This privacy policy explains how HFHeilsa ehf., reg. no. (kennitala) 621025-1390 (“we”) collects, uses and protects personal data in connection with this website and shop. We comply with Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data and the EU General Data Protection Regulation (GDPR).
Data controller
HFHeilsa ehf., reg. no. (kennitala) 621025-1390, Lágmúli 4., 108 Reykjavík is the controller of the personal data processed here.
Email: hfheilsa@gmail.com
The website and shop are run on technology provided by Opta ehf. (Birtast), which acts as a data processor on our behalf under a data processing agreement.
What we collect and why (legal basis)
- Orders and payments: name, email, phone, address, Icelandic ID number (where relevant) and order history. Legal basis: contract (Art. 6(1)(b) GDPR), to fulfil your purchase.
- Invoices and accounting: the purchase data invoices are based on. Legal basis: legal obligation (Art. 6(1)(c) GDPR), cf. the Icelandic Bookkeeping Act No. 145/1994.
- Customer account: email and login if you create an account. Legal basis: contract or legitimate interests.
- Newsletter: your email if you sign up. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
- Site analytics: non-identifying visit statistics (page, device type, referring site). We store neither IP addresses nor browser fingerprints for this purpose. Legal basis: legitimate interests in simple statistics.
- Optional analytics and marketing: Google Analytics, Meta Pixel and/or TikTok Pixel, only if you consent. Legal basis: consent.
Recipients and processors
We only share data with parties that are necessary to provide the service:
- Opta ehf. (Birtast): hosting and operation of the website and shop (processor).
- Kling: payment processing.
- Dropp and Pósturinn: parcel delivery, when you choose that delivery method.
- Payday: invoicing.
- Resend: sending emails (confirmations, newsletters).
- Supabase: data storage and authentication.
- Google (Analytics, Maps), Meta (Instagram, Pixel), TikTok: only when analytics or marketing has been accepted, or when you click an embedded map or post.
Transfers outside the EEA
Some service providers (e.g. Google, Meta, TikTok and Resend) may process data in the United States. Such transfers rely on appropriate safeguards, such as the EU Standard Contractual Clauses (SCC) and/or the EU-US Data Privacy Framework.
Retention
- Accounting records (orders and invoices): 7 years, as required by the Bookkeeping Act.
- Customer account: while the account is active.
- Newsletter: until you unsubscribe.
- Site analytics: at most 14 months.
Your rights
You have the right to access your data, have it corrected, have it erased, have processing restricted, receive your data in a portable format, object to processing based on legitimate interests, and withdraw consent at any time (this does not affect the lawfulness of earlier processing).
Contact us to exercise these rights.
Email: hfheilsa@gmail.com
You can also lodge a complaint with the Icelandic Data Protection Authority, Persónuvernd, Laugavegur 166, 105 Reykjavík, personuvernd.is, postur@personuvernd.is.
Cookies and local storage
Necessary (no consent needed): cart, customer login and language setting. These work regardless of your choice.
Optional analytics and marketing cookies (Google Analytics, Meta, TikTok) load only after you consent. You can change or withdraw your consent at any time with the Cookies link at the bottom of the page. Embedded maps (Google Maps) and social media posts load only when you click them.
Contact
Contact us about privacy or to exercise your rights.
Email: hfheilsa@gmail.com