Trifectask Privacy Policy

This Privacy Policy explains how TRIFECTA OÜ, registry code 17027345, registered in the Estonian Commercial Register, address Toome, Jälgimäe küla, 76404 Saku vald, Harju maakond, Estonia, VAT number EE102757390 (Trifectask, we, us or our), processes personal data when you visit our website, create an account, sign in, use the client portal, or purchase our services.

Controller contact: info@trifectask.com. Website: trifectask.com.

1. Scope and roles

This policy covers Trifectask's public website and the Trifectask client portal (tasks, chat, reports, team and billing tools), including email/password login and optional Google Sign-In, and subscription payments processed by Stripe.

Trifectask acts as an independent controller for account, billing, authentication, support and website-analytics data that we determine to process for our own purposes.

Where we access or maintain your website, online store, systems or Customer Content under your instructions, we act as your processor (or subprocessor). That processing is governed by the Data Processing Addendum, which forms part of the service contract. This Privacy Policy is a transparency notice and does not replace the DPA.

2. Personal data we process as controller

Depending on how you use Trifectask, we may process:

• Account data: name, email address, password hash (if you use email login), role, preferred language, timezone and currency.
• Google Sign-In data (optional): if you choose Google Sign-In, we receive your Google account identifier, name and email address (and profile image if provided). We do not receive your Google password.
• Company and billing profile: legal company name, contact person, contact email, VAT identification number, registry code, country of establishment, billing address, postal code and website.
• Service-relationship content: portal tasks, chat messages, attachments, reports and related progress metadata that you exchange with us about the engagement.
• Payment and subscription data: subscription status, package type, invoice/receipt records and Stripe customer/subscription identifiers. Stripe processes payments and payment-instrument details. Trifectask does not store payment-card numbers or other primary payment-instrument details.
• Technical and security data: session and other necessary authentication/security cookies, IP address and device/browser information typically sent with HTTP requests, and system or access logs used to operate and secure the service.
• Website analytics (with consent): if you allow analytics cookies, we use Google Analytics 4 on the public website to understand aggregated traffic and usage. See section 7.

3. Customer website and store data (processor role)

When you instruct us to maintain or access your website, online store or related systems, we may process personal data contained there on your behalf — for example visitor or customer contact details, order or form content, and content you place in those systems. That Customer Personal Data is processed under the DPA. You remain responsible for the lawfulness of your instructions, your privacy notices and your legal basis.

We do not currently use freelancers to deliver the Services. Customer Personal Data and data from customer websites are not provided to artificial-intelligence services.

4. Purposes and legal bases

We process controller personal data to:

• create and manage user accounts and company workspaces;
• authenticate you (email/password or optional Google Sign-In);
• deliver website maintenance, SEO, reporting and related client services;
• operate the portal (tasks, chat, team collaboration, progress tracking);
• process subscriptions, invoices and payment-related notices;
• provide customer support and respond to requests;
• maintain security, prevent abuse and troubleshoot incidents;
• measure public-website usage where you have consented to analytics; and
• comply with legal obligations (for example accounting and tax).

Where the GDPR applies, we rely on contract to provide the portal and paid services you request; legitimate interests to secure the service, improve reliability and communicate about the service you use (balanced against your rights); legal obligation where we must keep billing or tax records; and consent where required (in particular for non-essential analytics cookies).

Providing company, contact and billing details may be necessary to conclude and perform a service contract. If required information is not provided, we may be unable to open a paid subscription or provide the Services.

5. Hosting and infrastructure

The Trifectask portal, its database, related self-hosted applications and the info@trifectask.com mailbox run on an OVHcloud virtual private server physically hosted in Germany. OVHcloud is the physical hosting provider (subprocessor for Customer Personal Data under the DPA; processor/service provider for our controller operations as described here).

Where Trifectask hosts a customer website, primary website data and backups are stored on that same German VPS infrastructure. Where you or a third party hosts the website, website backups made through the Services remain in that hosting environment. Trifectask maintains automated daily backups of systems and customer environments hosted or managed by Trifectask, where technically applicable. Trifectask does not host or administer customer email on this server.

6. Recipients and sharing

We do not sell personal data. We do not disclose personal data to unrelated third parties for their own purposes.

Personal data may be processed only by:

• authorised Trifectask personnel who need it to provide, secure or support the Services;
• the service providers described in this policy and, for Customer Personal Data, the approved subprocessors listed in the DPA; and
• authorities or other parties where disclosure is required by law.

Current service providers relevant to controller processing include:

• OVHcloud — physical VPS hosting in Germany as described above.
• Stripe — payment processing and subscription billing; payment-instrument details are handled by Stripe, not stored by Trifectask.
• Google — optional Google Sign-In (identity) and, with consent, Google Analytics 4 on the public website.
• Scheduling tools — if you book a call via an embedded calendar provider (for example Calendly), that provider processes the booking under its own terms.

Workspace team members may see content shared in that workspace (tasks, chat, reports) according to portal permissions.

WhatsApp is not a standard support or credential-transfer channel. Please use the portal chat or email info@trifectask.com.

7. Cookies and Google Analytics 4

Necessary cookies used for login, session security and similar essential functions operate without analytics consent.

Google Analytics 4 is used for analytics on the public marketing website. It is not loaded until you consent to analytics through the cookie banner. You can accept or reject analytics with equal ease, later change or withdraw your cookie preferences via the cookie settings control on public pages, and read more in this policy. We store the consent version and the time of your choice.

If Google Analytics 4 were enabled inside the authenticated client portal or used to process Customer Personal Data on a customer's behalf, that use would require a separate role assessment and possible addition to the DPA subprocessor list before go-live. Current implementation target: public website only, consent-gated.

8. International transfers

We are established in Estonia (EU). The Trifectask server is physically hosted by OVHcloud in Germany (EEA). To the extent OVHcloud entities access data from outside the EEA in connection with support or group operations, we rely on the applicable OVHcloud data-processing agreement and Standard Contractual Clauses where required.

Stripe and Google may process data in countries outside the EEA. Where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision, as applicable.

9. Retention

We keep personal data only as long as needed for the purposes above:

• Portal tasks, chat messages, attachments, hosted website copies and related service data — returned or deleted in accordance with the DPA and Customer's choice after termination of the relevant contract, unless law requires retention. Any return request should be made within 30 days after termination.
• System and access logs — retained for security, troubleshooting and incident investigation for no longer than 30 days, unless a longer period is reasonably necessary for an active investigation or required by law.
• Trifectask-hosted data backups — automated daily backups where technically applicable; copies in routine backups may remain until overwritten under the normal cycle, remaining protected and not restored except for disaster recovery, security or legal necessity.
• Billing and invoice records — for the period required by applicable accounting and tax law.
• Account profile data — while the account/workspace is active and thereafter as needed for support, disputes, legal retention or until deletion is completed under the rules above.

10. Security

Trifectask implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. Measures are reviewed and updated as appropriate to the risk.

Security concerns may be reported through the portal or to info@trifectask.com.

11. Credentials and customer access

You retain access to your own websites and systems throughout the Services. We will not intentionally make ourselves the sole administrator of your systems.

You may provide credentials through the portal or by email to info@trifectask.com. Email and ordinary portal messaging are not dedicated credential vaults; we may require a more secure transfer method for particularly sensitive or privileged access. Do not send payment-card data or unnecessary special-category personal data through these channels. You are responsible for removing or rotating credentials granted to us when cooperation ends.

12. Your rights

Subject to applicable law (including the GDPR), you may have the right to access, rectify, erase, restrict or object to certain processing, and to data portability. Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You may also lodge a complaint with your local supervisory authority. In Estonia, the supervisory authority is the Estonian Data Protection Inspectorate (*Andmekaitse Inspektsioon*).

To exercise your rights, contact info@trifectask.com. We may need to verify your identity before fulfilling a request. Requests that concern Customer Personal Data processed on a customer's behalf should usually be directed to that customer as controller; we will forward such requests as described in the DPA.

13. Children

Trifectask is a business service intended for adult professionals and companies. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will take appropriate steps.

14. Changes

We may update this Privacy Policy from time to time. The effective date at the top will change when we do. Material changes may also be communicated through the portal or by email where appropriate.

15. Contact

TRIFECTA OÜ Registry code: 17027345 Address: Toome, Jälgimäe küla, 76404 Saku vald, Harju maakond, Estonia VAT number: EE102757390 Email: info@trifectask.com