Welcome to OnlySkills. OnlySkills prioritizes privacy and is dedicated to protecting the personal data of each User. This Policy outlines how personal data is collected, used, and safeguarded while interacting with the OnlySkills Platform. As a consumer-to-consumer platform, OnlySkills is designed to connect individuals directly, allowing Users to offer and acquire services in an efficient and secure manner.
To enable the use of Platform, certain personal data is collected to facilitate account creation, enable transactions, and ensure a secure user experience. Reviewing this Policy carefully is encouraged, as it clarifies OnlySkills' commitment to the responsible handling of personal data.
1. DEFINITIONS
1.1. In this Policy, the following definitions shall apply:
Agreement
the General Terms and Conditions, that regulate the relationship between OnlySkills and the User in relation to the use of the Platform.
Customer or You
a natural person who has registered as a User and uses the Platform to be connected with a Service Provider in order to receive a Service.
GDPR
regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
OnlySkills
onlyskills.com OÜ, a company registered in Estonia under the registry code 16813952, registered address Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551.
OnlySkills is the information society service provider that has developed and operates the OnlySkills Platform.
Service Provider
a natural person who has registered as a User and responds to a Customer's Service Request via the Platform.
Policy
this privacy policy.
Platform
the online platform operated by OnlySkills, accessible via OnlySkills.com and through a mobile application, enabling interactions between Customers and Partners for the provision of Partner Services.
User
the Customer and the Partner.
1.2. In the absence of a specific definition in Clause 1.1 of this Policy, the terms utilized herein shall be interpreted in accordance with their respective definitions ascribed under the GDPR. The complete text of the GDPR is accessible here.
2. DETAILS OF THE CONTROLLER
2.1. According to the GDPR, a controller is a person who, alone or jointly with others, determines the purposes and means of the processing of personal data. The processor, on the other hand, is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
2.2. OnlySkills is processing the personal data of the Users mainly for the performance of the Agreement, to provide an access to the Platform, collect fees, change information, or to improve its services. OnlySkills, as the platform service provider, acts as a controller of any Users' personal data collected and processed through the Platform.
2.3. For questions regarding this Policy or the processing of personal data, Users may contact the support team at www.onlyskills.com with inquiries or complaints.
3. PERSONAL DATA AND THE SOURCE OF PERSONAL DATA
3.1. OnlySkills processes the following categories of personal data related to Users:
Personal Details
Full name (surname and given name), gender, date of birth.
Contact Details
Email address, phone number, home address.
Identification Data
Information extracted from passport copies, including document number, issue date, expiry date, and issuing authority.
Geolocation Data
Geolocation of the address.
Payment Data
Customer's bank card number to process the payment with a third party payment service provider.
Bank Data
Partner's bank account details, provided for the purpose of receiving payment for the provision of Providing Services to the Customer.
Marketing Data
User's preferences for receiving marketing information from OnlySkills.
Profile Data
Data provided in the Users profile, such as previously fulfilled Service Requests, feedback given by the Customers, rating determined by algorithm.
Communication Data
Any correspondence exchanged between the Customer and the Partner through the Platform.
Support Data
Communication records between OnlySkills and the User, including inquiries and complaints.
Complaints and Evaluations
Complaints submitted against the Service Provider by the Customer and decisions made in connection with the complaints, Customer's evaluation of the service provided by the Service Provider.
Device Data
Details about the device used to access the Platform, including device model, brand, operating system version, build identifier, app version, a randomly generated per-install device identifier (not a hardware identifier), IP address, and device integrity status (such as whether the device has been modified or is running in an emulated environment). Device integrity checks are used solely for fraud prevention and do not access personal information.
Preference Data
User's preferences within the Platform.
Photos
Photo made by the Service Provider to confirm completion of Service Request, a photo attached to the Customer's complaint.
Analytics Data
Pseudonymous usage data collected with the User's explicit consent, including screens viewed, features used, interaction patterns (such as jobs viewed, applications submitted, messages sent), session timing, and app lifecycle events. Users are identified by a pseudonymous identifier (internal user ID) only — no directly identifying information such as name, email, or phone number is included in analytics data.
Third-Party Account Data
When a User voluntarily connects a third-party account (such as TikTok) to the Platform, OnlySkills may access the User's public username, profile avatar, and publicly available video analytics from that third-party platform. OnlySkills does not post on the User's behalf or access private information from the third-party account.
Push Notification Data
A device token generated by the operating system's push notification service (Firebase Cloud Messaging), used solely to deliver push notifications to the User's device. This token is not a hardware identifier and changes if the app is reinstalled.
Error and Performance Data
Technical error reports, crash logs, performance traces, and anonymised session replays (with all text, images, and interactive elements masked) collected automatically to identify and fix bugs, improve app stability, and monitor performance. No directly identifying information is included in error reports.
3.2. OnlySkills primarily processes personal data submitted directly by the User. However, personal data may also be processed when received from a User with whom the User is engaged (e.g., feedback, rating).
3.3. OnlySkills may aggregate personal data collected automatically, personal data obtained from third parties, and personal data provided by the User.
3.4. The disclosure of personal data to OnlySkills is voluntary. However, if the User declines to provide personal data, OnlySkills may be unable to offer services. For instance, OnlySkills cannot register the User on the Platform.
4. PROCESSING PURPOSE AND LEGAL GROUND
| Personal data concerned | Purpose | Legal Basis |
|---|---|---|
| Personal Details, Contact Details |
| To perform the Agreement (GDPR Art. 6 (1)-b)) |
| Profile Data, Identification Data |
| OnlySkills legitimate interest (GDPR Art. 6 (1)-f)) |
| Geolocation Data |
| Consent (GDPR Art. 6(1)-a)) |
| Payment Data, Bank Data |
| To perform the Agreement (GDPR S.6 (1)-b)) Obligation arising from law (GDPR Art. 6(1)-c)) |
| Photos |
| To perform the Agreement (GDPR S.6 (1)-b)) Consent (GDPR Art. 6(1)-a)) |
| Marketing Data |
| Consent (GDPR Art. 6(1)-a)) |
| Communication Data |
| OnlySkills legitimate interest (GDPR Art. 6 (1)-f)) |
| Support Data |
| To perform the Agreement (GDPR Art.6 (1)-b)) OnlySkills legitimate interest (GDPR Art. 6 (1)-f)) |
| Complaints and evaluations |
| OnlySkills legitimate interest (GDPR Art. 6 (1)-f)) |
| Device Data |
| OnlySkills legitimate interest (GDPR Art. 6 (1)-f)) |
| Preference Data |
| OnlySkills legitimate interest (GDPR Art. 6 (1)-f)) |
| Analytics Data |
| Consent (GDPR Art. 6(1)-a)) — analytics is only collected after the User explicitly grants consent and can be withdrawn at any time via Settings |
| Third-Party Account Data |
| Consent (GDPR Art. 6(1)-a)) — the User initiates the connection voluntarily |
| Push Notification Data |
| To perform the Agreement (GDPR Art. 6(1)-b)) |
| Error and Performance Data |
| OnlySkills legitimate interest (GDPR Art. 6(1)-f)) — necessary to maintain a reliable and secure Platform |
5. AUTOMATED DECISION MAKING
5.1. Automated decision-making involves decisions made solely through the automated processing of a User's personal data, without human intervention. Such processing may involve, for example, algorithms or software code designed to evaluate specific criteria.
5.2. The Platform employs an algorithm that ranks the most suitable Service Providers for each Service Request based on information in the database, identifying Service Providers whose profiles match the specific requirements and attributes of each job.
5.3. The automated processing of Users' data is essential for fulfilling the tasks specified in the General Terms and Conditions. If a User objects to the automated processing of their personal data, acceptance of this Policy is not possible, and consequently, the Platform Services cannot be provided, nor can the User register on the Platform.
5.4. The Platform performs automated device integrity checks at startup to detect potentially compromised devices (e.g., jailbroken or rooted devices, emulators, or mock location providers). These checks do not access personal data and are used solely as a fraud prevention signal. The integrity status is shared with the backend to apply enhanced security controls on high-risk financial operations such as payouts and bank account linking. A per-install device identifier (a randomly generated UUID, not a hardware identifier) is forwarded to the payment service provider to support device-level fraud risk assessment under GDPR Art. 6(1)(f) legitimate interest for fraud prevention.
6. TRANSFER OF PERSONAL DATA
6.1. Personal data may be transferred to the following categories of third-party recipients. Where a specific service provider is named, it is identified for transparency; OnlySkills reserves the right to replace providers with equivalent services that offer comparable data protection standards.
6.1.1. Payment service provider — Stripe, Inc. (USA, with EU data processing) assists in the management of payments, fraud detection, and the handling of funds. A per-install device identifier is shared with Stripe for fraud risk assessment.
6.1.2. Analytics provider — PostHog, Inc. (EU-hosted instance at eu.i.posthog.com) processes pseudonymous analytics data to help OnlySkills understand feature usage and improve the Platform. Analytics data is only collected with the User's explicit consent.
6.1.3. Error monitoring and performance provider — Functional Software, Inc. (Sentry, EU-hosted instance at de.sentry.io) receives error reports, crash logs, performance traces, and anonymised session replays (with all text, images, and vectors masked) to help OnlySkills identify and fix technical issues.
6.1.4. Push notification and cloud messaging provider — Google LLC (Firebase Cloud Messaging) processes device tokens to deliver push notifications. Google may process this data in the USA under Standard Contractual Clauses.
6.1.5. Mapping and geolocation provider — Google LLC (Google Maps Platform) processes location coordinates to display maps and enable location-based job matching.
6.1.6. Authentication and database provider — Supabase, Inc. hosts the Platform's database, real-time messaging infrastructure, and authentication services.
6.1.7. Third-party sign-in providers — Apple Inc. (Sign in with Apple) and Google LLC (Sign in with Google) process authentication data when the User chooses to sign in via these services. TikTok (ByteDance Ltd.) processes authentication and public profile data when the User voluntarily links their TikTok account for the Creator Rewards programme.
6.1.8. App delivery and update provider — Expo (650 Industries, Inc.) delivers over-the-air updates and may process device metadata in connection with update delivery.
6.1.9. Customer support and customer management service providers that assist with User inquiries and complaint resolution.
6.1.10. Affiliates, including any entity that directly or indirectly controls OnlySkills, is controlled by OnlySkills, or is under common control with OnlySkills (where control means the ownership of over fifty percent of voting rights, or equivalent power to govern financial and operational policies or appoint management).
6.1.11. Professional advisors and service providers, such as accountants, auditors, lawyers, IT support, and other outsourcing providers involved in the provision of OnlySkills's services.
6.1.12. Other Users of the Platform, to the extent necessary for the provision of Platform Service, including facilitating the formation of Service Agreement between the Customer and the Service Provider.
6.2. Measures are in place to ensure these data recipients uphold the confidentiality and security of personal data, processing it solely for the provision of services in compliance with applicable laws.
6.3. Certain third-party recipients are located outside the European Economic Area ("EEA"). In particular, Google LLC (Firebase Cloud Messaging, Google Maps), Stripe, Inc. (payment processing), TikTok/ByteDance Ltd. (Creator Rewards programme), Supabase, Inc. (database and authentication), and Expo/650 Industries, Inc. (app updates) may process data in the United States. Where personal data is transferred outside the EEA, OnlySkills ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on an adequacy decision where applicable. PostHog and Sentry process data on EU-hosted instances (eu.i.posthog.com and de.sentry.io respectively), ensuring data residency within the EEA. Users may request a copy of these safeguards by contacting OnlySkills as specified in Section 2.
7. SECURITY
7.1. OnlySkills has implemented the necessary organizational, physical and IT security measures to protect the User's personal data from any misuse, unauthorized access, disclosure, alteration or destruction.
7.2. Only authorized persons have access to the personal data of the Users. Whereas persons with access to personal data undertake to comply with the confidentiality obligation.
8. INTEGRITY AND RETENTION OF PERSONAL DATA
8.1. OnlySkills will not retain personal data for longer than is necessary for the purpose of processing the personal data or under applicable law. Normally, OnlySkills stores the personal data of the User as long as the User has an active account on the Platform. OnlySkills considers a User's account to be an active account until the User deletes its account. In addition to the above, OnlySkills retains the following time limits for the retention of personal data:
8.1.1. Personal Details, Contact Data, Profile Data shall be retained for 3 years after the deletion of the account;
8.1.2. Proof of payment of any fees shall be retained for 7 years from the date of payment of the fee;
8.1.3. Records related to disputes and investigations shall be retained until a decision is made.
8.2. The User understands and agrees that uninstalling the Platform from the smart device will not automatically delete their account and the personal data contained therein. In order to delete personal data, the User must terminate the Agreement in accordance with the procedure provided in the Agreement.
9. RIGHTS RELATED TO PERSONAL DATA
9.1. Users have the following rights regarding the processing of their personal data:
9.1.1. Right to Information – All relevant information is provided in this Policy. The latest version is available on the Platform.
9.1.2. Right to Access – Users may request a copy of their personal data processed by OnlySkills.
9.1.3. Right to Rectification – Users may request corrections to personal data if inaccurate or incomplete.
9.1.4. Right to Erasure – Users may request deletion of personal data unless retention is required by law, contract, or other lawful grounds.
9.1.5. Right to Restriction – Users may request restricted processing if data is inaccurate, incomplete, or processed unlawfully.
9.1.6. Right to Data Portability – Users may request that their personal data, provided to the Platform, be transferred to them or a third party where feasible.
9.1.7. Right to Object – Users may object to processing if lawful grounds for processing are not present.
9.1.8. Right to Withdraw Consent – Users may withdraw their consent for processing at any time, without affecting the lawfulness of prior processing.
9.1.9. Right to File Complaints – Users may file complaints regarding the processing of their personal data.
9.2. To exercise these rights, a written application is required, directed to the contact provided in Section 2. Additionally, the User must verify their identity for each request submitted and provide a contact address for OnlySkills' response. OnlySkills reserves the right to refuse such applications, providing justification for any refusal.
9.3. According to Article 12(3) of GDPR, OnlySkills must respond to applications within one month but will endeavor to respond within one week.
10. RIGHT TO AMEND THIS POLICY
10.1. OnlySkills reserves the right to amend this Policy unilaterally from time to time. Changes to the Policy will be communicated to the User by email. If the revised terms include processing of personal data for new purposes that require consent, OnlySkills will seek the User's consent before initiating such processing.