1. Who we are

The data controller responsible for your personal data is:

2. The personal data we collect

From Consumers (homeowners)

• Job request details: service type, city, emirate, area, budget range, urgency, free-text description of the job.
• Contact details: name, email address, WhatsApp or mobile phone number.
• Consent record: the date and time you submitted a job request, the IP address from which it was submitted, and whether you consented to sharing your details with additional providers.
• Communications: messages you send us via email or the Platform contact forms.

From Providers

• Business and identity: business name, trade name, trade licence number, copy of trade licence, Emirates ID of the owner, contact name, business address, business category.
• Profile content: services offered, service areas, pricing, photographs, credentials, insurance certificates, portfolio images.
• Account and billing: email address, phone number, login credentials, subscription status, billing records; payment method data is collected and stored by our payment processor Stripe and is not retained by TaskRight.
• Performance data: leads received, response rate, customer reviews, account activity.

Automatically collected

• IP address, device and browser type, operating system;
• pages viewed, time spent, referring URL, search terms used on the Platform;
• approximate location derived from IP address;
• cookie and similar tracking identifiers (see Cookie Policy).

3. How we use your data

• To operate the Platform and match Consumers with verified Providers.
• To share a Consumer's contact details and job description with the Provider(s) that Consumer has selected and, if the Consumer has opted in, with additional verified Providers in the same service category.
• To verify a Provider's trade licence, credentials and background at onboarding and on a rolling basis.
• To process Provider subscription payments via Stripe.
• To communicate with you about your account, your requests, and changes to our service.
• To send service updates, onboarding messages and — only where you have opted in — marketing communications.
• To improve the Platform, analyse usage patterns and fight fraud.
• To comply with our legal obligations and respond to lawful requests by public authorities.

4. Our lawful basis

Under the PDPL we process personal data only where we have a lawful basis to do so. The lawful bases we rely on are:

• Consent — when you submit a job request and consent to your details being shared with Providers, and when you opt in to marketing communications.
• Performance of a contract — to operate the Provider subscription, process billing, and deliver Platform features to registered users.
• Legal obligation — to comply with UAE tax, consumer protection, anti-money-laundering, and data protection laws.
• Legitimate interests — to run, secure and improve the Platform, prevent fraud, and verify Provider credentials, where our interests are not overridden by your rights.

5. Who we share your data with

We share your personal data only with the recipients below, and only to the extent necessary.

• Matched Providers. When a Consumer submits a job request, we share the job details and contact information with the Provider(s) the Consumer selects, and — only if the Consumer has ticked the relevant option — with additional verified Providers in the same service category. Each lead we share includes a timestamp of the Consumer's consent, to evidence that sharing is lawful.
• Payment processor. Provider subscription payments are processed by Stripe Payments Europe, Ltd. Stripe collects payment method data directly and is an independent controller for that data; TaskRight does not see or store full card numbers.
• Service providers (processors) acting on our behalf. Cloud hosting, email delivery, analytics, customer support tooling and identity verification vendors process personal data on our instructions under written data processing agreements.
• Legal and regulatory. Authorities, courts or law enforcement where we are legally required to disclose, or to defend our legal rights.
• Corporate transactions. In the event of a merger, acquisition, financing or sale of all or part of our business, personal data may be transferred to the acquirer subject to equivalent protections.

We do not sell your personal data. We do not share Consumer contact details with Providers the Consumer has not consented to be matched with.

6. International transfers

Some of our service providers (including Stripe and certain cloud hosting and analytics providers) are located outside the UAE. When we transfer personal data outside the UAE, we do so only to jurisdictions that provide an adequate level of protection, or under appropriate safeguards consistent with the PDPL and any regulations issued by the UAE Data Office.

7. Cookies and tracking

We use cookies and similar technologies to operate the Platform, remember your preferences, measure usage, and deliver advertising. Full details — including how to refuse cookies — are in our Cookie Policy.

8. How long we keep your data

• Consumer job requests and leads: kept for 24 months from the date of the request, to support dispute resolution between the Consumer and the matched Provider, then deleted or anonymised.
• Consumer account or contact records (if no job submitted): up to 12 months from last interaction.
• Provider account and profile data: for the duration of the subscription and for 6 years after the last billing event, to comply with UAE tax record-keeping requirements.
• Payment and billing records: retained by Stripe per Stripe's retention policy; summary records held by TaskRight for 6 years.
• Web analytics: aggregated and anonymised after 26 months.
• Legal / dispute files: for the duration of any limitation period applicable under UAE law.

9. Your rights under the PDPL

Subject to the PDPL and its implementing regulations, you have the right to:

• Access the personal data we hold about you and obtain information about how we process it;
• Correct inaccurate or incomplete personal data;
• Request deletion of your personal data where we no longer need it or where you withdraw consent;
• Restrict or object to our processing in certain circumstances;
• Receive a copy of the personal data you provided to us in a structured, commonly used format (data portability);
• Withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal;
• Lodge a complaint with the UAE Data Office if you believe your rights have been breached.

To exercise any of these rights, contact us at partner@taskright.ae. We will respond within one month of receipt unless the request is complex, in which case we may extend the period and will notify you.

10. How we protect your data

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These measures include encryption in transit (HTTPS/TLS), encryption at rest for sensitive fields, access controls, logged admin actions, regular backups, and vetting of personnel and vendors.

No system is perfectly secure. In the event of a personal data breach that is likely to result in risk to your rights, we will notify the UAE Data Office and, where required, affected individuals, in line with PDPL obligations.

11. Children

TaskRight is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact partner@taskright.ae and we will delete it.

12. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. The "Last updated" date at the top shows when this version took effect. Material changes will be notified via email or in-Platform notice.

13. Contact us

To exercise your rights, ask questions, or report concerns about your personal data, contact us at: