What we know about you, and why

This policy describes what personal data Íslandsvefir receives about you, why, who sees it and what rights you have under the EU General Data Protection Regulation (GDPR), Sweden’s Data Protection Act (dataskyddslagen, 2018:218) and Iceland’s Act No. 90/2018 on data protection. It describes what happens today, not what might happen later.

Who is responsible

Íslandsvefir is a brand of Gagnaver Datacenter AB, a company registered in Sweden. The company is the controller of the personal data described here: it decides why the data is processed and answers for that in law. The same company runs the hosting service Gagnaver.

Because the company is established in Sweden, the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), is the lead supervisory authority for this processing. The rules are the same as in Iceland, though: the EU General Data Protection Regulation (2016/679, GDPR) applies in Iceland through the EEA Agreement. You therefore have the same rights as if the company were Icelandic.

When you contact us

The project form on this site asks for your name, email address and a few words about the project. You can also give a phone number, a company, the services you are interested in, a budget range and a timeline. Those fields are optional.

Today the website stores none of this. When you send the form, your email app opens with the message ready, and it reaches us as an ordinary email once you send it. The same applies when you email or call us directly.

We use the information to reply to you, assess the project and make a proposal where relevant.

When you are a client

A project produces correspondence, proposals, contracts and invoices containing your name, email, phone number and company details. We need these to do the work and meet our bookkeeping obligations.

To do the work we may need access to your systems, such as a content management system, your domain, an accounting system like DK, Regla or Payday, or a payment gateway. We use that access only for the project and ask you to revoke it or change passwords when the work is done.

When we handle data on your website

Many sites we build or maintain hold personal data about your customers: online store orders, sign-ups, enquiries or bookings. Different rules apply to that data than to your own:

• You are the controller. You decide what data the site collects and why, and you are responsible for your site’s privacy policy.
• We are the processor. We handle the data only as far as the work requires — for example when testing an accounting integration or fixing a bug — and only on your instructions.
• We do not use the data for anything else, do not copy it to our systems unless the work requires it, and delete copies once they are no longer needed.

We sign a data processing agreement with you when the work involves this kind of processing.

If the site is hosted by Gagnaver, Gagnaver’s privacy policy and terms apply to the hosting — it is the same company.

When you browse this website

This website sets no cookies and runs no analytics. It does not load fonts, scripts or anything else from other companies. More on the cookies page.

The site is hosted by Gagnaver, the same company’s hosting service, on UpCloud servers in Stockholm, Sweden, inside the EEA. The server that delivers the pages records the usual technical details of each visit: IP address, time, which address was requested, the response code and which browser was used. This is used to run the site, find errors and defend against attacks. These logs are kept for 30 days and then deleted.

What allows us to process it

Data protection law requires a legal basis for each kind of processing. Ours are these:

• Contract: to prepare a proposal at your request, do the work and invoice you.
• Legitimate interests: to answer enquiries, prevent abuse and keep systems secure.
• Legal obligation: accounting records the law requires us to keep.

Who sees your data

Staff of Gagnaver Datacenter AB see it only when they need it to do the work. We use these services to run the business:

• Google Workspace (Google Ireland Limited, Ireland) for email. Google may process data outside the EEA. Such transfers rely on the European Commission’s standard contractual clauses or an applicable adequacy decision.
• Fortnox AB (Sweden) for accounting and invoicing.
• Gagnaver (the same company, Gagnaver Datacenter AB) hosts this website on servers from UpCloud (UpCloud Ltd, Finland) located in Stockholm, Sweden, inside the EEA.
• Cloudflare (Cloudflare, Inc., USA) may deliver this website through its network to make it faster and protect it from attacks. Traffic to the site then passes through Cloudflare, which processes IP addresses and request details for that purpose. Transfers to the USA rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

Service providers outside the company act only on our instructions.

We do not sell personal data and we do not hand it over for advertising. We hand data to authorities where the law obliges us to.

How long we keep it

We keep data for as long as it is needed for the purpose it was collected for, and no longer. Accounting records are kept for the period accounting law requires. The server’s access logs are kept for 30 days and then deleted. Enquiries that do not become projects are kept while the conversation is ongoing, and for a while afterwards so we can refer back to it.

Your rights

Under GDPR you have the right to:

• find out what data we hold about you and get a copy of it,
• have incorrect data corrected,
• have data deleted when we no longer need it,
• restrict processing while something is being looked into,
• object to processing based on legitimate interests,
• receive your data in a machine-readable form.

Contact us and tell us what you want to happen. We answer within the time GDPR allows, which is normally one month.

If you think we are handling your data badly, you can complain to Integritetsskyddsmyndigheten (imy.se), which supervises us. Under GDPR you can also complain to the data protection authority in the country where you live. In Iceland that is Persónuvernd (personuvernd.is).

Changes to this policy

If we change how we process personal data, we update this page and the date at the top.