Taackk GDPR & Data Protection Notice

Taackk Pty Ltd (ABN 83 701 856 671) operates the fractional executive marketplace at taackk.com. For the purposes of the EU/UK General Data Protection Regulation (GDPR), Taackk Pty Ltd is the data controller for personal data processed through our Services.

For privacy enquiries, contact us at [email protected]. Our Data Protection Officer can be reached at [email protected]. Our EU Representative, appointed under Article 27 GDPR, is [EU REPRESENTATIVE NAME AND ADDRESS], and our UK Representative is [UK REPRESENTATIVE NAME AND ADDRESS].

We collect the categories of personal data set out in Section 1 of our Privacy Policy. In summary: account data (name, email address, hashed password, role, subscription tier); profile data (professional history, skills, industries, publications and other information you provide); usage data (pages visited, features used, timestamps, IP addresses); communications (messages exchanged between Leaders and Businesses); payment data (processed by Stripe — we retain only a Stripe customer ID and subscription status); and technical data (browser type, device type, session tokens stored in HTTP-only cookies).

We process your personal data on the following lawful bases under Article 6(1) GDPR:

• Contract performance (Art. 6(1)(b)): to provide the marketplace, match Leaders with Businesses, and manage your account.
• Legitimate interests (Art. 6(1)(f)): to detect and prevent fraud, improve our Services, and maintain platform security. You have the right to object to processing based on legitimate interests.
• Legal obligation (Art. 6(1)(c)): to comply with applicable laws, including tax and financial regulations.
• Consent (Art. 6(1)(a)): for optional analytics cookies and any other processing for which we ask your consent. You may withdraw consent at any time, but this will not affect the lawfulness of processing carried out before withdrawal.

As a data subject in the Designated Countries or the UK, you have the following rights:

1. Right of access (Art. 15): request a copy of all personal data we hold about you. You can download this directly from your account settings.
2. Right to rectification (Art. 16): correct inaccurate data via your profile settings, or contact us.
3. Right to erasure (Art. 17): request deletion of your account and personal data — contact [email protected].
4. Right to data portability (Art. 20): download your data in machine-readable JSON format from your account settings.
5. Right to object (Art. 21): object to processing based on legitimate interests.
6. Right to restrict processing (Art. 18): request that we limit how we use your data.
7. Right to withdraw consent: for analytics cookies, use the cookie banner at any time.
8. Rights related to automated decision-making (Art. 22): you have rights not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. Our matching and recommendation features assist decision-making but do not make hiring or engagement decisions on your behalf.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (which may be extended by a further two months where requests are complex, in which case we will inform you).

We process data both inside and outside the Designated Countries and rely on legally provided mechanisms to lawfully transfer data across borders. Where we transfer personal data out of the Designated Countries or the UK to a country that has not received an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where required. You may request a copy of the relevant safeguards by contacting [email protected].

We retain personal data only as long as necessary for the purposes described in our Privacy Policy. Specific periods:

• Account data: duration of your account plus 30 days after deletion (to allow recovery).
• Audit logs: 12 months (security and compliance).
• Login attempt records: 90 days (fraud prevention).
• Session tokens: automatically purged on expiry.
• One-time tokens (OTP, password reset, email verification): 30 days after use.

We do not sell your personal data. We share data only with:

• Stripe — payment processing (PCI DSS Level 1 certified).
• OpenAI — AI-powered features such as profile generation and matching, processed under OpenAI's data processing agreement and not used to train their models.
• Infrastructure providers — cloud hosting and database services, bound by data processing agreements.
• Law enforcement — where required by law or to protect the rights and safety of our users.

Each processor is bound by a data processing agreement in accordance with Article 28 GDPR.

We implement technical and organisational measures to protect your personal data, including AES-256-GCM encryption for sensitive credentials, bcrypt password hashing (12 rounds), HTTP-only SameSite=Strict session cookies, TLS in transit, and role-based access controls. To report a security vulnerability, see our security disclosure policy.

If you have a concern about how we handle your personal data, please contact us first at [email protected] or our Data Protection Officer at [email protected]. You also have the right to lodge a complaint with a supervisory authority in the country where you live, work, or where an alleged infringement occurred. A list of EU supervisory authorities is available from the European Data Protection Board; in the UK, the supervisory authority is the Information Commissioner's Office (ICO).

Taackk is an Australian company and handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Australian users may also contact us at [email protected] with any privacy enquiry or complaint, and may lodge a complaint with the Office of the Australian Information Commissioner (OAIC). Users in other regions may have additional rights under their local laws; contact [email protected] for more information.

We may update this notice from time to time. Material changes will be communicated by email or via a notice on the platform. Continued use of Taackk after changes take effect constitutes acceptance of the updated notice.

For any privacy-related enquiries, contact our Privacy Team at [email protected]. Residents in the Designated Countries may also contact our Data Protection Officer at [email protected] and our EU Representative at the address set out in Section 1.