1. Introduction and Legal Basis
DVSbil.no ("we," "us," or "our") is committed to protecting your privacy and personal data in accordance with the GDPR, the Norwegian Personal Data Act, and other applicable data protection laws. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information.
2. Information We Collect
Depending on how you use DVSbil, we may collect the following categories of personal data:
• Identity and contact information, including your name, email address and telephone number;
• Business information, including company name, organisation number and business address, where applicable;
• Account information, including profile details, account preferences and authentication information;
• Listing information, including vehicle details, photographs, descriptions, prices, location and listing status;
• Communication information, including messages exchanged through the platform and correspondence with DVSbil support;
• Billing and payment transaction information relating to DVSbil subscriptions, advertising packages and promotional services;
• Technical and usage information, including IP address, browser type, device information, server logs and interactions with the platform.
Full payment card details are processed by third-party payment providers and are not stored by DVSbil.
3. How We Use Your Information
We may use personal data for the following purposes:
• to create, maintain and manage user accounts;
• to publish and manage vehicle, parts and service listings;
• to provide marketplace features, including search, messaging, vehicle requests, auctions, exchanges, rentals and dealer profiles;
• to enable communication between users without DVSbil becoming a party to their agreements;
• to process payments for DVSbil subscriptions, advertising packages and optional promotional services through third-party payment providers;
• to provide customer support and respond to user inquiries;
• to verify business information and manage dealer or company accounts;
• to protect users and the platform, prevent fraud, investigate suspicious activity and enforce our Terms of Service;
• to comply with legal, accounting and regulatory obligations;
• to analyse platform performance, correct technical problems and improve functionality and user experience;
• to send service-related notifications, security alerts and important account information;
• to send marketing communications where the user has provided consent or where another lawful basis applies. Users may unsubscribe from marketing communications at any time.
DVSbil does not use personal data to process vehicle purchase payments or to complete agreements between users.
4. Information Sharing and Disclosure
DVSbil does not sell personal data.
We may share personal data only where necessary to operate the platform, provide DVSbil services, protect users, comply with Norwegian law or fulfil another lawful purpose.
Personal data may be shared with the following categories of recipients:
• Other users: Information included in public listings, business profiles and user profiles may be visible to other users. Messages and information sent through platform communication features are shared with the intended recipient.
• Verified dealers and companies: Where a feature is intended only for verified dealers or company accounts, relevant information provided by the user may be made available to eligible business users, as clearly indicated within that feature.
• Payment providers: Billing and payment transaction information relating to DVSbil subscriptions, advertising packages and promotional services may be shared with third-party payment providers, including Vipps, Stripe and PayPal.
• Service providers: Personal data may be processed by trusted providers that support hosting, infrastructure, email delivery, customer support, security, analytics and other technical platform functions. These providers may process personal data only for the agreed purposes and under appropriate data protection obligations.
• Public authorities: Personal data may be disclosed where required by Norwegian law, a court order or a lawful request from a competent public authority, or where necessary to establish, exercise or defend legal claims.
• Business transfers: If DVSbil is reorganised, transferred or sold, relevant personal data may be transferred as part of that process, subject to applicable data protection requirements.
DVSbil may also disclose information where reasonably necessary to investigate fraud, security incidents, misuse of the platform or violations of the Terms of Service.
DVSbil limits the personal data shared to what is necessary for the relevant purpose.
5. Data Security
DVSbil implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, misuse, alteration or disclosure.
These measures may include encrypted connections, access controls, authentication mechanisms, security logging, backups, software updates and restrictions on access to personal data.
Payment information relating to DVSbil services is processed by third-party payment providers, including Vipps, Stripe and PayPal. DVSbil does not store full payment card details.
Service providers that process personal data on behalf of DVSbil are required to protect the information and process it only for agreed purposes and in accordance with applicable data protection requirements.
No method of transmission over the internet or electronic storage can be guaranteed to be completely secure. DVSbil reviews its security measures and updates them where reasonably necessary.
If a personal data breach occurs, DVSbil will assess the incident and notify the Norwegian Data Protection Authority (Datatilsynet) and affected individuals where notification is required under applicable law.
6. Cookies and Tracking Technologies
DVSbil uses cookies and similar technologies to operate the platform, protect user accounts, remember user preferences, understand how the website is used and, where the user has provided consent, measure marketing effectiveness.
Strictly necessary cookies may be used without consent where they are required to provide a service expressly requested by the user, including authentication, session management, security and essential platform functionality.
Functional, analytics and marketing cookies are used only after the user has provided valid consent, where consent is required by Norwegian law.
Users may accept or reject non-essential cookie categories and may withdraw or change their consent at any time through the cookie settings available on DVSbil. Withdrawing consent must be as easy as giving it.
Refusing non-essential cookies will not prevent access to the core functions of DVSbil, although certain optional features may be limited.
Third-party providers may place or access cookies when their services are used on DVSbil. Information about the providers, purposes and storage periods of cookies should be available through the cookie banner or cookie settings.
Users may also delete or block cookies through their browser settings. Blocking strictly necessary cookies may affect the operation of account, security or other essential platform features.
DVSbil processes information collected through cookies in accordance with this Privacy Policy, the Norwegian Electronic Communications Act (ekomloven), the GDPR and the Norwegian Personal Data Act.
7. Your Data Protection Rights (GDPR)
Under the GDPR and the Norwegian Personal Data Act, users may have the following rights regarding their personal data:
• Right of access: You may request confirmation of whether DVSbil processes your personal data and receive a copy of that data.
• Right to rectification: You may request correction of inaccurate personal data and completion of incomplete information.
• Right to erasure: You may request deletion of personal data where the legal requirements for deletion are met. This right may be limited where DVSbil must retain information to comply with legal obligations, prevent fraud or establish, exercise or defend legal claims.
• Right to restriction: You may request that DVSbil temporarily restrict the processing of personal data in certain circumstances.
• Right to data portability: Where applicable, you may request personal data you have provided to DVSbil in a structured, commonly used and machine-readable format.
• Right to object: You may object to processing based on legitimate interests. You may object to direct marketing at any time.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
• Rights relating to automated decisions: Where applicable, you may have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
• Right to lodge a complaint: You may submit a complaint to the Norwegian Data Protection Authority (Datatilsynet) if you believe that DVSbil has processed your personal data unlawfully.
To exercise your rights, contact support@dvsbil.no. DVSbil may request information reasonably necessary to confirm your identity before responding.
DVSbil will respond without undue delay and normally within one month. Where a request is complex or numerous, the response period may be extended by up to two additional months. In that case, DVSbil will inform the user within the first month.
These rights may be subject to limitations or exceptions under applicable law.
8. Data Retention
DVSbil retains personal data only for as long as necessary for the purposes described in this Privacy Policy or for as long as required by Norwegian law.
The applicable retention period depends on the type of information and the purpose for which it is processed:
• Account information is normally retained while the user account remains active. After account closure, information will be deleted or anonymised within a reasonable period unless continued retention is necessary for legal compliance, security, fraud prevention or the establishment, exercise or defence of legal claims.
• Listing information is retained while the listing is active and may be retained for a limited period after removal for account history, moderation, fraud prevention, dispute handling and legal compliance.
• Messages and support correspondence may be retained for as long as necessary to provide support, handle complaints, investigate misuse or document relevant communications.
• Billing, payment and accounting records relating to DVSbil subscriptions, advertising packages and promotional services are retained for the period required under Norwegian accounting and tax law. Relevant accounting documentation is generally retained for five years after the end of the financial year.
• Security logs, technical logs and fraud-prevention information are retained only for a limited period determined by the relevant security purpose, unless a longer period is necessary to investigate an incident or comply with legal obligations.
• Marketing information is retained until the user withdraws consent, unsubscribes or DVSbil no longer has another lawful basis for processing it.
• Backup copies may remain temporarily after information has been deleted from active systems and will be overwritten or deleted in accordance with DVSbil’s normal backup procedures.
When personal data is no longer necessary, DVSbil will delete it securely or anonymise it so that it can no longer be linked to an identifiable person.
Legal requirements, ongoing disputes, fraud investigations or security incidents may require certain information to be retained for a longer period.
9. International Data Transfers
DVSbil is established in Norway and primarily processes personal data within Norway and the European Economic Area (EEA).
Some service providers used by DVSbil may process or access personal data from countries outside the EEA. This may apply, for example, to providers of hosting, infrastructure, analytics, communications, customer support or payment-related services.
Where personal data is transferred outside the EEA, DVSbil will ensure that the transfer is based on a valid legal mechanism under the GDPR. This may include:
• a decision by the European Commission confirming that the destination country provides an adequate level of data protection;
• the European Commission’s Standard Contractual Clauses together with additional safeguards where necessary; or
• another lawful transfer mechanism permitted under applicable data protection law.
For transfers to organisations in the United States, DVSbil may rely on an applicable adequacy framework where the recipient is validly certified. Where such a framework does not apply, another valid transfer mechanism will be used.
DVSbil will assess international transfers and apply appropriate technical, contractual and organisational safeguards where required.
Users may contact support@dvsbil.no to request further information about international transfers and the safeguards used.
10. Children's Privacy
DVSbil account services and transaction-related platform features are intended for persons aged 18 or older.
Persons under the age of 18 must not create an account, publish listings, place bids, send offers, purchase paid DVSbil services or enter into agreements through the platform.
DVSbil does not knowingly collect personal data from persons under 18 through registered account services.
Public pages may be viewed without an account. When a person visits public pages, limited technical information may be processed through strictly necessary cookies, security systems and server logs as described in this Privacy Policy.
If DVSbil becomes aware that personal data has been collected from a person under 18 in breach of this policy, DVSbil will take reasonable steps to restrict the account and delete the information where there is no lawful reason to retain it.
A parent or legal guardian who believes that a person under 18 has provided personal data to DVSbil may contact support@dvsbil.no.
11. Data Controller and Privacy Contact
The data controller responsible for the processing of personal data through DVSbil.no is:
EDVINS ZUJS DVSBIL
Organisation number: 935 879 876
Vangshaugvegen 65
7340 Oppdal
Norway
Email: support@dvsbil.no
For questions about privacy, the processing of personal data, or the exercise of your data protection rights, please contact us using the email address above.
12. Changes to This Privacy Policy
DVSbil may update this Privacy Policy where necessary to reflect changes in platform features, personal data processing activities, service providers, security practices or applicable legal requirements.
The current version of this Privacy Policy and the date of the latest update will be available on DVSbil.no.
If a change materially affects how DVSbil processes personal data or the rights of users, DVSbil will provide appropriate notice, for example by email, an account notification or a prominent notice on the platform. Where reasonably possible, the notice will be provided before the change takes effect.
Immediate changes may be made where necessary to comply with law, address a security risk or protect users and the platform.
Where a new processing purpose requires consent or another specific legal basis, DVSbil will obtain the required consent or establish the appropriate legal basis before beginning that processing.
Previous versions may be retained where reasonably necessary to document changes and demonstrate compliance with applicable data protection requirements.
Questions about this Privacy Policy may be sent to support@dvsbil.no.