Privacy policy

Controller

Sumarsól ehf, Icelandic ID 421015-0740, Fjarðargata 17, 220 Hafnarfjörður, is the controller for processing described here. Privacy questions can be sent to stjornusol@solbadsstofa.is.

Information we process

When you send an inquiry or application, we process the details you enter, including name, email, phone, message and CV. Technical anti-abuse information and email delivery metadata may also be produced.

When you buy a gift card, we process your name and email, the recipient’s name and message if you enter them, the amount and order number, and the gift card’s usage history. Card details never reach us.

Purpose and legal basis

We use the information to answer inquiries and process applications at your request. Necessary administration and security measures may also rely on the legitimate interests of Sumarsól ehf.

Gift card purchase information is necessary to complete the purchase and accept the gift card, and is kept to meet legal bookkeeping obligations.

Service providers

Resend delivers email. Cloudflare hosts and protects the website, including the Turnstile anti-abuse service. They process information under agreements and the controller’s instructions.

Teya processes gift card payments, and Cloudflare stores gift cards and orders.

Transfers outside the EEA

Cloudflare and Resend are US companies, so information may be processed in the United States. These transfers rely on their certification under the EU-US Data Privacy Framework and on the European Commission’s standard contractual clauses.

Retention

Ordinary inquiries are kept for up to 12 months. Unsuccessful applications are kept for up to 6 months. Information about a successful applicant moves into the relevant recruitment and employment process.

Gift card information is kept while the gift card is valid and then for seven years, as required by Icelandic bookkeeping law. Unpaid orders are deleted after 12 months.

Your rights

Where applicable, you may request access, correction, deletion or restriction and object to processing. You may also complain to the Icelandic Data Protection Authority, Persónuvernd. Contact stjornusol@solbadsstofa.is to exercise your rights.