Data-sharing addendum for professionals

Last updated: 16 October 2026 · Part of the Terms for professionals (version pro-terms-2026-10-16)

This addendum is between Scality Ltd (reg. no. HE459172), trading as Ergo (“we”), and you, the professional receiving customer requests (“you”). It applies to every customer’s personal data we share with you (“Customer Data”): name, phone number, WhatsApp preference, email address, job details (service, city or area, timing, budget, description) and any photo, whether you receive it by email or in your professional area.

1. Roles

We and you are each an independent controller of Customer Data under the GDPR. We decide how requests are collected and matched; once a request is shared with you, you decide how you use it to respond and do the job, within the limits of this addendum. We are not joint controllers, and neither of us processes Customer Data on the other’s behalf. Each of us is responsible for its own compliance with the GDPR and Cyprus law.

2. Purpose limitation

• Use Customer Data only to contact that customer about that request, to give a quote, and to carry out, invoice and support any job the customer agrees with you.
• Do not sell, rent or give Customer Data to anyone else, and do not use it for marketing, newsletters, other offers or to build contact lists unless the customer separately and freely agrees to that with you directly.
• Do not pass a lead to another business. If you cannot take the job, tell us and do not contact the customer.
• Do not copy Customer Data into tools that use it for their own purposes (for example public AI tools that train on inputs).

3. Telling the customer who you are

When you first contact a customer, say your name and business name, that you received their request through Ergo, and how they can reach you about their data (GDPR Art. 14(3)(b)). If you keep their data after the first contact, give them your own privacy information or a link to it.

4. Security

• Keep Customer Data secure (GDPR Art. 32): protect your phone and computer with a screen lock, keep software up to date, don’t share your Ergo login, and limit access to people in your business who need it.
• Photos are shown through short-lived links. Save them only if you need them for the job.
• Keep Customer Data in the EU/EEA or, if your tools store it elsewhere, only with a lawful transfer safeguard (GDPR Chapter V).

5. Retention and deletion

• If no job results, delete Customer Data (including the lead emails we sent you, messages, call notes and photos you saved) no later than 6 months after you received it.
• If you do the job, you may keep what you need for invoicing, guarantees and tax, for as long as the law requires.
• Requests in your Ergo professional area are deleted automatically 12 months after submission.

6. Customer rights and deletion requests

• If a customer asks you directly to access, correct or delete their data, or objects, deal with it yourself within one month (GDPR Art. 12) and tell us at privacy@ergocy.com if it concerns a request from Ergo.
• When a customer asks us to delete their data or withdraws consent, we will tell every professional who received it (GDPR Art. 19). You must then delete the Customer Data (except what you must keep under section 5 for a job already agreed) and stop contacting them within 7 days, and confirm to us by email when done.

7. Breaches

If Customer Data is lost, stolen or accessed by someone who should not have it (for example a lost phone or a hacked email account), you are responsible as controller for notifying the Office of the Commissioner for Personal Data Protection within 72 hours where required (GDPR Art. 33) and the customer where required (Art. 34). Please also tell us at privacy@ergocy.com within 48 hours of becoming aware, so we can protect other customers. We will tell you without undue delay if a breach on our side affects leads delivered to you.

8. Cooperation and checks

Each of us will help the other, reasonably and promptly, with customer requests, complaints and questions from the data protection authority about Customer Data. On request, you will confirm in writing that you follow this addendum. If you break it, we may restrict or end your account under section 8 of the Terms for professionals.

9. Liability

Each of us is liable for its own processing of Customer Data and for any fines or claims arising from its own breach of the GDPR or this addendum, as set out in GDPR Art. 82.

10. Duration

This addendum applies for as long as you hold Customer Data received through Ergo, including after your account closes. Each lead is shared with no more than 5 professionals.