Privacy Policy
Last updated: 25 July 2026
This Privacy Policy explains how AKERSEL AS ("Deshi", "we", "us") collects, uses and protects your personal data when you use the Deshi marketplace as a customer or vendor. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (personopplysningsloven).
- Data controller
AKERSEL AS
Org. no. 937 757 832
VAT no. 937757832 MVA
Selma Ellefsens Vei 6, 0581 Oslo, Norway
1. Who is responsible for your data
AKERSEL AS is the data controller for personal data processed through Deshi. For questions about this policy or to exercise your rights, contact us at legal@akersel.no. Vendors selling on Deshi are independent businesses and act as separate controllers for the personal data they receive to fulfil their own orders (for example, your name and delivery address).
2. Personal data we collect
We collect: account details (name, email, phone, password — stored only as a secure hash); delivery and billing addresses; order history and the contents of your cart; payment status and method (card details are handled by our payment providers, not stored by us); communications you send us; marketing-consent choices; and technical data such as your IP address, device/browser information and cookies. Vendors additionally provide business details (organisation number, VAT number, store address, bank details) when they register.
3. How we use your data
We use your personal data to: create and manage your account; process, deliver and support your orders; handle payments, refunds and payouts to vendors; provide customer service; prevent fraud and secure the platform; meet legal and accounting obligations; and — where you have consented — send marketing about products and offers. We do not sell your personal data.
4. Legal bases for processing
We rely on the following legal bases under the GDPR: performance of a contract (to provide the service and fulfil your orders); our legitimate interests (to secure and improve the platform and prevent fraud), balanced against your rights; legal obligation (for example, bookkeeping and tax retention); and your consent (for marketing emails and non-essential cookies), which you may withdraw at any time.
5. Who we share data with
We share personal data with: the vendor(s) fulfilling your order, so they can pack and deliver it; service providers acting on our behalf (hosting, email delivery, analytics, file storage), who process data under our instructions; payment providers who process your payment; and delivery carriers. We may also disclose data where required by law or to protect our rights. Providers acting on our behalf are bound by data-processing agreements.
6. Payments
Payments are handled by third-party payment providers (such as Stripe and Vipps/MobilePay). When you pay, your card or payment-account details are provided directly to the provider and processed under their own privacy terms; Deshi does not store full card numbers. We receive confirmation of payment status and the information needed to reconcile orders, refunds and vendor payouts.
7. Cookies and similar technologies
We use strictly necessary cookies to keep you signed in and to remember your cart — these are required for the service to work. Where used, analytics or preference cookies are set only with your consent. You can control cookies through your browser settings; blocking essential cookies may prevent parts of the site from working.
8. How long we keep your data
We keep personal data only as long as necessary for the purposes above. Account data is retained while your account is active. Order, invoice and accounting records are retained to meet Norwegian bookkeeping requirements (generally five years, and longer where the law requires). Marketing data is kept until you withdraw consent. When data is no longer needed, we delete or anonymise it.
9. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls, and optional two-factor authentication for admin and vendor accounts. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the authorities of any breach where required by law.
10. Your rights
Under the GDPR you have the right to: access the personal data we hold about you; correct inaccurate data; request erasure; restrict or object to certain processing; data portability; and withdraw consent at any time (without affecting prior processing). To exercise these rights, contact legal@akersel.no. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no).
11. International transfers
We aim to keep personal data within the EU/EEA. Where a service provider processes data outside the EEA, we ensure an adequate level of protection through mechanisms such as the European Commission's Standard Contractual Clauses or an adequacy decision.
12. Children's privacy
Deshi is not directed at children. You must be at least 18 years old, or have the consent of a parent or guardian, to create an account. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.
13. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always available here, with the "last updated" date shown above. Where changes are significant, we will take reasonable steps to notify you, for example by email or a notice on the site.
14. Contact and complaints
For any privacy question or request, contact us at legal@akersel.no, or by post to AKERSEL AS, Selma Ellefsens Vei 6, 0581 Oslo, Norway. You may also contact the Norwegian Data Protection Authority (Datatilsynet) if you believe your data has been handled unlawfully.