Privacy Policy

1. Controller

The controller of your personal data is the provider of the Loks service at loks.is, as identified in the Legal information document. Contact for data protection matters: support@loks.is.

Card payments are processed by Stripe Payments Europe, Ltd., Dublin, Ireland, which acts as a separate controller for payment data. We never receive or store your full card number.

We have not appointed a Data Protection Officer, as we are not required to.

Because we offer a service to people in Iceland, part of the European Economic Area, we process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679) as applicable in the EEA and, in Iceland, with the Act on Data Protection and the Processing of Personal Data No. 90/2018.

2. What we process, why, and on what basis

Account data: e-mail address, display name, password in hashed form, account type, and for business accounts the company name and registration number; optionally telephone number, profile photograph and description. Processed to provide the service under our agreement with you, Article 6(1)(b). Telephone number and photograph are optional and processed on the basis of consent, Article 6(1)(a).

Verification data: the fact that verification through electronic identification was completed, the date, and the identifier returned by the provider. We do not store copies of identity documents. Article 6(1)(b) and (f), our legitimate interest in preventing fraud and building trust.

Advertisement content: text, photographs, price, location, category and attributes you enter, published publicly by design. Article 6(1)(b). Do not include other people's personal data in an advertisement.

Messages: content and metadata of messages exchanged with other users. Article 6(1)(b), and where a report is made, Article 6(1)(f), our interest in investigating breaches and protecting users.

Reviews: content, rating and identity of the reviewer, published publicly. Article 6(1)(b) and (f).

Usage data: pages viewed, searches, saved searches, favourites, advertisements opened, region selected, device and browser information, IP address. Article 6(1)(f), our interest in operating, securing and improving the service; and for the analytics, behavioural analysis and advertising tools described in the Cookie Policy, Article 6(1)(a), your consent.

Security data: your IP address as an irreversible hash, an event counter and a time window. We use these only to detect and stop automated abuse, mass account creation and mass harvesting of phone numbers. We never store the IP address itself, and the hash is deleted after 30 days. Point (f), our legitimate interest in protecting the service and its users against abuse.

Advertisement counting data: when we count how often the photographs of an advertisement are paged through, or how often a sponsored advertisement is clicked, we use an identifier that exists only for this purpose. It is a hash with its own separate salt, unrelated to the security identifier, and the calendar day is part of the hash, so it cannot be matched across days. It is used only to avoid counting the same reader twice on the same day and is deleted after 24 hours. The counts themselves are not personal data and are never combined with security data. Point (f), our legitimate interest and the advertiser's interest in accurate counting.

Order and billing data: services purchased, amounts, dates, invoice data. Article 6(1)(b) and (c).

Moderation data: reports made and received, decisions, restrictions and their reasons. Article 6(1)(f) and (c). A reporter without an account may optionally give an e-mail address so that we can reply. That address is processed on the basis of our legitimate interest, Article 6(1)(f), solely to answer the report, and is deleted together with the report.

Support correspondence: the content of your correspondence with us. Article 6(1)(b) and (f).

Company account request: the kennitala of the company or of the person trading, the company name, a description of the business, a link to a web page or a social page, and how many listings are planned each month. The kennitala is not kept in readable form but as a one way fingerprint, which also stops the same kennitala from being used on two accounts. Only staff can see this, and it is used to confirm that the account is a business one. Point (b), performance of the contract, and point (f), our interest and the interest of other users in the company mark being correct.

Job applications: when you reply to a job listing, we pass your name, e-mail address, optional phone number, your message and any attached documents, including your CV, to the employer who placed that listing. By sending the application you do so knowingly and you want that employer to receive your data; from that point the employer decides on its own how it uses the data and how long it keeps its own copy. The basis is point b, performance of a contract, and for details you give voluntarily point a, your consent. Inside our service the employer can open the application for 30 days after it is sent. We share the application with nobody else and use it for no other purpose.

3. What we do not do

We do not sell personal data. We do not use the content of private messages to target advertising. We do not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing; automated tools help prioritise potentially problematic content, but removal or restriction is subject to human review on request.

4. Who we share data with

Application hosting, database, authentication and file storage: our cloud provider, acting as a processor. Content delivery and protection: our CDN provider, as a processor. Domain and DNS: ISNIC, as a processor. Sign-in with Google: Google Ireland Ltd., as an independent controller for its own purposes. Electronic identification: the identification provider, as an independent controller. Transactional e-mail: our e-mail provider, as a processor. Website analytics and behavioural analysis: our analytics providers, as processors, only where you have consented. Advertising and measurement: Meta Platforms Ireland Ltd. and Google Ireland Ltd., as independent or joint controllers, only where you have consented. Accounting: our accounting provider, as a processor.

We also disclose data to public authorities where required by law, and to advisers where necessary to establish, exercise or defend legal claims. Seller data is disclosed to tax or law enforcement authorities only in response to a request with a legal basis.

Where a provider processes data outside the European Economic Area, the transfer is made on the basis of an adequacy decision or of Standard Contractual Clauses adopted by the European Commission, with the additional measures required in each case.

5. How long we keep data

Account data: for the life of the account, then 12 months after closure, to handle disputes and prevent circumvention of restrictions.

Advertisements: while published, then 24 months archived, then deleted. An advertisement you delete yourself leaves public view at once and is erased for good 90 days after the deletion, unless a report about it is still open. Photographs are deleted within 30 days of the advertisement being deleted, and 30 days after an advertisement is marked as sold or finished; the listing page then remains visible without photographs.

Messages: 24 months from the last message in a conversation.

Reviews: for as long as the reviewed account exists.

Verification records: for the life of the account, then 12 months.

Reports and moderation decisions: 24 months from closure of the case; records of a suspension for 36 months.

Usage data linked to an account: 14 months.

Security data linked to an IP address: 30 days.

Identifier used for advertisement counting: 24 hours.

Unfinished listing drafts: 90 days.

Cookie consent records: 24 months.

Order, invoice and accounting data: for the period required by applicable accounting and tax law.

Support correspondence: 24 months.

Where a longer period is needed to establish, exercise or defend legal claims, we retain the relevant data for that period and no longer.

Company account requests: the description, the link and the planned number for 24 months from the decision; the staff decision and its date for the life of the account and then 12 months. The kennitala fingerprint follows the rule for verification records.

Job applications and their attachments: 30 days from sending, then the application and the files are deleted for good. Three days before that deadline the employer gets one reminder that the access window is closing.

6. Your rights

You have the right to request access to your personal data, rectification, erasure, restriction of processing and portability of data you provided. You may object to processing based on our legitimate interest, and you may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise a right, write to support@loks.is. We reply within one month and may extend that period by two further months for complex requests, in which case we tell you.

Some rights are limited. We may refuse erasure where we need the data to comply with a legal obligation, to establish or defend legal claims, or where deletion would let a user suspended for a serious breach circumvent that suspension.

You have the right to lodge a complaint with a supervisory authority. In Iceland this is Persónuvernd, Laugavegur 166, 105 Reykjavík, personuvernd.is. You may also complain to the authority of your country of residence.

7. Security

We protect data through encryption in transit, hashing of passwords, access control at the level of individual database rows, restricted staff access on a need-to-know basis, and logging of administrative actions. No system is completely secure. If a personal data breach occurs that is likely to result in a high risk to your rights, we inform you without undue delay.

8. Children

Loks is not directed at persons under 18 and we do not knowingly process their data. If you believe a person under 18 holds an account, write to support@loks.is and we will remove it.

9. Changes

We may update this Policy. The current version is published in the service with its date. Where a change is material we notify registered users.

10. Search records

We keep the words people type into search. For each search we store only the words themselves, the language of the site, the number of results, whether a result was opened, and the time to the hour without minutes. We attach no identifier to the entry: no account, no session, no network address, and no hash of any of these. If what was typed looks like personal data, such as a kennitala, a phone number, an email address or a card number, we do not store it at all, and search itself works normally. We use these records to improve search and we delete them after 180 days.

CV and job applications

A CV you build on Loks is private data. On the site only you can see it; we do not use it in search, in promotions, or to build lists for anyone else. When you apply for a job, a copy of the CV travels with the application to whoever posted that job, and that copy does not change afterwards, so you and the employer see the same text that was sent. A looking for work ad never shows the CV document, your full name, a photo, your national id number, your address or your email; a phone number is optional and appears only when someone chooses to see it. A CV you remove is gone from the site; the copy that went with an application stays with whoever received it and follows the retention period for applications. Payment records for the publication fee are kept like other payments, see the payments section.

Tax information and payment intermediation

Today we charge fees only for our own services, so we do not act as an intermediary for payments between users. If we start intermediating such payments and an obligation arises to report seller data to tax authorities, we will inform users before starting that model.

Removed listings and complaints

A listing you remove disappears from Loks at once and the photos are taken out of public hosting. We keep the listing text, the conversations about it and any reports for 7 months after that, for Loks staff only, on the basis of our legitimate interest and the interest of other users in examining complaints, fraud and disputes. After 7 months the record is destroyed for good; a listing with an open report is kept until the case is closed and then follows the rule for reports and moderation decisions. A buyer can leave a review for 30 days after the listing was removed. Every staff access to a removed listing is logged.

Language

The Icelandic version of this Policy is binding. Other language versions are informational translations, and in the event of any discrepancy the Icelandic version prevails.