1. Dual Roles: Data Controller vs. Data Processor

Under international privacy law, the legal classification of our processing depends on our relationship with the data:

2. Categories of Information We Collect

We collect information in the following categories:

• Direct Identifiers: Name, professional title, business email address, company telephone number, corporate postal address, and store URLs.
• Commercial Information: Details regarding your marketplace channels, daily order volumes, support software in use, service scope requests, and transaction billing history.
• Client System Credentials: Role-restricted staff invitations and access tokens configured by clients directly within their marketplace seller portals or helpdesk tools.
• Communications & Inquiries: Transcripts of live chat communications (via Tawk.to), emails exchanged with our team, and coordination messages inside client-dedicated Slack channels.
• Technical & Network Metadata: Anonymized IP addresses, browser types, device operating systems, referral URLs, and visit timestamps collected for diagnostic and site security purposes.

3. Legal Bases for Processing (EU & UK GDPR Art. 6)

For individuals in the European Economic Area (EEA) and the United Kingdom, we process personal data under the following recognized legal bases:

• Performance of a Contract (Art. 6(1)(b)): Executing the 3-Day Risk-Free Trial, delivering contracted operational capacity, and performing storefront operations requested by the merchant.
• Legitimate Interests (Art. 6(1)(f)): Responding to prospective business inquiries, safeguarding our IT infrastructure against fraud and cyber threats, and optimizing website reliability.
• Compliance with Legal Obligations (Art. 6(1)(c)): Maintaining statutory accounting books, tax records, and cooperating with lawful regulatory inquiries.
• Consent (Art. 6(1)(a)): Where explicitly requested for optional non-essential communications or cookie categories.

4. Storefront Data Protection & Zero-Monetization Guarantee

We understand that client customer data and sales history are confidential trade assets:

• No Selling or Data Harvesting: Taskline does NOT sell, rent, lease, or monetize customer records, supplier lists, or sales metrics extracted from client storefronts.
• Principle of Least Privilege: We instruct clients to provision role-restricted access accounts with minimum permissions required for operational execution (e.g., customer support tier without financial export rights).
• Confidentiality Agreements: 100% of Taskline operational personnel operate under legally binding Non-Disclosure Agreements (NDAs) that survive the termination of service.

5. International Cross-Border Data Transfers (GDPR Art. 44-49)

Because Taskline supports global businesses, personal data may be accessed or processed across multiple countries. When transferring personal data outside the EEA, Switzerland, or the UK, we implement standard statutory safeguards:

• Standard Contractual Clauses (SCCs): We incorporate the European Commission's approved Standard Contractual Clauses (Implementing Decision 2021/914) and the UK International Data Transfer Addendum (IDTA) into our service agreements.
• Technical Safeguards: Enforced endpoint full-disk encryption, mandatory two-factor authentication (2FA), zero-trust access controls, and encrypted transit (TLS 1.3).

6. California Privacy Notice (CCPA / CPRA)

This section applies specifically to residents of the State of California under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020:

7. Your Rights Under GDPR & UK GDPR

Data subjects within the EEA and United Kingdom possess the following enforceable statutory rights:

• Right of Access (Art. 15): Obtain confirmation as to whether your data is processed and a copy of such data.
• Right to Rectification (Art. 16): Require the correction of inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten", Art. 17): Request deletion of data no longer needed for contracted purposes.
• Right to Restriction of Processing (Art. 18): Restrict processing under specified legal grounds.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object at any time to processing based on legitimate business interests.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your national Data Protection Supervisory Authority (such as the ICO in the UK, CNIL in France, or DPC in Ireland).

8. Data Retention Schedule

We retain personal data only for as long as strictly necessary to fulfill the purposes for which it was collected:

• Client Contract Records: Retained for the duration of the engagement plus statutory tax and accounting retention requirements (typically 7 years).
• Trial Access Credentials: Revoked immediately upon trial completion or transition to paid operations.
• General Inquiries & Live Chat: Chat transcripts and contact submissions are pruned after 24 months unless an ongoing commercial relationship exists.

9. Exercising Your Rights & Contact Information

To submit a verifiable consumer request under GDPR, CCPA/CPRA, or any global privacy law, please contact our data governance team. We will verify your identity and respond within the statutory timeframes (30 days for GDPR, 45 days for CCPA):