Controller and contact
QUANTROQ LIMITED, company number 17491089, is the controller for personal information processed to run Freelance Guru and provide our own platform services. Our registered office is 9 Studio, 50-54 St Paul's Square, Birmingham, United Kingdom, B3 1QS.
For privacy questions and rights requests, contact [email protected], with “Privacy” in the subject if convenient. You do not have to use a special form or legal terminology.
Freelancers, clients and payment providers may be separate controllers for their own activities. When a freelancer processes a client’s data strictly on instructions, those parties may instead have a controller–processor relationship requiring a separate agreement; this notice does not resolve every project-specific role.
Information covered
Depending on how you use the service, we process:
- Account and contact information: name, email, account identifiers, business identity, country, account preferences and authentication records.
- Professional profiles: skills, rates, experience, portfolio material, availability and profile images you choose to provide.
- Project and communications information: briefs, proposals, work agreements, project messages, files, delivery and acceptance records, revision requests and support correspondence.
- Transaction information: work prices, fees, provider references, payment status, refund and payout records, and limited payment or beneficiary details needed for the supported route.
- Verification information: identity or business evidence and verification results where necessary and proportionate for account security, fraud prevention or provider requirements.
- Device and service information: IP address, browser/device information, session and security logs, access events and consent choices; optional analytics only where lawfully enabled.
- Reputation and disputes: reviews, reported content, complaint details, responses and relevant evidence.
Do not place identity documents, full payment-card details, health records or unrelated sensitive personal information in a public profile or project message. Where a particular service requires more sensitive processing, we will assess it and provide the additional information and legal basis before introducing it.
Sources
We obtain data directly from you, from your counterparties in project records and disputes, from your use of the platform, and from relevant payment, verification or security providers. We may check public business registers where proportionate to verify a business or investigate fraud.
When information comes from someone else, we will provide the required privacy information within the applicable timeframe unless a lawful exception applies. We will not use a public-source label as permission for unrestricted profiling.
Purposes and lawful bases
| Purpose | Main lawful basis |
| - | - |
| Create accounts, administer orders, deliver notifications and provide requested support | Performance of our contract with the user, or steps requested before it |
| Manage business contacts acting for an organisation | Legitimate interests in administering that business relationship |
| Coordinate authorised payments, payouts and refunds | Contract for our service; legal obligations where applicable |
| Secure accounts, prevent fraud and investigate misuse | Legitimate interests in protecting users and the service; legal obligations where specifically applicable |
| Assess disputes and establish or defend claims | Contract administration and legitimate interests in fair resolution and legal protection |
| Maintain tax, accounting and other legally required records | Compliance with applicable legal obligations |
| Display user-selected profiles, proposals and project reviews | Contract for the relevant marketplace feature and, where appropriate, legitimate interests in a reliable marketplace |
| Optional promotional messages and non-essential tracking | Consent, unless a specific lawful alternative is applicable and explained |
Where we rely on legitimate interests, we assess necessity and balance our interests against your rights. Verification is not described as a universal statutory AML duty of QUANTROQ where no such duty has been established.
You may refuse optional data or withdraw consent without losing unrelated core services. Information necessary for a contract, security check or lawful payment requirement may be required to provide the affected feature; we will explain the consequence of not providing it.
Visibility and sharing
Profile fields intended for public display may be visible to other users and accessible on the public internet. Private messages and deliverables are intended for the relevant parties, authorised staff and service providers necessary to administer the project; do not include secrets in a field marked public.
We share only relevant information with:
- Counterparties: information needed to identify the supplier/client, assess proposals, perform the work, arrange a lawful transaction and handle a dispute.
- Payment and verification providers: data needed for the selected route and its eligibility, security, settlement and legal requirements.
- Technical service providers: hosting, communications, support, storage and security providers acting under appropriate arrangements.
- Professional advisers and authorities: where reasonably necessary for advice, legal duties, protection of rights or lawful requests.
- Business successors: necessary data in a genuine restructuring or transfer, subject to safeguards and appropriate notice.
The live payment flow must identify the provider and its independent privacy notice before data is sent for that service. You may ask us for information about recipients or recipient categories; we will not substitute an undisclosed provider for a materially different purpose without the required assessment and notice.
We do not permit project messages or private deliverables to be used to train general-purpose AI models merely because they were submitted to the platform. Any separate proposed use requires an appropriate lawful basis, assessment and transparent notice.
International processing
Users and service providers may be located outside the UK. Where we transfer protected personal information to a country without an applicable adequacy arrangement, we will use an appropriate transfer mechanism, such as relevant UK contractual safeguards and any required supplementary measures; where EU GDPR applies, the relevant EU mechanism must also be addressed.
Contact us for information about the safeguards relevant to your data and how to obtain an appropriate copy. We do not claim that all data remains in the UK or that accepting these Terms waives international-transfer protections.
Retention
We keep information only for a justified purpose and apply the following retention framework, subject to a longer legal requirement or a documented claim/security hold:
| Record type | Retention approach |
| - | - |
| Active account and profile | While the account is active and needed to provide the service |
| Closed-account working data | Remove or anonymise within 90 days where no continuing lawful purpose applies |
| Core order, fee, transaction and contractual claim records | Normally up to 6 years after completion or closure of the relevant transaction or claim |
| Ordinary support correspondence | Normally up to 24 months after closure, unless part of a continuing dispute or contractual record |
| Routine security and access logs | Normally up to 12 months, with relevant extracts retained longer for a documented incident or claim |
| Identity evidence | Avoid duplicate documents; retain only what is necessary for the documented verification purpose and applicable retention requirement |
| Backups of deleted working data | Expire through a controlled cycle normally within 90 days; kept out of ordinary use while awaiting deletion |
| Marketing suppression and consent records | The minimum information needed to honour preferences and demonstrate compliance |
A six-year contractual-record period does not mean every work file, identity document or complete conversation must be retained for six years. We minimise the evidence retained and restrict its access; a hold must be reviewed and ended when no longer justified.
Your rights
Subject to applicable law, you may request access, correction, erasure, restriction, portability or information about processing, and object to processing based on legitimate interests. You may object to direct marketing at any time and withdraw consent as easily as it was given, without affecting prior lawful processing.
We respond within the applicable legal deadline, normally one month under UK GDPR. If an extension or other permitted timing rule applies, we will explain it within the required period; we may request proportionate information to verify identity, but do not routinely require excessive documents.
Some information may need to remain for legal obligations or claims. If we cannot fulfil a request in full, we will explain the basis and available challenge routes.
You may complain to the UK Information Commissioner’s Office at https://ico.org.uk/ or to another competent authority where applicable. We encourage you to contact us, but you do not have to exhaust an internal complaint before approaching an authority.
Automation, security and children
Security tools may flag suspicious behaviour, and the service may apply the disclosed 72-hour acceptance workflow. We do not treat an automated flag as conclusive evidence of wrongdoing; users may contact support to challenge a consequential restriction or erroneous automatic acceptance and request human review.
Before introducing processing that amounts to a solely automated decision with legally or similarly significant effects, we will assess its lawful basis, safeguards and required disclosures. This notice is not advance permission for unspecified automated eligibility or credit decisions.
We use proportionate organisational and technical security measures, such as access restrictions, secure authentication, protected transmission where applicable and incident procedures. No service can promise absolute security; do not share passwords or authentication codes in messages.
The service is intended for adults aged 18 and above. If we learn that a child has opened an account, we will restrict the account and address deletion or lawful retention appropriately.
Cookies and changes
Our Cookie Policy explains device storage, consent and settings. Optional advertising or analytics processing is not authorised merely by agreeing to these Terms.
We will update this notice when processing changes and draw attention to material changes where required. The notice must describe actual operations; no unspecified analytics, advertising, biometric verification or AI-training service is presumed to be active.