Privacy Policy

1. Who is responsible

The data controller is DealMatch. For privacy questions or to use your rights, email [email protected].

Sellers and repair shops are independent controllers of the data they receive to fulfil your order or repair, and their own privacy policies apply to how they use it.

2. Data we collect

Account details: name, username, email, phone number and password (stored only as a secure hash). If you sign in with Google, we receive your name and email address from Google.
Addresses: delivery addresses you save, and the location you give for a repair request so nearby shops can bid.
Orders: products bought, prices, order status, delivery and tracking details.
Repair requests: device brand and model, a description of the fault, photos you upload, your contact details, bids received, and messages with repair shops.
Seller information: business name, CVR number, address, listings, subscription plan and payment history.
Reviews and messages: reviews you write and messages you send through the contact form.
Technical data: IP address, browser type, and server logs created when you use the site, which we need for security and troubleshooting.

We don’t use advertising trackers or third-party analytics, and we don’t build marketing profiles.

3. Why we use it (and our legal basis)

To provide the service, including your account, cart, orders, repair requests, bids, messages and notifications. Basis: performance of a contract (GDPR art. 6(1)(b)).
To meet legal obligations, such as bookkeeping and tax rules and answering lawful requests from authorities. Basis: legal obligation (art. 6(1)(c)).
To keep the platform safe, including preventing fraud, spam and abuse, verifying sellers, and securing accounts. Basis: legitimate interests (art. 6(1)(f)).
To improve the platform using aggregated, non-identifying statistics. Basis: legitimate interests (art. 6(1)(f)).
To send service emails such as verification codes, password resets and updates about your orders and repairs. We only send marketing emails if you have opted in, and you can unsubscribe at any time. Basis: contract / consent (art. 6(1)(a)).

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Transfers outside the EU

Some providers (Google and Cloudflare) may process data in the United States. These transfers are protected by the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

6. How long we keep it

Account data: while your account is open. When you close it we delete or anonymise it, except where the law requires us to keep it.
Orders and payment records: 5 years from the end of the financial year, as required by the Danish Bookkeeping Act (bogføringsloven).
Repair requests and messages: as long as needed to complete the repair and handle any warranty claim or dispute, and then deleted.
Contact-form messages: until your question is resolved and any follow-up is complete.
Server logs: a short period for security purposes.

7. How we protect it

All traffic is encrypted with HTTPS. Passwords are stored only as strong one-way hashes. Login sessions use secure, HttpOnly cookies that scripts can’t read. Access to personal data is limited to people who need it, and login and reset attempts are rate-limited to block guessing attacks. No system is perfectly secure, but if a breach puts your rights at risk, we will notify you and the Danish Data Protection Agency as the law requires.

8. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you and get a copy of it.
Rectify data that is wrong or incomplete. You can edit most of it in your profile.
Erase your data (“right to be forgotten”), unless we must keep it by law.
Restrict or object to processing based on legitimate interests.
Data portability: receive your data in a machine-readable format.
Withdraw consent at any time, where processing is based on consent.

To use these rights, email [email protected]. We reply within one month. You can also complain to the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.

9. Cookies

We only use cookies and local storage that are strictly necessary for the site to work, such as keeping you logged in and remembering your cart. See our Cookie Policy for the full list.

10. Children

DealMatch is not intended for children under 15, and we don’t knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes

We will update this policy if how we handle data changes. The date at the top shows the latest version, and we will notify account holders of important changes by email.

Questions?