Privacy Policy

1. General

This policy applies to personal data we process about visitors to our website and people who contact us. By using this website or contacting us, you acknowledge the practices described here. If you do not agree with this policy, please do not use the website.

2. Data Controller

Vanda legal ehf. is the data controller responsible for the personal data described in this policy.

Reg. no. (kennitala): 430326-0660

Address: Mýrarási 10, 110 Reykjavík, Iceland

Email: dagny@vandalegal.is — Phone: +354 865 6364

3. Information We Collect

Information you provide. When you use our contact form or email us, we collect your name, email address and the content of your message.

Technical and usage data. When you visit the website, our analytics tools may collect information such as your approximate location, device and browser type, the pages you view and how you interact with the site. This data is only collected where you have consented to analytics cookies.

4. Purpose of Processing

We process personal data to respond to enquiries and provide legal services, to operate and improve the website, to understand how the site is used so we can develop it further, and to comply with our legal and professional obligations.

5. Legal Basis

We rely on the following legal bases under the GDPR: your consent (for analytics and other non-essential cookies, which you can withdraw at any time); the performance of a contract or steps taken at your request before entering into a contract (when you contact us about our services); compliance with a legal obligation (for example bookkeeping and record-keeping); and our legitimate interests in operating, securing and improving the website.

6. Third-Party Sharing

We do not sell your personal data. We share it only with service providers who help us operate the website and our practice, and only to the extent necessary. These include:

Vercel Inc. — website hosting and performance analytics.

Google Ireland Ltd. — Google Analytics, for website usage statistics (only with your consent).

CookieHub ehf. — cookie consent management.

ActiveCampaign, LLC (Postmark) — delivery of contact-form emails.

Sanity AS — hosting of the website's content.

Some of these providers may process data outside Iceland and the EEA. Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. We may also disclose personal data where required by law or to establish, exercise or defend legal claims.

7. Cookies & Analytics

Our website uses cookies and similar technologies. Strictly necessary cookies are required for the site to function and are always active. Analytics cookies (Google Analytics and Vercel Analytics) help us understand how visitors use the site and are only set after you give consent through our cookie banner.

When you first visit, you can accept or decline non-essential cookies, and you can change or withdraw your choice at any time through the cookie settings. We use Google Consent Mode, which means analytics tags do not store cookies or identifiers until you have consented.

8. Retention Period

We keep personal data only for as long as necessary for the purposes described in this policy. Contact-form correspondence is retained for as long as needed to deal with your enquiry and any resulting client relationship, and thereafter as required by law (for example accounting records, which Icelandic law requires us to keep for seven years). Analytics data is retained in line with the settings of the analytics tools we use.

9. Your Rights

Under the GDPR and Icelandic data protection law you have the right to access the personal data we hold about you, to have inaccurate data corrected, to request erasure or restriction of processing, to object to processing based on legitimate interests, to data portability, and to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at dagny@vandalegal.is. We will respond within the time limits set by law.

10. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. Our service providers are bound by their own security and data-processing obligations.

11. Complaints

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd), Rauðarárstígur 10, 105 Reykjavík — www.personuvernd.is. We would, however, appreciate the chance to address your concerns first.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available on this page, and the date above shows when it was last revised. Material changes will be made clear on the website.