Persónuverndarstefna

1. Who we are

This website (kilomarketing.is) is operated by Egilsstaðabón ehf (kt. 6105240280), trading as Kilo, with registered address at Smiðjusel 4, 700 Egilsstaðir, Iceland ("we", "us", "our"). We are the data controller for personal information collected through this website.

For privacy inquiries, contact: kiloauglysingastofa@gmail.com

2. What we collect

We collect personal information in the following ways:

Contact form submissions

• Name
• Email address
• Company name (optional)
• Message content you provide
• Interest area (which service you are asking about)

Automatically collected (cookies & trackers)

• IP address
• Browser type and version
• Pages visited and time on site
• Referring source (e.g. which ad or website sent you here)
• Device type

3. Why we use your data (legal basis under GDPR)

• To respond to inquiries — legitimate interest + performance of pre-contractual measures
• To measure website performance and optimize ads — consent (via cookie banner)
• To send follow-up emails about our services — legitimate interest (B2B context); you can opt out any time
• To comply with legal/accounting obligations — legal obligation under Icelandic law

4. Third-party services we use

We share limited personal data with the following processors:

• Netlify (hosting) — United States, GDPR-compliant via Standard Contractual Clauses
• Meta / Facebook (advertising pixel) — United States, tracks visits for ad optimization. You can disable via our cookie banner.
• Google Workspace (email, documents) — European data centers where possible
• OpenAI / Anthropic (if your data is used for AI projects we do for you — covered by a separate Data Processing Agreement)

We do not sell your personal data to any third party.

5. How long we keep data

• Contact form submissions: up to 24 months after last contact, then deleted
• Client records (invoices, contracts): 7 years (Icelandic accounting law)
• Website analytics / cookies: up to 13 months from first visit

6. Your rights under GDPR

If you are in the EEA, UK or Iceland you have the right to:

• Access — ask what personal data we hold about you
• Rectification — correct wrong or outdated data
• Erasure — ask us to delete your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, where consent is the legal basis
• Complain — to the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is)

To exercise any right, email kiloauglysingastofa@gmail.com. We respond within 30 days.

7. Cookies

We use essential cookies (to make the site work) and marketing cookies (Meta Pixel, for ad optimization). You will see a cookie banner on your first visit — you can accept, reject or customize. You can change your preference any time by clearing your browser cookies and returning to the site.

8. International data transfers

Some processors (Netlify, Meta) are located in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission to protect your data during these transfers.

9. Security

We use TLS/SSL encryption for all data transmission. Access to personal data is restricted to authorized personnel who need it to perform their duties.

10. Children

Our services are for businesses and adults. We do not knowingly collect data from individuals under 16. If you believe we have, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified via a banner on the website. The "Last updated" date below reflects the current version.

Last updated: 23 April 2026