Legal
Privacy notice
Last updated: October 2026
1. About this privacy notice
This Privacy Notice explains how Controlant hf. and its affiliated companies (collectively referred to as “Controlant”, “we”, “us” or “our”) collect, use, share and protect personal data in connection with our business activities.
It applies to personal data relating to visitors to our website, users of our products and services, customers and prospective customers, suppliers, business partners and other business contacts, as well as individuals applying for employment with us.
We process personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data.
2. Our role in the processing of your personal data
Controlant acts as a data controller when processing personal data for its own business purposes, including managing customer and business relationships, operating its website, marketing, recruitment and administering its services. The relevant Controlant group company is responsible for personal data processed for its own business purposes. Controlant hf. generally acts as the data controller for personal data processed in connection with this website.
When Controlant processes personal data on behalf of customers in connection with the provision of its services, Controlant generally acts as a data processor, and the relevant customer acts as the data controller. Such processing is governed by the applicable customer agreements and data processing arrangements.
Where Controlant acts as a processor, requests relating to personal data should generally be directed to the relevant customer.
3. Personal data we collect
We collect personal data that you provide directly to us, that is collected when you use our website or services, or that we receive from other sources, including your employer, business partners and service providers.
Depending on your relationship with Controlant, this may include:
- Contact and business information: Name, job title, employer, email address, telephone number and other professional contact details.
- Account and service information: Account credentials, user profiles, preferences, service usage information and communications relating to our products and services.
Website and technical information: IP address, device and browser information, website interactions and information collected through cookies and similar technologies, as further described in our Cookies and Tracking Notice.
- Communications and marketing information: Inquiries, correspondence, feedback, event participation, marketing preferences and interactions with our communications.
- Recruitment information: CVs, applications, qualifications, employment history, interview information, references and other information provided or obtained during recruitment.
We may also receive relevant personal data from third parties, including customers, business partners, recruitment agencies and publicly available professional sources, where permitted by applicable law.
4. How and why we use personal data
We process personal data for the following purposes, depending on your relationship with Controlant and the nature of our interactions:
| Purpose | Legal basis |
|---|---|
| Providing and managing our services, including user accounts, customer support, service communications and technical operations. | Performance of a contract, where the individual is a party to that contract, or our legitimate interests in providing and managing our services. |
| Managing business relationships, including communications with customers, suppliers, partners and other business contacts. | Our legitimate interests in conducting and managing our business, or performance of a contract, where applicable. |
| Operating, securing and improving our website, systems and services, including troubleshooting, analytics, research and development, and preventing unauthorized access. | Our legitimate interests in maintaining secure and effective operations, or consent where required. |
| Marketing and communications, including newsletters, events, promotional activities and relevant business communications. | Our legitimate interests in promoting our business, or consent where required, including for certain electronic marketing and tracking activities. |
| Recruitment, including evaluating applications, conducting interviews, assessing suitability and managing recruitment processes. | Our legitimate interests in recruiting personnel, taking steps prior to entering into an employment contract, or compliance with legal obligations, as applicable. |
| Compliance and protection of legal rights, including meeting legal and regulatory obligations, responding to lawful requests and establishing, exercising or defending legal claims. | Compliance with legal obligations or our legitimate interests in protecting our legal rights and business interests. |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Where we rely on legitimate interests, we consider those interests against your rights and freedoms in accordance with applicable data protection law.
5. Sharing personal data
We may share personal data with third parties where necessary for the purposes described in this Privacy Notice, including:
- Controlant group companies: To support our business operations, provide services and manage customer and business relationships.
- Service providers and business partners: Including providers of IT, cloud hosting, customer support, recruitment, marketing, professional advisory and other services supporting our operations.
- Customers and authorized users: Where necessary to provide our services, administer user accounts or support customer relationships, subject to applicable contractual arrangements.
- Authorities and other third parties: Where required by law or necessary to comply with legal obligations, protect our rights or respond to lawful requests.
- Business transactions: In connection with an actual or proposed merger, acquisition, financing, restructuring or sale of all or part of our business.
Where third parties process personal data on our behalf, we require appropriate contractual arrangements and safeguards in accordance with applicable data protection law.
6. International data transfers
Controlant operates internationally, and personal data may be transferred to or accessed by our affiliated companies and service providers outside the European Economic Area (EEA), including in the United States.
Where personal data is transferred to countries outside the EEA that have not been recognized as providing an adequate level of data protection, we use appropriate safeguards in accordance with applicable data protection law, including the European Commission's Standard Contractual Clauses, where applicable.
You may contact us using the details below for further information about the safeguards applicable to such transfers and how to obtain a copy of them.
7. Data security and retention
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration or disclosure, taking into account the nature of the data and the risks associated with its processing.
We retain personal data only for as long as necessary for the purposes described in this Privacy Notice, including to provide our services, manage business relationships, comply with legal and regulatory obligations, and establish, exercise or defend legal claims.
Retention periods depend on the nature of the personal data, the purposes for which it is processed and applicable legal or contractual requirements. Where Controlant processes personal data on behalf of customers, retention is governed by the applicable contractual arrangements and customer instructions.
For recruitment purposes, we retain applicant information for the duration of the recruitment process and for a limited period thereafter, where necessary for legitimate business purposes or to comply with legal obligations.
8. Your rights
Under applicable data protection law, you have certain rights regarding your personal data, including the right to request access, rectification, erasure, restriction of processing and data portability, and to object to processing, subject to applicable legal conditions. Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of earlier processing.
You also have the right to object at any time to the processing of your personal data for direct marketing purposes.
To exercise your rights, please contact us using the details below.
Where Controlant processes personal data on behalf of a customer, requests concerning such data should generally be directed to the relevant customer as the data controller.
You also have the right to lodge a complaint with a competent data protection supervisory authority, including the Icelandic Data Protection Authority (Persónuvernd).
9. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our practices, services or applicable legal requirements. The updated version will be published on our website with a revised "Last updated" date. Where required by law, we will provide additional notice of material changes.
10. Contact us
If you have questions about this Privacy Notice or how we process personal data, or wish to exercise your rights, please contact us at:
Controlant hf.
Smáratorg 3
201 Kópavogur
Iceland
Email: legal@controlant.com