Privacy Policy

Who we are

Verklagnir ehf., reg. no. (kt.) 460199-2479, Krókháls 5A, 3rd floor, 110 Reykjavik, Iceland, is the controller of the personal data described here. This policy covers the website www.verklagnir.is and related services. We process personal data in accordance with Act No. 90/2018 on Data Protection and the Processing of Personal Data and the EU General Data Protection Regulation (GDPR). Questions can be sent to info@verklagnir.is or by phone on +354 517 0270.

What data we collect and why

We collect only what we need. The legal basis for each activity is given in brackets.

• Enquiries and service requests: name, email, phone number, message and, for a service request, address, equipment details and attachments (images and documents). We use them to reply and provide service. (Necessary for your request or a contract, and our legitimate interest in answering enquiries.)
• Digital advisor: your answers about your property and heating system. They are stored in your browser and reach us only if you send an enquiry. The answers are analysed with artificial intelligence (OpenRouter and TypeSafe) to suggest a heat pump; name, email and phone number are not sent there, but free text you type into the advisor is. Please do not enter personal data in it. A specialist reviews the suggestions, and we take no decisions with legal effect on you based solely on automated processing. (Necessary for your request, and legitimate interests.)
• User account: name, email, password (stored in encrypted form), link to a company and sign-in data, including IP address. (Necessary for the contract for the account.)
• Events: name, email, phone number and company. Whoever registers a group may also enter details of other participants. (Necessary for registration, and legitimate interests.)
• Security: IP address and request counts, to guard against misuse and attacks. (Our legitimate interest in secure operation.)
• Analytics and marketing (Google Analytics and Meta Pixel): only with your consent. See our cookie policy at www.verklagnir.is/vafrakokur. (Consent, which you can withdraw at any time.)
• Sales and warranty matters: name, national ID number, address, invoices and warranty correspondence. (Necessary for a contract and legal obligation, e.g. the Accounting Act.)

If you do not provide information marked as required, we cannot answer your enquiry, create an account or register you for an event. Please do not send us sensitive data, such as health information.

Who we share data with

We do not sell personal data. We use service providers who handle data on our behalf under data processing agreements: Vercel (hosting), Neon (database), Microsoft (email), Bunny.net (delivery of images and files), Algolia (search), OpenRouter and TypeSafe (AI), Better Auth (sign-in and security) and, with your consent, Google and Meta. We share information with authorities where the law requires.

The Site is hosted by Vercel in data centres in Europe (Stockholm, Dublin, London and Frankfurt) and the database is with Neon in London. Some of our service providers are in the United States. We then ensure adequate protection, for example through the EU’s standard contractual clauses or a certification under the Data Privacy Framework.

How long we keep data

Enquiries are kept in our mailbox until we delete them, and you can ask at any time for your enquiry to be deleted. Attachments are deleted as soon as the email has been sent, and at the latest within 24 hours. A user account is kept while it exists, and you can delete it yourself under “My account”. Event registrations are kept until they are deleted, and you can cancel your registration or delete your account at any time. Accounting records are kept for 7 years as the law requires. When data is no longer needed we delete it or make it impossible to link to you.

Security

We use encrypted connections, encrypted password storage, access control and rate limiting to protect data. Attachments are held in private storage and deleted immediately after sending.

Your rights

You have the right to access data about you, have it corrected or erased, restrict processing, receive it in a portable form and object to processing based on our legitimate interests. You can withdraw consent at any time. Send a request to info@verklagnir.is. We respond without delay and at the latest within one month. We may need to verify your identity.

If you believe our processing breaches the law you can complain to Persónuvernd (the Icelandic Data Protection Authority), Rauðarárstígur 10, 105 Reykjavik, tel. +354 510 9600, postur@personuvernd.is, www.personuvernd.is. We encourage you to contact us first.

Children

The Site is not intended for children under 18.

Language

This Privacy Policy is drafted in Icelandic and translated into English. In the event of any inconsistency, conflict, or divergence between the English translation and the Icelandic version, the Icelandic version shall prevail and be binding.

Changes to this policy

We may update this policy. The latest version is always published here with the date of the last update.