Privacy Policy of the TOSYA Platform

2.1. The controller of the personal data of Platform Users within the meaning of Article 2 of the Law of Ukraine “On Personal Data Protection”, and the controller within the meaning of Article 4 of the GDPR, is ФОП Романець Арсен Андрійович, taxpayer registration number РНОКПП 3739606798, registered address: Львівська обл, м. Шептицький, Новодвірська 1, entry number in the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Organisations: 331988505648, entry date: 04.09.2026 (hereinafter referred to as the Administration).

2.2. Contact email address for enquiries regarding the processing of personal data: support@tosya.app.

3.2. The Administration does not intentionally collect personal data whose processing presents a particular risk to the rights and freedoms of personal data subjects under the Law of Ukraine “On Personal Data Protection” and the GDPR. The User undertakes not to publish such data on the Platform.

4.1. The Administration receives personal data directly from the User when the User creates an Account, completes a Profile, publishes a Request, Portfolio or Review, sends messages or contacts the support service.

4.2. Certain technical data is collected automatically when the Platform is used through cookies and similar technologies in accordance with the Cookie Policy.

4.3. Payment data relating to Paid Features may be received from payment services or other technical providers that process payments.

5.3. Personal data is processed for sending marketing communications only with the User’s separate consent, which may be withdrawn at any time.

6.1. The Administration does not accept or process payments for work performed or services provided by Masters to Clients.

6.2. The Platform may process payments only for Paid Features of the Platform, including a PRO subscription, Proposal packages or other additional functions.

6.3. Payments are processed through third-party payment services that process payment data in accordance with their own rules and privacy policies.

6.4. The Administration does not store Users’ complete payment card details unless otherwise expressly stated on the Platform.

7.1. Some information published by the User on the Platform is public or available to other Users in accordance with the Platform’s purpose.

7.2. Such information includes the User’s name, Profile photograph, Master description, service categories, Portfolio, rating, Reviews, city or region, and other information independently added by the User to their Profile or publications.

7.3. The User independently determines the scope of information made available to other Users and is responsible for publishing it.

8.1. The Administration may send Users service messages related to Accounts, Requests, Proposals, chats, payments, moderation or security.

8.2. Messages may be sent by email, browser push notifications, messages within the Platform or other available communication channels.

8.3. The User may change notification settings where such functionality is available on the Platform.

8.4. Service messages necessary for Account operation, security or compliance with legal requirements are sent regardless of the User’s marketing settings.

9.1. The Platform uses cookies and similar technologies for authentication, session maintenance, User settings, security, analytics and service improvement.

9.2. The procedure for using cookies is established by the Cookie Policy published on the Platform.

10.2. Cross-border transfers of personal data are carried out in compliance with the Law of Ukraine “On Personal Data Protection” and, where applicable, the GDPR, including transfers to countries that ensure an adequate level of personal data protection or through the application of standard contractual clauses.

11.1. Personal data is retained for the period necessary to achieve the processing purposes specified in this Policy, but no longer than necessary for Account operation, provision of the Platform’s functionality, compliance with legal requirements, dispute resolution, prevention of violations and protection of rights.

11.2. Personal data associated with an Account is retained for the duration of the Account’s existence and for 30 (thirty) calendar days after its deletion to complete technical deletion processes.

11.3. Data relating to payments for Paid Features and the corresponding primary accounting documents are retained for the period established by Ukrainian legislation for storing accounting and tax records in accordance with Clause 44.3 of Article 44 of the Tax Code of Ukraine.

11.4. Data necessary for reviewing complaints, resolving disputes or defending against claims is retained for the limitation period established by the Civil Code of Ukraine and other applicable legislation of Ukraine.

11.5. Content that was public or transferred to other Users within the Platform’s functionality may remain available where necessary for the operation of the service, preservation of interaction history or pursuit of the Administration’s legitimate interests.

11.6. Upon expiry of the retention period, personal data is deleted or anonymised in accordance with the Law of Ukraine “On Personal Data Protection”.

12.1. The Administration takes organisational and technical measures required by the Law of Ukraine “On Personal Data Protection” and the GDPR, where applicable, to protect personal data against unlawful access, loss, alteration, disclosure or destruction.

12.2. Such measures include access controls, encryption of data transmission channels using HTTPS, secure storage of passwords in hashed form, activity logging, backups and other security measures.

12.3. The Administration designates a responsible person to organise work relating to personal data protection in accordance with the Law of Ukraine “On Personal Data Protection”.

12.4. In the event of a personal data breach that may pose a risk to the rights and freedoms of Users, the Administration notifies the Users and, where required by law, the competent authority within the periods established by law.

12.5. No method of transmitting or storing data on the Internet is completely secure, and therefore the Administration cannot guarantee the complete absence of risks.

13.2. To exercise their rights, the User must contact the Administration at support@tosya.app. The Administration has the right to require confirmation of the User’s identity before fulfilling the request.

13.3. Requests are reviewed within a period not exceeding 30 (thirty) calendar days from the date of receipt.

13.4. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal and does not prevent processing based on other legal grounds specified in Clause 5.2 of this Policy.

14.1. The Platform is not intended for independent use by persons who do not have full civil capacity under the applicable legislation of Ukraine.

14.2. If the Administration becomes aware that personal data has been provided by a person without the required consent of their legal representative, the Administration has the right to restrict access to the Account or delete such data.

15.1. The Platform may contain links to third-party websites or services.

15.2. The Administration does not control the privacy policies or rules of such third-party services and is not responsible for their actions.

15.3. Before using third-party services, the User is advised to review their privacy policies.

16.1. The Administration has the right to amend this Policy unilaterally.

16.2. The updated version of the Policy is published on the Platform with its effective date. In the event of material changes, the Administration additionally notifies Users by email or through a notification on the Platform.

16.3. Continued use of the Platform after the updated Policy takes effect confirms that the User has reviewed the updated personal data processing terms.

17.1. Users may contact the Administration regarding this Policy, the processing of personal data or the exercise of personal data subject rights at support@tosya.app.