Privacy policy

Data controller

Iceland GeoSurvey (ÍSOR), reg. no. 600503-4050, Urðarhvarf 8, Entrance B, 4th floor, 203 Kópavogur, is the controller responsible for the processing of personal data described here. Data-protection enquiries can be sent to personuvernd@isor.is or by phone on +354 528 1500.

What personal data we collect

ÍSOR collects only the personal data necessary in each case. Depending on your interaction with us, this may include:

• Contact details you provide through web forms, e.g. name, email address, phone number and the content of your message.
• The email address you register to receive ÍSOR's newsletter.
• Technical information and usage statistics, e.g. browser type, which pages are visited and where visits come from. ÍSOR's analytics is cookieless and does not store IP addresses. Where an IP address is used for security purposes (to prevent abuse of web forms), it is stored only as a hashed value, never in its original form.
• Information from job applications and the CVs of applicants for positions.

Purpose and legal basis for processing

Personal data is processed only for clear and legitimate purposes: to respond to enquiries and provide services, to send the newsletter, to manage job applications, and to improve and ensure the functioning of the website. The legal basis is, as applicable, your consent (e.g. for the newsletter and optional cookies), that the processing is necessary for a contract or steps taken at your request, a legal obligation to which ÍSOR is subject, or ÍSOR's legitimate interests in operating and improving its activities.

Cookies

ÍSOR's website uses cookies to ensure the site functions properly and, with your consent, to analyse usage and gather statistical information. Necessary cookies are used without consent, while optional cookies (e.g. for analytics) are only enabled if you accept them in the consent banner. You can change or withdraw your consent at any time, and you can also control or delete cookies in your browser settings.

Sharing of personal data

ÍSOR does not sell personal data. Information is not shared with third parties unless necessary to provide a requested service, to fulfil a legal obligation, or with processors acting on ÍSOR's behalf. The main processors are Supabase (database and file storage), Vercel (website hosting), Resend (email delivery) and Google (maps, active only with your consent). Such processors act only on ÍSOR's instructions and under data-processing agreements. Where data is transferred outside the European Economic Area, e.g. to service providers in the United States, it is done on the basis of appropriate safeguards, such as the EU Standard Contractual Clauses (SCCs).

Retention period

Personal data is not retained longer than necessary for the purpose for which it was collected, unless law requires longer retention. Enquiries submitted through web forms are deleted once the matter has been handled and, as a rule, no later than 24 months after receipt. Newsletter subscriptions are kept until you unsubscribe; unsubscribed records are removed within 6 months. Website usage statistics, which contain no personal identifiers, are kept for at most 14 months.

Security of personal data

ÍSOR applies appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including encryption of communications and restricted staff access.

Your rights

Under data-protection law you have the following rights regarding the personal data ÍSOR processes about you:

• The right of access to information about what personal data is processed about you.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure (the right to be forgotten) where the conditions are met.
• The right to restrict processing and the right to object to processing.
• The right to data portability.
• The right to withdraw consent at any time, where processing is based on consent.

Data-protection officer

In accordance with European legislation on data protection and the processing of personal data, ÍSOR has a designated data-protection officer. ÍSOR's data-protection officer receives enquiries requesting information about the processing and collection of personal data and requests to exercise the rights listed above.

Comments and enquiries about the handling of personal data can be sent to personuvernd@isor.is.

Right to lodge a complaint

If you consider that ÍSOR's processing of your personal data breaches data-protection law, you have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd), www.personuvernd.is.

Changes to this privacy policy

This privacy policy may be updated from time to time to reflect changes in ÍSOR's activities or the legal environment. The latest version is always published on this page.