PRIVACY
POLICY.

YoungMerit (referred to as “YoungMerit”, “we”, “us” or “our”) operates the online platform accessible at youngmerit.com and any associated mobile applications or sub-domains. We connect young workers with businesses to complete short-form paid tasks, enabling workers to build verified work histories and businesses to access affordable, accountable entry-level talent.

For the purposes of data protection law, we are the data controller of personal information collected through the platform. We determine the purposes for which and the means by which personal data is processed.

We collect personal information in several ways: information you provide to us directly, information generated by your use of the platform, and in limited circumstances, information received from third parties.

2.1 Information You Provide Directly

2.2 Information Generated Automatically

2.3 Information From Third Parties

If you register or log in using a third-party authentication provider such as Google or LinkedIn, we receive basic profile information from that provider including your name, email address and profile photo, subject to the privacy settings you have configured with that provider. We do not receive or store your password for those services.

We may also receive limited fraud-prevention signals from payment processors and identity verification providers.

We collect personal information only for specific, explicit and legitimate purposes. We do not process data beyond what is necessary for those purposes.

• To create and manage your account — verifying your identity, enabling login, maintaining your profile and managing your preferences.
• To operate the platform — matching workers to tasks, processing task applications, managing escrow payments and releasing funds on approval.
• To build verified reputation records — recording completed tasks, storing review scores and trust metrics, generating your Skill Passport and level progression.
• To process payments securely — facilitating payment from businesses into escrow, holding funds securely and releasing them to workers upon task approval.
• To prevent fraud and ensure security — detecting bot activity, monitoring for account takeover attempts, verifying that users are who they claim to be and investigating disputes.
• To provide customer support — resolving disputes, responding to queries and managing platform mediation processes.
• To comply with legal obligations — meeting our obligations under anti-money laundering laws, tax reporting requirements and court orders.
• To improve the platform — analysing usage patterns in aggregate to identify bugs, improve features and develop new functionality.
• To communicate with you — sending transactional notifications (task updates, payment confirmations), safety alerts and, where you have consented, product updates and career advice.

Where the General Data Protection Regulation (GDPR), the Protection of Personal Information Act (POPIA), or other applicable law requires us to identify a legal basis for processing your personal information, we rely on the following:

Beyond the core purposes listed above, we want to be specific about how your data appears and is used on the platform.

5.1 Your Public Profile

When you create a worker profile, the following information is visible to businesses and other logged-in users of the platform: your first name and last initial, your location at country level, your skills, your trust score, your completed task count, your level badge and any reviews you have received. Your full name, email address, payment details, identity documents and precise device information are never visible to other users.

5.2 Your Skill Passport

Your Skill Passport is a shareable summary of your verified work history. When you share your Skill Passport using a generated link, the recipient can view your task completion record, trust score and skill certifications. You control whether your Skill Passport link is active and can deactivate it at any time from your account settings.

5.3 Reviews and Ratings

Reviews submitted by businesses about your work, and reviews you submit about businesses, are permanently recorded as part of the platform's trust infrastructure. Reviews may not be removed except where they are found to be fraudulent, abusive or submitted in bad faith following a dispute investigation. Verified review data forms the core of our reputation system.

5.4 Automated Decision-Making

Our fraud detection system uses automated processing to assess the risk of individual transactions and accounts. Where an account is flagged as high-risk, an automated decision may temporarily restrict access pending human review. You have the right to request human review of any automated decision that significantly affects you. You may exercise this right by contacting us at the details in Section 15.

Trust score calculation, level progression and task matching are also partially automated but do not produce decisions that have significant legal effects on you beyond your experience of the platform.

We do not sell your personal data. We do not share your personal data with third parties for their own marketing purposes. We share data only in the following circumstances:

6.1 With Other Platform Users

As described in Section 5.1, limited profile information is visible to other logged-in users. When you are matched to a task or accept a task, the business posting that task will be able to see your profile information and communicate with you through the platform messaging system. Similarly, workers can see business name and rating information for businesses posting tasks.

6.2 With Service Providers

We engage trusted third-party service providers who process personal data on our behalf under binding data processing agreements. These include:

All service providers are required to maintain the confidentiality and security of personal data and are prohibited from using it for any purpose other than providing the specified service.

6.3 Legal Disclosure

We may disclose personal data to competent authorities, regulators or courts where required to do so by applicable law, a valid court order, or where necessary to protect the rights, property or safety of the platform, its users or the public. Where legally permitted, we will notify you before disclosing your data.

6.4 Business Transfers

If we are involved in a merger, acquisition, sale of assets or other business restructuring, personal data we hold may be transferred to the successor entity. You will be notified in advance of any such transfer and of any changes to this Privacy Policy that may result.

We use cookies and similar tracking technologies to operate the platform, remember your preferences and understand how you use the service. A cookie is a small file stored on your device by your browser.

We do not use advertising or tracking cookies. We do not use cookies to build profiles of your behaviour for advertising purposes on other websites.

You can manage your cookie preferences at any time through the cookie settings panel available in the footer of the platform. You can also configure your browser to block or delete cookies, though this may affect platform functionality. For more information about managing cookies, visit allaboutcookies.org.

We retain personal data for as long as is necessary for the purposes for which it was collected, or as required by applicable law. We apply the following retention periods:

When data reaches the end of its retention period, it is securely deleted or irreversibly anonymised. If you request deletion of your account, we will delete or anonymise your personal data within 30 days except where retention is required by law or for legitimate dispute resolution purposes.

We operate across six countries. As a result, personal data collected in one country may be processed in a different country where our servers, service providers or team members are located. Wherever data crosses international borders, we ensure that appropriate safeguards are in place.

For transfers from the European Economic Area (including France and Spain) to countries not deemed adequate by the European Commission, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by technical and organisational measures as appropriate.

For transfers involving data collected in the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs.

For transfers involving data collected in South Africa under POPIA, we ensure that the recipient is subject to a binding agreement that upholds standards of protection substantially similar to those required by POPIA.

For transfers involving personal data of Chinese citizens, we comply with the requirements of China's Personal Information Protection Law (PIPL), including completion of any required security assessments and the implementation of standard contracts as promulgated by the Cyberspace Administration of China.

Depending on where you are located, you have a number of rights regarding your personal data. We are committed to facilitating the exercise of these rights promptly and without excessive charge. We will respond to all rights requests within 30 days of receipt, extendable by a further two months for complex or multiple requests with prior notice.

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 15. We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests.

You also have the right to lodge a complaint with your relevant data protection supervisory authority. Details for each jurisdiction are provided in Section 13.

We take the security of your personal data seriously and implement technical and organisational measures designed to protect it against unauthorised access, loss, destruction or alteration.

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS). We enforce HTTPS across all platform endpoints.
• Encryption at rest: Personal data stored in our databases is encrypted at rest using AES-256 encryption.
• Password security: Passwords are never stored in plain text. We use bcrypt with a high work factor to hash all passwords before storage.
• Multi-factor authentication: All accounts are required to enrol in multi-factor authentication. MFA codes are time-limited and single-use.
• Access controls: Internal access to production systems and personal data is restricted on a need-to-know basis, with audit logging of all access events.
• Rate limiting and bot detection: All authentication endpoints are rate-limited to prevent credential stuffing attacks. We use behavioural analysis to distinguish human from automated traffic.
• Penetration testing: We conduct regular third-party security assessments and penetration tests of our platform infrastructure.
• Data breach response: We maintain an incident response plan. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and will inform affected users without undue delay where required.

This platform is not directed at or intended for use by persons under the age of 18 years. We do not knowingly collect personal data from children or minors as defined under applicable law in each jurisdiction where we operate.

Specifically:

• Users must confirm during registration that they are 18 years of age or older.
• Identity verification is conducted for all users who transact on the platform, which serves as an additional check against minor participation.
• If we become aware that we have collected personal data from a person under 18 years of age, we will take immediate steps to delete that data and close the associated account.

If you believe that a minor has created an account on our platform, please contact us immediately at the details provided in Section 15. We will investigate and take appropriate action within five business days of receiving such a report.

In jurisdictions where a higher minimum age applies for consent to data processing (for example, where the age of digital consent is 16 under GDPR), we apply that higher threshold.

In addition to the general provisions of this policy, the following jurisdiction-specific rights, obligations and supervisory authority contact details apply to users in the relevant countries.

We may update this Privacy Policy from time to time to reflect changes in our practices, the law or the services we provide. When we make changes, we will update the “Last updated” date at the top of this policy.

For material changes that significantly affect your rights or the way we use your data, we will provide advance notice through one or more of the following means:

• A prominent notice on the platform homepage or your account dashboard before the changes take effect.
• An email notification to the address registered to your account at least 14 days before material changes come into force.
• In-app notification on your next login.

Your continued use of the platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree to the updated policy, you should stop using the platform and may request deletion of your account.

Previous versions of this Privacy Policy are available on request from our Data Protection Officer.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern about how we have handled your personal data, please contact our Data Protection Officer using any of the methods below. We aim to respond to all enquiries within five business days and to resolve all rights requests within 30 days.