Version 1.1 · in force from August 20, 2026
Privacy Policy
Version 1.1 · Effective from 20 August 2026
1. Who is responsible for your data
The controller of your personal data is Afterworc OÜ, registry code 17554808, registered address Mäealuse tn 10/2, Mustamäe linnaosa, Tallinn, Harju maakond, 12618, Estonia.
For any question about your data, write to info@afterworc.com.
This policy explains what we collect when you use the AfterWorc platform, why, on what legal basis, how long we keep it and what you can require of us.
2. What we collect
Account data. Email address, password (stored only as a cryptographic hash, never in readable form), interface language, time zone, two-factor authentication settings, and the records of your consents.
Profile data. Name or business name, country, professional specialisation, skills, experience, rates, portfolio items and links, profile photo, and anything else you choose to publish.
Verification data. For the Verified level: identity document data and a face image, processed by a specialist identity verification provider. We do not store copies of identity documents ourselves; we store the outcome of the check, its date and the provider's reference. For the Worc-Checked level: interview notes and reference contacts you have named, with the outcome and the reason for it.
Deal data. Offers, briefs, proposals, agreed scope and price, milestones, delivered files, acceptance and dispute records, reviews.
Financial data. Balance and ledger entries, bank details you provide for withdrawal, payment references and matched bank statement lines, invoices, and the tax identifiers we are required to hold.
Communications. Messages you send through the Platform, support tickets, and the delivery records of the emails we send you. We never store the body of an outgoing email and never write it to our logs.
Technical data. IP address, browser and device information, timestamps, and the audit records of significant actions on your account.
Measurement data, only if you agree to it. If you accept the analytics or marketing categories in the cookie banner, your browser sends Google, Microsoft, Meta and LinkedIn the pages you open, the steps you take through them, an identifier for your browser and your IP address. We do not send them anything from our own database, and we never send them your name, your email address, anything you have typed into a field, or the identifier of your account. If you refuse, none of this is sent and none of those providers is contacted at all. The full list of tools and cookies is in our Cookie Notice, section 4.3.
3. Why we process it, and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, providing the Platform, concluding and settling Deals | Art. 6(1)(b) — performance of a contract |
| Confirming your email address and securing your account | Art. 6(1)(b) and Art. 6(1)(f) — our legitimate interest in a secure service |
| Identity verification for the Verified level | Art. 6(1)(b); document and biometric data under Art. 9(2)(a) — your explicit consent |
| Live interview and reference checks for the Worc-Checked level | Art. 6(1)(a) — your consent, given by requesting the level |
| Holding funds, charging commission, keeping accounting records | Art. 6(1)(b) and Art. 6(1)(c) — legal obligation |
| Preventing fraud, abuse and money laundering; enforcing our Terms | Art. 6(1)(f) and Art. 6(1)(c) |
| Handling reports of unlawful content, moderation and appeals | Art. 6(1)(c) — obligations under the Digital Services Act |
| Reporting to tax authorities where the law requires it | Art. 6(1)(c) |
| Service emails about your account, your Deals and your money | Art. 6(1)(b) |
| News and marketing emails | Art. 6(1)(a) — your consent, withdrawable at any time |
| Product analytics and improvement (Google Analytics, Microsoft Clarity) | Art. 6(1)(a) — your consent, given in the cookie banner |
| Measuring advertising (Google Ads, Meta Pixel, LinkedIn Insight Tag) | Art. 6(1)(a) — your consent, given in the cookie banner |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before it.
4. Decisions about you
We use automated tools to flag suspected fraud, abuse and unlawful content. A decision that restricts your account, your visibility or your money is taken or confirmed by a person. You will be told what was decided, on what ground, and whether automated means were involved, and you may contest it and ask for it to be reviewed by a person.
Ranking in search results uses relevance, verification level, profile completeness, rating, activity and, where applicable, paid promotion. Paid placements are labelled. We publish the main parameters of ranking on the Platform.
5. Who sees your data
Other Users. Your public profile, your verification level, your rating and your reviews are visible to other Users. What you publish in a profile is published by you. Within a Deal, the other party sees your name, the agreed terms, your messages and the files you deliver.
Our processors. We use service providers who process data on our instructions and under a written agreement: hosting and infrastructure, email delivery, error and performance monitoring, and — once engaged — identity verification and payment services. We publish the current list on the Platform and update it when it changes.
Measurement and advertising providers, only if you agree to them. Google Ireland Limited (Google Analytics 4, Google Ads), Microsoft Ireland Operations Limited (Clarity), Meta Platforms Ireland Limited (Meta Pixel) and LinkedIn Ireland Unlimited Company (Insight Tag) receive data directly from your browser, not from our servers, and only after you have accepted the category they belong to. For their own analytics and advertising purposes they act as controllers in their own right, alongside us. Refusing the categories stops them being contacted at all.
Authorities. We disclose data where the law obliges us to, and no further than the obligation requires.
We do not sell your personal data. We do not share it for third-party advertising beyond the advertising measurement described just above, which happens only with your consent and only through your own browser.
6. Where your data is
Your data is stored and processed in the European Union. Our servers are in the EU and we select processors that keep data in the EU or EEA.
There is one exception, and we state it rather than leave it to be found. If you accept the analytics or marketing categories, the measurement data described in section 2 goes to Google, Microsoft, Meta and LinkedIn. They are engaged through their Irish entities, but each belongs to a group with infrastructure in the United States, and that data may be processed there. Those transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework and, where it does not cover a particular transfer, on Standard Contractual Clauses. Refuse the categories and no such transfer takes place.
7. How long we keep it
| Data | Period |
|---|---|
| Account and profile | For as long as the account exists |
| Registrations that never became an account | 12 months from collection |
| Deals, invoices, ledger entries and accounting records | 7 years from the end of the financial year, as required by Estonian accounting law |
| Verification outcomes | For as long as the account exists, and 5 years after where anti-money-laundering law requires |
| Messages within a Deal | 3 years after the Deal closes — they are the evidence in a dispute |
| Consent records | For as long as required to demonstrate lawful processing, and not deleted on withdrawal: withdrawal is recorded as a new entry |
| Moderation decisions and their statements of reasons | 5 years |
| Technical logs | 12 months at most |
When a period ends, data is deleted or irreversibly anonymised. Closing your account does not delete what we are legally required to keep; the rest is removed.
8. Your rights
Under the GDPR you may:
- ask what we hold about you and receive a copy;
- correct inaccurate data — most of it you can correct yourself in your settings;
- have data erased where we no longer have a basis to keep it;
- restrict or object to processing based on our legitimate interest;
- receive your data in a machine-readable format and have it sent to another provider where technically feasible;
- withdraw consent at any time;
- not be subject to a decision based solely on automated processing that produces legal effects — see section 4.
Write to info@afterworc.com. We answer within one month; if a request is complex we may extend by two months and will tell you why. We do not charge for this, unless a request is manifestly unfounded or excessive.
If you believe we handle your data unlawfully, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee), or to the supervisory authority of your country of residence.
9. Cookies
We use cookies that are necessary for the Platform to work — signing you in, keeping your session, protecting against cross-site request forgery. These do not require consent.
Analytics and marketing cookies are set only with your consent, which you may give or refuse when you first visit and change at any time, at /settings/cookies. Refusing them does not restrict your use of the Platform in any way.
Since 20 August 2026 those categories are not hypothetical: they cover Google Analytics 4, Google Ads, Microsoft Clarity, Meta Pixel and LinkedIn Insight Tag. Our Cookie Notice names every one of them, every cookie they set, how long each one lives and what we can and cannot delete when you withdraw. It is the fuller document on this subject, and where the two texts describe the same thing, it governs.
10. Security
Passwords are stored as hashes computed with a memory-hard algorithm and are never recoverable. Traffic is encrypted in transit. Access to production data is limited to those who need it and is logged; an operator viewing your personal data is itself recorded as an audit event.
Uploaded files are served from a separate domain, without Platform cookies, and always as a download rather than as a page.
We keep no antivirus scanner in our own perimeter at present. We compensate for this by checking file content rather than trusting file extensions, by limiting file types and sizes, and by the isolation described above. We will say so here if that changes.
If a personal data breach occurs that is likely to result in a high risk to you, we will tell you without undue delay, and we will notify the supervisory authority within 72 hours.
11. Children
The Platform is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, write to info@afterworc.com and we will remove the account.
12. Changes to this policy
We may update this policy. Where a change materially affects your rights, we notify you and the new version takes effect no earlier than 15 days later. Every published version remains available, and we record which version you accepted and when.
13. Contact
Afterworc OÜ, Mäealuse tn 10/2, Mustamäe linnaosa, Tallinn, Harju maakond, 12618, Estonia.