Privacy Policy

FIKSO AS is the controller for Fikso’s processing of personal data. Organisation number: 937 927 061. Address: Smalvollveien 44, 0667 Oslo, Norway. Website: www.fikso.no. Contact us about privacy, the processing of personal data and your rights at Contact@fikso.com or by post at the above address.

We process information you provide to us, such as your name, contact information, account, profile, job description, messages, offers, images, reviews and enquiries. For service providers, this may include the business name, organisation number, qualifications, VAT status and information required for tax reporting.

We also receive information from the other party to the job, Stripe and relevant public registers, including payment status, refunds and verification status. Stripe collects payment and identity information through its own solution. The verification information to which Fikso has access depends on the account type and integration; Fikso must obtain only what is necessary.

During use, technical information is recorded, such as IP address, time, device, browser, error messages and security events. Information from optional analytics and marketing tools is processed only where the necessary consent has been obtained.

Avoid sending health information, national identification numbers, police certificates or information about children in public advertisements and messages. Sensitive information is not collected as a standard part of ordering. If a service requires such processing, a separate solution, information and legal basis must be in place before it is activated.

Accounts, ordering and performance: We use necessary account, contact, job and message information to provide the platform service you have requested. The legal basis is Article 6(1)(b) GDPR for a user who is a party to the agreement. For business contact persons, necessary administration relies on point (f), our legitimate interest in providing and administering the business’s agreement.

Payment and settlement: We use transaction references, amounts, payment and verification status, and the information necessary for commission calculation, invoices, credit notes, refunds and payout instructions. Payment takes place through Stripe Connect, with the job payment on the service provider’s connected account and a separate application fee payable to Fikso. Fikso’s commission is invoiced only to the service provider. We process documentation of agreed prices, the pricing plan, payment, valid exercise of the right of withdrawal and any express approval by Fikso of a fee reduction. The legal basis is the agreement under Article 6(1)(b) GDPR, or point (f) for business contact persons. Documentation required for accounting purposes is processed under point (c).

Tax and regulatory requirements: Information such as identity, address, tax residence, tax identification number and remuneration is processed and reported to the extent that a specific legal obligation applies, under point (c). This includes relevant Norwegian platform rules and any equivalent foreign rules. Not all information is required from all users.

Security and prevention of misuse: We use technical logs, relevant transactions, verification status, information about required approvals and specific reports concerning jobs to detect and investigate fraud, protect accounts and enforce lawful rules. This includes assessing temporary restrictions, account suspension and payout holds under the Terms of Use. The legal basis is Article 6(1)(f) GDPR, our and our users’ interest in a secure service. We limit processing following a documented balancing of interests. Statutory investigations rely on point (c) where applicable. A suspicion or complaint is recorded as such and does not in itself constitute evidence of fault.

Customer support and disputes: Necessary information is used to handle complaints, assess performance and administer payouts or refunds under the agreement, on the basis of Article 6(1)(b) for the contracting party. For business contact persons, handling legal claims and other necessary case administration, point (f) is used following a balancing of interests. Specific regulatory obligations rely on point (c). Documentation may include images of the work, the parties’ explanations, an expert report and information about legal proceedings; irrelevant information is limited or redacted. We also process necessary documentation of notices, the parties’ comments, breaches, the calculation and dispute of fee or compensation claims, and any set-off. Processing does not give Fikso greater authority to claim payment, deduct funds or suspend accounts than that provided by the law and the Terms of Use.

Public profiles and reviews: We display information that the user asks to publish as part of the agreement, under point (b). Necessary review checks and moderation rely on point (f), or point (c) where there is a specific legal obligation. We do not use this basis for unrelated advertising.

Operation and improvement: Necessary operational logs and limited error analysis rely on point (f), our interest in a functioning and secure platform. Optional user analytics and tracking that require consent rely on point (a) and relevant electronic communications rules.

Marketing: Electronic marketing is sent on the basis of consent, point (a), unless a specific lawful exception for existing customer relationships applies. In that case, point (f) is used following a balancing of interests. You may always opt out. Operational messages about a job do not depend on consent to advertising.

Certain account and job information is necessary to enter into and perform the agreement. Verification and tax information may be required by law. Mandatory fields and the consequences of not completing them are explained at the time of collection. Failure to provide mandatory information may prevent registration, jobs or payment. Optional profile information and marketing consent are not conditions for basic access.

Other users receive the information necessary to assess and perform the job. Profile information and published reviews may be public. The exact address, private contact information and messages must not be publicly available without a separate basis. The job address is shared where necessary for an offer or performance. In a complaint case, both parties receive relevant submissions and documentation so that they can comment. Information not needed for the case is redacted where possible.

Stripe receives the information necessary for payment, account creation, verification, fraud prevention and payout. For many of these purposes, Stripe is an independent controller. For certain technical services, Stripe may act as a processor. The role is assessed according to the specific service and agreement, not solely the provider’s name. See https://stripe.com/privacy.

Providers of hosting, communications, customer support and technical operations may process information on Fikso’s behalf under data processing agreements and instructions. Actual providers and services: [insert provider, purpose and relevant processing location]. Accountants, auditors and legal advisers receive only necessary information and are subject to relevant obligations. A surveyor or other expert receives only necessary information when Fikso, on request, organises an assessment under the complaints procedure and a legal basis exists. An independent professional adviser may be a separate controller; the role, recipient and information are clarified when the engagement is arranged. Information about the scope of the engagement, acceptance of the price, advance payment, invoice and cost allocation is also processed where necessary to administer the assessment and payment claims. A report to be used in Fikso’s payment assessment is shared with both parties with any necessary redactions.

Tax authorities and other competent authorities receive information where required by law. Information may be shared to establish, exercise or defend legal claims where a legal basis exists. We do not sell personal data. Any change to this practice requires a new assessment and accurate information, and cannot be based on general acceptance of the terms.

Some providers, including Stripe, may process or provide access to information outside the EEA. The actual countries and relevant recipients must be described here before publication: [countries and providers].

Where the GDPR requires a transfer mechanism, a relevant adequacy decision or the EU Standard Contractual Clauses are used, together with the necessary assessments and supplementary measures. The EU–US Data Privacy Framework may be used only for a certified US recipient and where the framework covers the transfer. A provider agreement alone is insufficient.

Contact us for information on the transfer mechanism and a copy of relevant safeguards, with any redactions necessary to protect security and other individuals’ information. We do not base routine transfers on general consent in the Terms of Use.

Account and profile: Retained for as long as the account is used. On closure, the public profile is removed and other account information is deleted or anonymised within 90 days unless there is a specific continuing need under the points below. Inactive accounts must be reviewed after 24 months, and the user notified before any closure.

Job agreements, messages documenting the agreement and disputes: Normally retained for 3 years after completion of the job or case in order to handle claims. Documentation for services with longer statutory periods for notifying defects is normally retained for 5 years where necessary. A specific legal claim may justify longer retention until the case and relevant periods have ended; irrelevant information is deleted earlier.

Accounting documentation: Retained for the statutory period, normally 5 years after the end of the financial year for primary documentation under Norwegian rules. Any specific requirements are assessed on a case-by-case basis. This does not automatically include all messages or all profile data.

Platform reporting: Identity, verification and reporting documentation is retained for the period required by the specific reporting rule. [Specify verified periods under Norwegian rules and any DAC7 obligations before publication.] Documentation is not used for other purposes merely because it must be retained.

Technical logs: Normally up to 90 days. Relevant security logs may be retained for up to 12 months where there is a documented need, and records of specific incidents for longer where necessary for a case. Information that can be anonymised is anonymised earlier.

Marketing and consent: Contact information is used until consent is withdrawn or another legal basis ceases to apply. Limited evidence of consent and opt-out may be retained for as long as necessary for documentation and to respect the opt-out.

Backups: Deleted information is phased out through the ordinary backup rotation within [confirmed maximum period]. Access is restricted, and deletions are reapplied if a backup is restored. Stripe has its own retention periods for processing under Stripe’s responsibility.

Necessary technology is used for login, security and functions you request. Other cookies, pixels or similar technology for analytics and advertising are activated only after valid consent where required. Refusing must be as easy as accepting, and consent may be withdrawn through [settings].

An updated overview at [link] must state the actual provider, purpose, duration and whether the technology is necessary or optional. The privacy notice does not replace a valid consent choice. Embedded payment tools must be assessed separately according to their purpose and actual use.

[Describe actual use before publication.] Ranking may use information about offers, location, availability and reviews if these form part of the actual solution. The explanation alongside the search results must describe the parameters and whether payment affects placement.

Fikso must not make decisions producing legal effects or similarly significant effects solely by automated means without a valid basis and the necessary safeguards under Article 22 GDPR. If such processing is introduced, the individual must receive specific information about the logic, significance, expected consequences and rights before it is used. Risk signals leading to human review are also described where relevant. Stripe’s processing must be assessed separately and explained in Stripe’s information.

You may request access, rectification, erasure, restriction and data portability where the conditions are met. You may object to processing based on legitimate interests on grounds relating to your situation. For direct marketing, the right to object is unconditional. Consent may be withdrawn without affecting the lawfulness of previous processing.

Send your request to Contact@fikso.com. We may request proportionate confirmation of your identity. We normally respond within one month. If the period is lawfully extended, we inform you within that month of the reason and the new deadline. Rights are not always absolute; where a request is refused in whole or in part, we explain the basis and the opportunity to complain.

You may complain to the Norwegian Data Protection Authority (Datatilsynet), https://www.datatilsynet.no, or to the relevant data protection authority in the country where you live or work. You are not required to complain to Fikso first.

We must use appropriate technical and organisational measures, including access controls, secure connections and restricted access to documentation. Payment data is handled through Stripe; the data that Fikso actually receives must be limited and verified in the integration.

User accounts are for individuals over 18 years of age. Services involving children are ordered by an adult. Information about the child must be limited to what is actually necessary to perform the service and must not be published in a public advertisement. Specific privacy and safety procedures must be established for categories such as childcare and homework help.

In the event of material changes, we provide information through the platform or by email before new processing begins where required. If new consent is necessary, it is obtained separately. The current version and date are displayed on the website.