Privacy Policy

Last updated: 5th August 2026

123-Work Ltd (“we,” “us,” or “our”) is the Data Controller of your personal data in relation to the website https://123-work.com (the “Website”). This Privacy Policy explains how we collect, use, store, share and protect your personal data in accordance with the Gibraltar General Data Protection Regulation (the “Gibraltar GDPR”) and the Data Protection Act 2004 (as amended). By using the Website, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

Controller:

123-Work Ltd 

PO Box 1010, Gibraltar, GX11 1AA

Email: [email protected]

2. Personal Data We Collect

We may collect and process the following categories of personal data:

 

  1. a) Data you provide directly
  • Identity and contact data (name, email address, username)
  • Account and login data
  • Billing and payment data (processed by our payment service providers)
  • Content you submit (comments, messages, profile information, support requests)
  • Any other information you voluntarily provide

 

  1. b) Data collected automatically
  • Technical data (IP address, browser type and version, device type, operating system, time zone)
  • Usage data (pages visited, time spent, clicks, referring URLs)
  • Cookie and similar technology data

 

  1. c) Data from third parties
  • Payment confirmation data from payment processors
  • Authentication data if you use social login (e.g. Google, Apple)
  • Analytics data from service providers

 

We do not intentionally collect special categories of personal data (Article 9 Gibraltar GDPR) unless you voluntarily provide it.

3. Purposes and Legal Bases for Processing

We process your personal data only when we have a valid legal basis under Article 6 of the Gibraltar GDPR:

| Purpose | Legal Basis |

|———|————-|

| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |

| Processing payments and subscriptions | Performance of a contract (Art. 6(1)(b)) |

| Providing customer support | Performance of a contract / Legitimate interests (Art. 6(1)(b) and (f)) |

| Sending service-related communications | Performance of a contract (Art. 6(1)(b)) |

| Improving and securing the Website, analytics | Legitimate interests (Art. 6(1)(f)) – our interest in operating a secure and functional service |

| Marketing communications (if any) | Consent (Art. 6(1)(a)) – you may withdraw consent at any time |

| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |

| Enforcing our Terms and protecting our rights | Legitimate interests (Art. 6(1)(f)) |

 

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms.

4. Sharing of Personal Data

We do not sell your personal data. We may share it only with:

Processors (service providers) who process data on our behalf under a data processing agreement (hosting, payment processors, analytics, email delivery, customer support tools)

  • Competent authorities when required by law
  • Professional advisors (lawyers, accountants) under confidentiality obligations
  • Potential buyers or investors in the event of a business transfer (subject to appropriate safeguards)

All processors are contractually required to process personal data only on our instructions and to implement appropriate security measures.

5. International Data Transfers

Your personal data may be transferred to and processed in countries or territories outside Gibraltar. Under the current Gibraltar GDPR (as amended by the Data Protection Regulations 2026), a transfer of personal data may take place if it is to:

 

  • a third country or international organisation that has an adequacy decision from the European Commission pursuant to the EU GDPR;
  • the United Kingdom; or
  • a Member State of the European Union.

Where none of the above apply, we will ensure appropriate safeguards are in place (for example Standard Contractual Clauses approved by the European Commission or other lawful mechanisms under Chapter V of the Gibraltar GDPR). You may request further information about the safeguards we use by contacting us.

6. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this Policy, or as required by law.

 

Typical retention periods:

  • Account data: for the duration of your account + a reasonable period afterwards
  • Billing and transaction data: as required by tax and accounting laws
  • Support correspondence: generally up to 3 years after the last interaction
  • Analytics and log data: usually 12–26 months

 

When data is no longer needed, we securely delete or anonymise it.

7. Your Rights under the Gibraltar GDPR

As a data subject you have the following rights:

 

  • Right of access (Art. 15) – obtain confirmation and a copy of your personal data
  • Right to rectification (Art. 16) – correct inaccurate or incomplete data
  • Right to erasure (“right to be forgotten”) (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object (Art. 21) – particularly to processing based on legitimate interests or to direct marketing
  • Right to withdraw consent at any time (where processing is based on consent)
  • Right not to be subject to automated decision-making producing legal or similarly significant effects (Art. 22) – we do not currently engage in such processing

 

To exercise any of these rights, please contact us at [email protected]. We will respond within one month (extendable by two further months in complex cases), in accordance with the Gibraltar GDPR. You also have the right to lodge a complaint with the supervisory authority:

 

Gibraltar Regulatory Authority (GRA)

Information Commissioner 

2nd Floor, Eurotowers 4 

1 Europort Road 

Gibraltar 

Website: https://www.gra.gi

Email: [email protected]

8. Cookies and Similar Technologies

We use cookies and similar technologies. For full details, please see our Cookie Policy.

9. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration, in accordance with Article 32 of the Gibraltar GDPR. These include encryption in transit, access controls, regular security assessments, and staff awareness measures. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Gibraltar Regulatory Authority and, where required, affected individuals without undue delay.

10. Children’s Privacy

The Website is not directed at children under 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected such data, we will delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new “Last updated” date. Where changes are material, we will take additional steps to inform you (for example by email notice or a prominent notice on the Website).

12. Contact Us

For any questions about this Privacy Policy or to exercise your data protection rights, please contact:

 

Email: [email protected]

Postal address: PO Box 1010, Gibraltar, GX11 1AA