The data controller responsible for your personal data is:

timeNough Europe Inc. SARL-S
57 Avenue de la Gare
L-1611 Luxembourg
Luxembourg

Registration Number: B267980
Date of Registration: 31/05/2022
VAT Registration Number: 20222439923
VAT Number: LU34107527
Email: legal@tink.you

We are committed to protecting your privacy and ensuring that your personal data is handled in accordance with the General Data Protection Regulation (GDPR) and applicable Luxembourg data protection laws.

We collect different types of personal data depending on how you interact with Tink.you:

A. For GiG Workers (Account Holders):
• Identity Data: Full name, date of birth, gender, citizenship, marital status (for KYC compliance)
• Contact Data: Email address, phone number (including WhatsApp number for 2FA)
• Financial Data: IBAN, payout method preferences, payment history
• Identity Verification Data: Government-issued ID documents processed through Didit for KYC
• Account Data: Worker code/handle, password (encrypted), security preferences
• Usage Data: Login history, IP addresses, session data, backoffice activity logs

B. For Tippers (Customers Sending Tips):
• Communication Data: WhatsApp phone number, conversation content with our automated system
• Transaction Data: Tip amounts, recipient worker codes, payment timestamps
• Payment Data: Payment card details are processed directly by Stripe and are NOT stored on our servers

C. Automatically Collected Data:
• Technical Data: IP address, browser type, device information, operating system
• Location Data: Approximate geographic location based on IP address (for fraud prevention)

We process your personal data for the following purposes:

A. Contract Performance (GDPR Art. 6(1)(b)):
• Creating and managing GiG Worker accounts
• Processing tip payments and facilitating payouts
• Enabling WhatsApp-based tipping conversations
• Managing sharing rules between workers
• Providing the secure backoffice functionality

B. Legal Obligations (GDPR Art. 6(1)(c)):
• Conducting KYC (Know Your Customer) verification as required by anti-money laundering regulations
• Maintaining financial records for tax and accounting purposes
• Responding to legitimate requests from law enforcement authorities

C. Legitimate Interests (GDPR Art. 6(1)(f)):
• Preventing fraud and ensuring platform security
• Improving our services and user experience
• Analyzing usage patterns to optimize platform performance
• Sending service-related notifications (not marketing)

D. Consent (GDPR Art. 6(1)(a)):
• Sending optional newsletter communications (GiG Workers can opt-in/out at any time)

We share your personal data with trusted third-party service providers who assist us in operating Tink.you. All processors are contractually bound to GDPR-compliant data processing agreements:

A. Stripe, Inc. (Payment Processing)
• Purpose: Processing tip payments securely
• Data shared: Payment card details (processed directly, not stored by us), transaction amounts
• Location: USA (EU-US Data Privacy Framework certified)
• Privacy Policy: stripe.com/privacy

B. Twilio Inc. (WhatsApp Communication)
• Purpose: Powering WhatsApp-based tipping conversations
• Data shared: Phone numbers, message content
• Location: USA (Standard Contractual Clauses in place)
• Privacy Policy: twilio.com/legal/privacy

C. Didit (Identity Verification)
• Purpose: KYC verification for GiG Workers
• Data shared: Identity documents, facial recognition data, personal details
• Privacy Policy: didit.me/privacy

D. AbstractAPI (Data Validation)
• Purpose: Email address and IBAN validation
• Data shared: Email addresses, IBAN numbers (server-side API calls only)

We do NOT sell, rent, or trade your personal data to third parties for marketing purposes.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account Data: Retained for the duration of your active GiG Worker account, plus 5 years after account closure for legal and tax compliance

• Transaction Records: Retained for 10 years as required by Luxembourg commercial law and anti-money laundering regulations

• KYC Documents: Retained for 5 years after the business relationship ends, as required by AML regulations

• WhatsApp Conversation Logs: Retained for 90 days for dispute resolution purposes, then automatically deleted

• Session and Login Data: Retained for 12 months for security monitoring

• Released Worker Codes: Worker codes that are released due to inactivity become available for new registration after 365 days

When data is no longer needed, it is securely deleted or anonymized.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3
• Password Security: Passwords are hashed using industry-standard algorithms and never stored in plain text
• Access Controls: Strict access controls limit who can access personal data within our organization
• Security Monitoring: We continuously monitor for security threats and vulnerabilities
• Data Processing Agreements: All third-party processors are bound by GDPR-compliant data processing agreements
• Regular Audits: We conduct regular security assessments of our systems and third-party processors

While we strive to protect your personal data, no method of transmission over the Internet is 100% secure. In the event of a data breach affecting your rights, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR.

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15): You can request a copy of the personal data we hold about you.

• Right to Rectification (Art. 16): You can request correction of inaccurate or incomplete data. GiG Workers can update most information directly in their backoffice.

• Right to Erasure (Art. 17): You can request deletion of your personal data, subject to legal retention requirements.

• Right to Restriction (Art. 18): You can request that we limit processing of your data in certain circumstances.

• Right to Data Portability (Art. 20): You can request your data in a structured, commonly used, machine-readable format.

• Right to Object (Art. 21): You can object to processing based on legitimate interests.

• Right to Withdraw Consent (Art. 7): Where processing is based on consent, you can withdraw it at any time.

To exercise these rights, contact us at legal@tink.you. We will respond within 30 days. Identity verification may be required.

Some of our third-party service providers are located outside the European Economic Area (EEA). When we transfer your personal data outside the EEA, we ensure adequate protection through:

• EU-US Data Privacy Framework: For transfers to US companies that are certified under this framework (e.g., Stripe)

• Standard Contractual Clauses (SCCs): EU Commission-approved clauses that provide contractual safeguards (e.g., Twilio)

• Adequacy Decisions: Transfers to countries recognized by the EU as providing adequate data protection

You can request more information about the safeguards we use for international transfers by contacting us.

Tink.you is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. GiG Workers must be at least 18 years old and must verify their age through our KYC process. If we become aware that we have collected personal data from a child without verification of parental consent, we will take steps to delete that information promptly. If you believe we have inadvertently collected data from a minor, please contact us immediately at legal@tink.you.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify registered GiG Workers via email for significant changes
• Post a prominent notice on our platform

We encourage you to review this Privacy Policy periodically. Your continued use of Tink.you after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

timeNough Europe Inc. SARL-S
57 Avenue de la Gare
L-1611 Luxembourg
Luxembourg

Email: legal@tink.you

We aim to resolve all complaints internally. If you are not satisfied with our response, you have the right to lodge a complaint with:

Commission Nationale pour la Protection des Données (CNPD)
15, Boulevard du Jazz
L-4370 Belvaux
Luxembourg
Website: cnpd.public.lu