PriceSpy is the controller of personal data as described in this policy, unless otherwise stated.
Personal data means information which can directly or indirectly be linked to a living natural person. Examples of personal data include name, address, phone number, and email address. Under certain circumstances, information about IP addresses and your user behaviour when using the Services may also constitute personal data.
Processing of personal data covers all use of personal data, such as collection, exchange and storage.
Controller of personal data means the party which, alone or together with another party, decides on the purposes and means for the processing of the personal data and who is ultimately responsible for ensuring that the processing takes place in accordance with applicable personal data legislation.
Legal grounds for our processing of personal data
In order for our processing of personal data to be legal, we must have a legal ground. A legal ground in this case means that we must be able to present a justification prescribed by law to why we process personal data for a particular purpose. Examples of legal grounds used by us are consent, legitimate interest, agreement, and legal obligation.
Personal data that we collect
To give you an overview of how the processing of data is carried out, we have divided the personal data into three categories based on how it is collected.
a) Personal data that you yourself give us
When you use the Services you might provide us with personal information, for example by filling out web forms, creating a user account, sending messages to our support, or by giving us feedback via our contact forms. Personal data in this category could be name, address, phone number, email address, and other information depending on what you choose to submit to us.
b) Personal data that we collect when you use the Services
When you use the Services, we collect information about your usage, such as which parts of the Services you use, which products you are looking at, and how you interact with the websites that provide the Services. This information can be divided into the following categories:
i. Technical information about your device and internet connection
Through server logs and other tools, we record information about your device, your connection to the Services, and your use of the Services on different devices. This information may include operating system, web browser version, IP addresses, cookies, and various unique identifiers. We use this information in order to, among other things, provide the Services by remembering your settings, and to troubleshoot our systems.
ii. Information about the use of the Services
We collect information about how you interact with the Services, including what you show interest in, what your visit to the Services looks like, and which ads you click on. We also collect information about your visits to the websites where the Services are provided, and how you interact when using these websites.
iii. Location information
When you use the Services, we calculate an approximate geographical location based on the IP address you use. If you have accepted location services on your device, we will regularly collect more detailed information about your geographical location. If you don't want us to collect detailed information about your geographical location, you can turn off location services in your device. We will then only collect information about your approximate geographical location based on your IP address.
iv. Cookies and other technologies that store data locally on your device
c) Personal data from other sources
We may from time to time receive personal data from other sources, that is, personal data that is not collected directly by us from you as a user. Such sources may be other companies within the Schibsted Media Group, advertisers, advertising networks, authorities, or our partners. For example, one of our partners could provide us with information on how you acted after you clicked on a product in the Services. Another example is when our partners provide profiling information consisting of probability-based information about your interests, which helps us optimise our and Schibsted's marketing and campaigns.
Why we process personal data
In order for you as a user to understand why we process personal data, we have chosen to categorise our processing based on its purpose. We process personal data for a number of reasons, namely:
i) to fulfill our contractual obligations,
ii) to comply with legal requirements,
iii) to provide the Services, including customer support,
iv) to analyse the traffic on and to the Services,
v) to be able to offer relevant ads outside the Services,
vi) to send newsletters and similar communications to our users,
vii) to be able to personalise our Services, including our and Schibsted's advertising, and
viii) to be able to troubleshoot the Services and investigate misuse.
More detailed information about purposes (iii) to (viii) follow.
iii) To provide the Services, including customer support
We process personal data in order to be able to deliver a functional and user-friendly service, among other things by adapting the Services to your technical user situation and the choices you make on the Services. Processing of personal data for this purpose also include the processing we do in order for us to handle support issues and to respond to the feedback from our users.
The processing of personal data for this purpose is based on our legitimate interest in providing basic functionality and service related to the Services.
iv) To analyse the traffic on and to the Services
We want to be able to create the best possible conditions for improving the Services. Therefore, we collect information about the traffic on the Services and on the websites and apps that provide the Services. Such information helps us understand our users, understand market trends, identify improvement potential in the Services, and much more. Ultimately, this leads to a better PriceSpy experience.
The processing of personal data for this purpose is based on our legitimate interest in analysing and improving the Services. You can nevertheless choose to turn off the analysis function and our processing of personal data for this purpose in our privacy settings.
v) To be able to offer relevant ads outside the Services,
We want to reach our users with relevant ads and other types of marketing even when you are on other websites and in other apps. In order to know what's relevant to you, we need to process personal data. This includes information about what you have shown interest in when you have used the Services, your geographical location, and your demographic profile. By sharing such information with marketing networks and marketing platforms such as Facebook, Google, and Appnexus, we can create a probability-based customisation of our ads and measure their impact by marketing analysis.
Facebook and Google are personal data controllers for their respective processings for this purpose. Regarding Appnexus, their personal data liability varies depending on how and by whom the personal data is collected. Contact us if you want to know more about their respective responsibilities and how you as a user can control their processing of personal data.
The processing of personal data to offer relevant advertisements outside the Service is based on our legitimate interest. We share personal data with Facebook and Google for this purpose. Please contact us to learn more about how we share personal data with Facebook and Google. You can at any time disable sharing of personal data with Facebook and Google in our privacy settings.
vi) To send newsletters, price alerts, and similar communications to our users
If you have an active user account with us, or if you subscribe to our digital mailings, we may send you emails with offers and marketing. These types of offers or marketing can also be sent via other digital contact paths, such as social media. You can choose to be exempt from these mailings at any time by contacting us.
The processing of personal data for this purpose is based on our legitimate interest if you have an active user account with us, or it is based on consent if you have actively chosen to subscribe to our newsletters and offers. You can withdraw your consent at any time by contacting us.
vii) To personalise our Services, including our and Schibsted's advertising
We want to create a personalised user experience of the Services, by amongst other things adapting the content of the Services according to the user's individual preferences. This also includes customising ads and marketing on the Services and other websites or apps run by companies within the Schibsted Media Group.
The personal data processed for this purpose are user behaviours, IP addresses, purchase history, and approximate geographical position. With that information, the likelihood that you get relevant advertising increases when you are using the Services or other websites and apps provided by companies within the Schibsted Media Group.
The legal grounds for processing personal data for this purpose consists of our legitimate interest in improving the experience of our services and Schibsted's advertising. You have the option to turn off this function in our privacy settings.
viii) To be able to troubleshoot the Services and investigate misuse
We process personal data relating to our users' activity on the Services in order to be able to troubleshoot our systems, which is a fundamental part of our security work on the Services. We also process personal data in order to investigate misuse of the Services and the websites and apps where the Services are provided. Abuse refers to, among other things, creating fake profiles, harassment, acting in violation to our terms, or acting in violation of applicable law.
If we discover or suspect misuse of the Services, we may share personal data with others in order to investigate and combat such misuse.
Processing of personal data for this purpose is based on our legitimate interest in offering a secure service.
Exchange of data
In some cases we share personal data with our partners in order to let them personalise offerings and advertisements. We enter into agreements to ensure that our partners process personal data in accordance with applicable privacy and data protection legislation.
Personal data may be transferred to third parties in case the business or part of the business and personal data processed in connection with such portion are sold, moved or transferred. We may also disclose your information if we are required to do so as a result of legal obligation, court order, government regulation or if such disclosure is necessary to assist a criminal investigation or other legal investigation here or abroad. If there is any suspicion that you have committed a crime in connection with the use of the Services, information may, upon request, be disclosed to the authorities.
Transfer of information to a non-EU/EEA country
We may transfer your personal data to third countries, eg. countries outside the EU/EEA. If we do, we take actions in accordance with applicable legal requirements to ensure a sufficient protection for your personal data.
Storage time for personal data
When the personal data is no longer necessary for the purpose for which they were originally collected, we anonymise or delete them.
As a user, you have a number of rights regarding our processing of your personal data. All rights are not absolute, but some of them may be limited. The rights you have regarding our processing of your personal data are the following:
i) Right to information
ii) Right to register extracts
iii) Right to correction
iv) Right to deletion of you personal data ("the right to be forgotten")
v) Right to limitation of processing
vi) Right to data portability
vii) Right of objection to processing
Upon a request to have your personal data deleted from us, we will anonymise your posts, reviews, and your user account. This means that your reviews or posts published on the Services will remain if they don't contain personal data, though with an anonymous user ID as the sender. The main reason why we don't delete reviews or posts is that these are an important part of PriceSpy. Without them, PriceSpy would lose an important part of its purpose. If you want to delete your reviews or posts in the Services, you have to do this before requesting a deletion of you personal data from us.
We maintain routines and measures to ensure that no unauthorised persons gain access to your personal data and that all processing of personal data takes place in accordance with applicable law. These measures include risk assessments, implementation of organisational and physical measures, as well as routines for handling of data and follow up requests regarding access to, rectification, block and deletion of personal data.
Use of social plug-ins
When you use the Services, you may share information from the Services on social media, such as Facebook, LinkedIn, or Twitter, through an implemented social plug-in (such as a 'like' button). If you choose to share information via a social plug-in, your browser will transfer the following data to the social medium:
a) date and time of your visit;
b) the internet address or URL for the address you are temporarily visiting;
c) your IP address;
d) the browser you are using;
e) the operating system you are using;
f) your username and password and, where applicable, whether you are a registered user of the social medium, your first name and surname; and
g) the information for which you have used this specific plug-in.
PriceSpy is not the personal data controller for the processing of personal data that happens after you share information via social plug-ins on the Services. The personal data responsibility lies with the social media that provide these plug-ins. For this reason, we refer to the respective social medium if you want to read more about the processing of personal data within the framework of the social plug-ins that we use. Please note that you can block social plug-ins in your browser settings.