Privacy policy

Österby hár ehf

Last updated: May 2025

1. Introduction

Österby hár ehf ("we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our salon, shop on our website, or contact us.

This policy complies with the General Data Protection Regulation (GDPR) as applied in Iceland through the European Economic Area (EEA) Agreement, and the Icelandic Act on Data Protection and the Processing of Personal Data (Act No. 90/2018).

2. Who We Are

Data Controller: Österby hár ehf

Address: Austurvegur 33-35, Selfoss 806, Iceland

Email: juan@osterby.is

Website: österby.is

3. What Personal Data We Collect

3.1 When you shop online (Österby Shopify store)

When you place an order through our online store, we collect:

• Full name

• Shipping and billing address

• Email address

• Phone number

• Payment information (processed securely by our payment provider — we do not store card details)

3.2 When you visit our salon

If you make a purchase or enquiry at our physical location, we may collect:

• Name and contact information (if provided voluntarily)

• Transaction data via our POS system

3.3 When you contact us

If you reach out by email or through a contact form, we collect your name, email address, and the content of your message.

4. How We Use Your Personal Data

We use your personal data for the following purposes:

• To process and fulfil your online orders, including shipping and delivery

• To manage payments and prevent fraud

• To communicate with you about your order or enquiry

• To comply with our legal obligations

• To improve our products and services

5. Legal Basis for Processing

We process your personal data on the following legal grounds under GDPR Article 6:

• Contract performance: to process your orders and deliver your purchases.

• Legal obligation: to comply with Icelandic tax and consumer protection laws.

• Legitimate interests: to manage our business and improve our services.

6. Sharing Your Data

We do not sell your personal data. We may share it with trusted third parties only when necessary:

• Shipping and logistics providers (to deliver your orders)

• Payment processors (to handle transactions securely)

• Shopify Inc. (our e-commerce platform provider)

• Icelandic public authorities (when required by law)

All third parties are contractually required to handle your data in accordance with GDPR.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by Icelandic law. Order and transaction data is typically kept for 7 years in accordance with Icelandic accounting regulations.

8. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access: to request a copy of the data we hold about you.

• Right to rectification: to request correction of inaccurate data.

• Right to erasure: to request deletion of your data ("right to be forgotten").

• Right to restriction: to request that we limit how we process your data.

• Right to data portability: to receive your data in a structured, machine-readable format.

• Right to object: to object to processing based on legitimate interests.

To exercise any of these rights, please contact us at juan@osterby.is. We will respond within 30 days.

9. Cookies

Our website uses cookies to improve your browsing experience and analyse site traffic. By using our website, you consent to the use of cookies in accordance with our Cookie Policy. You may disable cookies through your browser settings at any time.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Our online store uses SSL encryption and all payments are processed through secure, certified payment gateways.

11. Complaints

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd):

Website: www.personuvernd.is

Email: postur@personuvernd.is

Phone: +354 510 9600

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated date. We encourage you to review this policy periodically.

13. Contact Us

For any questions or requests related to this Privacy Policy, please contact us:

Österby hár ehf

Austurvegur 33-35, Selfoss 800, Iceland

juan@osterby.is