Privacy Policy

1. General

This policy applies to personal data we process about visitors to our website and people who contact us. Its purpose is to inform you about what data we collect, for what purposes and on what legal bases, in accordance with our duty to provide information under Article 17 of the Icelandic Data Protection Act.

2. Data Controller

Vanda legal ehf. is the data controller responsible for the personal data described in this policy.

Reg. no. (kennitala): 430326-0660

Address: Mýrarási 10, 110 Reykjavík, Iceland

Email: dagny@vandalegal.is - Phone: +354 865 6364

3. Information We Collect

Information you provide. When you use our contact form or email us, we collect your name, email address and the content of your message.

Technical and usage data. When you visit the website, our analytics tools may collect information such as your approximate location, device and browser type, the pages you view and how you interact with the site. This data is only collected where you have consented to analytics cookies.

4. Purpose of Processing

We process personal data to respond to enquiries and provide legal services, to operate and improve the website, to understand how the site is used so we can develop it further, and to comply with our legal and professional obligations.

5. Legal Basis

We rely on the following legal bases under Article 9 of the Icelandic Data Protection Act: your consent within the meaning of Article 10 of the Act (for analytics and other non-essential cookies, which you can withdraw at any time); the performance of a contract or steps taken at your request before entering into a contract (when you contact us about our services); compliance with a legal obligation (for example bookkeeping and record-keeping); and our legitimate interests in operating, securing and improving the website.

6. Third-Party Sharing

We do not sell your personal data. We share it only with service providers who help us operate the website and our practice, and only to the extent necessary. These are:

Vercel Inc. - website hosting and performance analytics.

Google Ireland Ltd. - Google Analytics, for website usage statistics (only with your consent).

CookieHub ehf. - cookie consent management.

ActiveCampaign, LLC (Postmark) - delivery of contact-form emails.

Sanity AS - hosting of the website's content.

Some of these providers may process data outside Iceland and the EEA, in particular in the United States. Where that happens, we rely on appropriate safeguards under the provisions of data protection law governing transfers of personal data outside the EEA, such as the European Commission's adequacy decision under the EU-US Data Privacy Framework for certified organisations (e.g. Google LLC, Vercel Inc. and ActiveCampaign, LLC), or the European Commission's Standard Contractual Clauses. We may also disclose personal data where required by law or to establish, exercise or defend legal claims.

7. Cookies & Analytics

Our website uses cookies and similar technologies. Strictly necessary cookies are required for the site to function and are always active. Analytics cookies (Google Analytics and Vercel Analytics) help us understand how visitors use the site and are only set after you give consent through our cookie banner.

When you first visit, you can accept or decline non-essential cookies, and you can change or withdraw your choice at any time through the cookie settings. We use Google Consent Mode, which means analytics tags do not store cookies or identifiers until you have consented.

8. Retention Period

We keep personal data only for as long as necessary for the purposes described in this policy. Contact-form correspondence is retained for as long as needed to deal with your enquiry and any resulting client relationship, and thereafter as required by law (for example accounting records, which Icelandic law requires us to keep for seven years). Analytics data in Google Analytics is retained for a maximum of 14 months before being deleted or anonymised.

9. Your Rights

Under the Icelandic Data Protection Act you have the right, among others, to access the personal data we hold about you and to be informed about its processing (Article 17 of the Act), to have inaccurate data corrected and to request erasure or restriction of processing (Article 20 of the Act), to object to processing based on legitimate interests, to data portability, and to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at dagny@vandalegal.is.

10. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. Our service providers are bound by their own security and data-processing obligations.

11. Complaints

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd).

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available on this page, and the date above shows when it was last revised.