Privacy Policy

Introduction

Mellow, including its Mellow Service web-based platform and mobile applications ("Mellow.io", "Mellow", "Mellow Service", "we"), cares about user privacy and takes the protection of personal data seriously.
‍
This Privacy Policy is designed to inform users about their privacy rights and explain how we collect, process, retain, share, and transfer their personal data, keeping it secure every step of the way.  The Privacy Policy governs the processing of your personal data by Mellow companies when you visit or use our website at https://www.mellow.io, as well as any other websites, pages or content we operate (jointly the "website"), or request and/or use any products, services, functionality or applications (mobile apps) of Mellow (jointly the "services").  
‍
Your personal data is controlled by TMS SolarWeb Ltd, a Mellow company that determines the purposes and means of processing it. This Privacy Policy also applies to Mellow operators and all companies of the Mellow group, including legal entities, individual entrepreneurs, and consultants that provide Mellow services and are engaged in processing your personal data. All Mellow operators adhere to appropriate safeguards when processing your personal data in accordance with the EU General Data Protection Regulation (the "GDPR").

By accessing the website and/or using our services, you confirm your acceptance of the terms of this Privacy Policy. These implicit actions indicate that your consent to the processing of your personal data is freely given, specific, informed, and unambiguous. In cases where we are legally required to obtain your informed consent to process some categories of your personal data or to proceed with some other actions, we shall ask you for your specific consent. We may periodically modify this Privacy Policy as we undertake new personal data practices or revise procedures to comply with applicable laws. Please check back from time to time this page with our Privacy Policy to ensure you agree with any changes to it (the last update date is specified at the top of the Privacy Policy).

Data Protection Officer  

If you have any questions, requests, or complaints in relation to our privacy practices and this Privacy Policy, or you want to exercise your rights as regards privacy, please contact our Data Protection Officer at dpo@mellow.io, or by mail at the postal address: TMS SolarWeb Ltd on floors 5 and 6 of 17 Theklas Lysioti, Pissas Building, Limassol 3030, Cyprus.

Personal data we collect and purposes it serves

We may collect:
- Information gathered directly from you. When you register, set up your account (personal profile), request, make use of our services, or communicate with us, you are asked to provide some necessary information about yourself that we use to serve your request or provide our services to you.
- Information collected when you visit our website or use the Mellow Service (including mobile applications). To the extent permitted under applicable laws, we may collect some technical and other information through various means (including cookies) on your interaction with the website and the Mellow Service. This helps us to improve our services, enhance the security of your account (personal profile) and the Mellow Service, and personalize your experience (for more information, refer to the "Cookies and tracking" section).
- Information from publicly available sources and third parties. We may collect information about you from your customers and from open sources, including but not limited to social media, credit risk databases, and ID verification and KYC/KYB/AML web services to verify your identity and prevent fraud and other illegal activities, only doing so in accordance with applicable data protection laws.

Below are the categories of your personal data that we may collect and process, depending on what services you use and how you interact with the Mellow Service, its applications, or its website:
‍
Identification data: Your full name, date of birth, gender, country, webcam photo or video, passport or other national identification documents, driver's license, tax identification number, tax status, a form of doing business/professional activities, and relevant documents.
Contact information: Address of residence or registration, email address, billing or delivery address, work address, telephone number, and documents confirming the address.
Social identification data: Information related to your work experience or profession (specialization, professional and educational background), information about your company, position in the company, ownership/shares in the company, information about recommendations (referrals and referees), information about your related and affiliated parties, your business contacts, behavioral data, compliance data (including risk assessments).
Financial data: Information on bank cards and other payment methods, bank accounts, e-wallets’ and crypto wallets’ IDs and addresses, information on transactions (date and time, TXIDs, etc.), and other related information and documents.
Information generated when you interact with the Mellow Service or related to your activities in your personal profile in the Mellow Service (the "profile data"): Your user identification number, date of registration, date of acceptance of your agreement with Mellow and its number, your customers and/or your collaborators (subcontractors), verification status, invite delivery status, number of invited users, information about tasks and offers, the progress of rendering services/ performing works, materials related to your services/works, your payments or payouts, other information about transactions in the Mellow Service, your texts, voice and speech recordings, documents, requests (including those sent to our support), your requests regarding products, services or other functionality, your preferences, reviews, information from surveys, comments, as well as other information collected and/or generated in the course of your interacting with Mellow or using the Mellow Service.
Technical and usage data: Internet connection data, IP address, login, browser type and version, device type, category and model, location of your device, time zone settings, device language, application or SDK usage, preference settings, diagnostic data, information from cookies, advertising campaign tags, and other data stored or available in relation to your devices when you visit the website or use the Mellow Service, including its applications, as well as other information about how you use the website and applications.
Communication and marketing data: Your communication preferences, your marketing messaging preferences, consumer marketing profile, and other data.

In each case, Mellow makes every effort to collect the minimum possible amount of your personal data, limiting it to what is necessary for the processing purposes.

Below are the processing purposes, categories of personal data that Mellow may process, and corresponding legal bases.
‍
1. Purpose: To arrange and render our services for your benefit, and to enable you to perform under services/works agreements (as a subcontractor or a customer), including:
− Registering with the Mellow Service
− Conducting KYC/KYB procedures  
− Using the Mellow Service
− Creating and working with offers
− Handling tasks  
− Working on projects as a team
− Saving your orders, services, and projects
− Making payments to subcontractors
− Crediting customers’ advance payments
− Communicating with you (sending notifications related to the Mellow Service, processing your requests, and resolving issues through support)
− Resolving and mediating disputes
− Preparing reports and acts
− Ensuring that our website and the Mellow Service are protected against security threats. − To perform other actions to provide services/ work or obtain their results under your agreements with Mellow.  

1.1. Personal data categories:
− Identification data
− Contact information
− Social identification data
− Profile data
− Financial data
− Technical and usage data
− Communication and marketing data

1.2. Legal basis (GDPR):
− Contractual or pre-contractual measures (Art. 6.1 (b) of GDPR)
− Legitimate interests (Art. 6.1 (f) of GDPR)
− Compliance with legal obligations under applicable laws (Art. 6.1 (c) of GDPR)
− Consent (Art. 6.1 (a) of GDPR, if applicable)

2. Purpose: To enable users to create tasks using the voice and speech recognition feature that converts them to texts.

2.1. Personal data categories:
− Voice and speech recordings, texts

2.2. Legal basis (GDPR):  
− Consent (Art. 6.1 (a) of GDPR; you can manage consent via your mobile device’s settings)

3. Purpose: To comply with applicable laws and to protect the legal interests of customers, subcontractors, the Mellow Service, and other stakeholders, we may implement measures to prevent and mitigate risks of money laundering and terrorism financing (ML/TF), credit risks, fraud, and other illegal activities, as well as conduct customer due diligence to verify compliance with applicable laws (including checks against sanctions lists).

3.1. Personal data categories:
− Identification data
− Contact information
− Social identification data
− Profile data − Financial data
− Technical and usage data
− Communication and marketing data
− Data from publicly available sources
‍
3.2. Legal basis (GDPR):
− Contractual or pre-contractual measures (Art. 6.1 (b) of GDPR)
− Legitimate interests (Art. 6.1 (f) of GDPR)
− Compliance with legal obligations under applicable laws (Art. 6.1 (c) of GDPR)
− Consent (if applicable)

4. Purpose: To improve your experience with the Mellow Service along with its functionality, efficiency, and usability, and to make it more personalized. Where applicable, automate your interaction with the Mellow Service, provide interactive tips, guides, and notifications regarding the usage of the Mellow Service, and maintain internal services such as referral programs.

4.1. Personal data categories:
− Identification data
− Contact information
− Social identification data
− Profile data
− Technical and usage data
− Communication and marketing data

4.2. Legal basis (GDPR):
− Legitimate interests (Art. 6.1 (f) of GDPR)
− Consent (Art. 6.1 (a) of GDPR, if applicable)

5. Purpose: To improve user experience, website, products, services, marketing, and user and customer relationships by conducting: (i) statistical research based on personal data of customers and subcontractors, including survey data; (ii) troubleshooting of the Mellow Service (analyzing performance and functionality, fixing errors, etc.); (iii) data analysis. Study user behavior in their role as consumers, including user preferences, interests, and Mellow Service usage patterns in order to define marketing and business strategies for business development of Mellow.

5.1. Personal data categories:
− Identification data
− Contact information
− Social identification data
− Profile data
− Technical and usage data
− Communication and marketing data

5.2. Legal basis (GDPR):
− Legitimate interests (Art. 6.1 (f) of GDPR)
− Consent (Art. 6.1 (a) of GDPR, if applicable) Depending on the device, your consent status may be changed in the device settings.

6. Purpose: To inform you about offers on special features, options, products and services of the Mellow Service, including by sending you targeted or personalized advertising through the Mellow Service or otherwise sending you marketing communications about products and services that we believe may be interesting or useful to you or that you have requested to stay updated about. Mellow may also provide you with reports about your activities in the Mellow Service or news of the Mellow Service or inform you about products or services provided by its subsidiaries, affiliates, and partners, including marketing partners.

6.1. Personal data categories:
− Identification data
− Contact information
− Social identification data
− Profile data
− Technical and usage data
− Communication and marketing data

6.2. Legal basis (GDPR):
− Legitimate interests (Art. 6.1 (f) of GDPR)
− Consent (Art. 6.1 (a) of GDPR, if applicable)  

7. Purpose: To facilitate business transfers that may include mergers or acquisitions, reorganizations or restructurings, assignments to group companies of Mellow or companies under common control or interest, rebranding, creation and launching of new products, and changes in business models and products.
‍
7.1. Personal data categories:
− Identification data
− Contact information
− Social identification data
− Profile data
− Financial data
− Technical and usage data
− Communication and marketing data

7.2. Legal basis (GDPR):
− Contractual or pre-contractual measures (Art. 6.1 (b) of GDPR)
− Legitimate interests (Art. 6.1 (f) of GDPR)
− Consent (Art. 6.1 (a) of GDPR, if applicable)

Your rights

The GDPR and some countries' privacy laws provide certain rights to data subjects, which, subject to the applicable laws, you may exercise by contacting our DPO at dpo@mellow.io.

Right to be informed and right of access: You may check if Mellow processes your personal data or get access to your personal data that Mellow has. You may also request information about the purposes of the processing, categories of personal data concerned, who we disclose your personal data to, source of the data (if it was not collected directly from you), envisaged period for which the personal data will be stored, and other information as per the applicable laws.

Right to rectification: You may request us to correct (rectify) the record of your personal data maintained by Mellow if it is inaccurate or incomplete.

Right to erasure ("right to be forgotten"): You may request that we erase your personal data or cease processing it, subject to certain exceptions.  

Right to restriction of processing: In some cases, you may have the right to restrict our processing of your personal data.  

Right to data portability: Where our legal basis for processing your personal data is contractual or pre-contractual measures, we will, if technically feasible and upon your request, provide your personal data to you or transmit it directly to another controller, subject to certain exceptions.

Right to object: You may object, on grounds relating to your particular situation, to the processing of your data. For example, if our legal basis for processing for direct marketing purposes is a legitimate interest, you have the right to object to such processing.

Right to withdraw consent: For processing requiring your consent, you can withdraw your consent at any time by contacting us at the email stated above. Such withdrawal of consent does not affect the lawfulness of the processing based on the consent given before exercising this right.

If you refuse to allow Mellow to process your personal data where Mellow needs to process your personal data by law, or under the terms of your contracts with Mellow, Mellow may not be able to enter into or perform these contracts, or you may not or will not be able to use certain functionality of the Mellow Service. Further, in some cases, Mellow may terminate the business relationship with you and/or delete your account (personal profile) in the Mellow Service, and/or continue processing your personal data without your consent on the grounds specified in Art. 6.1 of GDPR and/or in accordance with other applicable laws.

Right not to be subject to decisions based solely on automated processing, including profiling: Mellow may rely on automated services, including profiling, to determine whether an 5 account poses legal risk or another type of risk. Please note, however, that Mellow shall not make any decision whose legal effects would significantly affect you based solely on the processing of your personal data by automated (technological) means without any human involvement. The Mellow team will review any decision that is made based on the algorithm. If you have any concerns regarding this matter, please contact us so we can resolve them.

Reasonable access to your personal data and other related information shall be provided at no cost upon request made to Mellow at dpo@mellow.io. We shall respond to your request within 30 days from the day of its receipt, unless applicable law specifies otherwise. If the response cannot be provided within this time frame, we shall give you a date estimate for when the information shall be provided. If we cannot satisfy your request, we shall specify the reason and inform you about your additional rights.

Right to lodge a complaint with the competent supervisory authority: Under the laws of many countries, you have the right to lodge a complaint with the appropriate data protection authority if you have concerns about the way we process your personal data.

Personal data of children and minors

We do not knowingly collect, process, store, use or disclose the personal data of individuals who have not reached sufficient legal capacity to perform works and/or render services in the Mellow Service under the national laws of the country of citizenship and/or permanent residence of the data subject, unless otherwise provided by applicable laws.

You must not use the Mellow Service if you: (1) do not have the sufficient legal capacity to use the Mellow Service in accordance with the national laws of your country of citizenship and/or permanent residence; and (2) have not obtained all the necessary permissions and consents to perform work and/or provide services in the country of which you are a citizen and/or in which you permanently reside and/or from which you access and/or plan to use the Mellow Service.

Sensitive and special categories of personal data

We collect and process sensitive user data only for the purposes as defined in this Privacy Policy and in compliance with applicable laws. We have implemented strict security measures to safeguard this information and comply with applicable privacy laws.

We observe KYC (Know Your Customer) requirements, so we must verify your identity. This verification process includes comparing your passport or ID photo to the biometric parameters of your face captured during a live web camera session. We ask for your consent to processing your biometric data by a processor of our choosing or us. You can withdraw your consent at any time by contacting us at dpo@mellow.io.

In order for us to give you the best user experience and enable you to create tasks easily, the Mellow mobile application, subject to the settings of your mobile device, may process your speech and voice to recognize them and convert them into text. You can restrict such processing at any time in the settings of your mobile device. In other situations, unless otherwise provided by law, we shall obtain your consent before using your voice and speech (for example, in your phone calls with Mellow).

How we process personal data

Mellow may take any action with respect to your personal data that is permitted by applicable law and that is necessary or desirable for achieving the above purposes, including, without limitation, collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (disclosure, provision, access), segmentation, depersonalization, blocking, deletion, or destruction of personal data, as well as any other actions in respect of your personal data subject to applicable laws.  

Mellow uses data processing methods such as non-automated processing of personal data, automated processing of personal data with or without transmission of the received information via information and telecommunication networks, and mixed processing of personal data.

Automation of user interaction

Mellow strives to ensure maximum convenience and efficiency in communicating with its users, as well as quick responses to users’ typical questions and situations that arise in the course of their interaction with the Mellow Service. For these purposes, your personal data may be processed, including through third-party services and automated data processing, to promptly send you interactive content, notifications, and guides on working and/or interacting with the Mellow Service. If you believe that such automated processing of your data has a negative effect on you and you do not agree with such processing, you can contact us at dpo@mellow.io. We shall review your particular circumstances and act accordingly.

Cookies and tracking
‍
Like many other websites, the Mellow website uses cookies. Please refer to the Mellow Cookies Policy to learn about the types of cookies we use, which purposes we pursue, and how you can withdraw your consent to the use of cookies.

International transfers of personal data

Mellow may transfer your personal data outside of the European Economic Area. When doing so, Mellow puts in place appropriate technical and organizational safeguards (including Standard Contractual Clauses) to ensure that such transfers are carried out in compliance with applicable data protection laws, except where the country to which the data is transferred has already been determined by the European Commission to provide an adequate level of protection.

Business transfers of personal data

In corporate or business transactions involving TMS SolarWeb Ltd and/or companies of the Mellow group, your personal data might be shared with another company, affiliated or not, who is involved in the transaction (hereinafter referred to as the "engaged business entity") for the purpose of processing personal data in accordance with the aforementioned objectives and in compliance with applicable data protection legislation. Such transfers may involve, among other things, allocation and storage of data in other databases, IT solutions, or online platforms (hereinafter referred to as the "platform"). These transactions may include mergers or acquisitions, reorganizations or restructurings, assignments to group companies of Mellow or companies under common control or interest, rebranding, creation and launching of new products, and changes in business models and products. In any case, the engaged business entity or the platform will be required to adhere to the terms of this Privacy Policy regarding your personal information.

By continuing to use our services or new services or products, you consent to the transfer of your personal data as described above and agree that the engaged business entity or the platform may continue to process your personal information as set forth in this Privacy Policy.

You have the right to exercise control over your personal data. If you disagree with the transfer of your personal data in accordance with this section, we respect your decision and encourage you to discontinue your use of our services. We will inform you via email and/or notice on our website and/or within your personal profile of any significant restructuring or change affecting you regarding the use of your personal data.

If you disagree, you may exercise your data subject rights as outlined in the "Your rights" section. If you have concerns, please contact us (referring to this Privacy Policy's "Questions, concerns, or complaints" section).

When and how we share information with others

To provide our services, ensure the security of the Mellow Service, and comply with anti-money laundering regulations, other applicable laws, and existing legal arrangements related to your use of the Mellow Service, we may share your personal data with third parties. These third parties include payment service providers and banks (to fulfil your payment requests), KYC/KYB/AML service providers (for due diligence purposes, to comply with applicable laws and fulfil existing legal arrangements related to your use of the Mellow Service), and messaging services (to facilitate our interaction with customers). We do not sell your personal data to any organization.

Mellow may share your information with such third parties, including but not limited to the aforementioned parties. If you disagree with the processing of your personal data as described, you have the right to restrict Mellow from such processing. However, this may restrict your access to and use of Mellow’s services.

Specifically, we may share your personal data with the service providers listed below.

KYC/KYB/AML service providers:
− Sum & Substance Ltd
Privacy Notice
CCPA Privacy Notification

Payment providers and banks:
− FENIGE SP. Z O.O.
Email: contact@fenige.eu  

− PayPal, Inc
Privacy Statement  

− Paymaster24
Privacy Policy

− WM Transfer Ltd  
Privacy Policy

− Bank 131, LLC
Policy of personal data processing

− Rietumu Banka
User Data Privacy Notice

− Revolut Limited (Revolut Payments, UAB)
Privacy Policy  

− dLocal Limited
Privacy Notice

− Ecommbx Ltd (ECOMMBANX)
Privacy Statement

− Quicko Sp. Z O. O.
Privacy Policy

− Bank of Cyprus Public Company Ltd
Bank of Cyprus Privacy Statement  

− Unlimit EU Ltd
Privacy Notice  

− TransferWise Ltd
Privacy Policy  

− Bank of America Corporation
Privacy Notice

− JPMorgan Chase Bank, N.A.
Privacy Policy

− QIWI  
GDPR compliance  

− CryptoProcessing (Dream Finance OÜ)
Privacy Policy

− INXY PL Sp. z o.o.
Privacy Policy

− Payoneer Europe Limited
Privacy Policy

− Everee, Inc.
Privacy Policy

Messaging services, business management solutions, analytics services:

− Intercom (Intercom R&D Unlimited Company)
Privacy Policy

− QSOFT LLC  
Privacy Policy

− AppsFlyer
(AppsFlyer Ltd, AppsFlyer Germany GmbH)
Website Privacy Policy
Services Privacy Policy

− Iterable (Iterable, Inc., Lionheart Squared LTD,  Lionheart Squared Limited)
Privacy Policy

− Google Analytics 4
[GA4] EU-focused data and privacy

− HubSpot
Privacy Policy

− Bubble
GDPR - Data processing agreement addendum

— Trustpilot
Privacy Policy
‍
Access to your personal data may also be given to other third-party service providers, such as IT solution suppliers and cloud service providers, payment service providers and banks, insurance agents, advisory and professional service providers, couriers, legal advisors, etc., to enable Mellow to render services to you or conduct its business more efficiently and effectively.

These third parties have their own privacy policies and practices regarding the processing of personal data. By consenting to this Privacy Policy, you also consent to the processing of your personal data in accordance with the privacy policies of these third parties, including the aforementioned parties. Please note that these third-party privacy policies may be updated from time to time, and it is your responsibility to periodically review them to stay informed about their data processing practices. 9

Mellow does not assume any responsibility for the privacy practices or the content of these third-party services.

If you are a subcontractor, we may disclose your personal data to:

(i) the customers in the Mellow Service in whose ultimate interests you perform (or are going to perform) works or render services; the disclosures include your full legal name, telephone number, email, specialization, dates of invitation to and registration with the Mellow Service, country, tax identification number (tax identification code), tax status, verification status, invite delivery status, payment methods, your invoices, works/services acceptance acts, and other information as required by applicable laws. This is necessary so you can accept tasks, participate in projects, and perform works / render services within the scope of such tasks and projects under the Subcontractor Offer Agreement on Performance of Works and Rendering of Services. As regards your other personal data that you may provide to us (e.g., your passport details), we shall obtain your express consent before disclosing such data to customers, unless otherwise provided by applicable laws;

(ii) other subcontractors in the Mellow Service who invite you to the Mellow Service to create a team of subcontractors, and/or to subcontractors who are in your team in the Mellow Service. Such disclosures include your full legal name, email, specialization, dates of invitation to and registration with the Mellow Service, country, tax status, verification status, invite delivery status, and other information as required by applicable laws. This is necessary so you can join teams of subcontractors in the Mellow Service, accept tasks and participate in projects, and perform works/render services within the scope of such tasks and projects under the Subcontractor Offer Agreement on Performance of Works and Rendering of Services;

(iii) If within the scope of the Mellow service, you are involved in performing a task (work/services) subject to applicable advertising laws (and any other regulations governing the placement of advertising and its labelling) or other tasks subject to special disclosure requirements established by applicable laws, you hereby expressly agree that your personal data may be disclosed to your customer (and/or task beneficiary) and other participants associated with the execution of such task (if necessary) for the purpose of fulfilment by the Mellow Service/other participants involved in the process of the task execution/setting, of the requirements of the legislation on advertising (advertising labelling) and/or other applicable laws. Your personal data that may be disclosed under this provision includes but is not limited to your verification data, the content of your tasks in the Mellow service, and any other available information related to such tasks, your Offer Agreement, your invoices, and documents in the Mellow service related to or associated with the relevant task.

We may also be required to share users’ personal data (of both customers’ representatives and subcontractors) with various financial institutions and/or enforcement or court authorities to comply with applicable laws, prevent fraud, enforce contracts and agreements we have with you, or protect our rights, property or safety, or the rights, property or safety of our employees and other parties.

Additionally, we may reveal your personal data to third parties if: (1) you request or authorize it; (2) to address emergencies or acts of God; and (3) to address disputes or claims, as well as to persons that provide a legally sufficient power of attorney.

Personal data you may choose to share on social media:  
When it is provided by the functionality of the Mellow Service, you can share some of your information, including reports on your activities in the Mellow Service contained in and processed through your personal profile in the Mellow Service (or generated through third-party services providers), on thirdparty services, like social media or messaging platforms or otherwise display your information in the public areas. By proceeding with the sharing of your personal data (by activation of a “share” or “post” checkbox/button or by other means), whether on social media platforms or any other public channels, you explicitly consent to making this personal data publicly available. This means that individuals who have access to the shared link or post will be able to view, analyze, or otherwise process the information included in your publication. It's important to note that these third-party services (social media sites) operate independently from the Mellow Service and maintain their own privacy policies governing data processing, which may be subject to updates over time.

Moreover, if you register in the Mellow Service through a third-party social media site (if it is provided by the functionality of the Mellow Service), your publicly available profile on the third-party social media site may be viewed or otherwise processed by Mellow.

Secure data handling procedures

We prioritize the security and confidentiality of personal and sensitive user data at Mellow. We have implemented rigorous data handling procedures (physical, technical, and administrative safeguards) to ensure its protection. These procedures include robust encryption methods, strict access controls, data minimization practices, secure storage systems, employee training on data security, appropriate disciplinary measures to enforce our employees’ responsibilities as regards ensuring privacy, incident response protocols, third-party compliance requirements, and regular audits and assessments. Besides, we update and test our security technology on an ongoing basis.

Marketing communications and direct marketing

We may use some of your personal data to decide which products, services, special functions, and offers of Mellow may be of interest to you. You may receive marketing emails and text messages (marketing communications) from Mellow if you request information from Mellow and/or agree to receive marketing communications from Mellow, or if you are a registered user of the Mellow Service and you do not opt out of receiving such communications. Mellow may send you marketing communications and other communications through such communication channels and/or in such forms as SMS, MMS, emails, account notifications (in the form of direct messages or banners), push notifications, social networks, and phone calls, among others.

Mellow may use various types of marketing communications, including direct marketing. By registering with Mellow and accepting the terms of this Privacy Policy, you consent to Mellow processing your personal data and communicating and interacting with you for direct marketing purposes. In addition, where applicable, the basis for the processing of your personal data shall be our legitimate interest in accordance with Art. 6.1(f) GDPR. As part of direct marketing or other types of marketing, Mellow may (but is not obliged to) process your personal data and send you newsletters, promotional offers or other informational and/or marketing materials, subscriptions and messages, or invite you to participate in events and advertising campaigns, as well as conduct surveys, research, and questionnaires with your participation (including for measuring customer loyalty, determining other user data indicators, and/or developing the functionality of the Mellow Service), and use other online marketing tools. Mellow reserves the right to at any time review and change the content of marketing messages, technologies used for marketing purposes, and methods for segmenting user (customer) groups (target groups). For example, a group of subcontractors may receive a special newsletter offering some Mellow Service’s functions for subcontractors who perform design tasks. Other newsletters may be aimed at informing subcontractors from certain countries about the available options for withdrawing remuneration. Also, Mellow may send you personalized marketing messages or direct emails, including with regard to the history of your actions in and/or interaction with the Mellow Service, in order to further personalize the service and better cater to user needs.  

For marketing purposes, Mellow may use automated services (including third-party services) and profiling. The personal data processed by Mellow for marketing purposes is specified in the “Personal data we collect and purposes it serves” section above under “Personal data categories.”

You have the right to at any time restrict Mellow from processing your personal data for the purposes of direct marketing, market research, and profiling conducted by Mellow for direct marketing purposes at any time by emailing dpo@mellow.io, or, if applicable, by following opt-out instructions contained in our marketing email or message sent to you, or by using the functionality of your device (if supported).  

Your opting out of receiving marketing communications shall not apply to service emails, text messages, and phone calls that are directly related to your use of the Mellow Service and performance of your agreements with Mellow (e.g., notifications about being invited to the Mellow Service, tasks, verification status, payments, change in the Mellow Service terms of use, security messages, etc.).

Mellow may compile and/or generate targeted/personalised reports for you related to your access to and use of the Mellow Service, aiming to enhance your loyalty, user experience, and for marketing purposes. For example, this includes an activity report for your year (or other period) in the Mellow Service. To prepare such reports, Mellow may share your information with third parties, including Bubble (https://bubble.io, refer to Bubble's GDPR - Data processing agreement addendum), HubSpot 11 (https://www.hubspot.com, refer to HubSpot’s Privacy Policy), Intercom (https://www.intercom.com, refer to Intercom’s Privacy Policy), as well as other Mellow’s marketing and development partners. These reports may subsequently be provided to you by means of third-party landing pages, email communication, or through the Mellow Service. If you do not agree with the mentioned processing, you have the right to restrict Mellow from such processing of your personal data. You can do so by emailing dpo@mellow.io or, if applicable, by following opt-out ("unsubscribe") instructions contained in a corresponding email or message sent to you.

Data storage and retention

Mellow retains your personal data to enable your use of the Mellow services for the period required to fulfill the relevant legitimate purposes described above, or as may be required by applicable laws (for example, for tax and accounting purposes or anti-money laundering regulations, or to address future legal disputes or claims). In addition, we may store, including in document form, some of your data related to the execution of civil law relations and other legal relations under the Offer Agreement and additional agreements with Mellow that you accepted when registering with and/or working in the Mellow Service for the purposes related to legal relations arising due to the involvement of Mellow and in accordance with applicable laws. Once the retention period expires or the data is no longer necessary, it will be securely deleted.

Data deletion

We respect individuals’ rights to the deletion of their personal data as permitted by applicable laws. Data subjects have the right to request the deletion of their personal data at any time, and we will take appropriate measures to fulfill these requests in a timely manner, ensuring compliance with GDPR requirements and safeguarding individuals’ privacy rights. Upon receiving a valid data deletion request, we will review and respond to it within 30 days. However, certain exceptions, such as obligations related to Anti-Money Laundering laws and other legal requirements, may limit our ability to immediately fulfill data deletion requests. In cases where data retention is necessary to comply with Anti-Money Laundering laws or other legal obligations, we will retain the personal data for the required period. Once the retention period expires or the legal obligations no longer apply, we will promptly and securely delete the data in accordance with applicable laws. This includes the deletion of data stored in our databases, backups, and third-party systems used for data processing. In any case, we will make reasonable efforts to comply with data deletion requests within the boundaries set by relevant legal exceptions and requirements.

Deleting freelancer account: * If you’re a freelancer, you can delete your personal profile. To do so, log in to your personal profile, navigate to "Preferences" and click "Delete account" in the section “Security”. * Please note that this option may be temporarily unavailable. At any time, you can request an account deletion by emailing at dpo@mellow.io.

Changes and updates to the Privacy Policy

Because our company and services change from time to time, this Privacy Policy can also be expected to change. We reserve the right to amend it at any time, for any reason, and without any notice to you other than the posting of the amended Privacy Policy on this website. We may email periodic notices regarding our terms and conditions or material changes thereto, but you should still regularly check our website to review the current amended version of the Privacy Policy. The provisions herein supersede all previous notices or statements regarding our privacy practices and the terms and conditions governing this website's use. By using the Mellow website and services, you agree to the terms and conditions of this Privacy Policy and any other agreement we may have with you. If you do not agree to these terms and conditions, you should not use this website or any Mellow services. 12 This Privacy Policy may be published in different languages. In case of any discrepancy, this English version shall prevail.

Questions, concerns, or complaints

Contact us at:
TMS SolarWeb Ltd
17 Theklas Lysioti, Limassol 3030, Cyprus,  
PISSAS BUILDING, floors 5 and 6
dpo@mellow.io

Special Privacy Notices for Residents of the States of California, Illinois, and Texas (the United States of America)
Last update: June 01, 2024

At Mellow, we highly value your privacy and are committed to safeguarding your personal information. If you reside in the States of California, Illinois, or Texas within the United States, please take a moment to read the corresponding special privacy notice below that is specifically relevant to you. If a matter is not addressed in these state-specific notices, our Privacy Policy terms will apply, unless otherwise required by applicable laws.

(i) Privacy Notice to Residents of the State of California Scope  

This Privacy Notice for Residents of the State of California (hereinafter the "CCPA Privacy Notice") complements Mellow's Privacy Policy and pertains to the processing of personal data of California residents.

Unless otherwise specified, the provisions of this CCPA Privacy Notice are only applicable if you are a California resident (as defined in Section 17014 of Title 18 of the California Code of Regulations) and provide your personal information to Mellow for processing.

For the purposes of this CCPA Privacy Notice, "Personal Information" is defined in accordance with the California Consumer Privacy Act (the "CCPA") and any associated regulations, as periodically amended.

Under this CCPA Privacy Notice, Mellow may operate as a business that falls outside the mandatory scope of the CCPA's coverage.  

The categories of personal information we may collect about you

The table below outlines the personal information we collect in our practices (divided by Category of personal information as per the CCPA) and those in effect during the 12 months preceding the effective date of this CCPA Privacy Notice. Please be aware that information voluntarily provided by you, such as during a phone conversation or a chat with our support team, may encompass categories of personal information not specifically detailed below.

1) Category A: Identifiers.
Types of personal information: Identifiers encompass characteristics like an actual name, alias, residential address, personal identifier, online identity, Internet Protocol (IP) address, email address, account name, tax number, driver's license number, passport number, or similar identifying information.

2) Category B: Personal information described in subdivision (e) of Section 1798.80 of the CCPA.  
Types of personal information: Personal information categories detailed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), including but not limited to full name, signature, tax number, physical address, email address, phone number, details from identity documents (such as document type, country of issuance, document number, expiration date, MRZ, data embedded in document barcodes, which may vary depending on the document, security features), driver's license or state identification card number, bank account details, credit or debit card particulars (including cardholder name, expiration date, first six and last four digits of the card number), and any other financial data (documents provided as evidence of the source of funds or wealth).

3) Category C: Protected classifications under California or federal law.
Types of personal information: Age, sex, and citizenship.

4) Category D: Commercial information.
Types of personal information: Records of personal property (as part of proof of address), Mellow’s functionality or services acquired/rendered or contemplated, or any other records of obtaining/rendering services.

5) Category E: Biometric data
Types of personal information: Biometric data, specifically facial characteristics.

6) Category F: Internet or comparable network-related activities.
Types of personal information: Details about online or electronic network-related actions, encompassing but not limited to the record of websites browsed, search inquiries made, and data about how a consumer engages with a website, application, or advertisement on the Internet.

7) Category H: Audio, electronic, visual, thermal, olfactory, or similar information.
Types of personal information: Data related to audio, electronic, visual, or related information, such as facial photos (including selfies), images of the face on identification documents, videos, and audio recordings.

8) Category I: Professional or employment-related information.
Types of personal information: User's profession or employment, including occupation and employment details.

9) Category L: Sensitive personal information.
Types of personal information: Personal data that discloses:
• The user's driver's license, state identification card, or passport number.
• The user's account login information.
• The utilization of biometric data to distinctly identify a user. Please note that we process your sensitive personal information solely to provide and facilitate the Mellow Service’s functionality, to fulfill agreements with you, or when required by applicable laws.

Sources of the personal information we collect

• Information obtained directly from you: When you register, create your account (personal profile), request our services, or communicate with us, you are required to provide essential information about yourself. We use this information to fulfill your requests and provide our services to you.
• Information collected directly or indirectly during your visits to our website or when using the Mellow Service (including mobile applications): To the extent permitted by relevant laws, we may gather technical and other data through various methods, including cookies, as you interact with the website and the Mellow Service. This data helps us enhance our services, bolster the security of your account (personal profile) and the Mellow Service, and personalize your experience.  
• Information obtained directly from third parties: We may obtain information about you from your customers, third parties, and publicly accessible sources, including, but not limited to, social media, credit risk databases, and identity verification as well as KYC/KYB/AML web services to confirm your identity and deter fraud and other unlawful activities. We do so in accordance with applicable data protection laws.

Purposes of processing your personal information

The information you provide serves the following purposes:
• Service Provision: We use your data to arrange and render our services/provide and facilitate the Mellow Service’s functionality to you, fulfill our agreements with you or to enable you to perform services/works agreements (as a subcontractor or a customer), including registration, 15 KYC/KYB procedures, task handling, project collaboration, remuneration processing, and user communication.
• Security and Compliance: We implement measures to ensure legal compliance, prevent risks like money laundering, fraud, and terrorism financing, and protect against security threats.
• User Experience Enhancement: We strive to improve your experience with personalized services, automation, and interactive guidance, including internal programs like referrals.
• Data Analysis: We analyze user behavior to optimize our services, website, and marketing strategies, based on statistical research and troubleshooting.
• Marketing and Communications: We inform you about special features, products, and services through targeted advertising and marketing communications. This may include promotions from our subsidiaries, affiliates, and partners.

Sale of personal data  

It's important to emphasize that Mellow does not engage in the sale of personal data.

Sharing personal information

We may share personal information with third parties when it is vital for delivering services to perform our agreements with you or for the functioning of the Mellow’s website and mobile applications. Additionally, this sharing might be necessary to accomplish other Mellow objectives and fulfill legal obligations. We take measures to limit third-party access to personal information and require them to provide reasonable assurances of effective safeguards for protecting this data. At times, Mellow may also need to disclose personal information to third parties with their own specific purposes. In these cases, Mellow ensures that all necessary agreements are in place, ensuring compliance with relevant laws and upholding nondisclosure obligations. The sharing of personal data is detailed in the 'When and How We Share Information with Others' section of the Privacy Policy.

Your rights

In accordance with applicable laws and regulations, you may exercise the following rights, subject to any exceptions or limitations that may apply in your jurisdiction:

Right to information

You are entitled to request information regarding the following:
• The categories of your personal information that we have collected.
• The categories of sources from which we have obtained your personal information.
• The purposes for which we have collected your personal information.
• The categories of third parties with whom we share your personal information and the specific personal information shared.

Right to access

You have the option to request a copy of the personal information that we have gathered about you within the past 12 months.

Right to correction

You have the right to request the correction of any inaccurate personal information that we have collected about you.

Right to delete personal information

You possess the right to request the deletion of any personal information we've collected from you and retained, with certain exceptions.

Should Mellow receive a verifiable request from a user to delete their personal information, Mellow is obligated to remove the user's personal data from its records, subject to certain exceptions. Additionally, Mellow must inform any service providers or contractors to delete the user's personal data from their records and notify all third parties with whom Mellow shared the personal information 16 to erase the user's personal data. However, exceptions may apply if doing so is infeasible, requires excessive effort, or is contrary to applicable laws. In particular, your deletion request may be declined if retaining the information is necessary to:
• safeguard information security, including actions related to detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, or prosecuting those responsible for such actions;
• comply with a legal obligation to retain personal information under applicable laws;
• make other internal and legitimate uses of that information that align with the purposes for which you provided it.

Right to opt-out of tracking for targeted advertising purposes  

You have the right to opt-out of tracking for targeted advertising purposes at any time. You can do this: (i) by emailing dpo@mellow.io; (ii) or following opt-out instructions in our marketing emails or messages; or (iii) using your device's functionality if supported. Please note that opting out of marketing communications does not apply to essential service emails, text messages, and phone calls directly related to your use of the Mellow Service and the fulfillment of your agreements with Mellow (e.g., notifications about service invitations, tasks, payment status, changes in terms of service, and security messages).

Right to nondiscrimination

You have the right to exercise the aforementioned rights without facing any form of discrimination prohibited by the CCPA.

(ii) Privacy Notice for Residents of the States of Illinois or Texas

This Privacy Notice for Residents of the States of Illinois or Texas complements Mellow's Privacy Policy and pertains to the processing of personal data of residents of Illinois or Texas, the USA.

Collection and use of personal information

We collect and use personal information in strict accordance with applicable state and federal laws. This information may include the data as described in the ‘Personal data we collect and purposes it serves’ section above.

In this Notice, Mellow explicitly states that it may collect and process your personal information, including specific "biometric characteristics" such as facial geometry scans, and "biometric data" derived from these characteristics, to confirm your identity during Know Your Customer (KYC) 17 procedures. Mellow will only collect and use biometric data after obtaining written consent from the respective data subject during their registration and/or before verification procedures.

Furthermore, we explicitly inform you that, for the purposes of fulfilling our agreements with you and KYC processes, we may collect and process personal data such as citizenship or immigration status, driver's license or state ID number, federal passport number, financial account numbers, bank card numbers.

Sharing of information

Mellow does not sell your personal information to third parties without your consent, as required by state laws. We may share your personal data for the purposes and with the third parties as outlined in the ‘When and how we share information with others’ section above.

Security of your data

Mellow employs industry-standard security measures to protect your personal information. In the event of a security breach, we will promptly and without undue delay notify you as mandated by applicable state law. Specifically, in compliance with the Personal Information Protection Act of Illinois, if Mellow holds personal information regarding an Illinois resident and becomes aware of a breach in the security of the system data associated with such personal data, Mellow is obligated to promptly notify that resident of the breach at no cost, ensuring the notification is delivered swiftly and efficiently.

Your rights

Apart from the rights that may be granted to you as indicated in our Privacy Policy, as a resident of Illinois or Texas, you may possess specific rights under state laws concerning your personal information. These rights may encompass the ability to access, correct, delete, or restrict the processing of your data. You can exercise your rights by submitting a request to the addresses provided in the 'Exercising Your Rights. Questions, Concerns, or Complaints' section below.

Data disposal

Mellow is committed to safely disposing of personal information that is no longer required for ongoing services or business operations, subject to applicable exceptions, or as provided for by the law.

Governing laws

In the event of any conflict or inconsistency between the other sections of the Privacy Policy and the terms outlined in this Notice, the terms in this Notice shall take precedence when the laws of Illinois or Texas (the USA) govern the legal relationship between Mellow and any data subject.

(iii) Changes to Special Privacy Notices for Residents of the States of California, Illinois, and Texas (the United States of America)

We may update these special privacy notices as required by state laws or as our practices change. The most recent version will be made available on our website.

Thank you for entrusting Mellow with your personal information. We are dedicated to maintaining the privacy and security of your data in accordance with state and federal regulations.

(iv) Exercising Your Rights. Questions, Concerns, or Complaints

If you have any questions, concerns, or complaints, or if you wish to exercise your rights, please contact us by submitting a request through one of the following methods:
‍
i. By sending a valid request to us via email at dpo@mellow.io

ii. For residents of the EU, you can mail us at the following address:
TMS SolarWeb Ltd
17 Theklas Lysioti Limassol 3030, Cyprus
PISSAS BUILDING, floors 5 and 6
Attention: Data Protection Officer.

iii. For residents of the USA, you can mail us at the following address:
Solar Staff Corp.
One World Trade Center
85th Floor, Suite 8540
New York, NY 10007
Attention: Data Protection Officer.