Privacy Notice for Laandet
Informational translation. The Norwegian version of this document is the legally binding one. If the two versions differ, the Norwegian text prevails.
Version 1.2.0 · Last updated 01.11.2026
This text was written with the help of AI and has not been reviewed by a lawyer.
Here we explain what personal data Laandet processes, why we do it, how long we store it and what rights you have. We only collect what we need to run the service.
1. Controller
Laandet is run under the name GPSI GovTech Solutions. It is not a registered business and has no organisation number (01.11.2026). The controller is therefore the person who runs the service:
- Name: Robert Cygan
- Address: Dronningensgate 14F, 8514 Narvik
- Email for privacy matters: laandet.steigen@gpsi.ai
2. In short
- We do not ask for your national identity number (fødselsnummer), date of birth or home address.
- Other users only see your display name, your profile photo if you have added one, the area you live in, when you became a member and actual statistics. Your email address is not shown.
- Messages, agreements, condition reports and cases can only be seen by those who are parties to them. Laandet staff only see them when you report something, or when you ask for help in a case. Every time a staff member sees the content, this is logged.
- We do not use analytics tools, advertising or tracking. We only use cookies that are necessary for the service to work.
- We remove location data (GPS) and other metadata from the photos you upload.
- The data is stored in Norway or elsewhere in the EU/EEA.
3. What data we process, and why
| What | Why | Legal basis |
|---|---|---|
| Account: email, password (stored as a cryptographic hash), display name, email confirmation, confirmation that you are over 18 and a private person, language choice | Creating and running your account | Contract (Art. 6(1)(b) of the GDPR) |
| Business account: organisation number, registered name from the Central Coordinating Register and when we checked it. We look the number up in the Brønnøysund Register Centre's open API when the account is created. | Checking that the entity exists and is active, and showing others who offers the service | Contract (Art. 6(1)(b)) |
| Profile photo (optional): the photo you upload, without location data and other metadata | Showing who you are on your profile and next to your name | Contract (Art. 6(1)(b)) |
| Login: sessions, IP address and browser type while the session lasts, and two-factor code for staff | Keeping you logged in and protecting the account | Contract and legitimate interest in security (Art. 6(1)(b) and (f)) |
| Profile: area, short introduction, membership date, number of completed rentals, reviews | Making it easier to trust each other | Contract (Art. 6(1)(b)) |
| Listings and photos | Showing what you offer, need or give away | Contract (Art. 6(1)(b)) |
| Messages | Making it possible for you to make arrangements with each other | Contract (Art. 6(1)(b)) |
| Rentals and handovers: terms, agreement text, acceptances, condition reports and photos, agreed meeting place, history | Making and documenting agreements between users | Contract (Art. 6(1)(b)). Storage after the rental has ended: legitimate interest in being able to document claims (Art. 6(1)(f)) |
| Cases ("Report a problem"): explanations, photos, proposed solutions, notes from Laandet | Helping the parties resolve disagreements and keeping the service safe | Legitimate interest (Art. 6(1)(f)) |
| Reviews | Giving other users honest information | Contract and legitimate interest (Art. 6(1)(b) and (f)) |
| Reports and moderation: reports, attached messages, decisions with reasons, appeals | Removing illegal or harmful content and protecting users | Legitimate interest (Art. 6(1)(f)). Legal obligation where the law requires it (Art. 6(1)(c)) |
| Notifications and emails about your account, requests, agreements and cases | Giving you necessary information about the service | Contract (Art. 6(1)(b)) |
| Security log: user ID, action, time and IP address (stored in scrambled form, as a hash) | Detecting and preventing misuse, and being able to show what has been done | Legitimate interest (Art. 6(1)(f)) |
| Error log (if used): technical error information with user ID, without content from forms | Fixing errors | Legitimate interest (Art. 6(1)(f)) |
We do not use your data for marketing, and we do not sell it.
Do not share sensitive information. Do not write about health, political views, religion or similar in listings, messages or cases. If someone has been injured in connection with a rental, only write what is necessary for the case.
4. Who can see the data
-
Everyone who visits Laandet: published listings and photos, your display name, your profile photo, your area, membership date, actual statistics and published reviews. For business accounts also the registered name and the organisation number.
-
The other party in a conversation, a rental or a handover: the messages, the agreement, the condition reports, the photos and the agreed meeting place.
-
Laandet's moderators:
- messages and content that you or others have reported,
- the content of a case when one of the parties has asked Laandet for help. Both parties are told about this.
Moderators do not have access to all private conversations. Every time they see private content, this is logged.
-
The police and other public authorities when the law requires or allows it.
5. Suppliers (data processors)
We use suppliers who process data on our behalf. We have data processing agreements with them.
| Service | Supplier | Where |
|---|---|---|
| Server, database and image storage | Hostinger (virtual server) | Data centre in the EU |
| Backups (encrypted) | Hostinger, on the same server | Data centre in the EU |
| Sending email | Hostinger (email service) | Transfers outside the EU/EEA follow the EU Standard Contractual Clauses in Hostinger's data processing agreement |
| Error logging | Not used | – |
When a business account is created, we send only the organisation number to the Brønnøysund Register Centre's open API (data.brreg.no). The Brønnøysund Register Centre is a public authority and not a data processor for Laandet.
We update this list before we start using new suppliers. If data is transferred to countries outside the EU/EEA, this only happens on a valid transfer basis, for example the EU's standard contractual clauses. If so, we will say so here.
6. How long we store the data
| Data | Retention period |
|---|---|
| Account details | As long as you have an account. If you have not logged in for 24 months, we will send you an email. If you do not log in within 60 days after that, we delete the account. |
| Login sessions, with IP address and browser type | Until the session expires, and no longer than 30 days |
| Deleted listings and their photos | 30 days after the listing was deleted |
| Profile photo | Until you replace or remove it, or delete your account. The old photo is deleted within a day. |
| Messages | 12 months after the later of these dates: the last message in the conversation, or the end of the last rental in the conversation. Messages used in a case are stored together with the case. |
| Agreements, acceptances, condition reports, photos and history for rentals and handovers | 3 years after the rental or handover has ended. This is the general limitation period for claims. |
| Cases | 3 years after the case is closed. If a party shows that the case is being dealt with by the conciliation board (forliksrådet), in court or by the police, we store the data until those proceedings are finished. |
| Reviews | As long as the account of the person reviewed exists, and no longer than 3 years after the rental |
| Reports, moderation decisions and appeals | 2 years after the case is closed |
| Security log | 24 months |
| Server logs | 30 days |
| Backups | No longer than 6 months |
7. When you delete your account
You can delete your account under "My profile". If you have an ongoing rental, a handover or an open case, it must be closed first. After that, we do the following within 30 days:
- We delete your email address, password, profile photo, introduction, area, listings you saved as favourites, notifications and listings that are not linked to a rental, with their photos.
- We keep agreements, condition reports, history and cases until the retention period in section 6 has ended. This data is necessary so that the other party can document any claim. Your display name as it appeared in the agreement is part of this documentation. Everywhere else you are shown as "Deleted user".
- Messages you have sent can still be seen by the other party, marked "Deleted user", until the retention period for messages has ended.
- Backups are deleted automatically within 6 months.
8. Your rights
You have the right to
- access the data we hold about you, and get a copy of it,
- have incorrect data corrected,
- have data deleted, with the exceptions set out in section 7,
- restrict processing, and object to processing based on legitimate interest,
- have your data handed over to you in a machine-readable format (data portability).
You can download your data under "My profile". You can also write to us at the email address in section 1. We will reply within one month.
If you believe that we are processing personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet) at www.datatilsynet.no. We would appreciate it if you contacted us first.
9. Security
We protect your data like this:
- All traffic is encrypted (HTTPS).
- Passwords are stored as a cryptographic hash. We cannot see your password.
- No one can see content other than what they are entitled to see. This is checked on the server every time.
- Staff must use two-factor login. Access to private content is logged.
- Backups are encrypted. For now they are stored on the same server as the service.
- We remove metadata, such as GPS location, from photos.
- We can restore the service from a backup.
If a security breach occurs that may affect you, we will notify the Norwegian Data Protection Authority (Datatilsynet) and you, as required by law.
10. Cookies
We only use cookies that are necessary for the service to work, for example to keep you logged in and remember your language choice. Read more in Cookies.
11. Changes
We update this privacy notice when we change how we process data. We will give notice of significant changes in Laandet and by email.