1.   General

Olíudreifing ehf., ID No. 660695-2069, Hólmaslóð 8-10, 101 Reykjavík, (hereinafter referred to as “Olíudreifing” or the “Company”) cares about protecting personal privacy. Olíudreifing places great importance on handling all personal data in accordance with applicable law and rules at each time. This policy includes information on which personal data Olíudreifing collects on individuals in the course of its operations and the purposes of the data collection, as well as information about other data recipients and how long data is retained. Also included is information on the basis on which Olíudreifing collects personal data, the rights of individuals and other important information related to the Act no. 90/2018 on Data Protection and the Processing of Personal Data.

2. What is personal data and processing of personal data?

Personal data refers to all information that can be traced to a specific individual, such as information about the individual’s name, ID number, address, email address, phone number, finances, health, IP address and more. 

The processing of personal data refers to all processing and use of personal data such as collection, registration, storage, modification or deletion.

3.   Personal data collected by Olíudreifing

Olíudreifing collects different personal data about different groups of individuals depending on the company's activities. In any case, Olíudreifing seeks to collect only the personal data that is necessary for the purpose of the processing. In particular, Olíudreifing collects the following personal data about customers and their contacts:

3.1.  Email communications

The information that Olíudreifing collects when it comes to e-mail communication with customers, their contacts and others is the name, e-mail address and the communication itself.  

3.2.  Contracts

Olíudreifing retains contracts made in the course of its operations. The personal information that Olíudrefing collects in connection with concluded agreements is, in particular, the name, ID number, job title and other contact information. 

3.3.  Invoicing

The information handled by Olíudreifing in invoicing is contact information.Þær upplýsingar sem Olíudreifing vinnur með þegar kemur að reikningsgerð eru tengiliðaupplýsingar.

3.4.  Customer file

Olíudreifing maintains a register of current customers and collects basic information (name, ID number, e-mail address, telephone number) on the customers who are individuals, and information about the contacts of the customers who are legal entities.

3.5.  Management of goods and services sold

The information that Olíudreifing needs to collect in order to be able to keep track of sold products and services is, in particular, the customer name, payment information, what products or services were purchased and the sales amount.

3.6.  Security cameras

There are security cameras in all of the Company’s major facilities. Olíudreifing temporarily retains footage from security cameras, but the footage is generally destroyed after 90 days.

4.   Purpose of collecting personal data

Olíudreifing primarily collects personal data to:

- manage customer relations;

- manage contracts;

- perform contracts;

- keep track of business history and customer relations;

- manage sold products and outsourced services, and

- for security and asset protection purposes.

5.   Legal basis for processing of personal data

Olíudreifing collects and processes personal data on the following legal basis:

- To fulfil a contractual obligation.

- With the approval of the data subject.

- To fulfil a legal obligation.

• - To protect the legitimate interests of the Company.

6.   How long does Olíudreifing retain personal data?

Olíudreifing only retains personal data for as long as it is necessary for the Company. When personal data is no longer needed, the Company deletes it in a secure manner.

7.   From whom does Olíudreifing collect data?

In general, Olíudreifing collects personal data directly from the individuals themselves. If personal data is collected from third parties, Olíudreifing will do its utmost to inform the individual in question.

8.   When and why does Olíudreifing disclose personal data to third parties?

Olíudreifing discloses personal information to third parties recruited by the Company to carry out pre-determined work, such as service providers, agents or contractors. In those cases, the Company enters into a processing agreement with the party in question. Such an agreement stipulates, among other things, the party’s obligation to follow Olíudreifing's instructions on the processing of personal data and the ban on using the data for other purposes. The party is also obliged to ensure the security of the data in an appropriate manner. Oil distribution may in some cases require disclosing footage from the Company's security cameras to the police if required. The sharing of such information would be on the basis of a legal obligation.

9.   Transferring personal data outside the European Economic Area

The Company is aware that strict conditions apply to the transfer of personal data to countries outside the European Economic Area. The Company does not do so under any circumstances unless there is sufficient authorisation to do so according to Act no. 90/2018 on Data Protection and the Processing of Personal Data.

10. Your rights

If you have given your consent for the processing of certain personal data, you are entitled, according to Act no. 90/2018 on Data Protection and the Processing of Personal Data, to withdraw your consent at any time. However, this right does not affect the legality of the processing that took place before consent was withdrawn. You also enjoy other rights, such as the right to access your data, the right to have incorrect or misleading information corrected, the right to have your personal data deleted, the right to prevent the processing of your personal data and the right to transfer your data. You should keep in mind that your rights are not without exceptions and may be subject to various conditions.

11. Security of your personal data

Olíudreifing has made appropriate technical and organisational security measures to secure the safety of personal data according to Act no. 90/2018 on Data Protection and the Processing of Personal Data. This includes only providing access to personal data to employees that require the data to carry out their work duties. In addition, the Company provides employees with appropriate security education and training on a regular basis.

12.        Olíudreifing’s contact information

Name: Olíudreifing ehf.

Address: Hólmaslóð 8-10, 101 Reykjavík

Email: odr@odr.is

13. Further information and Privacy Representative

If you have further questions about your rights or how Olíudreifing handles personal data, you can always contact the Company's Privacy Representative, Dattaca Labs Iceland ehf. by sending an e-mail to  dpo@dattacalabs.com.  You can also contact Olíudreifingu by emailing odr@odr.is.

14.  The right to lodge a complaint with the Icelandic Data Protection Authority

If you doubt that Olíudreifing handles your personal data in accordance with Act no. 90/2018 on Data Protection and the Processing of Personal Data, you have the right to lodge a complaint with the Icelandic Data Protection Authority  ().

Agreed on: 13.05.2020

Published: 13.05.2020

Will be reviewed: before 1.6.2021