Privacy policy

This is a translation. The Danish version applies if the two differ.

Last updated: 23 August 2026

1. Who are we?

Sparebørsen is a cashback service that gives you money back when you shop with our partner stores. The service is operated by Mosel AS (Norwegian company registration number 937 308 809), Inndalsveien 5, 5063 Bergen, Norway. Mosel AS is the data controller for the processing described here. Norway is part of the EEA, and the GDPR applies in the same way as within the EU. Contact: hej@spareborsen.dk.

2. What data do we collect?

We process the following personal data:

• Account information: name and email address. If you log in with Google, we receive your name and email address from there. We do not ask for your CPR number.
• Purchase data: information about purchases made via our affiliate links: the store, the amount and the time.
• Technical information: IP address, browser, device and operating system, so that the service works and in order to counter misuse.
• Cookies: we use necessary cookies for login and affiliate tracking, including a device ID (the “sb_did” cookie, lifetime 180 days).
• Click and account events: when you click through to a partner store, we record the time, the partner store, your IP address, browser information and device ID. The same is recorded on registration and on login. The purpose is to link purchases to the right account, including purchases you made before you registered, so that you receive the cashback you are entitled to, and to prevent misuse. This data is kept for no longer than 180 days and is processed on the basis of legitimate interest (GDPR art. 6(1)(f)).
• Order confirmations for cashback claims: when you submit a cashback claim, you upload the order confirmation from the store (PDF or image). It is used solely to confirm your claim and is deleted automatically no later than 90 days after the case has been decided.

Payouts are made via a payment link from Revolut that you complete yourself. We therefore do not collect or store your account number.

3. Why do we process the data?

• To deliver the cashback service and register your purchases.
• To create and administer your account.
• To pay out earned cashback.
• To improve the service and the user experience.
• To meet legal obligations (accounting and tax).

4. Legal basis

We process personal data on the basis of: our agreement with you (GDPR art. 6(1)(b)), legitimate interest (GDPR art. 6(1)(f)), consent where it is required (GDPR art. 6(1)(a)) and legal obligation, where accounting and tax rules require it (GDPR art. 6(1)(c)).

5. Who do we share data with?

• Affiliate networks: Adtraction, Addrevenue, Tradedoubler and others, in order to register and confirm purchases.
• Google: if you choose to log in with Google. Google Ireland Limited handles the login and passes your name and email address on to us. Google is an independent data controller for its part of the processing.
• Payment provider: Revolut, for paying out cashback.
• Technical providers: operation, hosting and email (see section 8).

We never sell your personal data to third parties.

6. Storage and deletion

Personal data is kept for as long as you have an active account. When you delete the account, we remove your data within 30 days, apart from data we are legally required to keep (a maximum of 5 years under the Norwegian accounting legislation that applies to Mosel AS). Click and account events containing IP address and device ID are deleted automatically after 180 days.

7. Your rights

You have the right to:

• Access the data we hold about you.
• Have incorrect data corrected.
• Have your data deleted.
• Data portability: to receive a copy of your data.
• Object to processing carried out on the basis of legitimate interest.
• Withdraw your consent at any time.
• Lodge a complaint with Datatilsynet, which is the supervisory authority in Denmark.

8. Where the data is processed, and our data processors

The data is processed mainly in Norway and within the EU/EEA; the exceptions that involve a transfer to a third country are listed below. Norway is covered by the EEA Agreement and by the GDPR, so a transfer there is not a third-country transfer. We use the following data processors:

• Hostinger: operation and hosting of the platform (EU/Lithuania)
• Resend: transactional email. Resend is established in the USA, so email address and message content are transferred there. The transfer takes place on the basis of the EU-US Data Privacy Framework and, in addition, the European Commission's standard contractual clauses (SCC) with supplementary safeguards.
• Revolut: payouts (EU)
• Google Ireland Limited: login with Google (EU). Google may transfer data onward to the USA under the Data Privacy Framework.

Sparebørsen for businesses, the subscription in which a store sends customer transactions to us and we act as data processor, is not yet offered in Denmark. When it launches, a data processing agreement is entered into as part of the terms of use.

9. Analytics, marketing and tracking

9.1 Statistics (without cookies)

We use Plausible Analytics to measure traffic and use of the service. Plausible collects no personal data, uses no cookies and does not identify you. No data is taken outside the EEA.

9.2 Ad tracking (only with your consent)

If you give your consent in our consent banner, we may activate ad tracking from platforms such as Meta (Facebook/Instagram), Google Ads, TikTok, Snapchat, Microsoft/Bing, Pinterest, X and Reddit, in order to measure and target advertising. The legal basis is consent (GDPR art. 6(1)(a)). Such platforms may transfer data to the USA on the basis of the EU-US Data Privacy Framework or standard contractual clauses (SCC). You may change or withdraw your consent at any time via “Cookies” at the bottom of the page. Without consent, none of this is loaded.

See our cookie page for a full overview of cookies and tracking.

9.3 Affiliate attribution (necessary)

In order to register cashback and credit it to your account, we use affiliate tracking: when you click through to a partner store via Sparebørsen, a first-party subId (a pseudonymous identifier) is stored with us and with the affiliate network in question (see section 5). This is necessary for the service to work and is processed on the basis of our agreement with you (GDPR art. 6(1)(b)). No third-party advertising cookies are set at this step.

10. Contact us

Questions about personal data? Write to us at hej@spareborsen.dk