Legal & Compliance

1. Introduction

Helfio ("we", "us", "our") operates an online platform that connects private individuals in Austria with qualified helpers for household services. Protecting your personal data is a core priority for us.

We process your data exclusively in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG 2018), and the applicable provisions of the Telecommunications Act (TKG). This Privacy Policy explains which personal data we collect, on what legal basis and for what purposes we process it, how long we retain it, and what rights you hold as a data subject.

2. Data Controller

The controller within the meaning of the GDPR is: Helfio, Austria, Email: privacy@helfio.at, Website: helfio.at

For all data-protection-related enquiries, our privacy team is available at privacy@helfio.at.

3. Personal Data You Provide

Registration and account data: When you create an account we collect your full name, email address, a password (stored exclusively in hashed form), and your preferred display language.

Profile data: You may voluntarily provide a profile description (short biography) and contact information of your choice, including phone number, website URL, Instagram, Facebook, Telegram, WhatsApp, or LinkedIn profile. Helpers additionally define their service categories and coverage areas (postal codes).

Task data (customers only): When creating a task we collect the task title and description, location data (street address, postal code, city), preferred date and time, budget, and any photos you choose to upload.

Offer data (helpers only): When submitting an offer we collect your offer message to the customer and the proposed price.

Communication data: Messages and comments you exchange with other platform users through the in-offer messaging feature.

Review data: Star ratings (1–5) and text comments you submit after a task has been completed.

4. Automatically Collected Data

Technical log data: With every page request we automatically record your IP address, browser type and version, operating system, device type, and HTTP user-agent in server log files.

Session data: To manage your login and to protect against Cross-Site Request Forgery (CSRF) attacks, we use session cookies and associated security tokens. Session data is held in our Redis cache and expires automatically after 120 minutes of inactivity.

API authentication tokens: When you access the platform via our API, we create Personal Access Tokens for secure authentication. These are retained until manually revoked or until your account is closed.

Usage timestamps: The times of actions you take on the platform (creating tasks, submitting offers, posting reviews) are recorded to ensure platform functionality and to detect abuse.

5. Legal Basis for Processing

We base the processing of your personal data on the following legal grounds under Article 6 GDPR:

Performance of a contract (Art. 6(1)(b) GDPR): Registration, profile, task, offer, and communication data are processed to fulfil the contract concluded with you and to provide you with the core platform features — in particular the matching of customers and helpers.

Legal obligation (Art. 6(1)(c) GDPR): In certain cases we are legally required to process or retain data, for example to comply with tax and commercial record-keeping obligations or to respond to requests from public authorities.

Legitimate interests (Art. 6(1)(f) GDPR): Technical log data, session data, and usage timestamps are processed on the basis of our legitimate interests in platform security, fraud prevention, and continuous service improvement. These interests do not override your fundamental rights and freedoms.

Consent (Art. 6(1)(a) GDPR): Non-essential cookies, analytics technologies, or marketing communications are deployed only on the basis of your explicit consent, which you may withdraw at any time with future effect.

6. Purposes of Processing

Platform provision: Creating and managing your user account; enabling customers to create tasks and helpers to submit offers; facilitating the entire matching and booking process.

Communication: Sending transactional emails (e.g. account activation, password reset, notifications about tasks and offers); enabling direct messaging between customers and helpers on the platform.

Review and reputation system: Processing and displaying ratings and reviews; calculating the average rating of helpers to promote trust and transparency.

Security and fraud prevention: Detecting and preventing fraud, spam, unauthorised access, and other abusive or unlawful activity on the platform.

Legal compliance: Fulfilling tax and commercial record-keeping obligations and responding to requests from public authorities.

Platform improvement: Analysing anonymised usage data to optimise platform features, performance, and user experience.

7. Recipients and Data Processors

We do not share your personal data with third parties for commercial advertising purposes. In connection with our service provision we work with the following categories of service providers acting as data processors within the meaning of Art. 28 GDPR:

Cloud file storage: Task photos you upload are stored in S3-compatible cloud storage services (e.g. Amazon Web Services S3). Transfer and storage are encrypted.

Email service providers: Transactional emails are sent via specialist providers (e.g. Postmark, Resend, or Amazon SES), which process the recipient's email address and email content in doing so.

Infrastructure providers: Our database server (PostgreSQL) and cache storage (Redis) run on the infrastructure of reliable cloud providers that are contractually bound to GDPR compliance.

Other platform users: Certain profile information of helpers (name, biography, average rating, service categories) is made publicly visible to customers. Task information is visible to helpers. This visibility is inherent to the platform's core function and is governed by the terms of use.

Public authorities: We may disclose data to law enforcement or other competent authorities where we are legally required to do so or where a legitimate interest exists (e.g. in cases of suspected fraud).

8. International Data Transfers

Certain data processors — in particular cloud storage and email service providers — may process data outside the European Economic Area (EEA). In such cases we ensure an adequate level of data protection through appropriate safeguards under Art. 46 GDPR:

Standard Contractual Clauses (SCCs) issued by the European Commission pursuant to Art. 46(2)(c) GDPR;

Adequacy decisions of the European Commission for certain third countries (where applicable);

The EU-US Data Privacy Framework for US-based providers that have joined this framework.

Further information about the applicable safeguards is available on request at privacy@helfio.at.

9. Retention Periods

We retain your personal data only for as long as necessary for the respective processing purposes or as required by statutory retention obligations:

Account data (name, email, password, profile): Until your account is deleted. Afterwards, certain data may be retained for up to 7 years where required by tax or commercial law retention obligations.

Task, offer, and communication data: Until deleted by you or until account closure. Data relating to completed transactions may be retained for the duration of statutory retention periods.

Review data: Until account deletion or upon substantiated request.

Session data: Automatic expiry after 120 minutes of inactivity in Redis cache.

API authentication tokens: Until manually revoked or until account closure.

Log files: Typically up to 90 days; longer retention only where a demonstrated security or legal need exists.

Task photos (cloud storage): Until the task or account is deleted, after which they are removed from cloud storage.

10. Your Rights as a Data Subject

You hold the following rights under the GDPR. To exercise them, please contact privacy@helfio.at — we respond within 30 days (for complex requests, within up to 3 months with prior notification):

Right of access (Art. 15 GDPR): Right to obtain confirmation and a copy of the personal data we process about you, together with all processing details.

Right to rectification (Art. 16 GDPR): Right to have inaccurate data corrected and incomplete data completed.

Right to erasure (Art. 17 GDPR): Right to have your data deleted when the purpose for processing has ceased, you have withdrawn your consent, or another erasure ground applies — provided no statutory retention obligation prevents this.

Right to restriction of processing (Art. 18 GDPR): Right to have processing restricted under certain statutory conditions.

Right to data portability (Art. 20 GDPR): Right to receive your data in a structured, commonly used, and machine-readable format and to have it transferred to another controller.

Right to object (Art. 21 GDPR): Right to object to processing of your data on the basis of legitimate interests (Art. 6(1)(f) GDPR) on grounds relating to your particular situation.

Right to withdraw consent (Art. 7(3) GDPR): Any consent given may be withdrawn at any time with future effect. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

11. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes the GDPR or the Austrian DSG 2018, you have the right to lodge a complaint with the competent supervisory authority:

Austrian Data Protection Authority (Datenschutzbehörde – DSB), Barichgasse 40–42, 1030 Vienna, Austria, Phone: +43 1 521 52-0, Email: dsb@dsb.gv.at, Website: www.dsb.gv.at

We nevertheless encourage you to contact our privacy team first (privacy@helfio.at) so that we can resolve your concern promptly and without formality.

12. Data Security

We implement appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction. These measures include in particular:

Encrypted data transmission via HTTPS/TLS for all connections to the platform;

Password hashing using bcrypt (cost factor 12) — plaintext passwords are never stored or transmitted;

Session security with CSRF protection to prevent Cross-Site Request Forgery attacks;

Token-based API authentication via Laravel Sanctum;

Role-based access control — users can only access their own data and explicitly shared public content;

Regular security audits and prompt application of security updates.

Despite these measures, no internet transmission can be guaranteed as absolutely secure. In the event of a security incident we will notify you and the competent authorities in accordance with statutory requirements.

13. Cookies and Similar Technologies

We use cookies and similar technologies on our platform. For detailed information about which cookies we use, for what purposes, and how you can manage your cookie preferences, please refer to our Cookie Policy.

Technically necessary cookies (e.g. session cookie, CSRF token, language preference cookie) are set on the basis of our legitimate interest in the secure and functional provision of the platform and do not require separate consent. For all non-essential cookies we obtain your explicit consent.

14. Minors

Our platform is intended exclusively for individuals who have reached the age of 18. We do not knowingly collect personal data from minors.

Should we discover or be informed that a minor has created an account, the relevant data will be deleted without delay. Please notify us at privacy@helfio.at if you believe this has occurred.

15. Automated Decision-Making and Profiling

We do not make solely automated decisions within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you.

The automatic calculation of a helper's average rating based on reviews submitted by users does not constitute automated individual decision-making within the meaning of Art. 22 GDPR, since it is based exclusively on input from other users and does not constitute an algorithm-driven decision about your suitability or conduct.

16. Changes to This Privacy Policy

We update this Privacy Policy as needed to reflect changes in our data practices, new legal requirements, or technical developments. The date of the most recent update is shown at the top of this document.

In the event of material changes we will notify you by email or by a prominent notice on the platform before the changes take effect.

17. Contact and Privacy Requests

For all questions, comments, and requests relating to this Privacy Policy or the processing of your personal data, please contact:

Helfio Privacy Team, Email: privacy@helfio.at

We respond to your requests within 30 days of receipt. For complex requests this period may be extended to up to three months; we will notify you of any extension in advance.

1. What Are Cookies?

Cookies are small text files stored on your device (computer, smartphone, tablet) when you visit a website. They allow the website to recognise you on subsequent visits and retrieve your stored preferences.

In addition to cookies, we use technically similar technologies such as web storage (localStorage, sessionStorage) that serve comparable functions. In this policy we use the term "cookies" collectively for all such technologies.

2. Legal Basis

Strictly necessary cookies are used on the basis of our legitimate interest in the secure and functional provision of the platform pursuant to Art. 6(1)(f) GDPR and § 96(3) TKG 2021.

Preference cookies (language, colour scheme) are also based on our legitimate interest, since they serve solely to improve your convenience and no user profile is created.

Analytics cookies and other non-essential cookies are used exclusively on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR and § 96(3) TKG 2021. You may withdraw this consent at any time.

3. Strictly Necessary Cookies

These cookies are essential for the technical operation of the platform and cannot be disabled without substantially impairing functionality.

Session cookie: Stores an encrypted session ID that maintains your logged-in state across page requests. Deleted automatically when you close your browser session or after 120 minutes of inactivity.

CSRF protection cookie (XSRF-TOKEN): Protects form submissions against Cross-Site Request Forgery attacks. Expires with the browser session.

Both cookies are processed exclusively on our own servers; no data is shared with third parties.

4. Preference Cookies

These cookies store your settings so you do not have to reconfigure them on every visit. They do not create a user profile and are not used for advertising purposes.

Language preference cookie: Stores your preferred display language (German/Austria, English, Ukrainian). Validity: 1 year.

Colour scheme cookie: Stores your choice of light or dark theme. Validity: 1 year.

You can delete these cookies via your browser settings, after which you will need to set your preferences again.

5. Analytics Cookies

Where we use analytics technologies to better understand usage behaviour on our platform and improve user experience, this is done exclusively with your explicit consent.

At the time of the last update of this policy, no third-party analytics services (e.g. Google Analytics) are active on the platform. Should this change, we will update this policy in advance and obtain your consent.

6. Third-Party Cookies

At the time of the last update of this policy, Helfio does not use any third-party cookies (e.g. social media tracking, advertising networks).

Should we integrate third-party services in the future, we will update this policy and — where required — obtain your explicit consent.

7. Managing and Withdrawing Consent

Via our cookie banner, you can grant or refuse consent for non-essential cookies on your first visit to the platform. Any consent given can be withdrawn at any time with future effect.

You can also manage, disable, or delete cookies at any time directly in your browser settings. Please note that disabling necessary cookies will significantly impair platform functionality (e.g. login, form protection).

Instructions for managing cookies in common browsers can be found in your browser's help documentation.

8. Changes to This Cookie Policy

We update this Cookie Policy as needed to reflect changes in the technologies we use or new legal requirements. The date of the most recent update is shown at the top of this document.

In the event of material changes we will notify you by email or via a prominent notice on the platform.

9. Contact

For questions about this Cookie Policy or our data practices, please contact: privacy@helfio.at

1. Scope and Contracting Party

These Terms of Service ("Terms") govern access to and use of the Helfio online platform by all registered and non-registered users. By registering or using the platform, you agree to be bound by these Terms.

The contracting party for these Terms is: Helfio, Austria, Email: privacy@helfio.at, Website: helfio.at

If you accept these Terms on behalf of a company or other legal entity, you represent that you are authorised to legally bind that entity.

2. Description of Services and Helfio's Role

Helfio is an online intermediary platform that connects private individuals ("Customers") who need household help and local services with qualified providers of such services ("Helpers") in Austria.

Helfio acts solely as an intermediary and does not become a party to the service agreements concluded between Customers and Helpers. All arrangements regarding the type, scope, price, and execution of a service are made exclusively between the respective Customer and Helper.

Helfio is not an employer, client, or agent of the Helpers and accepts no responsibility for the actual provision, quality, or legality of the services arranged.

3. Eligibility

Use of the platform requires that you are at least 18 years old and have full legal capacity.

The platform is intended for individuals residing or habitually present in Austria. Use from other countries is not expressly provided for and is at the user's own risk.

Registration on the platform is restricted to natural persons. Companies, agencies, or other legal entities may not create an account without first obtaining our express permission.

4. Registration and Account

Full access to the platform requires registration. You must provide complete, truthful, and current information at registration and commit to updating your account details promptly when they change.

You are responsible for all activities that occur under your account, regardless of whether you are acting yourself or a third party has gained access to your account. Do not share your login credentials (password, tokens) with third parties.

Any suspected unauthorised access to your account must be reported immediately to privacy@helfio.at. Helfio is not liable for damages arising from the disclosure of login credentials or failure to report a suspected breach.

Each individual may hold only one account. Multiple registrations are prohibited and entitle Helfio to immediately suspend all affected accounts.

5. User Roles: Customers and Helpers

Customers may create tasks on the platform, view and accept offers from Helpers, and rate Helpers upon completion of a task.

Helpers may create a profile on the platform, define service categories and coverage areas (postal codes), submit offers on tasks, and receive ratings from Customers.

A user may be registered simultaneously as a Customer and as a Helper, provided they meet the requirements for both roles. The role-specific obligations set out in these Terms apply to each role accordingly.

6. Customer Obligations

Customers commit to describing tasks truthfully and in full so that Helpers can submit informed offers. Misleading information about the location, nature, scope, or budget of a task is prohibited.

By accepting an offer, Customers commit to paying the agreed fee directly to the Helper. The specific payment arrangements are the sole responsibility of the Customer and Helper to agree upon.

Customers may not ask Helpers to perform services that violate applicable law, and must ensure safe and appropriate working conditions.

Reviews may only be submitted for services actually received and must be truthful, objective, and respectful.

7. Helper Obligations

Helpers commit to representing their skills, experience, availability, and service offerings truthfully. False or misleading profile information is prohibited.

Helpers are solely responsible for obtaining and maintaining all licences, business permits, and insurance required for their activities. Helfio does not verify or accept responsibility for these.

Helpers acting as independent contractors are solely responsible for correctly reporting their income for tax and social security purposes. Helfio is in no way to be regarded as an employer under Austrian employment or social security law.

Accepted tasks must be completed diligently, professionally, and within the agreed timeframe. If a task cannot be completed as agreed, the Customer must be informed without delay.

8. Prohibited Conduct

The following conduct is expressly prohibited on the platform:

Publishing content that is unlawful, offensive, discriminatory, defamatory, pornographic, or otherwise contrary to public decency;

Circumventing the platform to avoid commissions, fees, or other charges (off-platform communication with abusive intent);

Creating fake reviews, manipulating feedback, or otherwise influencing the reputation system in an unfair manner;

Automated access to the platform (scraping, bots) without Helfio's express written permission;

Using the platform for spam, advertising, chain letters, or unsolicited contact;

Any attempt to circumvent, disable, or compromise the platform's security measures.

9. Ratings and Reviews

The rating system is designed to promote trust and transparency on the platform. Customers may rate Helpers after a task has been completed using 1–5 stars and a text comment.

Reviews must be based on the reviewer's own direct experience and must be factually accurate. Helfio reserves the right to remove reviews that violate these Terms, are manifestly fabricated, offensive, or otherwise abusive.

Helfio does not editorially pre-screen reviews and is not liable for their content. Contact privacy@helfio.at if you consider a review to be abusive.

10. Content and Intellectual Property

All rights in the platform, including its design, software, text, graphics, logos, and databases, belong to Helfio or the respective rights holders. Reproduction, distribution, or public communication without express permission is prohibited.

By uploading content (photos, text) to the platform, you grant Helfio a non-exclusive, worldwide, royalty-free licence to use that content for the purpose of operating the platform. You warrant that your content does not infringe the rights of any third party.

Helfio is entitled to remove content that violates these Terms, applicable law, or the rights of third parties.

11. Disclaimer and Limitation of Liability

Helfio provides the platform on an "as is" basis and makes no warranty as to uninterrupted availability, freedom from error, or fitness for a particular purpose.

Helfio is not liable for damages arising from the use of services arranged via the platform, including damages caused by defective performance, accidents, or property damage. The contractual relationship for the service exists solely between the Customer and the Helper.

To the extent permitted by law, Helfio's liability is limited to cases of intent and gross negligence. Liability for slight negligence is excluded, except in cases of personal injury.

For consumers within the meaning of Austrian consumer protection law (KSchG), mandatory statutory warranty and liability rights are not affected by the above limitations.

12. Indemnification

You agree to indemnify and hold harmless Helfio, its employees, agents, and representatives from and against any claims, costs, damages, and liabilities arising from your breach of these Terms, your abusive use of the platform, or your infringement of the rights of third parties.

This indemnification obligation does not apply to the extent that Helfio itself is responsible for the damage.

13. Account Suspension and Termination

You may request deletion of your account at any time by contacting privacy@helfio.at. After deletion, your personal data will be handled in accordance with our Privacy Policy.

Helfio is entitled to temporarily suspend or permanently terminate accounts in the event of a breach of these Terms, abusive use, or an order from a public authority. In the case of a serious violation (e.g. fraud, harassment), suspension may take effect immediately and without prior notice.

Following account closure, you will lose access to the platform and your data. Agreements already concluded between Customers and Helpers are not affected by account closure.

14. Out-of-Court Dispute Resolution

In the event of a dispute between users, we recommend first contacting the other user directly. Helfio may mediate upon request but is not obliged to do so.

Pursuant to EU Regulation No. 524/2013 on online dispute resolution for consumer disputes, consumers have the option of resolving disputes via the European Commission's ODR platform: https://ec.europa.eu/consumers/odr/

In Austria, consumers may also use the Internet Ombudsman for out-of-court dispute resolution. Further information at: https://www.wko.at/service/schlichtung-fuer-verbrauchergeschaefte/schlichtungsverfahren

15. Governing Law and Jurisdiction

These Terms are governed by Austrian law, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). Consumers are additionally protected by the mandatory provisions of the Austrian Consumer Protection Act (KSchG) and the E-Commerce Act (ECG).

To the extent permitted by law, the competent courts in Vienna, Austria, shall have exclusive local jurisdiction over any disputes arising from or in connection with these Terms.

For consumers residing in another EU member state, the mandatory consumer protection provisions of their country of residence apply.

Should any individual provision of these Terms be or become wholly or partially invalid, the validity of the remaining provisions shall not be affected. The invalid provision shall be replaced by the legally permissible rule that most closely reflects the economic purpose of the invalid provision.

16. Changes to These Terms

Helfio reserves the right to amend these Terms as needed to reflect changes in legal requirements, new platform features, or changed business practices.

Material changes will be communicated to you at least 30 days before they take effect, by email or via a prominent notice on the platform. Your continued use of the platform after the amended Terms take effect constitutes acceptance of the changes.

If you do not agree to the changes, you have the right to delete your account free of charge before the changes take effect.

17. Contact

For questions about these Terms or about using the platform, please contact:

Helfio, Email: privacy@helfio.at

We respond to enquiries within 14 business days.

1. General and Helfio's Role

Helfio is a free-to-use intermediary platform and does not charge platform fees to customers or helpers. Payments for services rendered are agreed and settled exclusively and directly between customers and helpers.

As Helfio is not a payment service provider and does not process transactions between parties, any claims for refunds in relation to services must be directed to the helper (as the contracting party), not to Helfio.

This policy describes the cancellation rules on the platform and the statutory rights available to consumers in connection with service contracts arranged via the platform.

2. Task Cancellation Before Offer Acceptance

Customers may cancel or delete a task at any time before accepting an offer, free of charge. No obligations arise towards helpers who have submitted an offer.

Helpers may withdraw a submitted offer at any time before it has been accepted by the customer.

3. Cancellation After Offer Acceptance

Once a customer accepts an offer, a service contract is formed exclusively between the customer and the helper. Cancellation terms are governed by the agreement reached between the parties and by applicable law.

We strongly recommend that customers and helpers agree in writing on cancellation terms (notice periods, applicable costs) before work begins.

If a helper is unable to fulfil an accepted task, the customer must be informed without delay. Any partial services already rendered may be charged in accordance with what was agreed.

4. Statutory Right of Withdrawal (FAGG)

Consumers within the meaning of Austrian consumer protection law (KSchG) who conclude distance service contracts are entitled to the statutory right of withdrawal under the Austrian Distance and Off-Premises Contracts Act (FAGG, BGBl. I No. 33/2014).

Consumers generally have the right to withdraw from the contract within 14 days of conclusion without giving any reason. The 14-day withdrawal period begins on the day the contract is concluded.

The withdrawal must be declared to the helper (as the contracting party). Helfio can provide a model withdrawal form upon request at privacy@helfio.at.

5. Exceptions to the Right of Withdrawal

The right of withdrawal lapses pursuant to § 18(1)(1) FAGG if the helper has fully performed the service with the consumer's express consent before the withdrawal period has expired and the consumer was informed before performance began that they would lose their right of withdrawal upon full performance.

Where the parties have agreed that performance may begin before the expiry of the withdrawal period and the service has not been fully completed, the consumer must pay the helper a proportionate amount for services rendered up to the point of withdrawal (§ 16 FAGG).

6. Disputes Between Customers and Helpers

In the event of disagreements over services rendered or not rendered, we recommend that the parties first attempt to resolve the matter directly. Clear written documentation of agreed services (via the platform's messaging feature) facilitates resolution.

Helfio may act as an impartial mediator upon request but is not obliged to arbitrate disputes or make binding decisions. Contact privacy@helfio.at if you need support with mediation.

For out-of-court dispute resolution, consumers may use the European Commission's ODR platform (https://ec.europa.eu/consumers/odr/) or the Austrian Internet Ombudsman.

7. Review System After Task Completion

After a task is completed, customers have the opportunity to rate the helper. Reviews are an important quality assurance tool on the platform but do not replace any legal claims.

If you are unsatisfied with a service received, we recommend first seeking an amicable resolution with the helper before leaving a negative review.

8. Contact

For questions about cancellations, withdrawal rights, or disputes, please contact:

Helfio, Email: privacy@helfio.at

We respond within 14 business days.