Vici Eiendom ASPrivacy
Privacy Notice
This is an unofficial English translation provided for convenience. The Norwegian version at vicieiendom.no/personvern is the legally binding version and prevails in case of any discrepancy.
1. Controller
Vici Eiendom AS, org. no. 936 127 290, Klingenberggata 7, 0161 Oslo, is the controller for the personal data processed in connection with the products and websites described below. This means that we determine the purpose of the processing and the means used, and that we are responsible for ensuring that the processing complies with personopplysningsloven (the Personal Data Act) and the General Data Protection Regulation (GDPR).
Enquiries about privacy should be sent to marcel@costanix.no.
2. Scope of this notice
This notice applies to the following products and websites, all of which are provided by Vici Eiendom AS:
- Assistent (app.costanix.no)
- Kapital and Builder (costanix.no and app.costanix.no)
- Skilla (skilla.no)
- Utleiemalen (utleiemalen.no)
- Arkiva (arkiva.no)
- the websites costanix.no and vicieiendom.no
Where a product processes data in a way that is not described here, we provide information about it in the product before the processing begins.
When you enter data about other persons, for example tenants, investors, board members or customers of your business, we process that data in order to provide the service to you. When you enter such data for your own purposes, for example letting, accounting, running your business or raising capital, you are the controller for that data and we are the processor. This is governed by clause 10 of the terms and the data processing agreement.
3. Data we process
The data we process depends on which product you use and what you enter yourself. The main categories are:
- Account data: name, email address, telephone number where applicable, login credentials and settings.
- Purchase and payment data: which products and subscriptions you have purchased, amounts, times, invoicing details and payment status. Card numbers and other payment information are processed by the payment provider and are not stored by us.
- Content you enter: text, documents, images, receipts, links, figures and instructions that you upload or type into the products, and the output the products generate from them.
- Data from connected services: if you yourself connect an external service to a product, for example email or calendar in Assistent, we process the data necessary for the task you request.
- Data from public sources: for example data on companies, roles and properties from public registers, and data from publicly available property listings, such as address, price, property details and the estate agent's contact details.
- Communications: emails and other enquiries to us, and our replies.
- Technical data: IP address, browser type, device, time and event logs generated when you use the products and websites.
We do not ask for special categories of personal data, such as health data. We ask you not to enter such data or national identity numbers in the products unless it is necessary for the task.
4. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Creating and operating your account, providing the products and carrying out what you request | Contract, GDPR Article 6(1)(b) |
| Completing purchases, invoicing and handling the right of cancellation, termination and complaints about defects | Contract, GDPR Article 6(1)(b) |
| Bookkeeping and retention of accounting records | Legal obligation, GDPR Article 6(1)(c), cf. bokføringsloven (the Bookkeeping Act) |
| Customer service and responding to enquiries | Contract, GDPR Article 6(1)(b), or legitimate interest in responding to enquiries from persons other than customers, point (f) |
| Security, troubleshooting and prevention of misuse | Legitimate interest in keeping the services secure and stable, GDPR Article 6(1)(f) |
| Storing and compiling data from publicly available property listings in order to compare properties and prices over time and display aggregate statistics in Utleiemalen | Legitimate interest in giving users a better basis for their decisions, GDPR Article 6(1)(f). See sections 5 and 9. |
| Improving the products on the basis of usage patterns and anonymised statistics | Legitimate interest in developing the services, GDPR Article 6(1)(f) |
| Sending information about our own similar products to existing customers | Legitimate interest, GDPR Article 6(1)(f), cf. markedsføringsloven (the Marketing Control Act) section 15. You can opt out when you provide your email address, and in every mailing. |
| Newsletters and analytics tools that are not necessary | Consent, GDPR Article 6(1)(a). Consent may be withdrawn at any time. |
Where we rely on legitimate interest, we have assessed that the interest outweighs the consideration for your privacy. You may object at any time, see section 12.
5. Product-specific information
Assistent
Assistent processes the instructions you give by text or voice, and content from services you yourself connect, such as email and calendar. Voice recordings are converted into text in order to carry out the task. Assistent reads and uses data from connected services only to the extent required for the task, and is designed to ask for approval before anything is sent, published, deleted or changed on your behalf. You can disconnect a service at any time, and access then ceases. Use of data from Google services complies with the Google API Services User Data Policy, including the Limited Use requirements: the data is used only to provide the features you have requested, is not transferred to anyone except as necessary for that purpose, and is not used for advertising or to train general AI models.
Kapital
Kapital processes data about companies and their boards, management and owners, obtained from public registers and from material uploaded by the user. Where the solution is used to collect data from investors, the company or the arranger using Kapital is the controller for the investor data, and Vici Eiendom AS is the processor.
Builder
Builder processes the description, text and images you enter, and creates websites from them. Websites you publish become available to others. You are responsible for the content and for ensuring that you have the right to publish data about other persons.
Skilla
When you make a purchase from Skilla, we process purchase, payment and contact data. Skilla packages are used in your own account with Claude or ChatGPT. The content you enter there is processed by the relevant provider under its terms, and not by us.
Utleiemalen
Utleiemalen processes the property listings you ask to have analysed, documents you upload, such as the sales prospectus and condition report, and the figures you enter about loans, tax and your personal finances. Data from the property listings is obtained from publicly available listings and is also stored without any link to you as a user, so that we can compare properties and prices over time. Such listings may contain personal data, for example the address of a property and the name and contact details of the estate agent. We only display aggregate statistics, for example how many times a listing has been analysed, and never who has analysed it. The estate agent's contact details are not used for any purpose other than displaying the listing as published. If you are a seller or estate agent and wish to obtain access, rectification or erasure, you can contact us, see section 12.
Arkiva
Arkiva processes the receipts you upload and the answers you give about each receipt. Receipts may contain data about others, for example tenants and suppliers. Such data is processed only to produce the overview and the archive for you. Where several users share a receipts folder, they can see the contents of the folder.
6. Artificial intelligence
Several of the products use language models and other AI services to read documents, write drafts and carry out tasks. The content required for the task is then sent to the provider of the model. We use the providers' paid API services, under which the provider, according to the applicable terms, does not use the content to train models. The providers may store the content for a short period, typically up to 30 days, in order to detect misuse.
The products do not make decisions which produce legal effects concerning you or similarly significantly affect you based solely on automated processing, cf. GDPR Article 22. The output is decision support, and you decide for yourself what to do with it.
7. Processors and other recipients
We do not sell personal data. We use providers that process data on our behalf under a data processing agreement with us. The most important are:
| Provider | Task | Products |
|---|---|---|
| Vercel Inc. (USA) | Hosting and delivery of websites and applications | All |
| Supabase Inc. (USA, data stored in the EU) | Database, login and file storage | Assistent, Kapital, Builder, Utleiemalen, Arkiva |
| Google Cloud (Google Cloud EMEA Ltd., Ireland) | Maps and location data, document reading and language models | Utleiemalen, Arkiva |
| Anthropic PBC (USA) | Language models | Assistent, Kapital, Builder, Utleiemalen, Arkiva |
| OpenAI (USA and Ireland) | Language models | Assistent, Builder |
| ElevenLabs (USA) | Speech to text and text to speech | Assistent |
| fal.ai, Features & Labels Inc. (USA) | Image generation | Builder, Utleiemalen |
| Apify Technologies s.r.o. (Czech Republic) | Collection of publicly available listing data | Utleiemalen |
When you make a payment, we share the necessary data with Stripe Payments Europe Ltd. (Ireland) and Vipps MobilePay AS (Norway). They are independent controllers for their part of the payment, among other things in order to comply with anti-money laundering requirements, and process the data in accordance with their own privacy notices.
We may also disclose data to our accountant and auditor, to public authorities where we are obliged to do so, and, on the basis of legitimate interest under GDPR Article 6(1)(f), to any purchaser of all or part of the business, in which case on the same terms as those set out in this notice.
8. Transfers outside the EEA
Some of the providers are established in the USA or may process data there. We only transfer data outside the EEA where there is a valid transfer mechanism under GDPR Chapter V, normally that the provider is certified under the EU-US Data Privacy Framework or that we have entered into the European Commission's standard data protection clauses, with supplementary measures where necessary. You may request a copy of the transfer mechanism.
9. Retention periods
We do not store data for longer than is necessary for the purpose:
| Data | Retention period |
|---|---|
| Your account and the content you have entered | For as long as the account is active. Deleted within 90 days after the account is closed, unless you have requested that something be deleted earlier. |
| Content you delete yourself | Deleted from the solution without undue delay, and from backups when the backups are rotated, normally within 30 days. |
| Purchases, invoices and other accounting records | Up to five years after the end of the financial year, cf. bokføringsloven section 13. |
| Enquiries to us | Up to three years after the last enquiry, or longer if necessary for the establishment, exercise or defence of a legal claim. |
| Technical logs | Normally up to 90 days, longer only when investigating a specific security incident. |
| Connections to external services | Access tokens are deleted when you disconnect the service or close your account. |
| Data from property listings, cf. section 5 | Up to five years after the listing was retrieved. The personal data is then deleted, and only aggregate statistics without personal data are retained. |
| Inactive accounts | We may delete a free account that has not been used for three years, after notifying you by email at least 30 days in advance. |
10. Cookies
vicieiendom.no does not use cookies and does not load content from third parties. The products use cookies and local storage that are necessary for login, security and remembering your choices. Such storage does not require consent under ekomloven (the Electronic Communications Act) section 3-15. We only use cookies for analytics or marketing if you have actively consented, and you may withdraw your consent in the product at any time.
11. Information security
We have technical and organisational measures in place to protect the data, including encrypted transmission, access control, separate codebases for the products and restricted access for providers. In the event of a personal data breach that may result in a risk to you, we will notify Datatilsynet (the Norwegian Data Protection Authority) and, where required by law, you.
12. Your rights
You have the right to:
- obtain access to the data we process about you, and receive a copy of it (Article 15)
- have inaccurate or incomplete data rectified (Article 16)
- have data erased, unless we are obliged or have another basis to retain it (Article 17)
- request that the processing be restricted (Article 18)
- receive the data you have provided to us in a machine-readable format (Article 20)
- object to processing based on legitimate interest, and to direct marketing (Article 21)
- withdraw your consent at any time, without affecting the processing carried out before the withdrawal (Article 7)
Send your request to marcel@costanix.no. We will respond without undue delay and at the latest within one month. We may ask you to confirm your identity before we disclose any data. If the request concerns data for which another business is the controller, cf. sections 2 and 5, we will forward it to that business or ask you to contact the business directly.
13. Complaints
We would appreciate it if you contacted us first if you believe that we are processing data in breach of the rules. In any event, you have the right to lodge a complaint with Datatilsynet, Postboks 458 Sentrum, 0105 Oslo.
14. Changes
We update this notice when the products or the rules change. The current version is always available on this page, with the date at the top. In the event of material changes, we will notify you in the product or by email before the changes take effect.
15. Contact
Vici Eiendom AS
Postboks 1208 Vika, 0110 Oslo
marcel@costanix.no
Change log
- 1.1, 4 November 2026: The roles of controller and processor have been linked to who determines the purpose. The legal basis, retention periods and information about data from property listings have been added. The sections on artificial intelligence, Google services, marketing, cookies, inactive accounts and retention periods have been clarified.
- 1.0, 4 November 2026: First version.