Privacy Policy
Guðmundsson & Co. — effective 13.08.2026
Guðmundsson & Co. ("we", "us") is the data controller responsible for the personal data collected through
Gudmundssonco.is. We are registered in Iceland under kennitala 5901262330, with
registered address at [Kórsalir 1]. As Iceland is part of the European Economic Area, your personal data is
processed in accordance with the General Data Protection Regulation (GDPR) as implemented under
Icelandic law (Lög um persónuvernd og vinnslu persónuupplýsinga nr. 90/2018).
For any questions about this policy or your data, contact us at Gudmundssonco@gmail.com.

1. What Personal Data We Collect
● Order and account data: name, delivery and billing address, email, phone number, and order history, collected when you place an order.
● Payment data: processed directly by Shopify Payments; we do not store full card numbers on our own systems.
● Marketing data: your email address and engagement history if you subscribe to our newsletter or marketing communications.
● Technical data: IP address, browser type, device information, and browsing behaviour on the Site, collected via cookies and analytics tools (see Section 5).
● Communications: any information you provide when contacting us directly, e.g. via email or Instagram.
2. Why We Use Your Data (Legal Basis)
● To process and fulfil your order, provide customer service, and handle returns — necessary to perform our contract with you.
● To send you marketing communications (newsletter, product launches) — based on your consent, which you may withdraw at any time.
● To operate, secure, and improve the Site, and to understand how it is used — based on our legitimate interest, balanced against your rights, or on your cookie consent where required.
● To comply with legal obligations, such as accounting and tax record-keeping requirements under Icelandic law.

3. Who We Share Your Data With 

We share personal data with the following categories of service providers, who process it on our behalf under data processing agreements:
● Shopify Inc. — our e-commerce platform, order management, and hosting provider.
● Shopify Payments — our payment processor.
● Our email marketing provider, for sending newsletters and campaign communications to subscribed customers.
● Shipping and courier partners, to deliver your order.
We do not sell your personal data to third parties. Where a service provider is located outside the European Economic Area, we ensure an appropriate safeguard is in place, such as the European Commission's Standard Contractual Clauses.

4. How Long We Keep Your Data
We retain order and transaction data for as long as required under Icelandic accounting law (currently 7 years). Marketing data is retained until you unsubscribe or withdraw consent. Technical/cookie data is retained according to the retention periods set out in Section 5.
5. Cookies and Similar Technologies
The Site uses cookies and similar technologies for: (a) essential functions such as your shopping cart and checkout; (b) analytics, to understand how visitors use the Site; and (c) marketing, including retargeting on platforms such as Instagram and TikTok. Non-essential cookies are only set with your consent, which you can give or withdraw at any time via the cookie banner or your browser settings.
6. Marketing Communications
If you sign up to receive marketing emails, we rely on your consent to send them. Every marketing email includes an unsubscribe link, and you may withdraw consent at any time by clicking it or contacting us at Gudmundsson@gmail.com. Withdrawing consent will not affect communications necessary to service an existing order.
7. Your Rights
Under the GDPR, you have the right to:
● Access the personal data we hold about you.
● Request correction of inaccurate data.
● Request deletion of your data, subject to legal retention requirements.
● Restrict or object to certain processing.
● Receive your data in a portable format.
● Withdraw consent at any time, without affecting processing carried out before withdrawal.
● Lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd,
www.personuvernd.is), or your local supervisory authority.
To exercise any of these rights, contact us at [Gudmundssonco@gmail.com].
8. Data Security
We use appropriate technical and organisational measures to protect your data, and rely on Shopify's infrastructure for secure hosting and payment processing. No system is completely secure, and we cannot guarantee absolute security of data transmitted to the Site.
9. Children
The Site is not directed at individuals under the age of 18, and we do not knowingly collect personal data from children.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised effective date.