01. Scope and status
This notice explains the intended treatment of personal information of AREATO visitors, clients, professionals and correspondents.
The public website currently includes illustrative profiles and jobs. Future account, messaging, contract, payment and AI-support processing is described conditionally, not as an existing operational feature.
02. Controller and contact
The final legal entity responsible for AREATO processing, postal address and registration information must be confirmed before adoption.
Privacy requests: privacy@areato.work. Legal enquiries: legal@areato.work. Account assistance: support@areato.work. Any required data protection officer must be identified.
03. Information provided by users
Account creation may involve name, email, credentials, role and company association. Required fields should be limited to what the service needs.
Profiles may include expertise, portfolio, availability, location, hourly rate, job requirements and project scope. Users should avoid submitting unnecessary sensitive data.
04. Technical and usage data
Serving a website may involve IP address, request time, URL, browser characteristics and server response data for security and diagnostics.
The actual logging configuration, access permissions and retention periods must be audited and described rather than assumed.
05. Identity and business verification
If verification is activated, specific identity or business evidence and the verification result may be processed through a documented secure workflow.
A verification badge must describe the precise check performed and is not a guarantee of competence or payment. Current preview badges are illustrative.
06. Marketplace activities
Future functions may process searches, proposals, invitations, messages, contracts, milestones and files to support user-initiated collaboration.
Public profiles and listings may be visible to others. Private communications, financial records and verification evidence require restricted access.
07. Payments and billing
No production payment provider or escrow arrangement has yet been confirmed. Providers, controller roles and exchanged data must be disclosed before payment processing begins.
Billing records, invoices and legally required tax information may need retention. Full card details should be handled by an appropriately authorized payment provider.
08. Purposes of processing
Personal information may be used to deliver requested services, operate accounts, display profiles, enable communication and provide customer assistance.
Additional purposes may include proportionate security monitoring, fraud prevention, legal compliance and service diagnostics. Optional marketing requires a valid legal basis.
09. GDPR lawful bases
Contract necessity under Article 6(1)(b) GDPR may apply to processing objectively required to provide a requested service or take pre-contractual steps.
Legal obligations may rely on Article 6(1)(c). Legitimate interests under Article 6(1)(f) require balancing. Consent under Article 6(1)(a) must be freely given and withdrawable. The final purpose-by-purpose mapping remains open.
10. Public profile visibility
Users should be told which profile and listing fields are publicly accessible before publication. Search engines may cache public information outside AREATO control.
Private account records and confidential project files must not become public merely because an associated profile is visible.
11. Recipients and processors
Hosting, email delivery, support, verification, payment and security providers may process limited information when those services are adopted.
Each real provider, processing role, agreement and permitted access must be documented. Information may also be shared with the relevant marketplace counterparty where needed for a requested interaction.
12. International data transfers
The location of servers, backups, service providers and support access must be inventoried. No assertion is made that all data stays in a particular country.
Transfers outside the EEA, if any, require an applicable legal mechanism such as an adequacy decision or appropriate safeguards and an assessment of supplementary measures.
13. Retention and deletion
Personal information should be retained only as long as necessary for its purpose, applicable statutory duties, security needs or legal claims.
Accounts, logs, tickets, identity evidence, invoices and project records require separate concrete retention rules. Backup rotation and deletion handling must also be documented.
14. Information security
Appropriate technical and organizational measures may include access controls, encryption in transit, patch management, audit logging, backups and incident response.
Only controls actually deployed and tested should be claimed. No internet system can guarantee absolute security. Suspected account compromise should be reported to support@areato.work.
15. Cookies and browser storage
Essential session and security storage may be required for account functions. Optional analytics or advertising technology must be inventoried before deployment.
Where consent is required, optional technologies must not be activated beforehand. Further details belong in the Cookie Policy.
16. AI-assisted support
AREATO plans to explore AI-assisted classification, suggested responses and routing of support enquiries; this is not a statement that such a service is currently live.
Before activation, provider terms, training-use controls, data minimization, retention, human escalation and handling of sensitive requests must be assessed. High-impact account, fraud and payment decisions should not be made by unchecked automation.
17. Rights of individuals
Subject to applicable law, individuals may request access, correction, erasure, restriction, portability or object to certain processing. Consent may be withdrawn for future processing.
Send requests to privacy@areato.work. Proportionate identity verification may be required before disclosure. Statutory deadlines, exceptions and third-party rights apply.
18. Complaints and supervision
Privacy concerns may be raised with privacy@areato.work without limiting any statutory remedy.
Where applicable, individuals may complain to a competent supervisory authority in the EU member state of residence, workplace or alleged infringement. The operator’s competent authority must be confirmed.
19. Minors and sensitive information
The intended transactional marketplace account model is for adults capable of entering binding agreements; the actual age gate requires implementation and legal review.
Special-category data and identity documents should not be submitted unless specifically necessary under a secure and lawful process.
20. Changes and related documents
A final notice will identify its controller, effective date, update procedure and archived versions. Material changes will be communicated as legally required.
See Terms of Service, Cookie Policy, Imprint and Contact for related information. Privacy requests go to privacy@areato.work; contractual questions to legal@areato.work.