Privacy Policy

Lorro.app Privacy Policy

AHEX LTD (C 95809) | Lorro.app | Malta

  1. Who we are

Lorro.app is operated by AHEX LTD, a private limited company registered in Malta (registration number C 95809, registered office at 113, Triq l-Imdina, Qormi QRM 9016, Malta). AHEX LTD is the data controller for personal data processed through the Lorro.app platform. For any privacy matter, contact us at info@lorro.app. We have not appointed a Data Protection Officer, as our processing does not meet the mandatory thresholds; privacy matters are handled directly by management at the address above. (Note 1)

Lorro.app is a service for adults. By creating an account you confirm you are 18 or older; the platform is not directed at children.

  1. What data we collect and create

All users: name, email address, phone number, account credentials, messages and reviews exchanged through the platform, and non-identifying referral campaign tags.

Clients: job request details (category, description, photos, property characteristics, preferred time windows, general area), your exact service address and phone number (shared only as described in §6), payment card details (processed by Stripe — we never store card numbers), and your booking and transaction history.

Service providers: identity document number and type, date of birth, nationality, entity type and business or company registration details, VAT number, Jobsplus/CFR self-employment registration, work-authorization category and document references with expiry dates, Police Conduct Certificate (sighted for verification; we record the issue date and verification outcome), trade licence details (REWS Authorisation, F-Gas card) where applicable, knowledge-test results, coverage areas, offer history, earnings and payout data, and insurance details where provided. Where verification requires it, we may hold copies of verification documents pending review; retention follows §7. Verified, legally authorized providers are the core of the service. (Notes 2, 2a, 3)

Data we obtain from other sources: to verify providers, we cross-check details against public registers — including the REWS register of authorised electricians, the MCCAA F-Gas cardholder list, and the Malta Business Registry — and record the verification outcome.

Data we create: verification and vetting outcomes, reviews and ratings, dispute and remedy records, and support correspondence relating to your account.

Technical data: essential cookies required for login and platform function, and location data processed through Google Maps when you use address features. We do not currently run advertising pixels or third-party analytics; if that changes, this section and our cookie notice will be updated first. (Note 4)

  1. Why we process it (legal bases)

Contract performance: operating the marketplace — publishing job requests, transmitting offers, processing payments, enabling communication, and handling disputes and remedies.

Legal obligation: verifying providers' authorization to work before granting bidding rights; reporting providers' annual platform earnings and identification data to the Malta Tax and Customs Administration under DAC7 each January; maintaining accounting and tax records.

Legitimate interests: vetting providers for platform safety (including conduct-certificate verification), preventing fraud, maintaining review and dispute records, improving the service, and establishing, exercising, or defending legal claims. We rely on these interests subject to the minimization and safeguard measures described in this policy, and you may object at any time (§12). (Notes 2, 5)

Consent: direct marketing (§8) and any future non-essential cookies.

  1. Automated decision making

Passing our provider knowledge test automatically records your result and may automatically grant bidding rights. This automated step only ever operates in your favour (granting access); it never suspends or removes rights. If you fail, you may retake the test after 48 hours and may request human review of the outcome at info@lorro.app.

Suspension, delisting, and revocation of bidding rights are always decisions made by a human member of our team — no Lorro.app account is restricted by algorithm alone. You may contest any decision, request human intervention, and express your point of view by contacting us. (Note 6)

  1. Who we share it with

Stripe Payments Europe Ltd — payment processing and provider payouts; Stripe acts as our processor for platform payments and as an independent controller for parts of its own processing, such as payments compliance and fraud prevention, under its own privacy policy; Stripe collects tax identification data during payout onboarding Sharetribe Oy (Finland) — platform hosting and infrastructure, processing marketplace data on our behalf under its data processing terms (Note 7) Google (Google Ireland Ltd / Google LLC) — Maps and location services; Forms and Sheets used in provider onboarding and operations (Note 13) Zapier Inc. — workflow automation connecting the services above Insurers and brokers — claims handling only, per claim Malta Tax and Customs Administration — DAC7 annual reporting Professional advisers — legal and accounting, under confidentiality

We have data processing agreements with our processors. We do not sell personal data. (Note 7)

  1. What the other party to your transaction sees

Before an offer is accepted, providers see the job details, photos, property characteristics, general area (locality only), and the client's first name and last initial — never a phone number or exact address. After a client accepts an offer and payment is authorized, the client shares the exact address and phone number with that provider through the platform's message thread. This staged disclosure is a deliberate data-minimization design.

Providers who receive a client's personal data through an accepted job act as independent controllers of that data for the purpose of performing the job. Under our provider terms, they may use it solely to perform that job, must keep it confidential, and must delete it within one month of job completion unless their own legal obligations require longer retention. (Note 8)

  1. How long we keep it

Client job and transaction data, including message threads and dispute records: for the duration of applicable legal limitation periods (approximately 5 years from transaction completion), so that claims can be established, exercised, or defended (Note 9) Accounting, payment, and DAC7 records: as required by Maltese tax and company law — up to 10 years (Note 9) Provider verification and vetting records: duration of active provider status plus 3 years, except where statutory retention requires longer; verification document copies, where held, are kept only as long as verification requires (Note 2a) Fraud or safety investigation records: up to 10 years Dormant accounts: closed after 3 years of inactivity following email notice, with data then deleted or anonymized per this schedule

We maintain regular exports of platform records to our own secure storage so that these retention commitments do not depend on any single service provider. (Note 14)

  1. Direct marketing

We send marketing communications — such as service updates and referral programme invitations — with your consent, or to existing users about similar services under the soft opt-in rules, always with a one-click opt-out. We never email people who have not used Lorro.app without their consent. (Note 10)

  1. International transfers

Sharetribe Oy, our platform provider, is based in Finland (EEA); it and our other service providers (Stripe, Google, Zapier) may use subprocessors or process data outside the EEA, including in the United States. Such transfers are safeguarded by the EU–US Data Privacy Framework and, where applicable, EU Standard Contractual Clauses. (Note 11)

  1. Disclosure to authorities

We disclose personal data to police, courts, or regulators where legally required, and we reserve the right to report to the competent authorities any conduct that presents a threat to the safety of users, providers, or the public. Verification records, including work-authorization documentation, may be disclosed to competent authorities where the law requires.

  1. Business changes

If AHEX LTD undergoes a merger, acquisition, or asset sale involving the Lorro.app platform, personal data may be transferred to the successor entity under the protections of this policy, with notice to users.

  1. Your rights

You may access, rectify, erase, restrict, and port your personal data, object to processing based on legitimate interests, and withdraw consent at any time without affecting prior processing. Some rights are limited where we are legally required to retain data — for example, tax and accounting records — and we will explain any limitation when responding to your request. Contact info@lorro.app to exercise any right. You may lodge a complaint with the Information and Data Protection Commissioner (IDPC), Malta — idpc.org.mt — or your local EU supervisory authority, and you have the right to seek a judicial remedy.

  1. Third-party links

The platform may link to external sites, including payment and verification services. Their privacy practices are their own; this policy covers Lorro.app only.

  1. Changes to this policy

Updates will be posted on this page with a revised date, and users will be notified of material changes.

Last updated: 07/07/2026