Privacy Policy

This policy explains how Localee Limited ("Localee", "we", "us") collects, uses, stores, and shares personal data when you use the Localee platform. It is incorporated by reference into our Terms of Service and applies to all users — customers and service providers alike.

We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Irish Data Protection Acts 1988–2018, and the ePrivacy Regulations (S.I. 336/2011).

Contents

1. Who we are
2. Scope and our roles under GDPR
3. What personal data we collect
4. How we use it, and our legal bases
5. Who we share data with
6. International transfers
7. How long we keep data
8. Your rights
9. How we keep data safe
10. Cookies and similar technologies
11. Automated decisions and profiling
12. Notes for customers and providers
13. Changes to this policy
14. Contact

1. Who we are

Localee Limited is a private company limited by shares, registered in Ireland (CRO No. 805431; registered office: 6 Hunters Hill, Hunters Wood, Dublin 24, Ireland). We are the data controller for the personal data described in this policy, except where stated otherwise.

For privacy queries and to exercise your rights under GDPR, contact us at privacy@localee.ie. For other queries, use info.support@localee.ie.

We have not appointed a Data Protection Officer. Our core activities do not involve large-scale systematic monitoring or large-scale processing of special-category data, so Article 37 GDPR does not require us to. Privacy questions are handled by Localee's designated privacy contact at the email above.

2. Scope and our roles under GDPR

This policy applies to use of the Localee platform in Ireland. We operate only in Ireland.

Personal data flowing through the platform falls into one of three controllership tiers, mirroring §14.2 of our Terms of Service:

Localee as controller. For account data, payment-authorisation data, communications conducted through the platform, uploaded evidence, search and usage analytics, platform telemetry, and verification data submitted to us directly.

Independent controllers. Service providers and customers each act as independent controllers for personal data they exchange directly in connection with a booking — for example, gate codes shared with a cleaner, photographs taken at a service location, vehicle registrations supplied to a detailer, or information about a household, occupants, or premises that a provider needs in order to perform the service. Each party is independently responsible for GDPR compliance over that data.

Localee as processor. Where a service provider asks us to process customer data on its behalf, we act as a data processor. That covers the records a provider keeps of walk-in customers it books itself (§3.10) and of its team's rota and time off (§3.11). Section 14.6 of our Terms of Service sets out the terms of that processing.

3. What personal data we collect

3.1 Account data

Name, email, phone number, hashed password, profile photo, login activity, and device identifiers. Collected from both customers and service providers.

3.2 Identity and verification data (providers only)

Legal business name, trading name, CRO or business-registration number, Tax Reference Number, PPSN (sole traders only) with its proof — a Revenue document or a Tax Clearance Access Number — licence and insurance certificates, and, where a provider chooses it instead of Stripe's identity verification, a photographic ID, submitted to satisfy verification under §§3.3 and 18.3 of the Terms. We do not ask for proof of address.

We collect this data for our DAC7 tax-reporting obligation and our own safety, security, and trust checks — not to perform payment KYC or anti-money-laundering screening, which is carried out by Stripe as an independent controller (§5.2). We apply data minimisation: a provider verified by Stripe is not asked for a photo ID; a photo ID we do check is deleted the moment it is approved, and a Revenue document once our check is complete — only the outcome is kept. See the retention table in §7.

3.3 Payment data

Billing name and address, payment-method type, last-four digits of card, bank account details for payouts (providers only), and tokens issued by our payment processor. Full card numbers, CVCs, and bank credentials are processed and stored solely by Stripe Payments Europe Limited — Localee never receives or stores them.

3.4 Booking data

Service-card content (services offered, pricing, availability), booking history, dates and times, service or pickup locations, booking amounts, ratings, reviews, and dispute history.

3.5 Communications

Messages, voice notes, and call records exchanged through the platform, evidence uploads (photographs, documents), and notes added to a booking (for walk-ins, see §3.10).

3.6 Usage and device data

IP address, browser type, operating system, referring URL, pages viewed, features used, session duration, crash reports, and similar identifiers stored in your browser. We do not currently use analytics cookies — see §10.

3.7 Inferred data

Service preferences, repeat-booking patterns, geographic search clusters, and fraud-risk signals derived from the data above. We do not profile in a way that produces legal or similarly significant effects on you — see §11.

3.8 Special categories

We do not seek special-category data within the meaning of Article 9 GDPR (health, religion, sexual orientation, biometrics, and so on). The nature of some services may incidentally surface special-category data — a customer disclosing a health condition to a personal trainer or carer, or a provider photographing a service location that captures medical items. Where this happens, we process the data only to the extent necessary for the booking. The legal basis is your explicit consent or, where applicable, establishment, exercise, or defence of legal claims (Article 9(2)(a) and (f)).

3.9 Children

The platform is not directed at people under 18 and we do not knowingly collect personal data from minors. Providers offering services to or involving minors — childcare, tutoring, paediatric services — process minor-related personal data as independent controllers under §2, subject to their own legal obligations including those under the Children First Act 2015 where applicable.

3.10 Walk-in customers recorded by a provider

A provider can record a booking for a customer who books with them directly — in person or by phone — rather than through Localee. We call these walk-ins. The provider enters the customer's name and, if they choose, a phone number, email address and notes, together with the booking itself: service, date and time, price, any extras or discounts, notes about the visit, and the amount paid. The customer pays the provider directly; Localee does not process that payment.

The provider is the controller of these records, and we process them on the provider's behalf (§2). Walk-in customers do not get a Localee account. We never contact them — no emails or notifications from Localee — and no other provider or Localee user can see their details. Our staff see them only to support the provider — for example, when it asks us about a booking. We do not use these records for our own marketing or to profile the person. We ask providers not to record health or other sensitive details unless that is necessary and lawful.

3.11 Team rota and time-off records

A provider can keep its team's rota in Localee: shifts, changes to them, and time-off requests. A team member can ask for time off and give a reason, and the provider approves or declines it.

The provider is the controller of these records, and we process them on its behalf (§2). We use them only to show the rota to the provider's team, to work out when the provider can take bookings, and to send the related notifications. Our staff see them only to support the provider. We ask providers and their teams not to put health or other sensitive details in the reasons they enter.

3.12 Businesses we contact before they join

Before a business joins Localee, we may contact it to offer it our service. For that we keep the business's name; its contact person's name, email address and phone number; links to its website and social media; notes of our conversations; and mock-ups of how its page could look on Localee. We get these from the business's own website and social media, or from the contact person.

We tell the contact person about this when we first get in touch. We delete these details 12 months after our last contact, whether or not the business joins. You can ask us at any time to stop contacting you and to delete your details: email privacy@localee.ie.

4. How we use it, and our legal bases

We match every processing purpose to a lawful basis under Article 6 GDPR (and Article 9 where special categories are involved).

Identity KYC and anti-money-laundering checks are carried out by Stripe as an independent controller under its own regulated status (§5.2). Localee is not a regulated financial institution and does not perform separate AML screening. Our own verification is limited to what DSA Article 30 traceability, DAC7 reporting, and safety vetting require, and is held on the retention clocks in §7. While Localee qualifies as a micro or small enterprise, DSA Article 30 may not yet bind us directly (Article 29 DSA); in that case we apply Article 30's traceability standards voluntarily, on the basis of our legitimate interests in a safe, traceable marketplace, and the legal-obligation basis takes over when Article 30 applies to us.

Critical financial alerts override marketing preferences. Notifications such as payment-failure alerts, deposit-authorisation failures, balance-payment retry reminders, and booking cancellations triggered by payment failure are sent whether or not you have turned off informational and marketing notifications. They contain information you need to act on, and they are required for the performance of our contract with you. The notifications setting controls marketing communications only.

5. Who we share data with

We share personal data only to the extent necessary for the purposes set out in §4, and only with the categories of recipient listed below.

• Service providers and customers — the counterparty to a booking receives the data needed to perform or receive the service.
• Professional advisors — lawyers, accountants, auditors, tax advisors, insurers, all bound by confidentiality.
• Public authorities and regulators — where required by law (the Revenue Commissioners, An Garda Síochána, the Data Protection Commission, the courts).
• Successors — in the event of a corporate transaction (merger, acquisition, reorganisation, insolvency), data may be transferred to the successor entity subject to this policy.

5.1 Named subprocessors

We work with the trusted subprocessors below. Each is bound by an Article 28 GDPR data-processing agreement and processes personal data only on our documented instructions, except where the subprocessor is itself an independent controller for the relevant data (Stripe for KYC and payment-card data — see §5.2).

Push notifications to iPhones are delivered through Apple's Push Notification service, under Apple's own terms. Apple receives the device's push token and the notification's content.

The table above is the live list of all subprocessors — vendor name, role, and data processed. We update it, and email providers, at least 14 days before adding one (Terms §14.6(e)).

5.2 Stripe as independent controller

For the data Stripe collects directly through its Stripe Connect onboarding — legal name, date of birth, residential address, government-issued ID, bank account details — Stripe is the data controller, not Localee's processor. For that KYC data we only see a verification status and a tokenised reference; we do not receive or store the underlying identity documents Stripe collects. Separately, we collect a limited set of verification documents directly from providers for the purposes in §4 (DSA Article 30 traceability, DAC7 reporting, and safety vetting); those documents are held by Localee under the retention rules in §7, and we minimise them by relying on Stripe's verification status where we can. Stripe's own privacy policy applies to the data Stripe collects and is published at https://stripe.com/privacy.

5.3 No sale of personal data

We do not sell personal data and do not share personal data with third parties for cross-context behavioural advertising.

6. International transfers

We prefer to process personal data within the European Economic Area, or in countries the European Commission recognises as protecting it adequately.

Several of our subprocessors are based outside the EEA — notably in the United States — or process data there. Where personal data is transferred outside the EEA, we rely on one of the GDPR-recognised transfer mechanisms:

• an adequacy decision by the European Commission under Article 45 GDPR, including the EU–US Data Privacy Framework where the recipient is certified;
• Standard Contractual Clauses adopted by the European Commission under Article 46(2), supplemented by additional technical and organisational measures (encryption-in-transit and at-rest, pseudonymisation, access controls) where a transfer-impact assessment requires; or
• your explicit, informed consent under Article 49(1)(a), for occasional transfers not covered by the above.

You can request a copy of the safeguards applied to a specific transfer by emailing privacy@localee.ie. We may redact commercially sensitive content.

7. How long we keep data

We retain personal data only for as long as we need it for the purposes in §4, or as required by law.

When you close your account, we delete or anonymise your account data and usage data within 90 days, and we delete raw identity documents (photographic ID, proof of address) within the short windows in the table above rather than holding them for the full statutory period. We retain booking, payment, communications, tax, and verification-outcome records for the statutory periods stated above. Where law, a regulatory order, or active legal process requires longer retention, we will retain accordingly.

8. Your rights

You have the following rights over the personal data we hold about you.

If a provider recorded you as a walk-in (§3.10), that provider controls the record, so ask them first — they can show you, correct, export or delete your details in Localee. If you contact us instead (§14), we will pass your request to the provider and help them respond. The self-service download in §8.1 needs a Localee account, so it does not cover walk-in records.

8.1 Self-service: download your data

For access and portability, the fastest route is the self-service flow inside Localee. Sign in and go to Settings → Privacy & Data → Download your data. We prepare your export asynchronously and email you when it's ready. The export is delivered as a ZIP archive from your dashboard (not as an email attachment) and stays available for 7 days.

The archive contains a JSON file for each entity we hold about you — profile, bookings, payments, receipts, reviews, messages, packages, subscriptions, disputes, notifications, audit log — plus a bookings.csv for spreadsheet use, a manifest.json with SHA-256 hashes for integrity verification, and a README.txt explaining the contents.

Customers can export customer-scope data. Provider account owners can additionally export business-scope data, with team-member personal contact data scrubbed — each team member uses their own customer-scope export to retrieve their own data.

You can submit one active export per scope every 24 hours. The request is gated by a recent-reauthentication check (see §9), to mitigate stolen-token data exfiltration.

8.2 By email

For rectification, erasure, restriction, objection, or withdrawing consent, email privacy@localee.ie. We may need to verify your identity before responding. We will respond within one month of receipt; for complex requests we may extend this by a further two months and will tell you why.

8.3 Cost

Requests are free unless manifestly unfounded or excessive — in which case we may charge a reasonable fee or refuse, with reasons.

8.4 Complaining to the DPC

You have the right to complain to the Data Protection Commission of Ireland — 21 Fitzwilliam Square South, Dublin 2, D02 RD28; https://www.dataprotection.ie; info@dataprotection.ie. We would appreciate the chance to address your concerns first.

9. How we keep data safe

We maintain technical and organisational measures appropriate to the risk, including:

• TLS encryption for all platform traffic and at-rest encryption for stored personal data
• Role-based access controls and the principle of least privilege for Localee staff
• Two-factor authentication on administrative systems
• Dependency scanning and runtime error monitoring (via Sentry); third-party penetration testing planned from Year 1 of operations
• Secure software-development practices (code review, secret-handling policy)
• Supplier due diligence and contractual data-protection obligations (Article 28 GDPR)
• Incident response procedures aligned with Articles 33–34 breach-notification obligations
• A reauth-fresh requirement on sensitive account actions: deleting your account or downloading your data requires your identity to have been re-verified by password within the last 5 minutes, mitigating data-exfiltration attacks based on stolen session tokens
• Session revocation on password change and account deletion, closing the legacy-session window
• Signed, short-lived download URLs — sensitive exports use 5-minute signed links minted in the dashboard, so a forwarded email cannot expose the export

If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours, and you directly without undue delay where the risk is high. For walk-in records (§3.10), we notify the provider instead, and it decides whether to notify the Data Protection Commission and the people affected (Terms §14.6(h)).

You can help by keeping your login credentials confidential and reporting any suspected unauthorised access to info.support@localee.ie.

10. Cookies and similar technologies

We use a small set of strictly-necessary technologies to operate the platform — primarily a localStorage token to keep you signed in, a small number of first-party items including a UI-preference cookie (sidebar:state), plus Stripe's fraud-prevention cookies on payment pages. We do not use analytics or advertising cookies at launch.

Full details — categories, specific items, retention, third-party providers, and how to manage your preferences — are in our Cookie Policy.

11. Automated decisions and profiling

We do not make decisions producing legal or similarly significant effects on you that are based solely on automated processing within the meaning of Article 22 GDPR.

We do use automated signals to triage potentially fraudulent transactions, abusive accounts, or content that may breach our Terms. Any consequential action — account suspension, payment hold, content removal — is reviewed by a human Localee operator before it is enforced. You can appeal a moderation decision under §11.6 of the Terms or §18.5 (DSA internal complaint handling).

12. Notes for customers and providers

12.1 For customers

Service providers see your name, profile photo, service-location address (where relevant to the booking), the contact details needed to perform the service, your booking history with that provider, and any messages or evidence you upload. Providers act as independent controllers for the data they receive from you (§2) and have their own privacy obligations.

12.2 For providers

Customers see your trading name, profile, service cards, ratings, and reviews, and any data you publish on your provider page. We may share your business identity — CRO number, address, contact details — with public authorities under Article 30 DSA. Under DAC7, we report your booking volumes and identifying data to the Revenue Commissioners.

If you record walk-in customers (§3.10), you are the controller of those records. Tell those customers how you use their details, and handle their requests to see, correct or delete them — you can edit, export and delete a walk-in's details in Localee at any time. Please do not record health or other sensitive details unless that is necessary and lawful.

If you keep your team's rota and time off in Localee (§3.11), you are the controller of those records too. Tell your team how you use them, and keep health and other sensitive details out of the reasons.

12.3 Reviews

Reviews you publish are visible to other users and may be visible to non-users on the public web. We do not remove honest reviews on request; see §§4.5 and 10 of the Terms for the limited grounds on which we will.

13. Changes to this policy

We will update this policy whenever our practices change.

• Non-material changes (typographical, formatting, clarifications) take effect on publication.
• Material changes — changes to how we use your data, the legal bases we rely on, the categories of recipient, or your rights — take effect 30 days after we notify you by email and in-app.

Previous versions are archived and available on request at privacy@localee.ie.

14. Contact

Localee Limited Registered office: 6 Hunters Hill, Hunters Wood, Dublin 24, Ireland Company registration: 805431

• Privacy: privacy@localee.ie
• General: info.support@localee.ie
• Data Protection Commission of Ireland: https://www.dataprotection.ie