Privacy policy
Last updated: 16 October 2026
This policy explains how Ergo handles personal data about customers who request quotes, professionals who receive requests, and prospective professionals we would like to invite. It is given under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and the Cyprus Law 125(I)/2018.
1. Who is responsible
Ergo is operated by Scality Ltd, a company registered in Cyprus (reg. no. HE459172, VAT CY60062286C), Attikis 3, 401, Larnaca Center, 6045 Larnaca, Cyprus. Scality Ltd is the controller of the personal data described here.
Privacy contact: privacy@ergocy.com, or by post to the address above (mark it “Privacy”). We have not appointed a Data Protection Officer because the law does not require one for our activities (GDPR Art. 37); the privacy contact handles all data protection questions.
2. How Ergo works, in short
You describe a job once. We match it by service and city with independent local professionals and send it to 3 of them by default, and never more than 5, by email and in their professional dashboard. Those professionals contact you directly, and you agree any price with them and pay them directly. We don’t carry out or manage the work and we never take a commission on the job price. How we choose professionals is explained in our Terms.
3. Customers: what we collect and why
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Your request: service, city (and area if you give it), timing, budget, job description and an optional photo; your name, phone number (and whether you use WhatsApp) and email address | To record your request, confirm it to you by email, and match it with suitable professionals | Art. 6(1)(b): steps you ask us to take, under our customer Terms |
| Sending that request and your contact details by email, and showing them in the professional dashboard, to 3 matched professionals by default (never more than 5) | So they can contact you by phone, SMS, WhatsApp or email about this job | Art. 6(1)(a): your consent, given with the checkbox on the request form. We record the wording, its version and the time. |
| Records of which professionals received your request, when it was emailed and when they opened it in their dashboard | To run the service fairly, handle complaints, and investigate misuse | Art. 6(1)(f): our legitimate interest in a reliable, secure service |
| What professionals tell us about the request, such as “wrong number”, “out of area” or “job won” | To check lead quality and prevent abuse | Art. 6(1)(f): our legitimate interest in a reliable, fair service |
| Security data: the anti-spam check result, IP address and browser details in short-lived server logs | To protect the forms from spam and fraud and keep the site secure | Art. 6(1)(f): our legitimate interest in security |
Your name, phone number and email address, the service, city, timing and a short description are needed to send a request; without them we cannot match it and professionals cannot reach you. The budget and photo are optional. Please don’t include health information or other sensitive details in the description or photo; photos are re-saved without location (EXIF) data.
Withdrawing consent. You can withdraw at any time by emailing privacy@ergocy.com. We then stop sharing your request with any further professionals and delete it unless we need to keep it to deal with a dispute. Withdrawal does not undo sharing that already happened, but we will pass your request to delete on to every professional who received your details (see section 6).
4. Professionals: what we collect and why
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Name, business name, mobile/WhatsApp, email, services, cities, weekly capacity, description; sign-in email and login records | To create and run your account, verify who you are, match and deliver customer requests and handle support | Art. 6(1)(b): our contract with you (the Terms for professionals) |
| Professional dashboard: sign-in details (email magic link or Google sign-in), session and login records, and a log of which leads you opened and when | To keep your account secure, show you the leads sent to you, and investigate misuse or disputes | Art. 6(1)(b) contract; Art. 6(1)(f) security |
| If you tick “Call me about joining” on the join form: your phone number, the consent wording, version and time, and a record of our calls or messages about joining | To call you back about joining, and to prove you asked us to | Art. 6(1)(a) consent (Cyprus Law 112(I)/2004 Art. 106). Withdraw any time by email or by replying STOP. |
| Records of the terms and privacy notice you accepted (text, version, time) | To show what you agreed to | Art. 6(1)(f): legitimate interest in being able to prove our agreements; Art. 7(1) for consents |
| Leads delivered to you, reports you make about leads, complaints and their outcome | To handle complaints, keep matching fair and, if fees are introduced later, bill correctly | Art. 6(1)(b) contract; Art. 6(1)(f) fair operation of the service |
| Invoices and payment records (once paid plans start) | Tax and accounting | Art. 6(1)(c): legal obligation under Cyprus tax and VAT law |
| News and offers by email, SMS or WhatsApp, only if you ticked the optional box | Marketing about Ergo | Art. 6(1)(a) consent, as Cyprus Law 112(I)/2004 requires for electronic marketing. Unsubscribe any time. |
Our admin back office
A small number of authorised Ergo staff use a protected admin area to review professional applications, check lead delivery, handle complaints and answer data protection requests. Admin access requires individual sign-in, is limited to what each task needs, and is logged (who accessed which record, when and what was changed) so we can detect and investigate misuse (Art. 6(1)(f) and Art. 32).
5. Prospective professionals (data we obtain from public sources)
To build a network of local professionals, we may make a short list of businesses that publicly advertise home services in Cyprus. This section is our Article 14 notice to them.
- What we hold: business name, trade, service area, publicly listed business contact details (address, phone, email, website), the public listing’s link, rating and review count, and our short note on the business’s public online presence. We do not collect home addresses, personal social-media profiles, family details or reviewers’ data.
- Sources: public business listings and search results (Google Maps and Google Search, including data obtained through the DataForSEO service), the business’s own website, public directories and the public Cyprus companies register.
- Why and legal basis: to identify suitable businesses and invite them to join Ergo. Our legitimate interest (Art. 6(1)(f)) is recruiting local professionals so customers can be served; we have assessed that this does not override your interests given the limited, published business data involved and the safeguards below. We do not send marketing emails, SMS or WhatsApp messages, or make marketing calls, to you without your prior consent.
- Retention: if you don’t respond or sign up, we delete your details no later than 6 months after we collected them. If you sign up, section 4 applies.
- Opting out: email privacy@ergocy.com with “STOP” (or write to us). We stop immediately and add only the minimum needed (for example your business phone or email) to a do-not-contact list, which we check before any contact so that we never contact you again on any channel. You may object at any time, free of charge (Art. 21(2)–(3)).
- Recipients: only our team and the IT providers listed in section 7. We do not sell or share this list.
6. Sharing with professionals: independent controllers
We send each lead to the professional’s business email address and make it available in their dashboard. When we share your request with a professional, that professional (including the mailbox they receive our emails in) becomes a separate, independent controller of the details received and is responsible for how they use them. We are not joint controllers with professionals. Every professional must accept our data-sharing addendum, which requires them to use your details only to respond to and carry out your job, never to sell them or use them for unrelated marketing, to keep them secure, to tell you who they are when they first contact you, to delete them when no longer needed (and at the latest 6 months after receipt if no job results), and to act on deletion requests we pass on. If you want to exercise your rights against a professional, you can contact them directly or ask us and we will pass your request on (GDPR Art. 19).
We also share data when the law requires it (for example with a court or a public authority) or to establish or defend legal claims. We never sell personal data.
7. Service providers (processors) and international transfers
We use these providers to run Ergo. They act on our instructions under data processing agreements (GDPR Art. 28):
| Provider | What for | Where data is processed | Transfer safeguard |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore, with Supabase, Inc., USA) | Database, private photo storage, professional sign-in | EU: Frankfurt, Germany (AWS eu-central-1). Remote support access may come from Singapore or the USA. | EU Standard Contractual Clauses (Art. 46(2)(c)) in Supabase’s DPA |
| Vercel Inc. (USA) | Website hosting and server functions (run in Frankfurt), short-lived logs | EU and USA | EU–US Data Privacy Framework (Art. 45); Standard Contractual Clauses as a fallback |
| Cloudflare, Inc. (USA) | Domain name service (DNS) and Turnstile anti-spam checks on our forms | Global network incl. EU and USA | EU–US Data Privacy Framework; Standard Contractual Clauses as a fallback |
| Twilio Inc. (USA) – not yet in use | SMS notifications, once we switch them on | USA and other countries | EU–US Data Privacy Framework; Twilio Binding Corporate Rules and Standard Contractual Clauses |
| Resend (Plus Five Five, Inc., USA): transactional email | Sending request confirmations to customers, lead emails to professionals, and sign-in links | Emails sent from the EU region (Ireland, eu-west-1); Resend and its sub-processors may access account and delivery data from the USA | EU–US Data Privacy Framework (Resend is certified); Standard Contractual Clauses in Resend’s data processing addendum as a fallback |
| Our mailbox and office-software provider (to be confirmed) | Sending and receiving email with you, including privacy requests | To be confirmed | As set out in its data processing agreement |
The EU–US Data Privacy Framework is covered by the European Commission’s adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795). Cloudflare also processes limited Turnstile signals (such as IP address and browser data) as an independent controller to improve its bot detection, as described in its own privacy notice. You can ask us for a copy of the relevant safeguards at privacy@ergocy.com.
8. How long we keep data
| Data | Kept for |
|---|---|
| Customer requests, photos and the related consent record | 12 months after submission, then deleted automatically (photos are removed from storage shortly after) |
| Records of which professional received which request, and when they opened it | Deleted together with the request (12 months) |
| Lead emails we sent | Delivery logs at our email provider: no longer than 30 days (to be confirmed with the provider). Copies in professionals’ own mailboxes are their responsibility (section 6). |
| Login records and admin access logs | 12 months, then deleted |
| “Call me about joining” consent records | For as long as we may rely on the consent and up to 3 years after you withdraw or our last contact, to be able to prove it; your number is placed on our do-not-contact list if you withdraw |
| Professional accounts | While the account is active, then 24 months after it closes (for disputes and complaints), then deleted |
| Applications that are never activated | 6 months after sign-up |
| Invoices and payment records | As long as Cyprus tax law requires (currently 6 years) |
| Prospective professionals | 6 months after collection unless they sign up |
| Do-not-contact list | Only the minimum identifier, for as long as we do outreach, so we can keep honouring your objection |
| Server and security logs | Short-lived; no longer than 30 days |
9. Your rights
You have the right to access your data (Art. 15), correct it (Art. 16), have it erased (Art. 17), restrict its use (Art. 18), receive it in a portable format (Art. 20), and object to processing based on our legitimate interests (Art. 21(1)), and to direct marketing at any time (Art. 21(2)). Where we rely on consent, you can withdraw it at any time without affecting earlier processing (Art. 7(3)).
To use your rights, email privacy@ergocy.com. We may ask you to confirm your identity, for example by replying from the phone number or email you used. We reply within one month; for complex requests we may extend this by up to two further months and will tell you why (Art. 12(3)). It is free unless a request is manifestly unfounded or excessive.
Matching is automated (service and city, availability and fair rotation). It does not produce legal or similarly significant effects on you, so it is not automated decision-making under Art. 22, but you can always ask us how a request was matched.
10. Complaints
Please tell us first so we can try to fix it. You also have the right to complain to a supervisory authority (Art. 77). In Cyprus this is the Office of the Commissioner for Personal Data Protection, Kypranoros 15, 1061 Nicosia, Cyprus (P.O. Box 23378, 1682 Nicosia); tel. +357 22 818456; commissioner@dataprotection.gov.cy; www.dataprotection.gov.cy. You may also complain in the EU country where you live or work.
11. Security
Data is encrypted in transit and at rest. Customer requests are stored in the EU with row-level access rules so that each professional can see only the requests sent to them; photos are private and opened only through short-lived links. Access by our team is limited to what is needed.
12. Cookies
See our Cookie policy. We currently use only strictly necessary storage and no analytics or advertising cookies.
13. Children
Ergo is for adults. Please don’t submit a request if you are under 18.
14. Changes
We will update this page when our processing changes and show the new date at the top. If a change affects consent you gave, we will ask again.