Privacy policy

HB heildverslun ehf. handles personal data responsibly and lawfully. This policy explains what we collect when you use this website or are in contact or do business with us, why and on what legal basis, how long we keep it and what rights you have. It is based on the Icelandic Data Protection Act No. 90/2018, the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Article 88 of the Icelandic Electronic Communications Act No. 70/2022, which covers cookies.

Controller

HB heildverslun ehf., Smáratorg 3, 201 Kópavogur, Iceland, is the controller of the processing described here. Send questions and requests about your data to [email protected] or by post to the address above.

What we collect and why

Inquiries and correspondence

When you send an inquiry on the website, email us or call, we record your name, company, email address, phone number, message and the brands you are interested in, along with your language and the page you sent the inquiry from. We use this to answer you, send prices and details of the range, and start doing business if there is interest.

This is based on our legitimate interest in answering inquiries and serving shops and businesses (Article 6(1)(f) GDPR) and, where relevant, on steps taken at your request before entering into a contract (Article 6(1)(b)). We need your name and email address to reply; everything else is optional.

Customers

When a company does business with us, we process the names, job titles, email addresses and phone numbers of its contact people, along with order, delivery and invoice details. We do this to process orders, perform contracts and collect payment. This is based on our contract with the company and our legitimate interest in dealing with its contact people (Article 6(1)(b) and (f) GDPR), and on our legal obligation to keep accounting records (Article 6(1)(c)) under the Icelandic Bookkeeping Act No. 145/1994.

Where your visit came from

To see which marketing brings in inquiries, an inquiry includes how you reached the site: the landing page, the website that referred you, campaign tags (UTM) and ad click IDs (gclid, fbclid, msclkid or li_fat_id). Your browser keeps this during your visit and it only reaches us if you send an inquiry. If you have accepted analytics, your browser also remembers where you came from on your first visit. This is based on our legitimate interest in measuring our marketing (Article 6(1)(f)) and, for the first visit, on your consent (Article 6(1)(a)).

Security and abuse prevention

To keep out spam, we use your IP address to limit how many inquiries can be sent in a short time. It is held only in the server's memory for up to 10 minutes and is not stored with the inquiry. Our hosting provider may also log technical details such as IP addresses and times for security purposes. This is based on our legitimate interest in keeping the site secure (Article 6(1)(f)).

Analytics and advertising — only with your consent

If you agree, we use third-party tools to measure how the site is used and how our ads perform. The list of cookies at the bottom of this page shows which tools are currently active. Analytics (for example Google Analytics and Microsoft Clarity) shows which pages are viewed, how the site is used and how fast it loads. Marketing cookies (for example from Meta and LinkedIn) let us measure and tailor ads on their platforms.

If you have accepted marketing and send an inquiry, we also notify Meta directly from our server. Your email address, phone number and first name are sent in hashed form, together with your IP address and browser details, so Meta can match the inquiry to an ad you clicked. Meta never receives your message. If you have accepted analytics but your browser blocks Google Analytics, Google is told that an inquiry was sent, without your name or contact details.

This is based on your consent (Article 88 of Act No. 70/2022 and Article 6(1)(a) GDPR). You can withdraw it at any time with the cookie settings link at the bottom of the page. Withdrawal does not affect processing that took place before it.

We are joint controllers with Meta Platforms Ireland Ltd. and LinkedIn Ireland Unlimited Company for collecting data with their tools and passing it to them. We are responsible for obtaining consent and giving you this information; each company is responsible for its own further processing, and you can contact them directly about it. See the privacy policies of Google, Microsoft, Meta and LinkedIn.

Cookies

Cookies are small text files that websites store in your browser. This site also uses similar browser storage (session storage and local storage). Necessary storage is always on; analytics and marketing only if you agree. Rejecting is as easy as accepting. Your choice is kept for six months, after which we ask again. The cookies this site currently uses are listed at the bottom of this page.

Who receives your data

We never sell personal data. The following may have access, each only as far as needed:

Processors working for us under data processing agreements: our hosting provider (servers in the EEA); Microsoft, which runs our email (Microsoft 365) and receives inquiry notifications; and the service provider that runs and maintains the website.
Analytics and advertising services (Google, Microsoft Clarity, Meta and LinkedIn), only with your consent and only those currently active.
Bookkeepers, auditors and carriers in connection with our business.
Public authorities where the law requires it.

Transfers outside the EEA

Some of our providers, such as Microsoft, Google, Meta and LinkedIn, are US companies or owned by one, so data may be transferred to the United States. These transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, which applies in Iceland under the EEA Agreement, or on the Commission's standard contractual clauses. Contact us for details of these safeguards or a copy of them.

How long we keep data

Inquiries that do not lead to business: up to 24 months after our last contact.
Customer data: for as long as we do business; accounting records for seven years from the end of the financial year, as the Bookkeeping Act requires.
Your cookie choice: six months.
Where your visit came from: cleared from your browser when you close the tab. First-visit details are deleted if you withdraw consent to analytics.
Analytics and advertising: for the durations in the list at the bottom of this page and under each provider's terms.

After deletion, data may remain in backups for up to 14 days before it is gone for good.

Your rights

You have the right to:

access the data we hold about you and get a copy,
have inaccurate or incomplete data corrected,
have your data erased,
have processing restricted,
receive data you gave us in a machine-readable format (data portability),
withdraw consent at any time.

Send your request to [email protected]. We reply without undue delay and normally within one month, free of charge. We may need to confirm your identity. These rights have limits; for example, we must keep accounting records even if you ask us to delete them.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

If you believe we process your data unlawfully, you can complain to the Icelandic Data Protection Authority, Persónuvernd.

Right to object

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. We will then stop unless we can show compelling legitimate grounds that override your interests, or the processing is needed for legal claims. If you object to direct marketing, we will always stop.

Security

We protect data with appropriate technical and organisational measures. Connections to the site are encrypted (HTTPS), only staff who need the data can access it, and backups are taken regularly.

Changes

We update this policy when our processing or the law changes. The date of the last update is shown at the top of the page.