The data controller responsible for your personal data is:

timeNough Europe Inc. SARL-S
57 Avenue de la Gare
L-1611 Luxembourg
Grand Duchy of Luxembourg

Registration number: B290035
VAT: LU36579781
Email: legal@tink.you

We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Luxembourg data protection laws.

We collect different types of personal data depending on how you interact with Tink.you:

A. For GiG Workers (Account Holders):
• Full name, date of birth, and nationality
• Email address and phone number (WhatsApp)
• Residential address
• Identity verification documents (KYC via Didit)
• Banking details (IBAN for receiving payments)
• Profile picture
• Transaction history and account activity
• Device information and login data

B. For Tippers (Payment Senders):
• Email address (optional, for receiving receipts)
• Payment data (processed directly by Stripe — we do not store card details)
• IP address and approximate location based on IP address (for fraud prevention)

We process your personal data for the following purposes:

A. Contract Performance (GDPR Art. 6(1)(b)):
• Creating and managing GiG Worker accounts
• Processing tips and transfers
• Identity verification (KYC) via Didit
• Sending transaction notifications via WhatsApp (Twilio)

B. Legal Obligation (GDPR Art. 6(1)(c)):
• Compliance with anti-money laundering (AML) requirements
• Tax and regulatory reporting
• Responding to legal requests

C. Legitimate Interest (GDPR Art. 6(1)(f)):
• Fraud prevention and platform security
• Analytics and service improvement

D. Consent (GDPR Art. 6(1)(a)):
• Marketing communications (GiG Workers can opt-in/out at any time)

We share your personal data with trusted third-party service providers who assist us in operating Tink.you. All processors are contractually bound to protect your data under GDPR:

• Stripe — Payment processing
• Didit — Identity verification (KYC)
• Twilio — WhatsApp messaging
• AbstractAPI — Email verification and VPN detection
• PHP Sessions — Session management (PHPSESSID, CSRF token)

We do not sell your personal data. We do not share your personal data with third parties for marketing purposes.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account Data: Duration of your active account + 5 years after closure (legal requirements)
• Transaction Data: 10 years (Luxembourg tax and accounting obligations)
• KYC Documents: 5 years after end of business relationship (AML compliance)
• Payment Data: Retained by Stripe per their retention policy
• Session Cookies: Expire on browser close or after 24 hours
• Marketing Data: Until consent is withdrawn

When personal data is no longer needed, it is securely deleted or anonymised.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

• Encryption: All data transmission is encrypted via TLS/SSL. Sensitive data is encrypted at rest
• Access Control: Strict role-based access to our internal systems
• Payment Security: Stripe processes all payment data in their PCI-DSS compliant environment
• Identity Verification: Didit handles sensitive KYC documents in their secure environment
• Regular Audits: We periodically review and test our security practices
• Breach Notification: In the event of a data breach affecting your rights, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR.

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15): You can request a copy of your personal data
• Right to Rectification (Art. 16): You can request correction of inaccurate data
• Right to Erasure (Art. 17): You can request deletion of your data (restrictions apply)
• Right to Restriction of Processing (Art. 18): You can request limitation of processing
• Right to Data Portability (Art. 20): You can receive your data in a structured format
• Right to Object (Art. 21): You can object to processing based on legitimate interest
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, contact us at legal@tink.you. We will respond within 30 days. Identity verification may be required.

Some of our third-party service providers are located outside the European Economic Area (EEA). When we transfer your personal data outside the EEA, we ensure adequate protection through:

• Adequacy Decisions: Transfers to countries with adequate protection recognised by the European Commission
• Standard Contractual Clauses (SCC): EU-approved contracts with processors
• Supplementary Measures: Additional security measures as needed

You can request information about the specific safeguards we use for international transfers by contacting us.

Tink.you is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. GiG Workers must be at least 18 years old to register and complete KYC verification.

If we become aware that we have collected personal data from a child under 18, we will take immediate steps to delete that information. If you believe a child has provided us with personal data, please contact us at legal@tink.you.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify active GiG Workers via WhatsApp or email
• Display a prominent notice on our platform

Your continued use of Tink.you after any changes constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

timeNough Europe Inc. SARL-S
57 Avenue de la Gare
L-1611 Luxembourg
Email: legal@tink.you

If you are unsatisfied with our response or believe that we are processing your personal data in a manner that is not compliant with the law, you have the right to lodge a complaint with:

Commission Nationale pour la Protection des Données (CNPD)
15, Boulevard du Jazz
L-4370 Belvaux, Luxembourg
Website: cnpd.public.lu