CLEANER PRIVACY POLICY

This privacy policy (the “Policy”) describes how Bubla Services AB, company registration number 559473-2736 (“Bubla”, “we”, “us”), processes personal data about you when you apply to become a cleaner, use Bubla Partner (the “App”) or perform cleaning assignments through Bubla (the “Cleaner”, “you”). The Policy also applies after the cooperation ends, to the extent that information needs to be retained. If you also use Bubla as a customer, the customer privacy policy applies to that use.

The Policy provides information about the processing of your personal data under the General Data Protection Regulation (the “GDPR”). The legal basis for each processing activity is stated in the Policy. Reading the Policy does not constitute blanket consent to processing.

1. Controller responsibilities and contact

1.1 Bubla is the controller for the processing described in the Policy. This means that Bubla is responsible for how and for what purposes information is processed within these activities.

1.2 Postal address: Stora Badhusgatan 18, 411 18 Göteborg, Sweden. Privacy questions and rights requests: privacy@bubla.se. Questions about assignments, compensation and your account: support@bubla.se or support in Bubla Partner.

1.3 Shoutly AB is an independent controller for its processing under the separate employment agreement described in the cleaner terms, including employment administration, payroll, tax deductions, sickness absence and statutory reporting. That processing is covered by Shoutly’s privacy information. Bubla is responsible for processing under the Policy even where information is received from or disclosed to Shoutly. You can contact us for help identifying the appropriate responsible entity.

2. Personal data and sources

2.1 Application, identity and contact details. We process your name, personal identity number and verification results from BankID, contact details, account identifiers, language, application status and information you provide to show that you may perform the work. We also process saved incomplete registration and information about reviews, requests for additional information and decisions.

2.2 Your professional profile. We process your profile photograph, introduction, languages, service areas, availability and information about transport or mobility needed for planning. This information comes from you and our review of the profile.

2.3 Assignments and compensation. We process bookings, allocations, shifts, recorded start and end times, status, cancellations, checklists and reported obstacles. We also process compensation records, payout status, necessary tax and payment references and information about your connection to Shoutly. Address and payout information is processed where required in the activated registration or payout flow. Information may come from you, the customer, Shoutly or our systems. We also record the version of the terms and individual confirmation provided to and accepted by you, the time of acceptance and the agreed scope of automatic allocation.

2.4 Location data. When an assignment’s location feature is used, we process coordinates, accuracy, timestamps and information used for maps, arrival and estimated travel time. See section 5.

2.5 Communication and quality. We process messages, support cases, assignment photographs, customer ratings, complaints, safety reports and your explanation in a case. Information comes from you, customers, support and relevant partners. An allegation in a complaint is not, by itself, an established fact.

2.6 Technical information. We process information including IP address, app and device version, session information, security logs, crash and performance information and device identifiers required for sign-in, app protection and notifications. We also record the agreement versions you have accepted and choices you have made in the App.

2.7 Bubla limits collection to the information needed for each purpose. Medical certificates, criminal record extracts, complete banking documents and other sensitive documents must be supplied only to the designated recipient through a specifically identified secure channel. Such documents must not be sent through ordinary chat or email.

3. Purposes and legal bases

3.1 Bubla processes personal data for the purposes and on the legal bases set out below. References to a contract mean Bubla’s own platform agreement with you and steps before that agreement. Your employment agreement with Shoutly is not Bubla’s contractual basis. For transfers between Bubla and Shoutly, each company must have a legal basis for processing necessary for the specified purpose.

3.2 Application and account. We use contact, profile and application information to handle your request to work with us, give you access to Bubla Partner and administer your account. The basis is taking steps before and performing a contract with you, Article 6(1)(b) GDPR. If you use the App as a representative or employee of another company, equivalent administration relies on our legitimate interest in carrying out the cooperation, Article 6(1)(f).

3.3 Identity verification and account security. We use verified identity and technical security information to ensure that the correct person uses the account and to prevent unauthorised access and fraud. The basis is our legitimate interest in a secure service, Article 6(1)(f). Personal identity numbers are also processed only where clearly justified, particularly for secure identification. A legal obligation is used as a basis only for information that the particular obligation actually requires.

3.4 Planning and performance. We use availability, service area, assignment status and communication to plan, perform and follow up booked cleaning. Where you are the contracting party, the basis is Article 6(1)(b). For another provider’s personnel, the basis is our legitimate interest in administering and performing assignments, Article 6(1)(f). Displaying relevant profile information to customers and assessing quality rely on our legitimate interest in enabling customers to choose and recognise their cleaner and ensuring the agreed service quality.

3.5 Compensation. We use assignment and financial information to calculate agreed compensation, transfer records to Shoutly, track payouts and correct errors. The basis is Article 6(1)(b) where processing is necessary for our contract with you, otherwise Article 6(1)(f) for necessary administration of the cooperation. Accounting records are retained to comply with the Swedish Bookkeeping Act, Article 6(1)(c). Tax information is reported only to the extent required by applicable law.

3.6 Support, quality and legal claims. We use relevant communication, ratings and assignment information to assist you, investigate complaints and incidents, and establish, exercise or defend claims. The basis is our legitimate interest in effective support, safe services and fair case handling, Article 6(1)(f). We balance this against your privacy interests and limit information and access as needed.

3.7 Operations and improvement. Necessary technical logging and troubleshooting rely on our legitimate interest in stable and secure services, Article 6(1)(f). We use aggregated or de-identified statistics where sufficient. Optional analytics or storage on your device requiring consent is activated only after a separate choice.

3.8 Optional marketing. If we offer newsletters or other optional marketing, you may choose whether to receive it. Where processing relies on consent, Article 6(1)(a) applies. Declining does not affect access to assignments. Necessary assignment and safety information is not marketing.

3.9 To activate certain functions, Bubla needs the necessary identity, contact and payout information. If information is missing, we inform you of what is needed and which functions are affected. A requirement to complete a field in the App must correspond to a need supported by the relevant purpose and legal basis.

4. BankID and information requiring special protection

4.1 BankID is used to verify identity. Personal identity numbers and verification information are protected through restricted access and technical safeguards. Encrypted and pseudonymised information remains personal data where it can be linked to you. Your personal identity number is not displayed in the customer-facing profile.

4.2 Profile photographs are processed for the profile and identification purposes stated in the Policy. Any use for facial recognition or other biometric identification requires a separate legal assessment and is not covered by any general approval through the Policy.

4.3 Health data and other special categories of personal data may be processed only with a legal basis and an applicable exception for such processing. Where an obstacle affects the work, information provided to Bubla must be limited to what is needed for planning, without a diagnosis or other unnecessary health information. Certificates required for employment must be provided to the employer through the designated channel.

4.4 Checks involving criminal offence data may be performed only with specific legal authority. Before such a check, you must receive information about its scope, source, responsible entity, legal authority, retention and the opportunity to correct errors. Acceptance of Bubla’s terms does not provide general authorisation to collect or retain such information.

5. Location sharing in connection with assignments

5.1 The App’s location feature is used during the active journey to an assignment for navigation, arrival checks and information for the relevant customer. It may use the device’s last known position and update location in the background if device permissions allow. Information about the feature is provided in the App before activation.

5.2 Continuous location updates stop when cleaning is started in the App and the assignment moves to the checklist, or when the assignment ends. Status and times may subsequently be processed without continuous GPS tracking. The location feature must not be used to monitor your private life or breaks. Information already collected is subject to the retention rules in section 9 and is not automatically deleted when sharing is turned off.

5.3 The relevant customer receives location and arrival information associated with their booking. Authorised support may use the information for the same operational purposes and to handle a specific incident. Map and hosting providers process information necessary for the feature.

5.4 Processing is based on Bubla’s legitimate interest in coordinating the booked service and providing accurate arrival information, Article 6(1)(f) GDPR. Processing requires an assessment of necessity and proportionality. Device location permission controls technical access and does not in itself constitute GDPR consent to monitoring.

5.5 You can change location permission in your device settings. Navigation, automatic arrival checks and the customer’s live view may then become unavailable. Contact support for an alternative way to manage the assignment. A technical location error must not be the sole basis for concluding that work has not been performed.

6. Matching, ratings and automated checks

6.1 The cleaners displayed for an assignment are determined by factors including approved profile, service area, availability and booking conflicts. Eligible profiles are ranked using average customer ratings and the number of ratings in a weighted quality calculation. Where there are few ratings, a common reference value has greater influence to limit the effect of individual ratings on placement.

6.2 For automatic allocation of certain one-off assignments, the system chooses within a smaller group with similarly high quality scores. A rule limits the number of new profiles in the group when both new and established profiles are available. The customer and time slot are used to distribute selection within the group. This can affect how often you are shown or receive assignments, and therefore your opportunity to earn compensation. Where customers choose directly, they decide which available cleaner to book.

6.3 The App displays your overall rating. Individual customer ratings, authors and written reviews are available to authorised support but are not shown in the cleaner view. You retain the right to request access to your personal data under the GDPR. Other people’s rights must also be protected when information is disclosed.

6.4 Automated checks are also used for eligibility, verification, payout calculation and enforcing an identity block that has been decided. An active identity block may prevent new registration and affect both the cleaner and customer accounts. We then retain a protected identity reference to prevent circumvention, with restricted access and periodic review.

6.5 To request an explanation or review of an allocation, compensation calculation or restriction, contact support. You may request correction of the underlying information and human review, express your views and contest the decision. Decisions covered by the GDPR prohibition on solely automated decisions with legal or similarly significant effects may be made only with an applicable exception and the required safeguards. The Policy does not itself constitute such an exception.

7. Disclosure of personal data

7.1 Customers. Customers searching for or booking cleaning can see relevant profile information, such as display name, profile photograph, introduction, languages and overall ratings. The customer also receives assignment communication, status, arrival information and documentation needed for their own booking. Personal identity numbers, private home addresses, bank details and payroll records are not part of the customer-facing profile.

7.2 Shoutly. We share necessary identity, contact, assignment and compensation information for onboarding, verification and payouts, and receive relevant references and status information. Shoutly AB, company registration number 556888-3655, describes its own processing in its privacy policy. Where Shoutly processes information for its own legal or contractual purposes, it is an independent controller. Any information it processes solely on our instructions must be covered by a processor agreement.

7.3 Technology and communication. We use Google/Firebase for services including hosting, sign-in, data storage, app protection and troubleshooting, and mapping services for maps and routes. BankID and connected identity providers participate in identification. Activated email, SMS and messaging services, such as Mailgun/Sinch and relevant Apple or Google services, process necessary contact or device information. Stripe handles customer payments; this does not automatically mean that the cleaner’s bank or payroll information must be shared with Stripe. Only information needed for the relevant transaction or case is shared.

7.4 Other recipients. Authorised personnel, a relevant employer or assignment partner, insurers and legal advisers may receive information necessary for a specific case. Authorities and courts receive information where required by law or where disclosure otherwise has legal support. In a business transfer, relevant information may be disclosed to the parties concerned under confidentiality and with restricted access.

7.5 Providers processing personal data solely on Bubla’s behalf are processors and must follow our documented instructions. Where a recipient processes information for its own purposes, it is responsible for that processing. Bubla does not sell your personal data.

8. Transfers outside the EU and EEA

8.1 Some providers have international operations, support or subcontractors. Personal data may therefore be made available outside the EU/EEA even where a service’s main storage is in Europe.

8.2 Such transfers may take place only with an applicable legal mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses together with necessary supplementary safeguards. A US company’s certification may be relied upon only where it is valid and covers the recipient and the processing concerned.

8.3 You can contact privacy@bubla.se for information about current recipient countries and access to relevant transfer safeguards, subject to necessary protection of confidential information.

9. Retention periods

9.1 Bubla retains personal data for as long as needed for each purpose or required by law. The retention period is assessed for each data category. A requirement to retain financial records therefore does not mean that the entire profile, location data or all communications are kept for the same period. The following retention rules apply to the stated categories.

Active profile, availability and incomplete registration

For as long as needed for the application and cooperation. Operational information is removed on account deletion under section 10. For an incomplete application, continued need is assessed based on recent activity, contact with you and pending requests for additional information. When the application is withdrawn, closed or no longer to be pursued, the information must be deleted unless a legal obligation or specific case justifies limited continued retention.

Accounting, tax and payout records

Information constituting accounting records is retained through the seventh year after the end of the calendar year in which the financial year ended. Other records are included only where a separate obligation or documented need requires it.

Records for ordinary cleaning-related claims

Necessary information is normally retained for three years from the latest relevant cleaning, charge or classified case. This is a chosen retention rule, not a statement that all claims become time-barred after three years.

Ordinary support cases

Normally twelve months after the case closes. Dispute, safety, payment and legal cases are assessed separately.

Specific legal preservation

Only relevant information is retained longer where a documented case requires it. The need is reviewed within twelve months at the latest and extended only for a documented reason.

Blocking information

Active protected identity references are retained while the block remains justified and reviewed at least annually. Inactive references are deleted according to the period for the relevant case.

Unverified web deletion requests

Contact information needed for verification is deleted after 30 days if the request is not verified.

GPS and arrival information

May be retained only while needed for the active journey to the assignment, checks of arrival and recorded time, or investigation of a specific discrepancy. Once these purposes are complete, the information must be deleted. If an incident or legal claim requires continued retention, only relevant information may be kept under the rules for that case.

Technical logs

Retention is determined by the log’s function and the need to detect, investigate and follow up operational or security faults. Personal data must be deleted once troubleshooting, security checks and necessary follow-up are complete. A limited incident record may be retained longer under the rules for the relevant case.

Assignment photographs and chats

May be retained while needed to perform and follow up the assignment or handle a related support case. The information must then be deleted. Material necessary for a complaint, safety incident, payment issue or legal claim is subject to the retention rules for that case.

Backups

Retention is determined by the need to restore data and systems after a service failure or incident. A copy must be deleted once it has been replaced and is no longer needed for that purpose. Information deleted from ordinary operations must not be used for other purposes in backups. On restoration, previous deletion decisions must be reapplied.

9.2 Deletion and continued retention. Retention must be limited to the information needed for the relevant purpose. An open case does not justify retaining all profile, location or communication information. Once the retention period or documented need has ended, information must be deleted or anonymised so that it can no longer be linked to you. You can contact privacy@bubla.se for information about the retention periods and criteria applied to your information.

9.3 After account deletion, necessary historical information may be retained in a separate archive with restricted access. Encrypted information and information where the account name has been replaced with a reference remain subject to data protection rules if they can be linked to you.

10. Account closure and deletion

10.1 You can request deletion through Profile → Security → Delete account in Bubla Partner, or contact privacy@bubla.se, including where your account is restricted.

10.2 A deletion request may be submitted even if assignments, an active allocation, a dispute or a payment remain outstanding. Bubla explains what needs to be addressed and restricts new activity while the request is processed. The request must be assessed individually under applicable data protection rules even if the account flow contains a technical obstacle. Only information that remains necessary and has a legal basis may be retained.

10.3 Deleting the cleaner profile does not normally delete a separate customer profile. Shoutly’s own statutory retention does not automatically end when the Bubla account is deleted. We handle deletion by our processors and help identify independent recipients you may need to contact.

11. Your rights

11.1 You can request access to your personal data and information about processing, correction of errors, deletion and restriction of processing. Subject to the GDPR’s conditions, you may receive information you have provided in a structured, commonly used, machine-readable format and have it transferred to another controller.

11.2 You may object to processing based on legitimate interests. We must then assess whether there are compelling legitimate grounds that override your interests, or whether processing is necessary for legal claims. An objection to direct marketing always applies for that purpose.

11.3 You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Rights concerning automated decisions are described in section 6.

11.4 Requests to exercise your rights should be sent to privacy@bubla.se. Bubla may request the information necessary to verify your identity. We respond without undue delay and normally within one month. If a permitted extension of up to two further months is needed, we explain the reasons within the first month. If a request is not granted, we provide reasons and information about the right to complain. Requests are normally free of charge.

11.5 You may complain to the Swedish Authority for Privacy Protection or another competent supervisory authority. You do not first need to have your case reviewed by Bubla.

12. Security and changes to the Policy

12.1 We use access controls, protection of identity information, logging and other appropriate technical and organisational measures. Access must be limited to people who need the information for their work. Suspected unauthorised access or incorrect sharing can be reported to privacy@bubla.se or support.

12.2 Bubla may update the Policy. For material changes, we notify you in the App and/or by email before the new processing begins. Processing for new purposes requires a separate assessment and, where needed, new consent or additional information. The current version and date must be stated on the website and in the App.

Cleaner terms and conditions