PRIVACY & DATA PROTECTION POLICY
Version 1.0
Effective Date: June 4, 2026

IMPORTANT NOTICE

This Privacy & Data Protection Policy (“Privacy Policy”) explains how GUMBAE LTD (“GUMBAE”, “we”, “us”, “our”) collects, uses, stores, processes, and protects personal data.
This Policy applies to all users of the GUMBAE platform, including clients, freelancers, agencies, contractors, and managed-service personnel.
By using GUMBAE, you agree to this Privacy Policy.

1 — SCOPE AND APPLICATION

1.1 Covered Data

This Policy applies to all personal and business-related data including:

  • account registration information
  • identity verification data
  • payment and transaction data (via third-party providers)
  • communications and messages
  • service delivery content
  • uploaded files, documents, and media
  • AI-generated or AI-processed inputs and outputs
  • platform usage data and analytics

1.2 Platform Structure Acknowledgement

GUMBAE operates as:

  • a marketplace platform (client ↔ freelancer)
  • a managed-service platform (client ↔ GUMBAE)
  • a hybrid service coordination system
  • Data processing varies depending on transaction type.

2 — DATA CONTROLLER AND PROCESSOR ROLE

2.1 Role Variation

GUMBAE may act as:

  • Data Controller (when determining purposes of processing)
  • Data Processor (when processing data on behalf of clients)
  • Joint Controller (in limited regulatory scenarios)

2.2 Third-Party Processors

GUMBAE may use:

  • payment processors
  • cloud infrastructure providers
  • analytics providers
  • verification and identity service providers
  • AI infrastructure providers

3 — INFORMATION WE COLLECT

3.1 Information Provided by Users

We collect:

  • name, email, phone number
  • business or professional details
  • profile information
  • identity verification documents
  • tax or compliance information where required

3.2 Service Data

We collect:

  • project details
  • messages and communications
  • files and deliverables
  • client instructions
  • freelancer submissions

3.3 Technical Data

We may collect:

  • IP address
  • device information
  • browser type
  • usage logs
  • cookies and tracking data

3.4 AI Interaction Data

Where AI systems are used:

  • prompts
  • inputs
  • outputs
  • annotations
  • model interaction logs

4 — PURPOSE OF DATA USE

  • We use personal data to:
  • provide platform services
  • match clients and freelancers
  • process transactions
  • enable managed-service delivery
  • verify identities and prevent fraud
  • enforce platform policies
  • improve AI systems and workflows (where permitted)
  • comply with legal obligations

5 — LEGAL BASIS FOR PROCESSING

Depending on jurisdiction, we process data based on:

  • contractual necessity
  • legitimate business interests
  • user consent
  • legal obligations
  • fraud prevention and security needs

6 — DATA SHARING AND DISCLOSURE

6.1 Within the Platform

Data may be shared between:

  • clients and freelancers (for marketplace transactions)
  • GUMBAE internal teams (for managed services)
  • verified subcontractors under managed-service contracts

6.2 Third-Party Sharing

We may share data with:

  • payment service providers
  • compliance and verification partners
  • infrastructure providers
  • legal or regulatory authorities where required

6.3 No Unauthorized Sale of Data

GUMBAE does NOT sell personal data.

7 — INTERNATIONAL DATA TRANSFERS

Data may be transferred to and processed in:

  • Nigeria
  • United States
  • other jurisdictions where service providers operate

Users acknowledge that data protection laws may differ across jurisdictions.

8 — DATA RETENTION

8.1 Retention Period

We retain data:

  • as long as necessary for platform operations
  • for legal, tax, and compliance obligations
  • for dispute resolution purposes
  • for fraud prevention and security

8.2 Post-Termination Storage

  • After account termination:
  • certain data may be retained for legal compliance
  • dispute-related records may be preserved
  • confidential data remains protected under confidentiality obligations

9 — USER RIGHTS

  • Subject to applicable law, users may have rights to:
  • access personal data
  • correct inaccurate data
  • request deletion (where legally permitted)
  • restrict processing
  • object to certain processing
  • data portability
  • Requests may be subject to verification.

10 — SECURITY MEASURES

GUMBAE implements reasonable safeguards including:

  • encryption where applicable
  • access control restrictions
  • secure storage systems
  • monitoring for unauthorized access
  • third-party security compliance requirements

No system is 100% secure, and users acknowledge inherent risk.

11 — COOKIES AND TRACKING

GUMBAE may use:

  • cookies
  • analytics tools
  • session tracking
  • performance monitoring systems

Users may manage cookie preferences through browser settings.

12 — AI AND DATA USAGE

12.1 AI Processing Notice

User data may be processed using AI systems for:

  • classification
  • moderation
  • workflow automation
  • quality control
  • fraud detection

12.2 Training Restrictions

Unless explicitly permitted:

  • confidential client data is NOT used to train external AI models
  • sensitive project data is protected and segregated
  • proprietary datasets remain restricted

13 — HIGH-RISK DATA CATEGORIES

Certain categories require enhanced protection:

  • government-issued identification
  • financial data
  • health-related data
  • childcare/eldercare-related information
  • legal case-related data

Such data is subject to stricter access controls.

14 — DATA BREACH RESPONSE

In the event of a breach:

GUMBAE may:

  • investigate the incident
  • notify affected users where required by law
  • implement containment measures
  • cooperate with authorities

15 — THIRD-PARTY RESPONSIBILITY

GUMBAE is not responsible for:

  • third-party service provider breaches
  • payment processor data handling failures
  • external client or freelancer misuse of data

16 — USER RESPONSIBILITIES

Users agree to:

  • provide accurate data
  • protect account credentials
  • avoid sharing sensitive data unnecessarily
  • comply with applicable privacy laws

17 — POLICY UPDATE

This Policy may be updated periodically.
Continued use of GUMBAE constitutes acceptance of updated terms.

FINAL ACKNOWLEDGEMENT

By using GUMBAE, you acknowledge that:

you understand how your data is used
you accept cross-border data processing
you understand AI-assisted processing risks
you agree to the privacy framework governing the platform

END OF PRIVACY POLICY