Privacy policy

Last updated: 8 October 2026

Skilti og merkingar (Skilti og Merkingar & Tec ehf., reg. no. 450901-3260) operates this online shop and website (the "Service"). The online shop runs on Shopify technology.

This privacy policy describes what personal information we collect, how we use it and who we share it with when you visit the website, shop with us or otherwise communicate with us. If there is any inconsistency between our terms and this policy, this policy applies to personal information.

Controller

The controller of your personal information is Skilti og Merkingar & Tec ehf., reg. no. 450901-3260, Hólmbergsbraut 9a, 230 Reykjanesbær, email sm@skiltiogmerkingar.is, phone 454-1001.

Personal information we collect

Personal information is information that identifies you or that can reasonably be linked to you. Depending on how you use the Service, we may process the following information:

  • Contact details: name, address, delivery address, billing address, phone number and email address.
  • Icelandic ID number (kennitala): if you choose a payment method that requires it, e.g. an invoice in online banking.
  • Order information: the products you order, text, logos and images you send us for production, returns and cancellations.
  • Payment information: payment method, payment confirmation and transaction details. Card numbers are processed by the payment gateway and we do not store them.
  • Account information: if you create an account, the email address you log in with and your settings.
  • Communications: what you write to us by email or otherwise, e.g. photos included with a satisfaction guarantee request.
  • Reviews: if you write a product review, your name as it appears with the review.
  • Device and usage information: IP address, browser, device and how you use the website.

How we use the information and on what legal basis

  • To process your order and perform our contract with you: accept the order and payment, make and send the product, handle returns, defects and the satisfaction guarantee, and manage your account (item 2 of Article 9 of Act No. 90/2018).
  • To comply with legal obligations: accounting and invoices (item 3 of Article 9 of Act No. 90/2018).
  • For legitimate interests: website security, fraud prevention and answering enquiries. Our interests are that the business runs securely and that we can answer you and resolve issues (item 6 of Article 9 of Act No. 90/2018).
  • With your consent: cookies for analytics and advertising, and marketing emails (item 1 of Article 9 of Act No. 90/2018; Articles 88 and 94 of Act No. 70/2022). We may, however, send customers marketing emails about our own products without specific consent, provided they can opt out when the email address is registered and in every email (paragraph 2 of Article 94 of Act No. 70/2022).

We need your name and email address, and your address if we ship the product, to process an order. Without them we cannot accept it.

Who processes the information with us

We use the following service providers. They only receive the information they need for their task:

  • Shopify: the shop platform, website hosting, orders, customer accounts and email notifications.
  • Teya: card payments.
  • Payday: invoices, payment claims in online banking and accounting.
  • Pósturinn: receives your name and address to deliver the shipment to you.
  • Judge.me: customer reviews on the website.
  • Google: Google Analytics, Google Ads and Google Merchant Center, only if you accept cookies.
  • Meta (Facebook and Instagram): measurement and advertising, only if you accept cookies.

In addition, some parts of the website, e.g. reviews and payment badges, load from these providers and other apps in the shop. The provider in question then receives your device's IP address and information about your browser, regardless of cookies.

We may also need to disclose information if required by law, to protect our rights in a dispute, or if the business is sold or merged with another.

Relationship with Shopify

Shopify processes personal information on our behalf to run the shop. Shopify also uses certain information about your interactions with the shop and the Shopify platform to secure, develop and improve its services. In those cases Shopify is itself responsible for the processing, including responding to requests about your rights related to it.

Transfers outside the EEA

Some of our service providers store or process information outside the European Economic Area, e.g. in the United States or Canada. In that case the transfer is based on a decision that the country provides adequate protection or on an approved transfer mechanism, e.g. standard contractual clauses.

How long we keep information

We keep information for as long as we need it to process an order, handle the satisfaction guarantee and defect cases, manage your account or resolve disputes. Accounting records, e.g. invoices, are kept for seven years from the end of the financial year as required by law (Article 20 of Act No. 145/1994 on Bookkeeping).

Security

We take appropriate measures to protect the information, but no security measure is perfect. Do not send us sensitive information through insecure channels.

Children

The Service is not intended for children. If you are the parent or guardian of a child who has given us personal information, you can contact us and ask for it to be deleted.

Your rights

You have the right to:

  • access the personal information we hold about you,
  • rectification of incorrect information,
  • erasure of information,
  • restriction of processing,
  • portability of your own data, i.e. to receive a copy of the information and in some cases have it transferred to another party,
  • object to processing based on legitimate interests, including direct marketing,
  • withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing that took place before.

These rights apply regardless of where you live, with the exceptions provided for by law (Articles 15-21 of Regulation (EU) 2016/679; Articles 17, 20 and 21 of Act No. 90/2018).

You can opt out of marketing emails using the unsubscribe link in every email. We may still send emails related to your orders or account.

To exercise your rights, email us at sm@skiltiogmerkingar.is. We may need to verify your identity before we process the request.

Complaints

If you want to complain about how we process personal information, please contact us. You can also always lodge a complaint with the Icelandic Data Protection Authority, Persónuvernd (island.is/s/personuvernd) (paragraph 2 of Article 39 of Act No. 90/2018), or with the data protection authority where you live.

Changes to this policy

We may update this policy, e.g. if our practices or the law change. We publish the updated version on this page and change the "Last updated" date.