This policy describes what information DUZO collects about you, why, and what rights you have under the EU General Data Protection Regulation (GDPR).
Duzzoz AB (company registration number 559597-5946), Gamla Stationsgatan 2, 382 30 Nybro, Sverige, is the data controller for the information processed when you use DUZO. Privacy questions can be sent to info@duzo.se.
We have not appointed a data protection officer. Under Article 37 of the GDPR one is required of public authorities and of organisations whose core activities consist of large-scale, regular and systematic monitoring of people or large-scale processing of sensitive personal data, and our assessment is that DUZO's activities are not of that kind. All questions about how we process personal data go to info@duzo.se.
Account information: name, email address, and a password stored in encrypted (hashed) form — we can never see your password in plain text.
Transaction and bidding history: which auctions you've bid on, your max bids (visible only to you, never to other users), auctions you've won or sold, and deposits/withdrawals to your wallet.
Messages: conversations with buyers or sellers tied to a deal, so we can show shipment status, handle disputes, and provide support.
Ratings and reviews you leave or receive, and any rating appeals.
Pickup location data: if you're a seller and provide a pickup address, it's geocoded into coordinates to show on a map. If you choose to show only an approximate area, the coordinates are deliberately rounded so they don't point to an exact location.
Technical information needed to keep you logged in (session cookie) and remember your language choice (see our cookie policy).
Information for DAC7 reporting: as a seller you can give your date of birth and the number of the account your payouts go to (an IBAN, or a Swedish clearing and account number) under My account → My money; for a company, only the account. You can give them whenever you like, and when you approach the thresholds for reporting to the Swedish Tax Agency we ask you for them, and by email for any VAT number or, for a company, whether it has a permanent establishment in another EU country. We need them to file the report the law requires. What is reported, and when, is set out on the DAC7 page.
Personal identity number (personnummer, or coordination number): if you sell as a private individual, you give it in the application to sell, or under Profile & settings before your first withdrawal. If you live outside Sweden and have neither, you instead give your foreign tax identification number (TIN) and the country that issued it, for the same DAC7 reporting; it is processed and kept in the same way as the personal identity number. We process it for two purposes: for the report on sellers that the Swedish Act (2022:1681) on platform operators' collection of certain tax information (DAC7) requires us to file with the Swedish Tax Agency, and to identify securely who sells and is paid. The legal basis is legal obligation (article 6(1)(c)) for the reporting and our legitimate interest (article 6(1)(f)) in secure identification, and the number is processed only where that is clearly justified by these purposes (chapter 3, section 10 of the Swedish Data Protection Act). It is stored encrypted, never shown to buyers or other users, and can be seen only by authorised staff at DUZO — every time it is shown, that is logged. We keep it for as long as you have a seller account, and after that for as long as the law requires the records behind a report to be kept: seven years after the end of the period concerned. If you never had a sale settled, it is deleted when you close your account.
ID verification (such as copies of identity documents) is planned to become mandatory for all users at a later stage of the platform, but has not been introduced yet. We therefore do not currently collect or store any identity documents.
We do not currently use any third-party analytics or marketing cookies.
To perform the contract between you and DUZO (article 6(1)(b) of the GDPR). This is the main basis and it covers the marketplace itself: your account, bidding, payments and payouts, messages between buyer and seller, shipping and pickup, and the ratings left after a completed transaction.
To meet legal obligations (article 6(1)(c)). This covers the Swedish Accounting Act's requirement that accounting records of completed transactions are kept for seven years, and the annual report on sellers we are obliged to file with the Swedish Tax Agency under the DAC7 rules. That data we can neither refrain from collecting nor erase on request for as long as the obligation lasts.
For our legitimate interests, after weighing them against yours (article 6(1)(f)). Three things rest here: preventing and investigating fraud and misuse of the service, handling disputes between users and appealed ratings, and security logging of sign-ins and sensitive actions. We have weighed our interest in running a marketplace where people dare to trade with each other against your interest in not being profiled, and limited the processing to what the task requires. You have the right to object to processing that rests on this basis — see section 7 on your rights.
Account information — name, email address, address, phone number and profile picture — is kept for as long as your account exists.
Closing your account and erasing it are two different things. Both are under Profile & settings → Account & security. If you close your account it is shut and you can no longer sign in, but the data stays. If you want it removed, request erasure. Seven days after we have confirmed the request, your name, email address, address, phone number, profile picture and password are removed, and the account is replaced by an anonymous "Raderad medlem" (deleted member). At the same time your sign-ins, saved searches, favourites, follows, notifications and viewing history are deleted.
Records of completed deals — amounts, fees, payments, payouts and the delivery address an item was sent to — are kept for at least seven years after the end of the calendar year in which the financial year ended, because the Swedish Bookkeeping Act requires it. They are then attached to the anonymous account, not to your name. The records behind our DAC7 reporting are kept for at least seven years after the end of the year the report covers. There is currently no automatic deletion once those periods have passed, with one exception: the date of birth and account number you gave for DAC7 are kept for as long as your account exists, and if you have your account erased they are removed — unless you were paid for a sale in any of the last seven calendar years. Then they are kept until seven years have passed from the end of that year, and deleted automatically after that.
Messages between buyers and sellers are needed for as long as a complaint or a dispute about the deal can still arise. They are therefore deleted automatically three years after the last thing that happened in the deal: the latest message in the conversation, the buyer receiving the item, the payment reaching the seller or a return coming back. Three years is how long a business seller answers for a fault under the Swedish Consumer Sales Act. As long as the deal is not finished, or a dispute, a report or an appealed rating about it is open, nothing is deleted. The whole conversation is deleted at once — both parties' messages — also if your account has been closed or erased; until then a message is also the other party's record of the deal. On erasure of the account your name is removed from them. If you want a particular message removed sooner, write to us and we will consider it.
Requests you send to support are deleted automatically three years after we received them, together with the copy that went to our administrators. Copies of email we have sent — an email about a new message quotes the message — are kept for at most three years.
Ratings belong to the account they concern and are kept for as long as that account exists — including after an erasure has made it an anonymous account — because they belong to a completed deal and are the other party's assessment. Ratings are therefore not deleted automatically, and the text of a rating is not changed on erasure; if the author's account has been erased, the rating shows "Raderad medlem" as the author. A rating removed after a successful appeal is hidden from everyone, but kept as the record of that decision.
The screening of listings and applications is logged: what was screened, what the screening found and why. The log is deleted automatically three years after the screening — for an application, three years after the decision on it. For that long a decision can be questioned afterwards — by the person it concerned, by the notifier, by a supervisory authority or in court — and the log is then the record. The log for a listing that is still hidden after screening is kept for as long as the listing stays hidden.
Decisions on applications, and what our administrators have done, are on the other hand kept without a time limit, for as long as DUZO operates. They cannot be changed or deleted afterwards — that is technically blocked, so that nobody can rewrite what happened — and they are the proof of who decided what. They generally identify an account by its number, not by name, so after an erasure they can no longer be linked to you through the account.
Technical data: a sign-in lasts at most 30 days. It is deleted when you sign out, and an expired sign-in is cleared away. Your IP address is never stored in our database. The application only holds it in memory, to limit repeated attempts to create an account, sign in, reset a password, send a job application or report illegal content, and it is forgotten at most one hour after the last attempt. An email verification link is valid for seven days and a password reset link for one hour.
In addition, the web server and the server's operating system keep technical logs of requests to the site — including IP address, time and the page requested. They are used only for operations, troubleshooting and detecting attacks, and are deleted automatically once they are 30 days old.
We use a small number of providers in order to run the service. Each one receives only the data needed for its part, processes it on our behalf under a data-processing agreement, and may not use it for its own purposes — except where something else is stated explicitly below.
Amazon Web Services — hosting and storage. The platform, the database and the images that are uploaded run in the Stockholm region (eu-north-1). The data we store therefore stays inside the EU.
Stripe Payments Europe, Ltd — payments and payouts, and Swish once that payment method is switched on. The data required to carry out a payment or a payout is sent there: amount, order reference, and for sellers the account and identity details the provider is legally required to collect before it may handle payouts. Stripe is the controller for its own processing; its privacy policy applies alongside ours.
Resend — sending the service's email. The recipient's address and the entire finished message are sent there, which depending on the message can include names, listing titles, amounts, order references and tracking numbers.
Google (Gemini API) — the automatic screening of listings, and the optional photo suggestions when you post an item. The listing's title, category, description and up to six photos are sent there. No name, no account id, no email address and no postal address goes with them. See the paragraph on transfers outside the EU/EEA below.
Sendify — shipping broker. Through Sendify, parcels are booked with the carrier that delivers them, today DHL Freight or DSV, and Sendify passes the data on to that carrier. When a parcel is booked, the sender's name and address, the recipient's name and delivery address, the recipient's email address and phone number (if there is one on the account), the parcel's weight and measurements and the order reference are sent. The recipient's email address and phone number are used only to deliver the parcel and to tell the recipient when it is ready for collection at the service point. With Sendify a rate lookup is itself a draft booking with the same data, because the price depends on both addresses.
PostNord and DHL — the carriers, when a parcel is booked directly with them. Then the sender's and recipient's name and address, the parcel's weight and the order reference are sent. A plain rate lookup sends less than that: only postcode, country and weight, with no name.
Nominatim / OpenStreetMap — geocoding. The pickup address you type in as a seller is sent there to be translated into coordinates. No name and no account id goes with it, and the coordinates we then store are deliberately rounded to about a kilometre.
The Swedish Tax Agency (Skatteverket) — the annual report on sellers who reach the DAC7 thresholds. That is a legal obligation and not a processor relationship: the Tax Agency decides over that processing itself. What is reported is set out in the terms of use.
Transfers outside the EU/EEA. Hosting at Amazon Web Services is in Stockholm, so storage stays inside the EU. Stripe is established in Ireland. For Resend, Sendify and the carriers we rely on our agreements with them that the data is processed within the EU/EEA — that is a contractual term we state, not a location we have measured ourselves. One exception should be said plainly: the screening of listings calls Google's Gemini API on its global address, with no regional routing, so the data may be processed outside the EU/EEA by Google. That happens on the basis of the European Commission's standard contractual clauses and Google's data-processing terms. What is sent contains no directly identifying data about the seller — only the listing's own text and its photos.
During an ongoing dispute or an appealed rating, a DUZO administrator gets access to the relevant chat history and transaction details in order to make a fair decision.
We never sell your personal data to third parties.
When you submit a seller application, an initial automatic check is carried out. It is rule-based — it compares your answers against each other and looks for things that need a closer look. No AI and no language model is involved.
The check only produces a RECOMMENDATION for our administrators, and determines the order in which applications are read. No decision is made automatically: not an approval, not a rejection, not a request for more information. Every application is decided by a person who has read all of it and who is free to reach a different conclusion than the check.
Because the check is rule-based, we can always tell you exactly which rule applied to your application. You have the right to have a decision reviewed by a human, to express your own point of view, and to contest it — contact support and the case will be reopened. We log every decision and what the check recommended, to catch errors and to detect whether the screening goes systematically wrong against any group.
So no AI is used when reviewing seller applications. Listings, by contrast, are screened both against a word list and by an AI model — see the section below on how that works.
Every new and edited listing is screened before it becomes visible. First the title, category and description are compared against a fixed word list. Then the listing is read by an AI model (Google's Gemini), which receives the title, category, description and up to six photos and judges them against the rules on the Prohibited items page.
Where the breach is clear the listing is refused automatically and never created. You are told which rule it concerns, but deliberately not which word or which detail decided it — that would be a map of the control.
Where the case is unclear the listing is created hidden and put in a queue for a person, who decides it.
If the model cannot answer, the listing is published and screened again in the background — except where the word list has already reacted to something, in which case it waits for a person instead.
Every decision is logged, including the ones that let a listing through: which layer decided, what the judgement was, and the reason for it.
An automatic refusal is an automated decision within the meaning of article 22 of the GDPR. You have the right to contest it: write to support and a person retakes the decision with the whole listing in front of them. No automatic screening is final.
If you apply for a job with us through the Work with us page, we process what you send in: name, contact details, what you want to work with, your message and the CV you choose to attach. The data is used only to assess your application and to be able to contact you about it. You need no account to apply, and we do not link the application to an account if you happen to have one.
A job application is kept for at most twelve months and is then deleted automatically, the CV file included. If you want us to remove your data sooner, it is enough to get in touch and we will.
The processing rests on our legitimate interest in being able to recruit (article 6(1)(f)) and on your own choice to send the data in. The rights in section 7 apply to you as an applicant too.
If you report content as illegal through the Report illegal content page, we process what you send in: the address of the content, what the notice is about, your explanation, your name and email address and, if you are signed in, which account the notice came from. The data is used to review the notice, confirm that it has arrived, tell you the decision and handle any request for review. Your IP address is only used to limit how many notices can be sent, and is not stored with the notice (see section 5). You need no account to file a notice.
The person you report is not told who you are. The seller gets a statement of reasons for the decision, but not your name, your email address or your explanation. The data may be disclosed to the police or another authority where the law requires it, for example when a notice concerns a threat to someone's life or safety.
Your name and email address are erased automatically twelve months after the last decision in the case. The case itself — what was reported, why, and what we decided — is kept without them, because it is the record if the decision is later questioned. If you ask for your account to be erased, your name and email address are also removed from the notices you filed while signed in, when the erasure is carried out seven days after we have confirmed the request. Closing the account alone does not remove them.
The processing is necessary to comply with a legal obligation (article 6(1)(c)): the EU Digital Services Act requires us to receive, confirm and answer notices. The rights in section 7 apply to you as a notifier too.
If you write to us through the support form, we store the message: name and email address (the account's, if you are logged in), subject, message, the language you wrote in and a reference number. You need no account to write to us.
The data is used to handle and answer your message, for example when you want a person to review a decision again. The processing rests on our legitimate interest in being able to answer those who contact us (article 6(1)(f)), and when the matter concerns a deal or your account, on the contract with you (article 6(1)(b)).
Our administrators receive a notice about the message with your name, your email address and the beginning of the message, in the admin panel and by email. We send a receipt with the reference number to the email address you gave, through our email provider Resend; the receipt contains nothing you wrote.
The message itself is deleted automatically three years after we received it, together with the notice to the administrators (see section 5). If you want us to remove your data sooner, it is enough to get in touch. The rights in section 7 apply to you even if you have no account.
You have the right to request a copy of the data we hold about you, the right to have inaccurate data corrected, the right in some cases to have data deleted or its processing restricted, and the right to receive your data in a machine-readable format (data portability).
You also have the right to object to certain processing and the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) if you believe your data is being handled incorrectly.
Contact info@duzo.se to exercise any of these rights.
Passwords are never stored in plain text — they're hashed with a modern, secure algorithm. Login is handled through secure, time-limited sessions.
We work continuously to limit internal access to personal data to what's actually needed for each feature, for example ensuring only administrators can see the materials involved in a dispute.
We may update this policy as the platform or legislation changes. Material changes will be announced the same way as changes to the terms of use.
