Verka privacy policy

Verka is an Icelandic marketplace where customers post jobs and tradespeople send quotes. To run the service we need to process certain personal data about users. This policy describes what that data is, for what purposes and on what legal basis it is processed, who has access to it, how long it is kept and what rights users have.

The policy applies to everyone who uses the website verka.is: customers, tradespeople, people acting on behalf of companies, and people who browse the site without signing in.

Verka processes personal data in accordance with lög nr. 90/2018 um persónuvernd og vinnslu persónuupplýsinga (the Data Protection Act, No. 90/2018) and the European Union’s General Data Protection Regulation (EU) 2016/679 (“GDPR”).

Verka is not a company but a service run jointly by two individuals, who are joint controllers of the service: Brynjar Már Sigurjónsson, kennitala (ID number) 260502-2470, and Sigurður P. Ndaw Sigursteinsson, kennitala 010202-2640, with their address at Skólagerði 10, 200 Kópavogur.

Questions about privacy can be sent to verka@verka.is. You can address requests to exercise your rights to either controller. Verka has not appointed a data protection officer (DPO), as the service involves neither large-scale nor systematic monitoring within the meaning of Article 37 GDPR.

Joint controllership arrangement (Article 26 GDPR): the operators are jointly responsible for all of the processing described in this policy. Each of them receives and handles privacy requests and enquiries, and whichever of them receives a request makes sure it is answered.

If the running of Verka is transferred to a company set up by the operators, or to a new operator, users’ personal data will be transferred to that company or operator so that the service can continue. This will be announced with the same notice as other material changes (see section 14), and the new controller will be named.

We process the following categories of personal data:

• From your electronic ID when you sign in: Signing in to Verka is done with electronic ID through the Signet sign-in service. Each time you sign in we receive your full name and kennitala, and when you sign in with mobile ID (on your SIM card) also the mobile phone number the ID is registered to. Your name, as it is recorded in Registers Iceland (Þjóðskrá) and received from your electronic ID, is your display name on Verka: it is shown to other users on your profile and alongside the jobs, quotes, messages and reviews you are involved in. You cannot change it yourself, but you can ask for it to be corrected at the email address in section 2.
• Information you enter yourself: Role (customer or tradesperson), email address (a verified email address is needed to post jobs, send quotes or messages and register a company; until then the system creates a technical system address for the account, and no email is ever sent to it), area (postcode), bio (tradespeople), profile photo and trades.
• Marketplace data created as you use the service: Jobs you post, quotes you send or receive, messages between users and when they are read, and reviews with their ratings and photos — both customers’ reviews of tradespeople and tradespeople’s reviews of customers they have worked for. When a verified tradesperson opens a job posted on Verka we record it, so that the customer can see how many have viewed the job and so that the operator of the service can see whether notifications bring tradespeople to jobs. The customer only sees the number, never who. The record is kept for as long as the job exists and is deleted with it, or when the tradesperson deletes their account.
• Reports and requests to the operators: Reports about reviews or photos, requests for a manual licence review, and the operators’ notes on how they were handled.
• Tradespeople’s licence status: For tradespeople we obtain confirmation of their licence from the official register of licensed tradespeople on the basis of their kennitala, and mark verified licences on their profile.
• Information about companies and membership of them: If someone registers a company on the platform, we process information about the company itself (name, the company’s kennitala, area, description, phone number, website, logo and cover image, and work the company itself presents on its page with descriptions and photos), about the individual who registered it, and about its members: membership role, whether the person may send quotes on the company’s behalf, whether they choose to appear on its public page, and the date they joined. An invitation to join is addressed to the kennitala of the person invited.
• Email notifications: Your settings for which notifications you want to receive. When we send you an email we record the address it was sent to, the type of notification, timestamps and the message ID from the email service (Amazon SES). If you receive a daily digest of new jobs, we also record when the last digest was sent, so that the next one only shows jobs added since then. If an email cannot be delivered or is marked as spam, we record the address and the reason, so that nothing is sent to it again.
• Technical data: Essential cookies for your signed-in session (see section 11) and our hosting providers’ logs, kept for security and operations.

Verka does not process the precise location of your device. The location of a job is only the area or postcode you choose, and an address only appears if you write it yourself in text, for example in a job description or a message. Verka does not process any payment information.

All processing relies on a legal basis under Article 9 of Act No. 90/2018, cf. Article 6(1) GDPR. The table shows the purpose of each processing activity, what data is involved and the legal basis it relies on:

About phone numbers: Your mobile phone number is received from your mobile ID as part of authentication and is stored on your account page as contact information. It is not used to send you notifications or for marketing. Another user only sees your phone number if you write it yourself in a message to them.

Marketing: Verka does not send marketing emails or newsletters; email from Verka is only notifications and emails relating to your account. The daily digest of new jobs in a tradesperson’s trade and area is part of the service, not marketing email: it only contains jobs customers have posted on Verka, with no promotional material, special offers or news. If marketing email is ever introduced, it will only be with your prior consent, which you can withdraw at any time, and your right to object to direct marketing is unconditional.

Your name and kennitala are required to create an account and use the service; without them we cannot authenticate you with electronic ID. No automated decision-making or profiling within the meaning of Article 22 GDPR takes place on the platform.

Special rules apply to the use of the kennitala in Iceland: under Article 13 of Act No. 90/2018, use of the kennitala is permitted if it serves an objective purpose and is necessary to ensure reliable identification. We also take into account the guidance of the Icelandic Data Protection Authority (Persónuvernd) on the use of the kennitala.

Verka considers both conditions to be met for the following reasons:

• Signing in is done with electronic ID, and the kennitala is the unique identifier the ID returns. It ensures that each individual has only one account and that no one can create an account in someone else’s name.
• Reliable identification is essential to the nature of the service: customers let tradespeople into their homes and workplaces, and both parties need to be able to trust that the other party is who they say they are.
• Verifying tradespeople’s licences in the official register of licensed tradespeople is only possible with reliable identification on the basis of the kennitala.

Your kennitala is never shown to other users. In the database, access to your kennitala and phone number is restricted so that only you can see this information, on your account page.

A company’s kennitala: A legal entity’s kennitala is not personal data within the meaning of data protection law, since it identifies a company and not an individual, and it is publicly registered in the Register of Enterprises. It is displayed with the company on the platform. Information about the individuals who act on the company’s behalf, on the other hand, is personal data and is covered by this policy.

Invitations to join a company: Someone who manages a company invites others to join by entering their kennitala. The system neither confirms nor reveals whether an account exists for that kennitala, and once the invitation has been sent it only appears masked on the member list (for example 010188-****). The person invited sees the invitation when they sign in and decides for themselves whether to accept it. If they decline, they do not become a member and their name does not appear anywhere on the company.

Operators’ checks on companies: When a company is registered, Verka’s operators see the kennitala and phone number of the individual who registered it, for the sole purpose of confirming that they may act on the company’s behalf — by looking the company up in the Register of Enterprises and, where needed, phoning them. This is a limited exception to the rule above, based on the legitimate interest in companies on the platform being registered by people entitled to do so (Article 6(1)(f) GDPR), and it only applies to someone who has chosen to register a company. The same arrangement applies to requests for a manual review of trade licences.

Proof of authority: The person registering a company can choose to upload an extract from the Register of Enterprises at Skatturinn (Iceland Revenue and Customs) or a power of procuration, showing the board and holders of procuration. The document is stored privately — only the people who manage the company and Verka’s operators can access it, and then through a link that is valid for one minute. It is used for the sole purpose of confirming the authority, and it is deleted as soon as verification is complete, and also if the company or the owner’s account is deleted.

Lookup in the Register of Enterprises: When a company is registered, Verka looks up its kennitala in the open web service of Skatturinn’s Register of Enterprises and compares the kennitala of the person who registered the company with those of the people registered as its representatives. The individual’s kennitala is not sent to Skatturinn — only the company’s kennitala — and the comparison takes place on our side. Only the result is kept: whether authority is confirmed, whether the company’s name and status match, and the person’s job title at their own company. Information about other individuals that appears in the response, such as other board members, is neither stored nor recorded. The processing is based on legitimate interests (Article 6(1)(f) GDPR), and the result decides nothing automatically — an operator makes the decision.

We never sell personal data. The following parties are involved in the processing or may receive data:

• Supabase Inc. — hosting of the database, authentication system and file storage (for example profile photos and job photos). The data is hosted in a data centre within the European Union. Supabase is Verka’s processor.
• Advania Ísland ehf. (Signet) and Auðkenni ehf. — the Signet sign-in service verifies the electronic ID issued by Auðkenni and returns identity information to Verka (name, kennitala and, where applicable, phone number). Advania processes the authentication data on Verka’s behalf each time you sign in; Auðkenni is an independent controller for the issuing of the ID.
• Amazon Web Services EMEA SARL (Amazon SES) — sending email from Verka: notifications and emails relating to your account, for example confirming a new email address. AWS receives the recipient’s email address and the email itself, which is a short alert that something is waiting for you on Verka — the job’s title, trade, area and timing, and the name and rating of the person who sent a quote or message — but never the content of messages, job descriptions, photos or prices. Emails are sent through AWS data centres in Ireland (eu-west-1). AWS is Verka’s processor.
• Vercel Inc. — hosting of the website verka.is. Personal data passes through Vercel’s web servers in transit (for example when you update your profile or download your data) but is not stored there. Vercel keeps request logs for a limited time for security and operations.
• Google Cloud EMEA Limited (Google Workspace) — Verka’s email inbox. If you send us an email, for example to verka@verka.is, or reply to a notification from Verka, the email arrives in our inbox at Google Workspace and is stored there together with our replies: your email address, name and what you write. Notifications from Verka are not sent from there but through Amazon SES (see above). Google is Verka’s processor.
• Other users — only see content published on the platform in accordance with its access rules: name, area, bio, profile photo, verified licences, jobs, quotes on jobs that concern them, and reviews. Tradespeople’s reviews of customers are only visible to signed-in users, and they are shown to tradespeople on the customer’s jobs so that they can decide whether to quote for the work. Kennitala and phone number are never visible to other users.
• Parties to a message conversation — messages are only visible to the parties to the conversation. When messages are sent to or from a company, they are visible to the company’s members who may act on its behalf on the job in question: those who may send quotes in its name, or, on jobs the company itself posted, those who may post and manage jobs for it. We record when messages are read and show this to the sender (“Seen”). For messages to a company, we record which member opened them; the other party only sees that the company has seen the messages, not who.
• Other members of a company — if you are a member of a company, its other members see your display name, profile photo, verified trades, your membership role and when you became a member. You only appear on the company’s public page if you choose to yourself with the “Show me on the company page” switch, which is off by default and which you can turn off at any time. If you send a quote in the company’s name, the customer sees the company’s name and your name as the contact person. Your kennitala and phone number are never visible to other members.
• Verka’s operators — the two individuals named in section 2 have access to data on the platform to the extent needed for running the service, supporting users, handling reports and requests, and security. In Verka’s admin panel they see reports and requests together with the content they concern, and, when checking companies and licences, the kennitala and phone number of the person concerned (see section 5). The admin panel does not show the content of messages between users, only how many there are. As administrators of the system, however, the operators have technical access to the database as a whole and use it only for the purposes described in this policy.
• Advisers — lawyers, auditors and other advisers bound by confidentiality, to the extent necessary in connection with legal disputes or legal obligations.
• Public authorities — where required by law or by lawful orders from competent authorities. If we receive a demand from a public authority for information about you, we will let you know, unless the law or the authority’s order prohibits it.

Public display online: While Verka is in closed beta, the website is only open to signed-in users and search engines are asked not to index any of it. When the site opens to the public, tradesperson profiles and verified company pages will be open to everyone online, including without signing in, and search engines may index them. A tradesperson’s profile shows reviews of them together with the name of the customer who wrote each review and any photos attached to it. Open jobs on the Job board are also visible without signing in, but individual job pages are marked so that search engines do not index them. In robots.txt, Verka asks the web crawlers of AI services (for example GPTBot, ClaudeBot, PerplexityBot, CCBot and Google-Extended) not to fetch pages with user content — profiles, company pages and jobs. Robots.txt is, however, a request and not a technical barrier, and Verka cannot guarantee that everyone respects it. Tradesperson profiles and company pages are public by nature, since their purpose is to help customers find tradespeople, and the only way to make a tradesperson’s profile inaccessible to others is to delete the account.

Photos: Job photos, photos attached to reviews and company images (logo, cover image and photos of the company’s work) are stored in public file storage: anyone who has a photo’s URL can download it. Profile photos are served through temporary links. Documents proving authority to act for a company are stored privately (see section 5).

Information users receive about each other: Information that users exchange through Verka — for example an address or phone number a customer writes in a message — and use outside the platform, for example when drawing up a work contract or invoices, is the responsibility of the person who receives it. Tradespeople and companies who use information about customers in their own business are independent controllers of that processing. Processing by an individual purely in the course of a personal or household activity, for example when a customer has work done at home, however, falls outside the scope of data protection law. Verka’s operators are not responsible for users’ processing outside the platform.

If personal data is hosted or processed outside the European Economic Area (EEA), such a transfer only takes place on the basis of appropriate safeguards under Chapter V GDPR, such as the European Commission’s standard contractual clauses (SCCs) or an adequacy decision.

Verka’s database, authentication system and file storage are hosted within the European Union, and personal data is stored there. Vercel Inc. is an American company; to the extent that traffic through its web servers involves a transfer outside the EEA, that transfer relies on the European Commission’s standard contractual clauses in Vercel’s data processing agreement.

Email is sent through Amazon Web Services data centres in Ireland. Verka’s contracting party is Amazon Web Services EMEA SARL in Luxembourg, a subsidiary of the American company Amazon Web Services Inc.; to the extent that the processing involves a transfer outside the EEA, that transfer relies on the European Commission’s standard contractual clauses in AWS’s data processing agreement.

Email you send to Verka is hosted by Google Workspace. Verka’s contracting party is Google Cloud EMEA Limited in Ireland, a company in the group of the American company Google LLC; to the extent that the processing involves a transfer outside the EEA, that transfer relies on the European Commission’s standard contractual clauses in Google’s data processing agreement.

• Account and profile information is kept for as long as your account is active.
• When you delete your account, personal identifiers are removed — name, kennitala, phone number, email address, profile photo and bio — and the account is closed permanently. To enforce closures, and so that reviews follow a tradesperson or customer who registers again, we keep an encrypted reference (hash) to the kennitala for up to three years after deletion. It cannot be traced without a key held only by the system and is used solely for this purpose. If the account had been closed by Verka, the reference is kept for as long as the closure lasts. Records that concern other users remain without any link to personal identifiers (pseudonymised), so that the history of the people you dealt with — for example reviews that other users rely on — is not disrupted: jobs that quotes, messages or reviews are linked to, the quotes, messages and reviews themselves and the photos attached to them, together with photos of the jobs that remain. Jobs that no other user has been involved in are deleted, together with their photos.
• Text and photos you have posted yourself are not redacted when your account is deleted. If you have written personal data into text, for example an address in a job description, it therefore remains. You can ask at any time for specific content to be removed, at the email address in section 2, and the request will be assessed under Article 17 GDPR.
• If you are a member of a company, your membership is deleted when you delete your account and your name disappears from the company’s page. If you registered the company yourself, it is closed on deletion: it disappears from the platform, all members’ memberships end and unanswered invitations are withdrawn. Invitations addressed to your kennitala are deleted, since they contain the kennitala itself. Quotes the company sent remain, referring to the company, as part of the marketplace’s history, in the same way as other quotes.
• Backups of the database are taken daily by the hosting provider and the seven most recent are kept. Deleted data disappears from backups as they expire, at the latest about seven days after deletion.
• Reports about reviews and photos, together with the operators’ decision and notes on it, are kept for as long as the content they concern, so that the decision can be traced. If the person who sent a report deletes their account, the report remains pseudonymised, like other content that concerns other users. Requests for a manual licence review, and records that the register no longer confirms a licence, are on the other hand deleted when the account is deleted.
• Data that we are legally required to keep, for example bookkeeping records where applicable, is kept for as long as the relevant law requires.
• Access and activity logs (sign-ins, technical data) are kept for up to 90 days for security and operations.
• The record of emails sent (the address at the time of sending, type of notification, timestamps and the message ID from Amazon SES) is kept for 90 days and then deleted. When you delete your account, unsent notifications and your notification settings are deleted immediately.
• Email addresses that have permanently bounced or reported spam are kept for as long as the address is considered inactive, including after the account has been deleted, so that nothing is sent to it again. The list holds the address, the reason and the times, but no link to an account. You can ask for an address to be removed from the list at the email address in section 2.
• Emails you send to Verka, and our replies, are kept while the matter is being dealt with and afterwards only for as long as needed to follow it up or to show how it was handled. You can ask for the emails to be deleted sooner at the email address in section 2.
• Verka’s copy of the official register of licensed tradespeople (name, trade, year of issue and the first six digits of the kennitala) is refreshed by replacing the old copy with a new one. No history of older copies is kept, and the copy is not accessible to users; it is only used for matching.

Under data protection law you have the right to:

• Access — get confirmation of whether, and what, information about you is processed, and a copy of it.
• Rectification — have inaccurate or incomplete information corrected.
• Erasure — have information about you deleted when the conditions for this are met.
• Restriction of processing — in certain circumstances.
• Data portability — receive the information you have provided to us in a machine-readable format and, where technically feasible, have it sent directly to another controller.
• Withdrawal of consent — at any time, without affecting the lawfulness of earlier processing.

Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Article 6(1)(f) GDPR, see section 4). We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. Objections to direct marketing will always be complied with.

You can exercise the main rights directly on the Settings page: there you can correct your profile information, download a copy of your data with the “Download my data” button and delete your account with the “Delete account” button. If your account has been closed by Verka, send your request for deletion to verka@verka.is; it is carried out manually within the same time limit. If you no longer have access to your electronic ID, send the request to verka@verka.is with your kennitala and it is carried out within the same time limit. Other requests — for example to correct your name, which comes from your electronic ID and which you cannot change yourself, to restrict processing, or to object — can be sent to verka@verka.is and will be answered as quickly as possible and within one month at the latest. To confirm your identity we may ask you to send the request from your signed-in account or to confirm it with electronic ID.

Requests are handled free of charge. If a request is manifestly unfounded or excessive, for example because it is repetitive, we may charge a reasonable fee or refuse it. The rights are not absolute; if we cannot comply with a request, we will explain why and point out your right to complain to the Icelandic Data Protection Authority (see section 10).

You control email notifications under Settings → Notifications, where you can turn them all off or turn off individual categories. Every notification also has an unsubscribe link that turns them all off, without signing in. The link in the daily digest of new jobs, however, only turns off the digest; you will continue to receive other notifications.

If you believe that Verka’s processing of personal data infringes data protection law, you have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd), Rauðarárstíg 10, 105 Reykjavík — personuvernd.is. We would, however, encourage you to contact us first so that we can resolve the matter.

Verka only uses essential cookies: cookies that keep track of your signed-in session and a temporary security cookie that protects signing in against forged requests (CSRF protection). No analytics cookies, advertising cookies or third-party tracking tools are used. If that changes, this policy will be updated and consent obtained as required by law.

We apply appropriate technical and organisational measures to protect personal data, including access controls at database level — which, among other things, restrict access to the kennitala and phone number to the user themselves. Data is encrypted in transit and at rest with our hosting providers. Access to Verka’s admin panel is granted only to the operators and is not granted through the website itself.

In the event of a personal data breach, we will notify the Icelandic Data Protection Authority within 72 hours of becoming aware of it where required, and you without undue delay if it is likely to result in a high risk to your rights and freedoms. If you suspect that someone has gained access to your account, contact us immediately at verka@verka.is.

The service is intended for adults aged 18 and over and is not directed at children. Signing in with electronic ID helps ensure that accounts are created by the right individuals.

This policy may change, for example because of changes to the service or to legislation. Material changes will be announced on the website and when you next sign in at least 14 days before they take effect, and the date of the last update above will be changed.

See also Verka’s terms of use.