This page is available in English.

Privacy policy

Version 1.0 — 2 November 2026 · effective from 2 November 2026. In case of discrepancy between versions, the French version prevails.

1. Our commitment

This policy explains what personal data FixAll processes, why, with whom it is shared, how long it is kept and how to exercise your rights.

It is drawn up in accordance with the Data Protection Act 2017 of Mauritius ("DPA 2017") and Council of Europe Convention 108+, ratified by Mauritius. For users located in the European Union, it also meets the requirements of the General Data Protection Regulation (GDPR).

2. Controller and contact

The controller is ELK Consulting Ltd, Royal Road, Bain Boeuf, Pereybère, Mauritius.

For any question or to exercise your rights, contact our data protection officer at: contact@elkconsultingltd.com (phone: +230 5843 6113).

3. Data we process

Clients:

• identification and contact: mobile phone number (verified at sign-in), first and last name;

• service addresses and chosen area, any access instructions;

• Jobs: requested service, description, photos of the problem (up to 5), time slot, amount, status history;

• messages with the assigned Professional, reviews given and received, disputes and exchanges with support.

Professionals, in addition:

• display name, presentation, trades, areas, working hours, blocked days, statistics (ratings, completed Jobs, cancellations);

• verification documents: identity document, proof of address, certificate of character and, depending on the trade, qualifications, with their expiry date;

• declared amounts and commissions (accounting).

Technical data:

• sign-in and security logs (date, IP address, device type), the app's notification identifier, chosen language;

• on the website, and only with your consent, audience measurement (see section 10).

We do not process sensitive data within the meaning of the law, except any information in a certificate of character, limited to verifying Professionals. We do not collect your bank details.

4. Purposes and legal bases

In accordance with section 28 of the DPA 2017 (and Article 6 GDPR where applicable), we process your data on the following bases:

• performance of the contract (Terms of use): account creation and management, sign-in, booking, matching, Job assignment, messaging, Job notifications, end of Service, reviews, support;

• legal obligation: accounting and tax, answering authorities, security of processing;

• legitimate interest: verifying Professionals to protect Clients, preventing fraud and circumvention of the Platform (masking contact details), improving the service, handling disputes;

• consent: audience measurement on the website and in the apps, any promotional messages. You may withdraw consent at any time, without affecting past processing.

No decision with legal effects on you is based solely on automated processing: a Job is assigned when a Professional accepts it, and documents are checked by a person.

5. Who can see your data

• The assigned Professional sees, for that Job only, the Client's first name, exact address, description and photos. Before acceptance, they only see the service, the area, the time slot and the estimate.

• The Client sees the assigned Professional's display name, rating and verification status. Phone numbers and e-mails are masked in messages.

• The Operator's team accesses data according to its role (support, operations, verification, finance). Verification documents are accessible only to the verification team and the administrator; every access is recorded in an audit log.

• Our technical processors, bound by contract and acting on our instructions (section 6).

• Authorities, where the law requires it.

We do not sell or rent your data.

6. Processors and transfers outside Mauritius

• Railway (hosting of the Platform, database and files): servers located in the European Union (Amsterdam, Netherlands);

• Meta Platforms (WhatsApp Business Platform): sign-in verification by WhatsApp message and confirmations. Meta also processes this data as a separate controller for its own WhatsApp service, under its own privacy policy;

• Google (Firebase Cloud Messaging): delivery of app notifications;

• Resend: delivery of service e-mails (team accounts, passwords);

• Google (Google Analytics 4): audience measurement, only with your consent.

These providers may process data outside Mauritius, in particular in the European Union and the United States. In accordance with section 36 of the DPA 2017, such transfers rely on appropriate safeguards (data protection contractual clauses, providers' security commitments) or on another condition provided by law.

7. Retention periods

• Account: while it is active. After closure, identification data is deleted or anonymised within 3 months, except where it must be kept as below.

• Jobs, amounts and commissions: 7 years from the end of the financial year, for accounting and tax obligations and legal defence.

• Messages and photos of a Job: 2 years after the Job ends, then deleted (longer if a dispute is ongoing, until it is closed).

• A Professional's verification documents: for the duration of registration; deleted at the latest 12 months after the account is closed, or once replaced after expiry.

• Temporary sign-in data: verification codes and WhatsApp sign-in requests deleted after 2 days, failed sign-in attempts after 1 day, session tokens at the latest 7 days after expiry, unused photo upload links after 2 days.

• Security and audit logs: 12 months as a rule, longer if needed for an investigation or a dispute.

• Audience measurement: 14 months at most.

8. Security

We apply appropriate technical and organisational measures (section 31 of the DPA 2017): encrypted communications (HTTPS/TLS), hosting in secure data centres, database-level separation of data by brand and by role, verification documents stored in a private space and reachable only through temporary links, mandatory two-factor authentication for the team, passwords and codes stored encrypted or hashed, audit log of sensitive actions, regular backups, automatic masking of contact details in messages.

In the event of a personal data breach presenting a risk, we notify the Data Protection Commissioner without undue delay and, where feasible, within 72 hours (section 25 of the DPA 2017), and we inform the persons concerned where the breach is likely to result in a high risk to their rights (section 26).

9. Your rights

Under the DPA 2017 (sections 37 to 40) and, where applicable, the GDPR, you have the right to:

• access your data and obtain a copy;

• correct inaccurate data (your name can be edited directly in the app; the phone number is the one verified at sign-in);

• erasure, subject to data we must keep;

• restriction of processing and objection to processing based on legitimate interest;

• withdraw your consent at any time;

• data portability (for users covered by the GDPR);

• not be subject to a decision based solely on automated processing.

To exercise your rights, write to contact@elkconsultingltd.com stating the phone number of your account; we may ask you to confirm your identity. We answer within one month.

If you believe your rights are not respected, you may lodge a complaint with the Data Protection Office, Mauritius (Data Protection Commissioner, Port Louis — dataprotection.govmu.org). Users in the European Union may also contact the data protection authority of their country.

10. Cookies, local storage and audience measurement

The website and apps use strictly necessary local storage: chosen language, sign-in session, display preferences (theme), welcome tutorial status. It does not require consent.

Only with your consent, we use Google Analytics 4 to measure audience (page views, screens, booking steps) in aggregate form, to improve the service. IP addresses are not stored by Google Analytics 4. You can accept or refuse on your first visit and change your choice at any time; refusing has no effect on access to the service.

We do not use advertising cookies and do not sell any data for advertising purposes.

11. Minors

The Platform is reserved for persons aged 18 and over. We do not knowingly collect children's data (section 30 of the DPA 2017 requires parental consent under 16). If you believe a minor has given us data, contact us and we will delete it.

12. Account deletion

You can ask for your account to be deleted from the app ("Delete my account") or by e-mail to contact@elkconsultingltd.com. We confirm the request, close the account and delete or anonymise your data within the periods of section 7, except data the law requires us to keep.

13. Changes

We may update this policy. The version date appears at the top of the page; in case of a significant change, we inform you in the app or by message before it takes effect.