ExpatTray Marketplace Platform
Effective Date: September 1, 2025
Last Updated: September 22, 2025
Legal Entity: ConnecTech OÜ (Registration Code: 16425836) and ConnecTech Digital UK Ltd (Company Number: 16713902)
Registered Office (Estonia): Tartu maakond, Tartu linn, Tartu linn, Pärna tn 29-1, 50604, Estonia
Registered Office (UK): 34 Anderson Way, Rainham, London, United Kingdom, RM13 8TE
Contact: dpo@expatray.com
Welcome to ExpatTray, the global marketplace platform that connects expatriates, travelers, and service providers across international boundaries. We are committed to protecting your personal information and being transparent about how we collect, use, and safeguard your data when you interact with our platform.
This Privacy Policy explains our data processing practices in detailed, clear terms and covers all interactions you have with our services, whether you are browsing our marketplace as a guest, registered as a user, offering services as a provider, making purchases as a buyer, or contacting our customer support team. The scope of this policy extends to our website, mobile applications, APIs, and all related services that form part of the ExpatTray marketplace ecosystem.
Your privacy is fundamental to our relationship with you, and we are committed to earning and maintaining your trust through transparent, respectful, and legally compliant handling of your personal data. This policy should be read in conjunction with our Terms of Service, and together these documents constitute essential parts of your legal agreement with us.
We are ExpatTray, a digital marketplace platform operated by ConnecTech OÜ (incorporated in Estonia) and ConnecTech Digital UK Ltd (incorporated in the United Kingdom). Our platform specializes in connecting service providers with buyers, particularly serving expatriate and international communities worldwide by facilitating professional services, consultations, and appointment-based offerings.
Our Corporate Structure: ConnecTech OÜ serves as our primary European entity, handling operations and data processing for users in Estonia and other European Economic Area countries. ConnecTech Digital UK Ltd operates our United Kingdom services and handles UK-specific compliance requirements following Brexit. The applicable entity for your interactions depends on your location and the jurisdiction governing your transactions, as determined by ExpatTray based on applicable legal requirements.
Data Controller Responsibilities: For most activities described in this policy, ConnecTech OÜ and ConnecTech Digital UK Ltd act as joint data controllers, meaning we determine the purposes and means of processing your personal data. We make decisions about what personal information to collect, how to use it, how long to retain it, and with whom to share it, always in accordance with applicable data protection laws and regulations.
Data Processor Arrangements: In certain limited circumstances, we may act as a data processor when handling personal data on behalf of service providers who use our platform. For example, when we help service providers manage their customer relationships or export buyer information to their connected business tools, the service provider acts as the data controller and we process data according to their instructions. Service providers who engage us as a data processor must enter into our Data Processing Addendum to ensure appropriate data protection safeguards.
Contact Information:
Understanding what information we collect about you is fundamental to making informed decisions about using our marketplace platform. We believe in the principle of data minimization, which means we only collect personal information that is genuinely necessary to provide our marketplace services effectively, maintain the security and integrity of our platform, and comply with applicable legal and regulatory requirements across the various jurisdictions where we operate.
Account and Profile Information: When you create an account with ExpatTray, you voluntarily provide us with essential information that forms the foundation of your marketplace experience. This includes your full legal name as it appears on official identification documents, which helps us maintain accurate records and comply with verification requirements. We collect your email address as your primary communication channel and for account security purposes. Your phone number is required for account verification and important service notifications. You may optionally provide a profile picture and personal description to help other users understand your background and expertise, though these elements remain entirely under your control.
Service Provider Verification Data: For users who choose to become service providers on our platform, we collect additional verification information as part of our mandatory Know Your Customer (KYC) and Know Your Business (KYB) compliance procedures. This verification process requires government-issued identification documents such as passports, driver's licenses, or national identity cards, which we use to confirm your identity and prevent fraudulent activity. We collect address verification documents including utility bills, bank statements, or official correspondence to confirm your residential or business location. For commercial service providers, we require business registration documents, tax identification numbers, and authorized representative documentation that demonstrates the legal status and authority of your enterprise.
Financial and Payment Information: Our payment information practices are designed to minimize our handling of sensitive financial data while ensuring secure transactions. When you provide payment details, they are collected and processed directly by our PCI DSS compliant payment service providers including Stripe, Paystack, and similar processors. We do not store complete payment card numbers or security codes on our servers. Instead, we receive and retain payment tokens, the last four digits of payment cards for identification purposes, billing addresses for verification, and comprehensive transaction histories including amounts, dates, and payment status information necessary for platform operations and customer support.
Communication and Transaction Data: We maintain detailed records of all interactions and transactions that occur through our platform to provide effective customer support and ensure platform integrity. This includes the complete history of messages exchanged between buyers and service providers during the inquiry and booking process, all communications with our customer support team when assistance is needed, and comprehensive transaction details including service descriptions, booking preferences, scheduling information, and completion confirmations. We also collect reviews and ratings provided by users about their experiences with service providers and vice versa.
Platform Usage and Interaction Data: Your interactions with our marketplace generate valuable information that helps us understand how you use our services and enables us to provide personalized recommendations while improving your overall experience. We automatically collect detailed records of your marketplace activity including every service listing you view, search terms you enter, filters you apply, and the time you spend evaluating different options. We track which service provider profiles you visit and the patterns of your browsing behavior to understand your preferences and suggest relevant services that match your interests and needs.
Technical and Device Information: We automatically collect technical information as you navigate through our website and mobile applications using industry-standard web technologies. This includes detailed information about the device you use to access our platform, such as the type of device (smartphone, tablet, desktop computer), operating system and version, web browser type and version, screen resolution, and installed plugins or extensions that may affect platform functionality. We collect your Internet Protocol (IP) address, which provides general geographic information at the city and country level, and maintain detailed logs of your navigation patterns, page load times, and any technical errors encountered.
Location Information: Location data represents a particularly sensitive category that we handle with special care and transparency. We only collect precise location data when you explicitly grant permission through your device settings or browser preferences. This information is used primarily to provide location-specific services such as finding local service providers, calculating accurate service delivery estimates, displaying currency and pricing information appropriate to your region, and ensuring compliance with local regulations that may affect service availability. You maintain complete control over location data and can revoke permissions at any time without affecting other platform functions.
Social Media Integration: When you choose to create or connect your ExpatTray account using social media platforms such as Facebook, Google, or LinkedIn, these platforms share basic profile information according to the permissions you grant during the connection process. This typically includes your display name, profile picture, email address, and general demographic information such as location and language preferences. We use this information solely to streamline account creation and can be disconnected at any time through your account settings.
Payment and Financial Service Providers: We receive transaction-related information from our payment processing partners to confirm successful payments, detect fraudulent activity, and provide comprehensive transaction histories. This includes payment confirmation data, transaction status updates, chargeback notifications, and fraud risk assessments that help protect both buyers and service providers from financial harm.
Identity Verification and Security Services: We work with specialized identity verification providers to confirm that users are who they claim to be, particularly for service providers and high-value transactions. These services provide verification results indicating whether submitted identity documents appear legitimate, whether biometric verification (where permitted) confirms identity matches, and risk assessments that help us maintain platform security and trust.
Business and Professional Data Sources: For business service providers, we may receive information from professional licensing bodies, business registries, and credit reporting agencies to verify credentials, confirm business legitimacy, and assess financial stability. This information helps us maintain a trustworthy marketplace where buyers can confidently engage with verified professional service providers.
The personal information we collect serves specific, legitimate purposes that directly benefit your experience on our platform while ensuring the security, functionality, and legal compliance of our marketplace operations. We are committed to using your data transparently and only for purposes that align with your expectations and the services you have requested from us. Our data processing activities are governed by applicable data protection laws, including the General Data Protection Regulation (GDPR), UK GDPR, California Consumer Privacy Act (CCPA), and other relevant privacy frameworks.
Identity verification, payment processing, customer support, analytics, cloud hosting (e.g., AWS, Google Cloud, Microsoft Azure, Cloudflare, Cloudinary).
Regulatory authorities, law enforcement, and dispute resolution.
Information may be transferred during mergers, acquisitions, or sales.
Primary Data Locations: EU (Ireland, Germany), United States (Virginia, California), Asia-Pacific (Singapore, Australia)
| Data Type | Retention Period |
|---|---|
| Account Information | While active + 2 years after closure |
| Transaction Records | 7 years (tax and legal requirements) |
| KYC/KYB Documents | Typically 5–7 years (as required by law) |
| Identity Verification Images | Up to 90 days after verification |
| Communication Records | 2 years (longer if part of disputes) |
| Marketing Preferences | 24 months after last interaction |
| Analytics Data | 14 months (then anonymized) |
We do not sell personal information of users under 16 without opt-in consent.
We respond to privacy requests within 30 days and provide free assistance.
While we implement strong security measures, no system is 100% secure. Please protect your login credentials.
Manage preferences in our Cookie Control Center or your browser. We honor Global Privacy Control where required.
Our platform is for users 18 and older. We do not knowingly collect personal information from children under 16. Parents may request access, correction, or deletion where applicable.
You can request human review of decisions that significantly affect you and information about the logic involved.
We may update this policy to reflect practice or legal changes. We will notify you via email, in-product messages, or website notices. Material changes include 30 days' advance notice. Continued use after updates indicates acceptance.
Postal Address: ConnecTech OÜ, Data Protection Officer, Tartu maakond, Tartu linn, Tartu linn, Pärna tn 29-1, 50604, Estonia
Supervisory Authority Complaints: EU/EEA: Estonian Data Protection Inspectorate · UK: Information Commissioner's Office · US: State or FTC
Document Information:
Version: 2.0
Effective Date: September 1, 2025
Last Updated: September 22, 2025
Next Review: February 1, 2026
This privacy policy complies with GDPR, UK GDPR, CCPA/CPRA, and other applicable international data protection regulations.