Privacy policy

This policy describes how we collect, use, store, and share information when you use our public website, customer portal, careers area, contact and quotation forms, and (for eligible workers) worker crypto payout tools. It reflects the behaviour of our Laravel application as implemented on this site.

This document is not legal advice. Applicable privacy laws depend on your location and our activities; specific legal bases, retention schedules, and regulatory filings require review by qualified counsel before they are stated as binding commitments here.

1. Information we collect

1.1 Information you provide directly

• Contact and enquiries — name, email, optional phone and company, category, subject, and message (contact_enquiries).
• Sourcing / quote requests — contact name, email, company, title, description, optional product category, quantities, destination country, and target dates; linked to your account if you are signed in (sourcing_requests).
• Business account registration — contact name, work email, optional phone, password, business name, country, city, optional state/region and business type (users, business_profiles). Additional business fields (registration number, address, website) may be added in your profile.
• Recruitment — applicant name, email, optional phone, CV/resume file, optional cover letter, and responses to information requests (job_applications and related records). See the Recruitment & applicant privacy notice.
• Worker crypto payouts (approved worker accounts only) — payout wallet address (stored encrypted on your user profile and on payout requests), network label, requested amounts, currency, reason, and description (crypto_payment_requests). This is not a customer checkout or inbound payment channel.
• Portal actions — responses to quotations (accept/decline) and related commercial records; messages you send through implemented workflows.

1.2 Account and authentication data

We process account credentials (hashed passwords), optional email verification timestamps, account role and status (for example pending, approved, or suspended customer; worker; staff), approval metadata, and password-reset tokens when you use those features.

1.3 Technical, session, and security data

• Session data — when configured with a database session driver, our application stores session identifiers, optional IP address, user agent, and session payload server-side (sessions).
• Audit log — for certain staff actions we record actor, action type, subject reference, optional metadata, and IP address (audit_logs).
• Application logs — server and application logs may include technical diagnostics; we aim to avoid logging unnecessary personal data.
• Rate limiting — we limit repeated form submissions (for example contact and sourcing) to reduce abuse.

1.4 Information we do not collect through this site

We do not operate advertising analytics or third-party tracking pixels on the public site as implemented in our codebase. We do not request private keys or seed phrases for cryptocurrency wallets. We do not perform automated on-chain verification of wallet ownership—only format checks before staff review.

2. How we use information

• Respond to contact, consulting, and sourcing enquiries and maintain related reference numbers.
• Register, review, and administer customer accounts and portal access to quotations, orders, and sourcing records.
• Publish and manage product catalogue and blog content you choose to read (no account required).
• Run recruitment—evaluate applications, schedule interviews, issue offers, and communicate status.
• Process worker payout requests, internal review, status updates, and manually recorded payment evidence.
• Send transactional email and in-app notifications where configured (for example application confirmations, quote availability, account approval).
• Secure the site, prevent abuse, and maintain operational records for staff workflows.
• Display indicative cryptocurrency market data on the public crypto information page (server-side request to CoinGecko with caching—no wallet data is sent).

Legal grounds: Depending on context and applicable law, processing may rely on steps taken at your request before a contract, performance of a contract or pre-contractual measures, legitimate interests in operating a B2B platform, compliance with legal obligations, or consent where we explicitly ask for it. A formal mapping requires counsel approval.

3. Sharing and recipients

We do not publish a list of every sub-processor here until vendor contracts are confirmed. In operating this website, information may be processed by:

• Hosting and infrastructure — where the application and database are deployed (environment-specific).
• Email delivery — when outbound mail is configured (provider depends on production MAIL_* settings).
• File storage — CVs, offer letters, and similar files are stored on the configured disk (default private application storage; optional cloud storage if enabled).
• CoinGecko — server-side API calls for public market ticker data only.
• Font delivery — our layout may load typography from fonts.bunny.net, which receives standard HTTP request data from your browser.
• Staff and authorized roles — recruitment and payout data is accessible to authorized administrators under role-based permissions.

We may disclose information if required by law, to protect rights and safety, or in connection with a business transfer subject to appropriate safeguards. State-specific privacy rules may apply depending on your location; contact us with questions about how we process personal data in your context.

4. International transfers

Users may access the site from multiple countries. Data may be stored or processed in the United States or wherever our hosting and service providers operate. Contact us if you need information about cross-border processing relevant to your enquiry.

5. Retention

We keep information for as long as needed for the purposes above, unless a longer period is required by law or legitimate business needs (for example dispute resolution). The application does not currently enforce automated deletion schedules for enquiries, recruitment files, or payout records. When you delete your account, your user record is removed, but related database rows and files may persist where retention is required or where file cleanup is not yet automated—see Your privacy rights.

Quotation expiry may be processed by a scheduled task; that affects quote status, not a full erasure of historical commercial records.

6. Security

We use industry-standard measures appropriate to a business web application, including access controls for staff and portal areas, password hashing, encryption for selected worker wallet fields at rest, private storage paths for recruitment documents, and CSRF protection on state-changing requests. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

7. Your rights and choices

Depending on applicable law, you may have rights to access, correct, delete, or restrict certain processing, or to object and port data. How to exercise these rights on this site is described on Your privacy rights.

8. Cookies

We use essential cookies and similar technologies for sessions and security. We do not deploy non-essential analytics cookies in the current implementation. Details are in our Cookie policy.

9. Children

This site is intended for business users, applicants, and workers—not children. We do not knowingly collect personal information from children.

10. Changes

We may update this policy. The version and effective date at the bottom of this page will change when we publish updates. Material changes may also be highlighted on the site where appropriate.

11. Contact and complaints

Privacy questions and requests:

You may also use our contact form with category “Privacy request”. If you are unsatisfied with our response, you may have the right to contact a supervisory authority in your jurisdiction; applicable bodies depend on your location and our activities.