Privacy Policy
Last updated 19 October 2026
This privacy policy describes how Fidova processes your personal data when you use our dog-training platform — when you create an account, book courses or facilities, communicate with trainers, and use our services. We process your data in accordance with the EU General Data Protection Regulation (GDPR). Fidova is in a test period and the service is being developed continuously. We update this policy when our processing changes.
Data controller
We and the trainer or organization you book with are each an independent controller for our own part of the processing — we are not joint controllers. Who is the controller depends on which processing is involved. Softsyde AB (company reg. no. 559598-7354), which operates Fidova, is the controller for the platform itself: your account and sign-in, the marketplace and the public pages, notifications and emails, security and audit logs, and how long data is kept, deleted and anonymized. When you book a course, a venue or a private lesson, the trainer or organization receives the data needed for that booking. From that point the trainer or organization is an independent controller for how the data is used in their own business — for example participant lists, training notes, bookkeeping and their contact with you. That is not something we decide. For part of the processing Softsyde AB acts as a processor on behalf of the trainer or organization, handling data on their instructions — for example when we store their participant lists and deliver their messages to you. If you have questions about how a trainer or organization uses your data, contact them first. For questions about the platform you can reach us through the contact page — and if you are unsure who to ask, you are always welcome to contact us. Our full company name, registration number and postal address are listed on our contact page at https://fidova.se/contact, where you will also find current contact details. All processing described here is carried out by Softsyde AB.
Personal data we process
We process the following categories of personal data: • Account data: name, email address, phone number, password (stored as a secure hash, not in plain text), and language preference. • Profile data: for trainers, also a bio, experience, specialties, and profile image. If you are a trainer, your name and what you have filled in on your profile are shown on the public pages of the organization you train for. • Data about your dog: for example name, breed, age, and notes you enter yourself. • Booking and participation data: the courses, facilities and private lessons you book, attendance, and waitlist position. • Address for a home visit: if you book a private lesson at your home, we keep the address, the distance to the trainer and the travel fee on the booking. • Payment status: whether a booking has been marked as paid and confirmed. We do not handle card or bank details (see the payments section of the Terms of Service). • Communications: messages, group chats, reviews, feedback, and anything you send through the contact form. • Screenshots in bug reports: when you report a problem in the app you can attach an image of the screen. It is captured in your browser, you see it before sending and can remove it. We use it only to understand the problem and it is never public. If you close your account the image is deleted with it, while the bug report itself remains without any link to you, so an unfixed problem is not lost. The image is deleted 30 days after we close the report — we keep it that long in case the report has to be reopened. The bug report itself is deleted after 12 months, counted from when we closed it, or from when it arrived if nobody got to it. • Form drafts: when you fill in a form in several steps, such as the guide to becoming a trainer, we save what you have written as a draft while you fill it in, so you can continue later or on another device. Only you can see the draft. It is deleted when you send the form. Boxes where you agree to or declare something are never saved in the draft. • Training journal: notes and content you save about your training. • Technical information: IP address, device and browser information, logs, and error diagnostics needed for security and operation. • Visitor statistics: page views, where you came to the site from, country, device type and browser. The measurement is cookieless and is used to understand how the site is used — not to identify you. • Expression of interest: if you register interest in the test period before it opens, we keep the name, email, business name and message you supply on that form.
What you have to provide, and what happens if you do not
Most of what you fill in is optional. What is required is required by the contract with us or with the trainer – with one exception, last in the list, which is required by law. Here is the whole list: • Name and email address: needed for us to create an account for you. Without them, no account. • Details about your dog, at least name and breed: needed to book a course or a private lesson, because the trainer has to know which dog is coming. Without them you cannot book. • Address: needed only when you book a home visit, because the trainer has to know where to go. Without it you cannot book a home visit. • Phone number: optional. Give it and the trainer can reach you faster if something changes; leave it out and nothing happens. • Notes about the dog: entirely voluntary. The trainer reads them and uses them to adapt the training; write nothing and the trainer simply knows less. • If you are a trainer: company type, address and contact details are required in order to publish courses, because we have to be able to tell the customer who the seller is. A limited company, trading partnership or non-profit association also has to give its organisation number. A sole trader gives their personal identity number instead: it is their tax identification number, and it is the one item on this list we collect by law rather than by contract – we are a reporting platform operator to Skatteverket. See Reporting to Skatteverket below. The number you give for the reporting is never shown again after you save it, and it is not disclosed to anyone other than Skatteverket. When you become a trainer we do not ask for that number: a limited company, trading partnership or association gives its organisation number then, and we send it to Bolagsverket to fetch the company name and check that the number is registered (see Recipients below). Without what your company type requires, you cannot publish. One thing to keep in mind: the notes about the dog are free text that the trainer reads. Write anything that concerns the dog, but avoid information about your own health – we do not need it, and it does not belong there.
Purposes and legal basis
We process your data for the following purposes and on the following legal bases under the GDPR: • Providing the service — creating and managing your account, bookings, and communication. Legal basis: performance of a contract. • Working out the distance and the travel fee when you want to book a home visit. Legal basis: performance of a contract, because you ask for it before booking. • Sending necessary messages and notifications about your bookings and account. Legal basis: performance of a contract and legitimate interest. • Security, preventing misuse and fraud, and troubleshooting. Legal basis: legitimate interest. • Developing and improving the platform. Legal basis: legitimate interest. • Compiling aggregated statistics about how the platform and the marketplace are used, and publishing them where they cannot be traced back to an individual person or business. Legal basis: legitimate interest. • Measuring how the site is used, with cookieless visitor statistics, to see what works and what needs improving. Legal basis: legitimate interest. • Meeting legal obligations, such as accounting requirements where they apply. Legal basis: legal obligation. If we ever process data for purposes that require your consent, we will ask for it separately, and you can withdraw it at any time.
Reporting to Skatteverket
If you sell courses or premises through the platform, Fidova is a reporting platform operator under the Swedish Act (2022:1681). We then report annually to Skatteverket the consideration you received and the details identifying you as a seller: name, address, tax identification number and, for a sole proprietorship, date of birth. The legal basis is a legal obligation. The details are collected when you make your business public and cannot be opted out of while you sell through the platform. Skatteverket is the recipient. This applies to sellers only — buying a course does not make you reportable.
Signing in with Google or Facebook
You can choose to sign in with a Google or Facebook account instead of email and password. Both are optional — email and password work exactly as before, and you never have to use either of them to use Fidova. If you pick one you are sent there to sign in. Google, or Meta (which runs Facebook), then learns that you are signing in to Fidova, and processes the data under its own privacy policy — we have no control over that processing. We never see your password with them. When you come back we have received your email address, your name and your profile picture from the service you chose, and stored them on your account with us. It is the same information we would otherwise have asked you to type in. The legal basis is performance of a contract — we need it in order to give you an account. Both companies are established outside the EU/EEA: Google LLC and Meta Platforms, Inc., both in the US. We do not transfer any data to them — you are the one signing in with them, and they send the data back to us. Their own processing takes place under their respective privacy policies, and both are certified under the EU-U.S. Data Privacy Framework. You can switch to email and password at any time by requesting a new password, and you delete the data held by us by closing your account. Stopping using the sign-in does not remove anything at Google or Meta; you do that with them.
Transfers outside the EU/EEA
Your data is stored inside the EU/EEA. Four of our five sub-processors handle it entirely within the union: Supabase in Stockholm, Vercel in Stockholm, Sentry in Germany and Resend's sending infrastructure in Ireland. Two of the suppliers are companies established outside the EU/EEA, though – Supabase Pte. Ltd in Singapore and Resend (Plus Five Five, Inc.) in the US – and Cloudflare, which runs our DNS, is American. Where the data sits and where the company is based are two different questions: a company outside the union may need access for support and operations even when the data is stored in Stockholm. Those transfers are covered by the European Commission's standard contractual clauses. Resend is additionally certified under the EU-U.S. Data Privacy Framework. Google, which receives an address in the cases described under Recipients and processors, is Google LLC in the US and certified under the EU-U.S. Data Privacy Framework. We do not transfer your data outside the EU/EEA on our own initiative beyond what is set out in this section. If you would like a copy of the safeguards, get in touch and we will send them.
How long we keep your data
We keep your personal data for as long as you have an active account and for as long as it is needed for the purposes described above. When you close your account it is closed immediately: you are signed out and your profile disappears from the public pages. The data remains for 30 days, so you have time to change your mind and restore the account with the link we email you. After those 30 days the data is permanently anonymised and the account cannot be restored. Beyond that, the following is deleted automatically, every week: • Notifications – 12 months from when they were created. • Messages from the contact and reporting forms – 12 months from when we handled them, or from when they arrived if they were never handled. • Sent emails in our sending queue – 3 months; emails that could never be sent, 12 months. • The security log of changes in the service – 12 months. • Bug reports you send from the app – 12 months from when we closed the report, or from when it arrived if nobody got to it. • Screenshots in bug reports – 30 days after we closed the report. The image therefore goes before the report it belongs to. • The street address for a home visit – 30 days after the lesson. The postcode and town stay on the booking, because they explain the travel fee. • Drafts of forms you never sent – 90 days from when you last changed them. If you sell through the platform there is one more exception: the Swedish Act (2022:1681) requires us to keep the documentation of the checks we made on your seller details for at least seven years after the end of the year it covers. What is kept is the log of the measures – what we checked, when, and what the check returned – not the tax identification number itself. That number lives with your account and goes with it. Bookkeeping is an exception, and it is worth saying whose: you buy the course from the trainer, so it is the trainer who under the Swedish Bookkeeping Act (1999:1078) ch. 7 s. 2 must keep their accounting records for seven years after the end of the calendar year in which the financial year ended. Fidova receives no payment and keeps no accounts for your booking – we only record whether it has been marked as paid, and that record follows the booking and is deleted with the account.
Your rights
Under the GDPR you have the right to: • access the data we process about you, • have inaccurate data corrected, • have data erased, • request restriction of processing, • object to processing based on legitimate interest, • receive and move data you have provided (data portability), and • withdraw consent where processing is based on consent. To exercise your rights, contact us via the contact page. We handle your request as soon as we can. During the test period, some requests are handled manually.
Contact and complaints
If you have questions about this policy or want to exercise your rights, reach us via the contact page at https://fidova.se/en/contact. If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), the supervisory authority in Sweden, https://imy.se.