1. Introduction
This Privacy Policy explains how Gainlabs LTD ("Gainlabs LTD", "we", "us", "our") collects, uses, stores, shares, and protects personal data when you use GainWorkers (the "Platform"), including our website, dashboards, APIs, and related services.
Gainlabs LTD is the data controller for personal data processed through the Platform.
We are registered in England and Wales at 8/B Greenwood Grove
Abingdon, Marcham
England
OX13 6FR
United Kingdom.
Our ICO registration number is ZC201449.
2. Scope
This Policy applies to:
- Workers and employers who register for or use the Platform
- Visitors to public pages, blog posts, and help content
- API customers and SMM panel integrators using our reseller API
- Individuals whose data appears in proofs, submissions, chat, or support tickets
Separate terms may apply to third-party payment processors, identity vendors, or analytics providers acting as independent controllers. Links to their policies are provided where relevant at checkout or verification.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account and identity | Name, username, email, password hash, date of birth, gender (optional), company (optional), postal address, country, phone dial code | You at registration and profile updates |
| Verification (KYC) | Government ID images, passport or licence numbers, selfie with document, reviewer notes | You when submitting identity verification |
| Work activity | Accepted jobs, proofs, screenshots, template answers, revision history, qualification test attempts, trust and reliability metrics | Generated through Platform use |
| Wallet and payments | Deposits, withdrawals, crypto wallet addresses, on-chain transaction references, invoices, fees, escrow holds and releases | You and our payment partners |
| Employer campaigns | Campaign content, targeting rules, budgets, review decisions, API orders, webhook callbacks | Employers and API integrators |
| Security and integrity | IP address, device and browser signals, login events, 2FA activity, fraud flags, geo context, linked-account indicators | Automatically when you use the Platform |
| Communications | Support tickets, chat messages, blog comments, email and SMS verification codes | You and Platform messaging systems |
| Live Modes and monitoring | Session participation, lobby activity, automated verdict inputs, settlement snapshots | Generated during Live Broadcast, Arena, Rentals, Task Hunters, or related modes |
4. How we use personal data
We process personal data to:
- Create and administer accounts, authenticate users, and provide dashboards
- Match workers to jobs, enforce eligibility, geo rules, capacity limits, and qualification gates
- Review proofs, calculate payouts, manage escrow, deposits, and withdrawals
- Operate Trust Intelligence, fraud prevention, duplicate detection, and compliance reviews
- Provide employer tools, campaign publishing, API fulfillment, and reseller integrations
- Send service, security, and transactional communications
- Respond to support requests and enforce our Terms of Service
- Meet legal, tax, accounting, and regulatory obligations
- Improve reliability, security, and performance of the Platform
5. Lawful bases (UK GDPR)
Depending on the activity, we rely on one or more of the following lawful bases:
- Contract: processing necessary to provide the Platform you request
- Legal obligation: AML, fraud prevention, tax, and regulatory duties
- Legitimate interests: security, abuse prevention, service improvement, and proportionate analytics, balanced against your rights
- Consent: where required, for example optional marketing or non-essential cookies
Identity verification and payout compliance may involve special category data contained in identity documents. We process such data only where necessary for compliance, fraud prevention, and payout integrity, relying on substantial public interest and legal obligation where applicable, and with restricted access controls.
6. International hosting and data transfers
Gainlabs LTD is a United Kingdom company and operates under UK data protection law. To run GainWorkers reliably for members worldwide, parts of our platform infrastructure, including application hosting and technical operations, are located in Bursa, Republic of Türkiye, where our engineering team maintains the service.
The United Kingdom recognises certain countries as providing equivalent data protection standards for routine cross-border data flows. The Republic of Türkiye is not currently on that list. Where personal data is accessed from, stored in, or processed through Bursa, Republic of Türkiye, we do not rely on UK incorporation alone. We put approved legal safeguards in place before those transfers happen.
For transfers to our infrastructure providers in Türkiye we use the United Kingdom International Data Transfer Agreement (UK IDTA) and, where applicable, the UK Addendum to the EU Standard Contractual Clauses for controller-to-processor relationships. These are the standard UK-approved contractual tools for sharing personal data with service providers in countries without an adequacy decision.
Under those agreements we require our providers to:
- Process personal data only on our instructions and for documented purposes
- Apply confidentiality obligations to personnel with access
- Implement appropriate technical and organisational security measures
- Assist us with data subject rights requests and regulatory enquiries where relevant
- Delete or return data when processing ends, subject to legal retention duties
We supplement those contracts with practical security controls, including encryption in transit (HTTPS/TLS), application-level AES-256 encryption at rest for identity verification documents, role-based access control, audit logging, least-privilege administration, and restricted access to the KYC Secure Vault.
You may contact us for a summary of the safeguards relevant to your data or to request copies of appropriate redacted transfer documentation where we are permitted to provide them. Email info@gainworkers.com.
7. Sharing and processors
We share personal data only where necessary with:
- Cryptocurrency payment and payout processors, blockchain monitoring tools, and wallet infrastructure partners
- Email and SMS delivery providers
- Infrastructure, hosting, and security vendors
- Identity review personnel and controlled admin reviewers
- Professional advisers, auditors, insurers, and authorities where required by law
- Other users, where you choose to publish profile information, proofs, or chat messages
We require processors to protect personal data under written contracts and process it only on our documented instructions.
8. Retention
We retain personal data only as long as necessary for the purposes described in this Policy, including legal, accounting, dispute, and compliance requirements. Retention periods vary by data type, for example:
- Active account data: for the life of the account plus a limited post-closure period
- Financial records: as required by tax and audit rules
- KYC documents: for compliance periods required by payout and AML obligations
- Security logs: for a proportionate period to investigate abuse
When data is no longer required, we delete or anonymise it using reasonable technical measures.
9. Your rights
Under UK data protection law you may have the right to:
- Request access to your personal data
- Request correction of inaccurate data
- Request erasure in certain circumstances
- Restrict or object to certain processing
- Request data portability where applicable
- Withdraw consent where processing is based on consent
- Lodge a complaint with the ICO at ico.org.uk
To exercise your rights, email info@gainworkers.com. We may need to verify your identity before responding. We aim to respond within one month.
10. Security
We use administrative, technical, and physical safeguards appropriate to the nature of the data, including HTTPS/TLS in transit, hashed passwords, role-based admin access, audit logging, and a restricted KYC Secure Vault for identity documents.
KYC identity documents are stored outside public web directories, encrypted at rest with application-level AES-256, and are accessible only to authorised reviewers through time-limited admin tokens with access logging. Direct HTTP access to stored KYC files is blocked at the web server layer.
No online service can guarantee absolute security. You are responsible for keeping your password and 2FA devices secure.
11. Children
The Platform is not intended for individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will take appropriate steps.
12. Cookies and similar technologies
We use essential cookies and similar technologies for authentication, session security, CSRF protection, workspace preferences, and fraud prevention. Non-essential analytics or marketing cookies, if introduced, will be presented with appropriate consent controls.
13. Automated decision-making
The Platform uses automated scoring and rules for trust, reliability, geo eligibility, fraud screening, and capacity limits. These systems are advisory and may be combined with human review for payouts, verification, and enforcement actions. You may contact us for meaningful information about significant automated decisions affecting you.
14. Changes to this Policy
We may update this Policy to reflect legal, technical, or business changes. The "Last updated" date at the top will change when we do. Material changes may also be notified through the Platform or by email where appropriate.
15. Contact
Data controller: Gainlabs LTD
Contact: info@gainworkers.com
Registered address: 8/B Greenwood Grove
Abingdon, Marcham
England
OX13 6FR
United Kingdom