Your privacy matters to us. We make every effort to protect the personal data you provide to us and to ensure that all processing of personal data complies with the Act no. 90/2018 on Data Protection and the Processing of Personal Data (hereinafter referred to as the “Data Protection Act”).

 

We encourage you to read our Privacy Policy carefully, as it explains how Villimey slf., ID No. 550906-0820, Leiruvegur 2, 162 Reykjavík ICELAND (hereinafter also referred to as the “Company” or “we”), as data controller, collects and processes personal data.

 

This Privacy Policy applies to the our customers and, as applicable, to other individuals, such as those who communicate with Villimey and those who visit our premises, websites or other online sites operated by us, including our social media pages (keep in mind the social media sites have their own Privacy Policy). This Privacy Policy also applies to contacts of our customers, suppliers, contractors and other legal entities with whom we communicate or have contractual relationships with, as well as employees and job applicants of Villimey. Hereinafter, all such individuals are also collectively referred to as “you”.

 

Processing of personal data refers to any operation or set of operations which is performed on personal data. Examples of processing include collection, recording, storage, modification, disclosure, use, consultation and more. Articles 2, 3 and 4 of the Data Protection Act further defines the concept. This Privacy Policy primarily addresses our processing of personal data in the following circumstances:

• when individuals visit our website, www.villimey.is, or our social media pages;
• when individuals contact us, whether by mail, email, social media or other means;
• when individuals enter areas in or around our premises that are monitored by security cameras;
• when individuals apply for employment with us and/or individuals that are employed by us.

 

What personal data may we collect about you?

The types of personal data we may collect about you depend on the services we provide to you. We emphasize that we only process personal data that are necessary, in accordance with the purpose of the collection and the provisions of the Data Protection Act.

 

Different types of personal data may be collected depending on the circumstances and the nature of your relationship with Villimey. Please note that if you choose not to provide personal data, that is necessary for the performance of a contract or that we are legally required to process, we may not be able to provide you with the requested product or service.

 

As applicable, Villimey primarily processes the following personal data

• Identification and contact details, such as name, address, email address and telephone number. We may also process photographs of you, if you choose to submit images those images.
• Payment information, such as credit card numbers or bank account details.
• Information on purchases and/or services, such as transaction dates, purchased items, selected delivery methods and shipment tracking numbers.
• Communication history, such as information from communications you choose to have with the Company via mail, email, social media messages or other channels.
• Sensitive personal data, such as health-related information, but only if you choose to share such information with us firsthand. We do not request this. 
• Video recordings from security cameras monitoring areas in and around our premises.
• Information on individuals’ relationships with legal entities that have a business relationship with the Company, such as job title, workplace, work email address, and communications related to that business relationship.
• Technical data, such as IP addresses of visitors to the Company’s website and other digital identifiers related to the use and functionality of our website.

 

In addition to the above, Villimey processes the following personal data relating to employees and job applicants:

• Job application information, such as experience, education and references.
• Employment contract information, such as duration of employment, rights and obligations, job title and terms of employment.
• Payroll and tax-related information, such as bank account details, salary information, pension fund membership and contributions, and trade union membership.
• Attendance and absence information, such as sickness absence or vacation
• Information generated during employment, such as communications with customers or information relating to workplace accidents.
• Sensitive personal data, where applicable, such as trade union membership or health-related information in connection with sick leave.

 

For what purposes do we process your personal data?

All processing of personal data by Villimey is carried out for specific purposes and is based on lawful grounds under the Data Protection Act and other applicable laws, such as the Act no. 145/1994 on accounting.

 

We process personal data primarily for the following purposes:

• to operate our website and improve the user experience;
• to provide you with the services you request, including processing and fulfilling orders, providing order or delivery status updates, and related services;
• to respond to inquiries, requests and feedback submitted by you via email, orally or through social media;
• to send you information via email about offers, discounts and other newsletter-related content, provided you have consented to receive such communications;
• to send you personalized information, such as reminders regarding items stored in your shopping cart;
• to improve our products and services or inform you of changes to our services and terms;
• to fulfill contractual obligations regarding the provision of products or services;
• to comply with obligations under accounting laws and other applicable legislation;
• to manage recruitment and/or your employment relationship with the Company;
• to ensure safety and protection of property in and around our premises;
• to comply with legal requirements.

Legal basis for processing personal data

Villimey is responsible for ensuring that a lawful basis exists for the processing of personal data. Below is an overview of the legal bases applicable to our processing activities:

 

When you visit our website

When you visit our website, www.villimey.is, we collect technical data such as IP address, browser type or version, visit duration, and visited subpages. This processing is based on Article 9.1 and 9.6 of the Data Protection Act. We may also process data related to other website activities for statistical analysis and website improvement. Further details are provided in the Cookies section.

 

When you purchase a product or service

When you purchase a product or service from us, we process contact information, order details, payment information and related data based on contractual necessity. This processing is authorized under Article 9.2 of the Data Protection Act.

 

When you contact us with an inquiry or request

When you contact us via email or social media, we process the contact details you provide and the information included in your message. This processing is based on your consent and our legitimate interests in providing good customer service, pursuant to Article 9.1 and 9.6 of the Data Protection Act.

 

When you subscribe to our mailing list

If you subscribe to our mailing list, we process your contact details to send newsletters, marketing materials and other information of interest. This processing is based on your consent under Article 9.1 of the Data Protection Act.

 

You may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal. You can unsubscribe via the link in our emails or by contacting us at [email protected].

 

Business relationships

Where individuals provide services in their own name, processing is based on contractual necessity under Article 9.2. Where individuals act on behalf of a company, processing is based on our legitimate interests under Article 9.6.

 

Job applicants and employees

Processing of personal data relating to job applicants and employees is based on contractual necessity or pre-contractual measures under Article 9.2.

 

CCTV monitoring

Our premises are monitored by security cameras for safety and property protection purposes. Processing is based on legitimate interests under Article 9.6. Further details are provided below.

 

Health-related data

In exceptional cases, we process sensitive personal data relating to health based solely on your explicit consent and at your initiative, pursuant to Articles 9.1 and 11.1 of the Data Protection Act.

 

Legal obligations

Processing may also be required to comply with legal obligations, such as accounting requirements, under Article 9.3.

 

Marketing and other legitimate interests

Certain processing activities are based on our legitimate interests, provided such interests outweigh your privacy rights. Where required, a legitimate interest assessment is conducted.

 

Cookies

Villimey may process personal data through the use of cookies in connection with visits to our website. Cookies are small text files placed on a user’s computer or smart device. We use cookies, among other things, to optimize the functionality of our website, analyze performance and provide you with a personalized experience. Some cookies are necessary for the website to function properly and cannot be disabled.

 

Information collected through cookies may include visits to the website, time and date of visits, search terms, referring websites, browser type and operating system. In general, such statistical information is not personally identifiable.

 

Examples of cookies we use include:

• Strictly necessary cookies: enable you to navigate the website and use its features, such as accessing secure areas. The website cannot function properly without these cookies and they are therefore not optional.
• Functional cookies: allow the website to provide enhanced functionality and personalization, such as remembering your preferences (e.g. language). These may be set by us or by third-party providers whose services we have added to our website. If you do not allow these cookies, some or all of these services may not function properly.
• Analytics cookies: allow us to monitor and improve the performance of our website, such as analyzing usage, counting visits, identifying popular sections and areas for improvement.
• Marketing cookies: enable us to process personal data from cookies for marketing purposes of the Company and third parties, such as Google and Facebook.

You can always manage your cookie preferences on our website by accepting or rejecting all cookies except strictly necessary cookies. You can also block cookies by adjusting your browser settings. Further information on our use of cookies can be found in our Cookie Policy.

 

Data retention

Villimey retains personal data for as long as necessary for the purposes of processing, in accordance with applicable laws or legitimate business interests.

 

For example, accounting records are retained for seven years pursuant to Act No. 145/1994, while CCTV footage is deleted after a maximum of 30 days.

 

Sources of personal data

We primarily collect personal data directly from you. Personal data may also be collected indirectly, such as through cookies when you visit our website, or from third parties where permitted by law.

 

Disclosure of personal data to third parties

Villimey may disclose personal data to third parties where necessary to provide services or where required by law. Such recipients may include, for example, employees, service providers, payment processors, banks and debt collection agencies

 

Third parties only process personal data on our behalf and for specified purposes. Personal data is not transferred outside the EEA unless permitted by applicable data protection law.

 

Personal data may also be disclosed to authorities or legal advisors where required to protect legal rights or comply with legal obligations.

 

CCTV monitoring

Our premises are monitored by security cameras for safety- and property protection. Footage is only accessed in the event of incidents such as theft, vandalism or accidents and is generally disclosed only to law enforcement authorities where applicable. Recordings are automatically deleted after a maximum of 30 days unless retention is required because of events described here before.

 

Data security and breach notification

We implement appropriate technical and organizational security measures to protect personal data, including access controls and staff training. Despite these measures, the internet is never entirely secure.

 

In the event of a personal data breach likely to result in high risk to your rights and freedoms, we will notify you and the Icelandic Data Protection Authority without undue delay and no later than 72 hours after becoming aware of the breach.

 

Automated decision-making

Villimey does not engage in automated decision-making or profiling.

 

Your rights

Subject to applicable legal conditions, you have the right to:

• access information about your personal data and how they are processed;
• obtain copies of your personal data and request transfer to third parties where applicable;
• request correction or deletion of inaccurate data, subject to legal retention obligations;
• object to or restrict processing;
• withdraw consent where processing is based on consent;
• lodge a complaint with the Icelandic Data Protection Authority.

 

Requests may be submitted in writing to [email protected]. We will generally respond as soon as possible, at the latest within one month.

 

Regarding possible discrepancys

Please note that the original version of this Privacy Policy is in Icelandic. In the event of any discrepancy or inconsistency between the English version and the Icelandic version, the Icelandic version shall prevail.

 

Updates

Villimey reserves the right to review and update this Privacy Policy as necessary. Last updated: April 1st 2026.