Privacy Policy

This policy explains how Bright Valley s.r.o., registered office Podskalská 1512/22, Nové Město, 128 00 Prague 2, Czech Republic, Company ID (IČO) 30019028, registered in the Commercial Register kept by the Municipal Court in Prague under file no. C 455977 ("we"), the controller of your personal data, processes it when you use Gigisto, and which rights you have under the EU General Data Protection Regulation (GDPR). Contact for all privacy questions: legal@gigisto.com. We have not appointed a data protection officer, because the law does not require one for our processing; the contact above handles all requests.

1. What we collect

Category	Examples	Source
Account	name, email, country, time zone, password (stored only as a salted Argon2id hash), two-factor settings, passkeys	you
Profile	photo, title, skills, rates, portfolio, work history, education, languages, links	you
Marketplace activity	jobs, proposals, offers, contracts, messages, files, reviews, disputes, support tickets, reports	you and the other party
Payments and wallet	payment amounts and status, credits and bonus credits, receipts and invoices, payout wallet address (stored encrypted)	you, payment partners
Verification	legal name, date of birth, address, identity document number, document and selfie images, tax residency and tax ID	you
Security & technical	IP address, browser, sign-in history, active sessions, security and audit logs	your device

We do not knowingly collect special categories of data. Please do not upload them in messages or files.

2. Why we use it and our legal basis

Purpose	Legal basis (GDPR Art. 6)
Creating and running your account, matching, contracts, escrow, wallet, payouts, support	performance of a contract
Receipts, invoices (including self-billing), accounting and tax records	legal obligation
Identity verification, anti-money-laundering and sanctions checks, platform tax reporting (DAC7)	legal obligation
Preventing fraud and abuse, securing the platform, hiding contact details before a contract, security alerts to our staff	legitimate interests
Handling notices about illegal content and statements of reasons (Digital Services Act)	legal obligation
Service emails (e.g. a payment was released) — you choose which ones in Settings → Notifications	performance of a contract
Anonymous usage statistics without cookies	legitimate interests

We make no decisions based solely on automated processing that have legal or similarly significant effects on you. Automated signals (for example a possible sanctions match or a duplicate identity document) are always reviewed by a person. We do not use your data for advertising and we never sell it.

3. Who sees your data

• Other users see your public profile and, once you work together, what you share in the contract room. Contact details are hidden until a contract exists. Invoices show the legal name and address of both parties.
• Service providers acting for us (processors) under data processing agreements:
  • Contabo GmbH, Germany — server hosting in the EU;
  • our payment and banking partners, who process card and bank payments; card details go directly to the payment partner and never to our servers. Emails are sent from our own mail server.
• Staff security alerts. If enabled, our staff receive short alerts about sign-ins and security changes through Telegram. They can contain your email address and IP address, and Telegram may process them outside the European Economic Area. We keep these alerts to the minimum and can hide email and IP addresses in them.
• Authorities when the law requires it: the Czech tax administration under DAC7 (for freelancers: name, address, date of birth, tax ID, payout account and amounts earned), the Financial Analytical Office under anti-money-laundering law, and courts or police with a valid order.

4. Where it is stored

On our servers in the European Union (Germany). Apart from the staff alerts described above, we do not transfer your data outside the European Economic Area; if a provider ever has to, we use an adequacy decision or the European Commission's Standard Contractual Clauses.

5. How long we keep it

Data	Retention
Account and profile	while your account is open; deleted or anonymised after you close it
Identity document and selfie images	deleted 30 days after the verification decision; we keep only the decision and a one-way hash of the document number
Verification and tax data needed for DAC7 and anti-money-laundering	10 years, as the law requires
Contracts, payments, receipts, invoices, ledger	10 years, as Czech accounting and VAT law requires
Messages and files	while the account is open; afterwards as part of contract records for as long as needed for disputes and legal claims
Sign-in sessions	deleted after they expire
Security and audit logs	as long as needed to protect the platform and meet our legal obligations

6. Security

Encryption in transit (TLS) and at rest for identity documents, tax IDs and payout details; passwords hashed with Argon2id; mandatory two-factor authentication for staff and for withdrawals; role-based staff access with every access to identity documents logged; virus scanning of uploads; encrypted daily backups.

7. Your rights

You can ask for access, correction, deletion, restriction and data portability, and you can object to processing based on legitimate interests. You can download your data and close your account yourself in Settings → Privacy & data. For anything else write to legal@gigisto.com. We answer within one month.

You can also complain to the Czech data protection authority — Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz — or to the authority of the EU country where you live or work.

8. Cookies

We use only cookies that are strictly necessary — see the Cookie Policy.

9. Changes

We will tell you about material changes by email and in the product before they take effect.