Privacy policy

1. Controller

Diveo AB (org. no. 556883-9293, Stockholm, Sweden) is the controller for what is processed on these pages: the domain names Diveo AB owns and offers, and domains.diveo.se. This page says what we keep about you, why, for how long and who receives it.

We never sell personal data and do not use it for marketing.

2. Offers

When you make an offer we keep the domain, the amount, your name, your email address, your message and the language you read the page in. During the negotiation we keep every offer and counter-offer, with its amount, message and time. The offer is also emailed to us, and we answer you by email with our decision and, if we accept or make a counter-offer, a link to pay.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR), ours and yours, in answering and negotiating an offer you sent us yourself.

3. Orders and payment

When you order we keep your name, email address, address and country, and, if you give them, your company name, company registration number and VAT or registration number. We also keep the domain, the price, the VAT and the payment method, which version of the purchase terms you accepted and when, your IP address and your browser's user agent when you accepted them, whether the page showed the end of the terms before you could accept them, and whether you consented to the transfer starting within the withdrawal period.

For a business in another EU country we check the VAT number in the European Commission's VIES and keep the answer, with the name and address VIES holds for the number.

If you pay by card, Stripe receives the card details; the card number never reaches us. From Stripe we keep the card's country, brand, type and last four digits, Stripe's identifier for the card, the results of 3D Secure and the CVC check, Stripe's risk assessment, the billing country, and warnings of fraud, disputes and refunds. If you pay by invoice we may record the country of the bank the payment came from.

During the transfer we keep every step: when you opened the transfer code and when you confirmed you received the domain, with the time, IP address and user agent, the registrar's confirmation, and the domain's public registration record (RDAP) once it has been transferred. If you ask to cancel the purchase we keep your request and when you made it, and what you got back and what we kept. This is also the evidence we give Stripe if a card payment is disputed.

Legal basis: contract (Art. 6(1)(b)) to take, invoice and deliver the purchase; legal obligation (Art. 6(1)(c)) for VAT and bookkeeping; legitimate interest (Art. 6(1)(f)) for the checks against fraud and to answer a disputed payment. Without the details we cannot take the order.

4. The contact form

What you write in the contact form, your name, email address and message, is emailed to us with the domain you wrote from and the page's language. The form keeps nothing on the server; the message is in our email.

Legal basis: legitimate interest (Art. 6(1)(f)) in answering what you ask. If it concerns a purchase, the basis is contract (Art. 6(1)(b)).

5. Visits, logs and protection against abuse

We count visits to the domains' front pages on the server, with no cookies and no script in your browser. From the request your browser sends anyway we decide whether the visit is a person's or a robot's (the browser's own headers, its user agent and its language), and count each person once per domain and day. To do so the server computes a one-way code (an HMAC) from your IP address (an IPv6 address by its first 64 bits), your user agent and the domain, under a random key that holds for that day only, and keeps the code until the day is over; the address and the user agent are not stored. From one address at most 30 page views in ten minutes count, so that a script cannot inflate the figure. All that remains are numbers per domain and day: page views, visitors, visitors per country (as Cloudflare reads it from the address) and per referring website (its name, never the page), and requests that were not counted, per reason.

Legal basis for the visit count: legitimate interest (Art. 6(1)(f)) in knowing how many people visit each domain, to price it and to show buyers a figure that is true. The code cannot link your visits across days or domains, and no profile is made. You may object to the count as to everything we do on the basis of legitimate interest (see Your rights).

The web server logs each request with the IP address, time, page, status code, referring page and user agent. Links to a payment or an order are taken out of the log before it is written.

The forms count submissions per IP address (an IPv6 address by its first 64 bits) for ten minutes, and so does the VAT-number check, to stop automated submissions. The forms also ask your browser to solve a small computation (Altcha, served from our own server) instead of using someone else's service.

Legal basis for the log and the forms' counters: legitimate interest (Art. 6(1)(f)) in running the pages securely and protecting them against abuse and intrusion.

6. Cookies

We set only the cookies needed for what you do: lang keeps the language you chose, for a year, and a session cookie, which lasts until you close the browser, protects a form against forged submissions, for example when you answer a counter-offer. We use no cookies for statistics or marketing.

7. Who receives the data

Stripe (Stripe Payments Europe Ltd, Ireland) takes card payments and what you enter in Stripe's checkout. Stripe is a controller in its own right for its own checks against fraud and money laundering.

The invoice is made in Diveo AB's own invoicing system at diveo.se, which receives your name, address, email address, company registration and VAT numbers and what you bought, emails the invoice and books the sale. If you pay by card you receive an invoice marked as paid.

getpost.se sends the email from these pages, to you and to us.

Cloudflare runs the domains' DNS, protects the sign-in to our administration, and may carry the traffic to our server; it then sees your IP address and the request.

Oracle Cloud Infrastructure runs the server and the database, in Stockholm.

The European Commission (VIES) and your country's tax authority receive the VAT number when we check it. The registrar receives what a change of holder requires. Authorities, such as the Swedish Tax Agency, receive data when the law requires it.

8. Transfers outside the EU

We process the data within the EU. Stripe, Cloudflare and Oracle belong to US groups, so data may be transferred to the United States. That is then done under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

9. How long we keep the data

Offers, with every offer and counter-offer, stay in our database: nothing erases them automatically, and we have not set a time limit for them. An offer that led to a purchase is kept with the order. Ask us, and we erase an offer that did not lead to a purchase (see Your rights).

Orders stay in our database: nothing erases them automatically. A paid or invoiced order, with the evidence of the transfer, is kept at least as long as the Swedish Bookkeeping Act requires for the sale's records (chapter 7, section 2: until the end of the seventh year after the calendar year in which the financial year ended), and at least 540 days and three months after payment, the time within which a card payment can be disputed.

An order that was never paid or invoiced is also kept, and we have not set a time limit for it. Ask us, and we erase it.

A message from the contact form stays in our email: nothing erases it automatically, and we have not set a time limit for it. Ask us, and we erase it, unless it belongs to a purchase.

The web server's log goes to the output of the container that runs the server and is erased when that container is replaced, which happens when we put out a new version of the pages; it has no fixed limit in days. The visit count's day key and the codes computed with it are erased within an hour after their day is over, and the counts of requests that were not counted after 90 days; the numbers per domain and day are kept. The counters per IP address count the last ten minutes and expire after at most twenty; an expired counter may stay unread on the server until its cache is cleared. The language cookie lasts a year, the session cookie until you close the browser.

10. Your rights

You have the right to know what data we hold about you and to receive a copy, to have errors corrected, to have data erased when we no longer need it or may no longer keep it, to restrict how we use it, and to receive the data you gave us for a purchase in a machine-readable format. What the Bookkeeping Act requires us to keep we cannot erase early.

You may object at any time to what we do on the basis of legitimate interest. We then stop, unless we have compelling grounds that override your interest or need the data to establish, exercise or defend a legal claim.

We make no decisions about you by automated means alone. Stripe's own check may stop a card payment; you can then pay by invoice.

We answer within one month. You may also complain to the Swedish Authority for Privacy Protection (IMY), imy.se, the supervisory authority.

11. Questions

If you have questions about your personal data, or want to use any of your rights, write to us through the contact form on the domain's page.

To the contact form