Version: 3.0 Effective Date: March 19, 2026 Last Updated: March 19, 2026 Next Scheduled Review: September 19, 2026
Data Controllers: ConnecTech OU (Registration Code: 16425836), Tartu linn, Parna tn 29-1, 50604, Estonia ConnecTech Digital UK Ltd (Company Number: 16713902), 34 Anderson Way, Rainham, London, RM13 8TE, United Kingdom
Data Protection Officer: [email protected] General Support: [email protected]
This summary gives you the essential points. The full policy below provides complete detail.
ExpatTray is a services marketplace platform connecting buyers with service providers operating across international borders. The platform is operated by two related legal entities: ConnecTech OU, incorporated in Estonia (Registration Code: 16425836), with registered offices at Tartu linn, Parna tn 29-1, 50604, Estonia; and ConnecTech Digital UK Ltd, incorporated in England and Wales (Company Number: 16713902), with registered offices at 34 Anderson Way, Rainham, London, RM13 8TE, United Kingdom. Together, these entities determine the purposes and means of processing personal data collected through the ExpatTray website, mobile application, and APIs, and act as joint controllers under applicable data protection law. The entity primarily responsible for your data depends on your location and the jurisdiction of your transactions. Where required, a joint controller arrangement or intragroup data sharing agreement governs the relationship between the two entities.
In addition to acting as a controller, ExpatTray also acts as a data processor in limited circumstances. When a service provider uses the platform to manage booking records and communications concerning their clients, ExpatTray processes that data on the service provider's behalf. In those cases, a Data Processing Agreement governs our obligations. For all other processing described in this policy, ExpatTray acts as the data controller.
Account and Profile Data. When you register, we collect your name, email address, password (stored in hashed form), profile photograph, preferred language, and any optional biographical or professional information you choose to add. Service providers additionally provide business details such as company name, business address, service categories, and banking information for payouts.
Verification and KYC/KYB Data. To comply with anti-money laundering regulations and platform trust requirements, service providers must complete identity verification. This involves submitting government-issued identity documents, facial images for liveness checks, and, for business accounts, company registration documents. This process is handled through a third-party identity verification provider. Where facial imagery or biometric templates are generated, they are processed by that provider and are subject to the biometric retention terms described in Section 5.
Payment Metadata. We collect transaction identifiers, amounts, currency, timestamps, and booking references related to payments made on the platform. Payment card numbers, bank account details, and full financial credentials are not stored by ExpatTray. They are collected and processed directly by our payment processing provider in accordance with PCI-DSS standards. We receive only tokenized or truncated references sufficient to associate a transaction with your account.
Platform Activity. We collect records of your interactions on the platform, including listings you view or create, bookings initiated or received, messages exchanged with other users, reviews submitted, and service calendar appointments. This activity data is used to operate the marketplace, resolve disputes, and improve platform features.
Technical and Device Data. When you access ExpatTray, our servers and analytics tools automatically collect your IP address (used for country-level geolocation), browser type and version, operating system, device identifiers, pages visited, session duration, and referral source. This data helps us maintain platform performance, detect abuse, and understand how users navigate the service.
Social Login Data. If you choose to register or sign in using Google or Facebook, we receive from those providers the data you authorize during the OAuth consent process. This typically includes your name, email address, and profile picture. We do not receive your social media passwords or access to content beyond what you explicitly authorize.
Google Calendar Data. If you connect your Google Calendar account to ExpatTray for appointment scheduling, we request OAuth authorization to read and write calendar events. We use this access only to create, update, or cancel booking-related events on your behalf. ExpatTray's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements. You may revoke this access at any time through your Google account settings or your ExpatTray account settings.
AI Content Assistance. ExpatTray offers an optional tool to help service providers generate or improve listing descriptions using AI. If you choose to use this feature, the text you submit (such as a draft description or keywords) is sent to a third-party AI provider for processing. This transmission occurs only when you explicitly initiate the request. We do not use your listing content to train AI models, and the AI provider processes your input solely to return the requested output. Avoid including sensitive personal information in AI content requests.
Core Platform Operations. We use your account data, payment metadata, platform activity, and booking records to operate the ExpatTray marketplace. This includes creating and managing your account, processing bookings and payments, facilitating communications between buyers and service providers, and delivering the services you request. The legal basis for this processing is the performance of a contract (Article 6(1)(b) GDPR) between you and ExpatTray, or the taking of steps at your request prior to entering into that contract.
Security and Fraud Prevention. We use technical data, platform activity records, verification status, and behavioral signals to detect and prevent fraudulent transactions, unauthorized account access, identity misuse, and other harmful activity. This includes automated monitoring of suspicious patterns and, where necessary, account review or suspension. The legal basis is our legitimate interests (Article 6(1)(f) GDPR) in protecting the integrity of the platform and the interests of our users, balanced against the reasonable expectations of users in a marketplace context.
Legal and Regulatory Compliance. We use verification records, payment data, and transaction history to comply with applicable law, including anti-money laundering obligations, tax reporting requirements, and responses to lawful requests from regulators or law enforcement. The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR). Where AML or financial regulations require us to retain records for a specified period, we will do so regardless of account closure.
Personalization and Analytics. We use platform activity and technical data to understand how users interact with ExpatTray, identify areas for improvement, and provide relevant search results and recommendations. Analytics processing is performed using a product analytics provider that does not engage in cross-site tracking or advertising profiling. Analytics data is associated with identified user sessions, not anonymous. The legal basis for analytics and personalization is our legitimate interests (Article 6(1)(f) GDPR) in improving the quality and relevance of the service.
Marketing Communications. If you have opted in, we may send you email communications about new features, promotions, or platform news. In the EEA and UK, we will only send marketing emails where you have provided clear, freely given, specific, and informed consent (Article 6(1)(a) GDPR). You may withdraw consent at any time by clicking the unsubscribe link in any marketing email or by updating your communication preferences in your account settings. Withdrawing consent does not affect the lawfulness of processing carried out prior to withdrawal.
AI Content Assistance. When you explicitly request AI-assisted listing generation, the text you submit is processed by a third-party AI provider. The legal basis is the performance of a service at your request (Article 6(1)(b) GDPR) or, where applicable, your consent. This processing is entirely optional and user-initiated.
ExpatTray requires service providers to complete identity and, for businesses, corporate verification before transacting on the platform. This process involves the collection and processing of government-issued identity documents and, in some cases, facial images for liveness detection. Facial images and any biometric templates derived from them constitute special category data under Article 9 GDPR. Where required by applicable law, we process this data on the basis of your explicit consent, obtained at the point of verification initiation. In some jurisdictions, we may also rely on the substantial public interest in preventing fraud or fulfilling AML compliance obligations.
Identity document review and liveness checks are performed by a third-party identity verification provider under a Data Processing Agreement. Biometric templates and identity images are retained by that provider for up to 90 days following the completion of verification, after which they are deleted unless retention is required to support an active fraud investigation or legal claim. ExpatTray retains a verification status indicator and a reference identifier linked to your account for regulatory compliance purposes, subject to the retention periods described in Section 9.
Identity verification data is used solely for the purpose of confirming identity and enabling safe transactions on the platform. It is not sold, used for advertising, or shared with third parties outside the verification process. You may request deletion of your verification data after the mandatory retention period has elapsed by contacting [email protected]. Instructions for data deletion requests are also available at /data-deletion.
ExpatTray shares your personal data only to the extent necessary to deliver the platform services, meet legal obligations, or protect legitimate interests. We do not sell personal data.
Third-Party Service Providers. We engage third-party providers in the categories listed below. All providers are bound by Data Processing Agreements that restrict their use of personal data to the purposes for which it was shared and require them to implement appropriate technical and organizational security measures.
| Category | Purpose |
|---|---|
| Cloud infrastructure | Application and database hosting |
| Payment processing | Transaction processing and seller payouts |
| Media storage | Image hosting and delivery |
| Identity verification | Document and liveness verification |
| Authentication providers | Social login (Google, Facebook) |
| Analytics | Product usage analytics |
| AI services | Content assistance |
| Geolocation | Country-level detection for service relevance |
Other Platform Users. When a booking is confirmed, limited profile information (such as your display name, profile picture, and relevant booking details) is shared with the other party to the transaction to facilitate the service. Service providers also receive the booking context necessary to fulfill the appointment. We do not share your contact details or financial information directly with other users.
Payment Processing. Payment transactions are processed by a PCI-DSS compliant third-party payment processor. We share only the transaction reference and account identifiers necessary for the processor to complete or reconcile a payment. We do not transmit or store full payment card numbers.
Legal and Regulatory Disclosure. We may disclose personal data to courts, regulators, tax authorities, law enforcement, or other public bodies where we are required to do so by applicable law, a court order, or a legitimate regulatory request. Where permitted, we will notify you of such requests before disclosure.
Business Transfers. In the event of a merger, acquisition, asset sale, or restructuring involving ConnecTech OU or ConnecTech Digital UK Ltd, personal data held by the affected entity may be transferred to the acquiring party as part of that transaction. We will provide notice to affected users in advance where practicable, and the acquiring party will be required to honor the commitments made in this policy or provide a new policy with at least equivalent protections.
Calendar Integration. When you authorize Google Calendar integration, booking events are created or updated in your calendar through Google's API. This interaction is governed by Google's own privacy terms in addition to this policy.
ExpatTray's primary application infrastructure is hosted in Germany, within the European Union. Data processed by EU-based users is, by default, stored and processed within the EEA.
Some of our third-party service providers operate outside the EEA or the United Kingdom. Where personal data is transferred to a country that does not benefit from an adequacy decision under the GDPR or equivalent UK legislation, we ensure that appropriate safeguards are in place before the transfer occurs. For transfers from the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) GDPR. For transfers from the UK, we rely on the UK Addendum to the International Data Transfer Agreement, as issued by the UK Information Commissioner's Office, or equivalent UK-approved transfer mechanisms.
In addition to contractual safeguards, we apply supplementary technical measures including encryption of data in transit using TLS and encryption of data at rest, as well as access controls that restrict data access to authorized personnel only. We conduct transfer impact assessments for high-risk international transfers and review our transfer mechanisms periodically to ensure continued adequacy.
ExpatTray uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyze usage patterns. Cookies fall into three categories: essential cookies required for the platform to function, analytics cookies that help us understand how the service is used, and preference cookies that remember settings such as language and display options.
Non-essential cookies, including analytics and preference cookies, require your consent when you access the platform from the EEA or the United Kingdom. You may manage or withdraw your consent at any time through the cookie preferences panel available on the platform.
For a full description of the cookies we use, their purposes, and how to control them, see our Cookie Policy.
Security Measures. ExpatTray implements technical and organizational measures designed to protect personal data against unauthorized access, accidental loss, destruction, and disclosure. These measures include encryption of data in transit using TLS, encryption of sensitive data fields at rest, role-based access controls that limit data access to personnel who require it for their duties, regular security assessments, and internal processes for identifying and responding to security incidents. We review our security practices periodically and update them as the threat environment evolves.
We do not claim that any system is completely immune from breach or unauthorized access. However, we commit to taking reasonable and proportionate steps to protect your data, and to responding promptly and transparently when incidents occur.
Breach Notification. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, ExpatTray will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to affected individuals, we will also notify those individuals directly without undue delay, as required by Article 34 GDPR. Notification will describe the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed to address it.
Retention Principles. We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal and regulatory obligations, and to resolve disputes or enforce agreements. When data is no longer needed, we delete or anonymize it in a manner consistent with the sensitivity of the data. Accounts that are closed or deleted are subject to a 30-day retention window, after which identifiable account data is deleted, except where a longer period is required by law.
Retention Table.
| Data Category | Typical Retention |
|---|---|
| Account profile (identifiers, contact) | While account is active; deleted within 30 days of closure (unless required longer by law) |
| KYC/AML verification records | As required by applicable AML/tax laws (commonly 5-7 years) |
| Biometric templates/images (IDV) | Up to 90 days post-verification, unless required for fraud prevention or legal claims |
| Payment tokens and receipts | 7 years for tax and accounting |
| Bookings, invoices, transaction details | 7 years for tax and consumer law |
| Messages and communications | 2 years (longer if part of an active dispute) |
| Support tickets | 3 years |
| Marketing preferences and events | 24 months |
| Web/app analytics identifiers | 14 months (then aggregated/anonymized) |
Under the GDPR and UK GDPR, you have a number of rights in relation to your personal data. The following paragraphs describe each right and how to exercise it. You can exercise many of these rights directly through your ExpatTray account settings. For rights that cannot be fulfilled through self-service, submit a formal request to [email protected]. We will respond within one calendar month of receiving your request. If your request is complex or involves a large volume of data, we may extend this period by a further two months and will notify you of the extension.
We do not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline the request, in either case explaining our reasons in writing.
Access. You may request a copy of the personal data we hold about you, along with information about how it is used and with whom it has been shared. We will provide this in a structured, commonly used format.
Rectification. If the personal data we hold about you is inaccurate or incomplete, you may ask us to correct or complete it. Many profile fields can be updated directly in your account settings.
Erasure. You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and no other legal basis applies, where you have objected to processing and we have no overriding legitimate grounds, or where the processing is unlawful. Erasure is not absolute. We may retain data where a legal obligation requires it (such as AML record-keeping) or where the data is necessary for the establishment, exercise, or defense of legal claims. Instructions for data deletion are available at /data-deletion.
Restriction. You may request that we restrict processing of your data while the accuracy of the data is contested, while an objection is pending, or if the processing is unlawful but you prefer restriction to erasure.
Portability. Where processing is based on your consent or on a contract, and is carried out by automated means, you may request that we provide your data in a machine-readable format, or ask that we transmit it directly to another controller where technically feasible.
Objection. You may object to processing carried out on the basis of legitimate interests, including profiling. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless the processing is necessary for legal claims. You have an unconditional right to object to processing of your data for direct marketing purposes, and we will stop immediately upon receipt of such an objection.
Automated Decisions. You have the right not to be subject to a decision based solely on automated processing if that decision produces legal or similarly significant effects on you. See Section 11 for details of how we use automated processing and how to request human review.
Withdrawal of Consent. Where processing is based on your consent under Article 6(1)(a) or Article 9(2)(a) GDPR, you may withdraw that consent at any time by contacting us or using the relevant controls in your account. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
Supervisory Authority Complaint. You have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work, or the place of the alleged infringement. Our lead EU supervisory authority is the Estonian Data Protection Inspectorate (see contact details in Section 14). UK users may lodge complaints with the Information Commissioner's Office (ICO). We encourage you to contact us first, as we are committed to resolving concerns directly.
ExpatTray uses automated processing in a number of areas of the platform. This section describes how automated decisions are made and your rights in relation to them.
Search and Relevance. The platform uses automated algorithms to rank search results and recommend listings to buyers based on location, category, availability, and platform activity. This processing does not produce legal effects and is aimed at improving the relevance of results.
Identity Verification Document Checks. The identity verification process involves automated analysis of identity documents and facial imagery by our third-party verification provider. The automated output indicates whether submitted documents appear authentic and whether the liveness check was passed. Verification outcomes that affect your ability to transact may constitute decisions with significant effects. Where an automated verification check produces an adverse outcome, you may request a review by contacting [email protected].
Listing Compliance Review. Submitted listings may be assessed by automated tools to identify content that may violate platform policies. Listings flagged automatically are subject to human review before any enforcement action is taken.
Account Security Monitoring. Automated systems monitor account activity for indicators of unauthorized access, fraud, or policy violations. Where monitoring produces an alert that results in account suspension or restriction, a human reviewer will assess the situation before the action becomes permanent. If your account has been suspended, you may request a review by contacting [email protected].
Across all uses of automated processing that may produce significant effects, ExpatTray maintains human oversight as the final decision-making layer. You have the right to request human review of any automated decision that has materially affected you.
ExpatTray is a marketplace platform intended exclusively for users who are 18 years of age or older. Users must confirm they meet this age requirement during registration. We do not knowingly collect personal data from individuals under the age of 18.
If we become aware that a registered account belongs to a person under 18, we will take steps to verify the situation and, where confirmed, will delete the account and associated personal data without delay. We will also notify the relevant supervisory authority if the collection of a minor's data may have given rise to a risk.
If you are a parent or guardian and believe that your child has created an account or submitted personal data to ExpatTray, please contact us at [email protected] so that we can investigate and take appropriate action promptly.
ExpatTray reviews this Privacy Policy periodically and updates it when our practices change, when we introduce new features, or when legal requirements are updated. The next scheduled review is September 19, 2026.
For material changes, meaning changes that significantly affect your rights, the data we collect, or the purposes for which we use it, we will provide at least 30 days' advance notice before the changes take effect. Notice will be given by email to registered users at the address associated with their account, supplemented by a notice displayed on the platform. Where required by law, we will seek fresh consent before applying changes that affect consent-based processing.
Minor changes, such as clarifications of existing practices, correction of typographical errors, or updates to contact information, may be made without advance notice. The "Last Updated" date at the top of this policy will always reflect the most recent version.
If you continue to use ExpatTray after material changes have taken effect, you are considered to have accepted the updated policy. If you disagree with a material change, you should discontinue use and may request deletion of your account and associated data.
Data Protection Officer. All data protection inquiries, rights requests, and privacy concerns should be directed to our Data Protection Officer by email at [email protected]. We aim to respond to all formal requests within one calendar month. If your matter relates to the day-to-day use of the platform rather than a formal data rights request, you may also contact our general support team at [email protected].
Postal Contact.
ConnecTech OU Tartu linn, Parna tn 29-1 50604, Estonia Attn: Data Protection Officer
ConnecTech Digital UK Ltd 34 Anderson Way, Rainham London, RM13 8TE United Kingdom Attn: Data Protection Officer
Supervisory Authorities. You have the right to lodge a complaint with a data protection supervisory authority. We encourage you to contact us first so that we have the opportunity to address your concern directly. If you are not satisfied with our response, or if you prefer to contact a supervisory authority directly, the relevant authorities are:
For EU/EEA residents, our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). You can reach them at aki.ee/en. You may also contact the supervisory authority in your own country of habitual residence or place of work if you prefer.
For UK residents, the relevant authority is the Information Commissioner's Office (ICO), reachable at ico.org.uk.
We are committed to resolving privacy concerns transparently and within the timelines required by applicable law.