This draft explains the proposed handling of data when using SharkTask. Public information, booking data and private documents are distinct; future features apply only once enabled with their conditions disclosed.
Controller and scope
This proposal covers customers, providers and authorized staff using SharkTask websites and apps. Before adoption, the controller’s legal name, tax ID, address, email and telephone must be completed. SharkTask is the product name, not a substitute for identifying the legal entity responsible.
Data and purposes
Depending on the features used, data includes account and contact details, profiles, services, bookings, addresses, coordinates, conversations, uploaded files, reviews and technical access records. Purposes include account management, connecting participants, coordinating services, support, dispute handling and misuse prevention. Only data necessary for each disclosed purpose should be collected.
Location and addresses
Device location is requested through device permissions to find services or select an address. You can enter a different address; your current location need not be the service location. The agreed address, additional directions and map point are shared with those who need to deliver or coordinate the booking. Do not publish private addresses in reviews. Revoking permission does not erase previously saved addresses or bookings.
Identity and professional credentials
Identity verification and professional eligibility are separate checks. The proposal includes optional documentary identity checks for customers and activity-specific provider requirements, including ReTHUS or SIRNA checks where applicable. Profiles should show verification results and scope, not public copies of identity documents or full supporting records. Controls and consent for new checks must be implemented before activation.
Sensitive data and biometric access
Do not submit unnecessary medical records, intimate information or third-party documents. Sensitive data processing requires applicable safeguards and explicit authorization; its optional nature must be explained and it must not be an indiscriminate requirement. Face ID or fingerprint unlocking uses device authentication and is distinct from documentary identity verification; it does not mean SharkTask receives biometric templates. Any future face capture or liveness check requires specific prior information.
Chat, evidence and reviews
Booking conversations and evidence are intended for participants and authorized support or dispute handling, not public reviews. Reviews and photos you choose to publish are visible according to their publication context. Avoid identity documents, phone numbers, addresses, medical information or identifiable third-party images without authorization. End-to-end chat encryption is not promised.
Payments and commercial relationship
Under the proposed model, customers pay providers directly. Records of agreements, deposits, receipts and disputes document that relationship; uploading a receipt does not itself prove payment. Provider commissions or subscriptions payable to SharkTask are separate. Do not send banking passwords, complete card numbers or security codes through chat. Participants and data processing will be disclosed before future payment gateways are activated.
Recipients and technology providers
Depending on active configuration, operations may use Google Maps for place searches, Firebase for authentication or chat, and storage, hosting and notification providers. Address queries and data needed for these features may be processed by these suppliers. The final policy requires an inventory of processors, countries, purposes and contractual safeguards for international data processing and transfers. This policy does not authorize unrestricted sharing.
Permissions, cookies and communications
The website uses session and security mechanisms. Apps may request location, camera, file or notification permissions when the corresponding feature is used. Device and browser settings allow control of permissions and cookies, possibly limiting functionality. Operational booking and security notices must be distinguished from advertising. Nonessential marketing purposes require applicable consent and a withdrawal mechanism; this draft does not establish that a consent manager is already implemented.
Retention and security
Data should be kept for the disclosed purpose, legal obligations and claims handling, with restricted access. Closing an account does not immediately erase records subject to legal retention. A validated retention schedule must cover each data type, files and backups, with deletion or anonymization procedures. Absolute security and instant deletion of every copy are not promised.
Your rights and requests
You may access your data free of charge, update or correct it, request evidence of consent and information about its use, and request deletion or consent withdrawal where applicable. Identity checks for requests must be proportionate. General response periods are ten business days for inquiries, extendable by five, and fifteen business days for complete complaints, extendable by eight, with notice of reasons and the new deadline. You may contact Colombia’s SIC after completing the applicable prior procedure with the controller or processor.
Privacy contact awaiting completion
Before adoption, an effective privacy email or form, the responsible contact and handling procedure must be published. Help is linked below but must not be represented as an already verified specialist privacy channel. Do not send identity documents to addresses not confirmed by SharkTask.
Minors and policy changes
This draft does not enable child accounts or general collection of children’s data. Services involving minors require specific safeguards, respect for their best interests and representative involvement where applicable. Material changes of purpose will be disclosed before application and require renewed authorization where applicable. The version date identifies the draft, not its definitive effective date.
Required before these terms take effect
Complete controller identity and contact, rights request channel, supplier and country inventory, retention periods and consent mechanisms. Validate compliance with Colombia’s Law 1581 of 2012 and its regulations before final adoption.