Legal

Privacy Policy

We collect the minimum data needed to run the marketplace, never sell it to advertisers and let you export or delete your account at any time. This policy explains exactly what that means in practice.

1. Who is the data controller

Norfix is the controller of personal data processed through this site and app. For any privacy question, contact privacy@norfix.co.

2. What we collect

Account data: name, email, phone, city, role (customer or provider) and password hash.
Job data: request descriptions, photos, location and timing you choose to share.
Messages: chats between customers and providers, for safety and dispute resolution.
Payment data: processed by our payment partners; we store only the minimum needed for receipts and refunds.
Usage data: device, IP, pages viewed and actions taken, for security and product improvement.

3. Why we use it (legal basis)

Contract: to match you with pros or jobs, run bookings and process payments.
Legitimate interests: to prevent fraud, secure the platform and improve the product.
Legal obligation: to keep invoices, tax records and respond to lawful requests.
Consent: for optional marketing emails or non-essential cookies — you can withdraw consent anytime.

4. Who we share data with

We share data only with providers you choose to contact, with our payment and hosting processors (acting on our instructions), and with authorities when legally required. We never sell personal data to advertisers or data brokers.

5. How long we keep it

Account data is kept while your account is active and for up to 24 months after deletion for legal, accounting and dispute purposes. Invoices are retained for the period required by tax law in your country. Marketing data is deleted on unsubscribe.

6. Your rights (GDPR)

You can request access, correction, export, restriction or deletion of your data — and object to processing — at privacy@norfix.co. We reply within 30 days. You also have the right to complain to your national data protection authority.

7. International transfers

Data is hosted within the EU. Where a processor operates outside the EEA, we rely on EU Standard Contractual Clauses to protect your data.

8. Security

We use encryption in transit, encrypted backups, role-based access controls and regular security reviews. No system is perfectly secure, but we work hard to keep your data safe and we notify affected users in the rare event of a breach.