Privacy policy

Last updated 8 September 2026

Hereafter, gibbs is referred to as “the Service” and gibbs AS as “gibbs”, “we” and/or “us”.

At gibbs, we work hard to make sure everything you share through the Service stays under your control. We develop every feature with privacy as the first priority. Our business model is built on companies, institutions and organisations getting access to what you want them to, not the other way around. Our goal is a privacy policy that is clear and easy to understand for everyone.

Terms used:

• • Rental is a collective term for everything that can be rented and every service that can be booked through gibbs.
  • Service providers are, in this context, our partners who provide services we need.
    

1. Controller and processor

gibbs AS (org. no. 922 265 739) provides the Service. Our role under data protection law depends on which data is involved.

Gibbs is the controller for:

• visitors to gibbs.no, including statistics and marketing
• enquiries to us and meeting bookings
• the customer relationship with the hosts who use the Service
• user accounts created directly with us
• our own operations and security logs

Gibbs is the processor for:

• personal data about customers who book a rental through the Service

In this case, it is the host who is the controller. The host decides what is rented out, at what price and on what terms, and we process the data on the host's behalf under the data processing agreement. If you have questions about a specific booking, you can contact the host directly, or us at [email protected], and we'll help you further.

Legal basis

We process personal data on the following grounds:

• to perform our agreement with you, for example when you create an account, complete a booking or pay (GDPR Article 6(1)(b))
• to meet legal obligations, for example bookkeeping requirements (Article 6(1)(c))
• on the basis of consent, for statistics and marketing cookies (Article 6(1)(a))
• on the basis of legitimate interest, to protect the Service against misuse and fraud (Article 6(1)(f))

2. Personal data in general

The general rules for processing personal data apply to the entire Service. They mean that gibbs always processes personal data in line with applicable data protection law and with respect for privacy. All processing of personal data has a legal basis.

3. What data is stored, and what is it used for?

3.1 We collect the following personal data about our users:

(i) Contact details such as name, address, phone number and email, (ii) payment details such as debit or credit card or bank account for payouts, (iii) geographical location such as coordinates, (iv) booking history, (v) IP address.

3.2 How we use the data:

(i) Contact details are used to create an account on the Service. (ii) Payment details are used to receive payment for a rental or to make a payout for a rental. (iii) Geographical location is used to show rentals closest to you or to a chosen address. (iv) Booking history is used to show the user their history. (v) The IP address is used by the payment provider when processing payments and to detect and prevent fraud.

3.4 When you visit our website and the Service, cookies are used. Some are necessary for the website, login and payments to work. Others are used for statistics and marketing, and are only set if you consent. You'll find a full overview, and can change or withdraw your consent at any time, in section 9.

4. Our service providers

To deliver the Service, we use a small number of processors. They process data on our behalf, and only for the purpose described below. All payment details are encrypted. The list may be updated, and we encourage you to check it from time to time.

For Dintero and Nets Easy , the host enters into their own agreement and data processing agreement directly with the payment provider. Payment details are then processed under the agreement between the host and the provider.

5. Purpose of processing

We process the data so we can fulfil our obligations under our agreement with you. We use the data you provide to improve and deliver the Service to you, to make the Service easier for you to use.

6. Disclosure of data to third parties

We will not share, sell, transfer or otherwise disclose personal data to others unless we are legally required to. In connection with offences or similar, the data may be disclosed to the authorities on request.

7. Rights of the data subject

We process your personal data in accordance with the Norwegian Personal Data Act and applicable regulations. You have the right to request access to and portability of your personal data, and to request correction or deletion.
Right to withdraw consent

Where processing is based on consent, you can withdraw your consent at any time. Withdrawing consent should be as easy as giving it. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. You change or withdraw your cookie consent in section 9.

8. Information security

We protect your personal data with both physical and digital access control, and by encrypting sensitive parts of the data provided. We have routines and measures at several levels to make sure unauthorised persons cannot access your personal data, and that processing complies with applicable law. The measures include regular risk assessments and physical procedures to safeguard information security.

Requests about what data is registered, correction and deletion can be sent in writing to the following email: [email protected]

9. Cookies and consent

9.1 Cookies are small text files stored in your browser when you visit a website. They are used, among other things, to remember your choices, keep you logged in, measure how the website is used, and measure the effect of marketing.

9.2 We use four categories:

Necessary. Required for the website to work. They keep you logged in, make sure payments can be completed securely, and store your consent choice. These are set without consent, because the website does not work without them.

Preferences. Remember choices you have made, such as language and region.

Statistics. Help us understand how the website is used, so we can improve it. The data is aggregated and not used to identify you as an individual.

Marketing. Used to measure the effect of our marketing and to show relevant advertising.

9.3 Necessary cookies are set so the Service works and is secure. Preference, statistics and marketing cookies are only set if you have consented.

9.4 Analytics and marketing are only used on our public website. When you are logged in to the system, where bookings, customer data and payments are processed, we run no analytics or marketing tools. Only the cookies needed for the system to work are set there.

9.5 You can change or withdraw your consent at any time in the overview below. You can also delete cookies directly in your browser. If you delete the necessary cookies, parts of the Service may stop working.

Show full cookie overview

10. How long we store data

We store personal data for as long as necessary for the purpose it was collected for.

• Bookings, booking history and customer data: three years.
• Accounting records, such as payment transactions and invoice data: five years after the end of the financial year. This follows from Section 13 of the Norwegian Bookkeeping Act, and the period cannot be shortened.
• User account: as long as the account is active. If you delete your account, we delete the data, except what we are required to keep.
• Cookie consent: documented for as long as the consent applies.

When the storage period ends, the data is deleted or anonymised.

11. Transfers of data outside the EEA

Most of our processors store data within the EEA. Brevo stores data in France, Germany and Belgium, and Cookiebot stores data in Germany and Belgium.

Some providers process data in the USA. For these transfers, we rely on the following grounds:

• Google (Analytics and Ads) is certified under the EU–US Data Privacy Framework, supplemented by the EU Standard Contractual Clauses.
• Stripe is certified under the EU–US Data Privacy Framework and also uses the EU Standard Contractual Clauses.
• SendGrid uses the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.
• Calendly stores data in the USA and uses the EU Standard Contractual Clauses.

You can request more information about the transfer basis by contacting us at [email protected].

12. Complaints to the Norwegian Data Protection Authority

If you believe we are processing your personal data in breach of the rules, we'd like to hear from you first. Send an email to [email protected], and we'll look into it.

You also have the right to complain directly to the Norwegian Data Protection Authority (Datatilsynet), the supervisory authority for personal data processing in Norway. Contact details and guidance are available at datatilsynet.no.