Privacy Policy

Who we are and how to contact us

Controller: Cognowork (operated by Kwava UK Limited). For payments, our affiliated payments partners may act as controller/processor as appropriate.

Registered office: [Insert company address].

Email (privacy): privacy@cognowork.com

EU/UK representatives / DPO: Where required, we appoint representatives and/or a Data Protection Officer; contact details will be published in our Privacy Centre or provided upon request at the email above.

Supervisory authority (UK): Information Commissioner’s Office (ICO). You have the right to lodge a complaint with your local authority.

What we collect

We collect information in three ways: you provide it, we collect it automatically, or we receive it from third parties (e.g., payments and security partners).

2.1 Data you provide

• Account & Profile: name, display name, photo, contact details, country, languages, skills, portfolios, CV/resume info, company details, VAT/tax IDs (where applicable).
• Transactional: orders, bids/proposals, contracts, milestones, invoices, payout info (method, country, currency).
• Content & Communications: briefs, attachments, comments, messages, feedback/ratings, support requests, call/chat recordings (where permitted and disclosed).
• Verification (when required): government ID, proof of address, business registry docs, KYC results.
• Preferences: marketing choices, notification settings.
• Compliance & Safety: consent records, dispute history, reports of abuse, policy acknowledgements.

2.2 Data we collect automatically

• Device/Usage: IP address, device identifiers, browser/app type and version, operating system, time zone, language, referrer, pages viewed, clickstream, session events, crash logs.
• Approximate location: derived from IP (city/region level).
• Cookies & Similar Tech: cookie IDs, pixel tags, local storage (details in our Cookie Policy).

2.3 Data from third parties

• Payments & Payouts: status, limited card/bank metadata (we do not store full card numbers), chargebacks/returns.
• Security & Fraud Prevention: risk signals, sanctions/PEP screening results where legally required.
• Analytics & Advertising: aggregated insights about campaign performance (no sale of sensitive personal data).
• Public/Partners: information you make public (e.g., websites/portfolios) or that partners share in accordance with law.

Children: Cognowork is for users 18+. We do not knowingly collect data from children.

Why we use your data (legal bases)

We use your data only when we have a lawful reason under the GDPR/UK GDPR:

• Contract (Art. 6(1)(b)): To create/manage your account, enable Direct Orders and Bids, host files and messages, route payments/payouts, deliver support, and run the dispute process.
• Legitimate Interests (Art. 6(1)(f)): To keep services secure; prevent fraud/abuse; improve and personalize features; measure performance; send service-related communications; show limited in-product recommendations; enforce terms. We balance these interests against your rights.
• Consent (Art. 6(1)(a)): For non-essential cookies/analytics/ads, certain marketing emails/SMS, and optional features (e.g., recording calls) where required. You can withdraw consent at any time in settings or via our cookie banner.
• Legal Obligation (Art. 6(1)(c)): Tax/audit records, sanctions screening where applicable, responding to lawful requests.
• Vital/Public Interest (rare): To protect life/safety or comply with public interest mandates where required by law.

What we do with the data

We use your data to:

• Provide the platform: account setup, profiles, search/match, orders/bids, file exchange, collaboration, QA/editorial checks (if enabled), deliveries, revisions, ratings.
• Payments & payouts: process client payments, expert payouts, refunds/chargebacks, tax/VAT calculations; we rely on certified payment providers.
• Security & integrity: detect/prevent fraud/spam, verify identity or business where needed, monitor violations, ensure marketplace quality.
• Support & communications: respond to tickets, service notices, policy updates, transactional emails, and product changes.
• Personalization & analytics: improve UX, recommend relevant projects/experts, measure feature performance; we use aggregated and/or pseudonymised analytics where possible.
• Marketing (respecting your choices): newsletters, product updates, offers; you can opt out at any time via the email footer or settings.
• Legal & compliance: manage disputes, enforce agreements, produce audit/financial records.

We do not sell your personal information in the common sense of the word. Where U.S. laws define “sell” or “share” to include cross-context behavioural advertising, you may opt out (see Section 10).

Who we share data with

We share only what is necessary, under contracts that restrict use:

• Payments & Payout Partners: payment processors, banking partners, payout networks.
• Hosting & Infrastructure: cloud providers, content delivery networks, backup and logging services.
• Security & Compliance: KYC/KYB vendors, fraud‑prevention and threat‑intelligence services, sanctions screening (where legally required).
• Operations Tools: customer support platforms, email/SMS providers, project management and file processing tools.
• Analytics & Marketing: analytics platforms, A/B testing tools, consent‑management providers, ad platforms (non‑essential uses based on consent/opt‑out).
• Professional Advisers & Authorities: auditors, lawyers, regulators or law enforcement where legally required.
• Corporate Transactions: if we merge, acquire, or sell assets, data may transfer under equivalent protections.

We maintain an up‑to‑date sub‑processor list in our Privacy Centre (or upon request) and use appropriate data transfer safeguards (see Section 7).

How long we keep data (retention)

We keep personal data only as long as needed for the purpose collected and to meet legal, accounting, or reporting obligations, after which we securely delete or anonymise it.

Typical periods (illustrative, may vary by jurisdiction/contract):

• Account/Profile & Contract Data: while the account is active and up to 6 years after closure (UK tax limitation) or longer if legally required or for dispute handling.
• Support Tickets & Communications: 2–3 years after resolution.
• Logs & Security Data: 12–24 months unless needed longer for investigations.
• Backups: typically 35–90 days rolling.
• Marketing Data: until you opt out or your account is deleted, then placed on a suppression list.

International transfers

We may transfer/process data outside the UK/EEA (e.g., to the U.S. or other countries) using approved safeguards, such as:

• Standard Contractual Clauses (SCCs) and the UK IDTA/Addendum;
• Data processing agreements with security and confidentiality commitments;
• Additional technical/organisational measures (encryption, access controls, segmentation).

Where applicable, we also rely on adequacy regulations and comparable frameworks recognised by regulators.

Security

We use industry‑standard administrative, technical, and physical safeguards, including:

• encryption in transit and at rest (where appropriate),
• access controls and least‑privilege,
• network segmentation and monitoring,
• vulnerability management and penetration testing cycles,
• employee confidentiality and security training,
• incident response procedures and breach notification consistent with law (e.g., notifying the authority within 72 hours under GDPR where required).

No system is perfectly secure; if you suspect an incident, contact security@cognowork.com.

Your rights

Depending on where you live, you may have the right to:

• Access your data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase data (right to be forgotten) in certain cases.
• Restrict or object to processing, including objecting to processing based on legitimate interests and to direct marketing.
• Portability of certain data you provided in a structured, commonly used format.
• Withdraw consent at any time (does not affect prior processing).
• Lodge a complaint with your supervisory authority.
• California (CPRA): right to know/access, correct, delete, opt‑out of sale/share for cross‑context advertising, limit use of sensitive personal information (we do not use SPI for inferring characteristics).

How to exercise: email privacy@cognowork.com. We respond within one month (may extend by two months for complex requests). We may verify your identity and, where permitted, refuse manifestly unfounded/excessive requests.

Marketing, cookies, and opt‑outs

• Email/SMS marketing: requires your consent where required. You can opt out from any marketing message via the unsubscribe link or in settings.
• Cookies & similar tech: see our Cookie Policy for details, consent choices, browser controls, and analytics/ad preferences.
• “Do Not Sell/Share” (U.S.): where “share” covers cross‑context ads, you can opt out via our cookie banner or a “Do Not Sell or Share” link in the site footer.
• Global Privacy Control (GPC): where supported, we treat a valid GPC signal as an opt‑out/withdrawal of consent for non‑essential tracking.

Changes to this policy

We may update this Privacy Policy to reflect changes in law, technology, or our services. We will post the new effective date and, where changes are material, provide reasonable prior notice through the Site or email. If you continue using the services after changes take effect, you agree to the updated policy.