retained for two years after closure of the request.

11.8. Promotions, marketing and suppression records

Promotion and referral transaction records are retained for the applicable accounting, fraud and legal-claim period. Marketing data is retained until consent is withdrawn or the purpose ends. A minimal suppression record may be kept to honour an opt-out.

11.9. Reviews and deleted Accounts

Reviews may remain visible for marketplace integrity after Account closure, but the public author is changed to “Deleted user” within 30 days. Any internal link to the former Account is retained only where necessary for moderation, fraud, disputes or legal claims.

11.10. Backups

Deleted data may remain in access-restricted backups until overwritten under the backup cycle, normally no longer than 90 days, unless a legal hold applies. It is not restored to active use except for disaster recovery or legal necessity.

12. Data security

SixApp takes appropriate technical and organisational measures designed to protect personal data against: unauthorised access; accidental loss; destruction; alteration; unauthorised disclosure; misuse; and other unlawful or unauthorised processing.

Security measures may include access controls, authentication mechanisms, encryption or secure transmission where appropriate, logging, monitoring and other technical and organisational safeguards.

However, no internet-based service can be guaranteed to be completely secure. Users are responsible for maintaining the security of their Account credentials and must notify SixApp without undue delay if they suspect unauthorised access to their Account.

13. Automation, ranking and human review

SixApp may use rules and automated signals to rank Tasks or Offers, detect suspected fraud, protect Accounts, prioritise reports, identify duplicate Accounts and support moderation. Principal ranking factors include relevance, location, availability, timing, price, ratings, completion history, recency and safety or fraud signals.

As of the Effective Date, SixApp does not intend to make a decision based solely on automated processing that produces legal or similarly significant effects within Article 22 GDPR. A final Dispute appeal, permanent Account termination or comparable material decision receives meaningful human review.

You may request human review, express your point of view and contest a material automated or automation-supported decision by contacting support or info@sixapp.eu.

SixApp does not use automated systems to infer a Performer's emotional or psychological state, analyse private messages for performance evaluation or collect a Performer's location while the person is not offering or performing a Task. Messages may be accessed by authorised personnel where necessary for support, a User report, a Dispute, safety, fraud or legal compliance.

14. Cookies, device storage and SDKs

The Platform may use authentication tokens, local device storage, push-notification identifiers, security technologies and software development kits necessary to sign in, maintain sessions, communicate, prevent fraud and operate the service.

The website or application may also use analytics, crash-reporting or similar technologies. SixApp will classify each technology and obtain consent before using a non-essential technology where consent is legally required. Rejecting an optional technology will not prevent unrelated core use.

If browser cookies or other technologies requiring a dedicated consent interface are enabled, SixApp will provide an up-to-date cookie notice identifying purposes, providers, duration and choices. This Policy does not claim that the technical implementation is cookie-free.

15. Your rights under the GDPR

Subject to applicable legal conditions and limitations, you may have the following rights:

15.1. Right of access

You may request confirmation as to whether SixApp processes your personal data and request access to such data and relevant information concerning its processing.

15.2. Right to rectification

You may request correction of inaccurate or incomplete personal data.

15.3. Right to erasure

You may request deletion of personal data where the applicable legal conditions are satisfied. However, this right is not absolute. SixApp may be required or entitled to retain certain information for legal, tax, accounting, security, dispute-resolution or other lawful purposes.

15.4. Right to restriction of processing

You may request restriction of processing in circumstances provided by the GDPR.

15.5. Right to data portability

Where applicable, you may request to receive personal data that you have provided to SixApp in a structured, commonly used and machine-readable format and, where legally applicable, request its transmission to another controller.

15.6. Right to object

You may object to certain processing based on SixApp's legitimate interests. You may also object to direct marketing at any time.

15.7. Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing carried out before withdrawal.

15.8. Rights relating to automated decision-making

Where applicable, you may have rights relating to decisions based solely on automated processing as provided by the GDPR.

16. How to exercise your rights

You may exercise your data protection rights by contacting: info@sixapp.eu.

Please provide sufficient information to allow SixApp to identify you and understand your request. Please note that SixApp may request additional information where reasonably necessary to verify the identity of the person making the request and to protect personal data against unauthorised disclosure.

SixApp will respond to a valid request without undue delay and, in any event, within one month of receiving the request. Where permitted by applicable data protection law, this period may be extended by up to two further months, taking into account the complexity and number of requests. SixApp will inform you of any such extension within one month of receiving the request.

17. Right to lodge a complaint

Please contact SixApp first if you believe personal data has been processed incorrectly. This does not limit your right to complain directly to a supervisory authority.

The Latvian supervisory authority is the Data State Inspectorate, Elijas iela 17, Rīga, LV-1050, Latvia, telephone +371 67223131, email pasts@dvi.gov.lv, dvi.gov.lv.

You may also complain to the supervisory authority in the EU or EEA state of your habitual residence, place of work or the alleged infringement and may seek a judicial remedy.

18. Children

The Platform is intended only for persons aged 18 years or older. SixApp does not knowingly permit persons under 18 to create Accounts or use the Platform.

If SixApp becomes aware that personal data relating to a person under 18 has been collected in violation of the Terms, SixApp may take appropriate measures, including deleting the Account and relevant personal data where legally permissible.

19. Data breaches

If SixApp becomes aware of a personal data breach, it will assess and handle the breach in accordance with applicable data protection law.

Where notification to a supervisory authority or affected individuals is legally required, SixApp will make the required notifications within the applicable legal timeframe.

20. Changes to this Privacy Policy

SixApp may update this Privacy Policy from time to time. The updated version will be made available through the Platform and will state its effective date and last updated date.

Where required by applicable law, SixApp will provide Users with appropriate notice of material changes.

If a change materially affects the way SixApp processes personal data and applicable law requires consent or another specific legal basis, SixApp will take the measures required by law before applying the new processing.

21. Contact

Please write “Privacy Request” in the subject line where possible. SixApp may request information reasonably necessary to verify identity and prevent unauthorised disclosure.