Íslandspóstur ohf. (here after referenced as the ”company”, ”Pósturinn” or ”our” ) sets high standards when it comes to ensure
dependability, confidentiality and safety of personal informaiton that is being processed within the company. This Privacy Policy
includes personal informaiton of individuals that do business with the company,
take courses, contractors, contacts that act on behalf of legal entities in business with the company or consumers that
contact with the company, contacts of the company’s suppliers as well as other contacts (hereafter collectively referred to as “your”)
This privacy policy is intended to inform you about what personal information the company collects, including
how the company uses such personal information and who gets access to the information.
If you are unsure how this policy applies to you, please contact your IT manager
for further information. Contact information for the IT Manager is provided at the end of the policy.
- Purpose and legal obligation
Pósturinn strives to comply with all aspects of personal protection legislation, and this policy is based on Act no. 90/2018
um persónuvernd og meðferð persónuupplýsinga („persónuverndarlög“), með síðari breytingum. - What is personal information?
Personal information in the sense of this policy is any information about a personally identifiable or
an identifiable individual, i.e. information that can be traced directly or indirectly to a specific
individual Data that is not personally identifiable is not considered personal data. - Personal information that Pósturinn processes about customers
We collect and store a variety of personal information about our customers. Different personal data
may be collected about you depending on whether you are doing business with the company yourself or whether you act for
on behalf of a legal entity in business with the company.
The following are examples of information that Pósturinn processes about individuals in business with the company:
- contact information, such as name, phone number and email address;
- Social Security Number;
- Credit score;
- Communication information;
- account information;
- contracts and;
- informaiton due to collection of debt.
The following are examples of information that Pósturinn processes about individuals acting on behalf of legal entities
in business with the company: - contact information, such as name, phone number and email address;
- email address for service survey;
- communication history;
- surety bond information; and
- information on the creditworthiness of the power of attorney holder.
In addition to the above information, Pósturinn may also collect and process other information as customers
or the customer’s representatives/contacts provide the company themselves as well as information that belongs to the company
necessary for its operation. The information is primarily processed to be able to fulfill contracts
the company’s customers, but also on the basis of our legitimate interests in ensuring that customers
the company receives good service, e.g. by investigating complaints and conducting service surveys.
As a general rule, Pósturinn collects personal information directly from the customer or his contact person. Information
however, may also come from third parties, e.g. Credit Info in cases where a person requests it
to be in credit businiess with the company. If personal information is obtained from a third party in other cases,
the company strives to inform its customers about this.
Information about customers and customer representatives/contacts is stored for 4 years from the end of the transaction.
In the case of information that falls under the accounting law, it is preserved for 7 years from the end of the relevant period
fiscal year. Information from customer complaints may need to be kept longer, for example if
the complaint indicates that health damage has occurred.
- Personal information that Pósturinn processes about those who attend courses
When registering for a course, we request information from you about your name and contact information for that purpose
to manage registration.
The information is processed on the one hand based on your contract with Pósturinn regarding participation in a course, but
however, on the basis of consent.
Name and contact details are not stored for longer than 4 years from the date of the course
place Email addresses are kept on a mailing list until consent is withdrawn. You are always allowed to withdraw
your consent. - Personal information processed by Pósturinn regarding supplier contacts
The processing of personal information about supplier contacts may be necessary to fulfill the company’s contract
the relevant supplier, but the company also has a legitimate interest in such processing for the purpose of simplification
communication and improving cooperation with suppliers. The information in question is the following:
- contact information, such as name, phone number and email address;
- job title; and
- information from communications.
In addition to the above information, Pósturinn may also collect and process other information provided by contacts
to the company themselves. The information mainly comes directly from the contact, but it can also come
from the supplier itself.
Contact information is deleted or changed when the company becomes aware of changes
contact information. The above information is not kept longer than 4 years from the end of the contract
between the company and suppliers, unless it is information that falls under the scope of accounting and customs laws.
- Personal information that Pósturinn processes about contractors
We collect personal information about contractors who work for the company, but the information may be processed
depending on the nature of the tasks that the person carries out for the company.
The following are examples of information that Pósturinn may collect about you as a contractor, so that the company can
fulfilled their obligations based on the contractor agreement:
- contact information, such as name, social security number, email address and phone number;
- information about education, training and experience; and
- account information.
In addition to the above information, Pósturinn may also collect and process other information provided by contractors
to the company themselves as well as information that is necessary for the company due to its activities, such as information from
security systems in Ölgerðirn’s premises.
If you work for the company as an influencer, the company also processes personal data
your social media and performs post-campaign performance evaluations based on legitimate interests
of the company.
The information generally comes directly from you, but it may also come from third parties, such as from
consulting firms that analyze the effectiveness of social media campaigns. The company may also communicate
personal information to similar consulting companies for the purpose of analyzing the success of cooperation.
Information about the contractor is not kept longer than 4 years from the end of the project, unless it is
information that falls under the accounting law and information is then preserved for 7 years from the end of the person concerned
fiscal year. If the company chooses to keep information longer about the contractors who have worked for the company
requested consent for that retention.
- Personal information that Pósturinn processes about consumers
Pósturinn receives various inquiries and suggestions from consumers, for example by e-mail and via Facebook
the company’s page, which contains personal information. If you send a suggestion or complaint to the company, we know
to have a legitimate interest in retaining your contact information, such as name, telephone number and email address to
to follow up on your mission and, as the case may be, repair damage or defects in the product.
Information received by the company from consumers is not kept by the company for longer than 4 years from
the message is received, unless the message indicates that health damage has occurred, in which case there is reason for longer retention. - Personal information that Pósturinn processes about other contacts
In its activities, the company also collects contact information from various contacts, such as at those institutions and
authorities with whom the company is in regular contact. Is it done on the basis of the company’s legitimate interests
by simplifying communication, but the information is updated and deleted as needed at any given time. - Digital monitoring in the premises of Ölgerðir
For security and asset protection purposes and on the basis of Ölgerðir’s legitimate interests, it is used
camera surveillance in the company’s premises. Attention is drawn to the use of specially designed security cameras
signals.
If you, for example, as a contractor, have access to access-controlled spaces in the company’s premises, you know information about trips
your data about the premises also to be collected, for security and asset protection purposes.
Information collected through electronic monitoring is not retained for more than 90 days. - Disclosure to third parties
Pósturinn may share your personal information with third parties in connection with their contractual relationship with
the company. For example, information about you may be shared with consulting companies for service surveys, to
debt collectors for debt collection and to carriers for product distribution.
Your personal information may also be provided to third parties to the extent permitted or
is required on the basis of relevant laws or regulations, such as to the Commissioner of Customs and the Icelandic Tax Administration due to their supervisory role
of them with alcohol production and import.
Personal information may also be shared with third parties who provide us with IT services and others
services that are related to processing and are part of the company’s operations. These parties may be located outside of Iceland.
However, Pósturinn will not share personal information outside the European Economic Area unless this is permitted
on the basis of relevant privacy legislation, such as on the basis of standard contract terms, your consent or
Ads by the Personal Protection Agency about states that provide adequate protection for personal data.
Finally, personal information about you may be disclosed to the extent permitted or required
on the basis of applicable laws or regulations or in response to legal actions such as searches, subpoenas
or court order. - How is the security of personal information guaranteed?
Pósturinn strives to take appropriate technical and organizational measures to protect personal data
with particular regard to their nature. These measures are intended to protect personal information from
they are lost or changed accidentally and against their unauthorized access, copying, use or sharing. Example of
The security measures taken by Pósturinn are access controls in the company’s systems. - Changes and corrections of personal information
It is important that the personal information that Pósturinn works with is both correct and relevant. That’s why
it is important that the company is notified of any changes that may occur to your personal information.
You have the right to have inaccurate personal data about you corrected. Taking into account the purpose of processing
personal information, you also have the right to have incomplete personal information about you completed, including
to provide more information.
Please direct all updates to the IT Manager. - Your rights in relation to the personal data processed by the Company
You have the right to be confirmed whether or not we process personal data about you, and if so you can request
depending on access to the information and how the processing is handled. Then it may also be that you have the right to receive
a copy of the information. In certain circumstances, you can request from the company that we send information,
which you yourself have provided to us or originate from you, directly to a third party.
In certain circumstances, you can request that personal information about you be deleted without delay, for example
when the retention of the information is no longer necessary based on the purpose of the processing or because
you have withdrawn your consent to the processing of personal data and there is no other authorization
fundamental to it.
Do you not want to have your information deleted, for example because you need it to defend against a claim, but
if you still want them not to be further processed by the company, you can request that they be processed
will be limited.
If the processing of your personal data is based on the company’s legitimate interests, you also have the right to
object to that processing.
However, your aforementioned rights are not without priority. Thus, the law may oblige the company to reject a request
deletion or access to data. The company can then reject your request due to the company’s rights, such as on the basis of
intellectual property rights, or the rights of other parties, such as privacy, if the company considers those rights to be more important.
If circumstances arise where the Company cannot comply with your request, the Company will endeavor to explain
why the request has been refused, albeit with regard to restrictions based on legal obligations. - Inquiries and complaints to Personal Protection
If you want to use the rights described in 13. art. in this policy, or if you have any questions
regarding this privacy policy or the way the company processes your personal information,
please contact the IT manager.
If you are dissatisfied with the company’s processing of personal information, you can send a message to Personal Protection
(www.personuvernd.is). - Contact information
We have appointed an IT manager to oversee the implementation of this privacy policy.
Below you can find his contact information:
[personuvernd@posturinn.is]
Contact information about the company:
Íslandspóstur
Höfðabakki 9D
110 Reykjavík - Revision
Pósturinn can change this privacy policy from time to time in accordance with changes in
relevant laws or regulations or due to changes in the way the company processes personal data.
Any changes that may be made to the policy will take effect after the updated version has been posted
the company’s website.
This privacy policy was published on 15.05.2018.