TölvuLab Privacy Policy

1. Data controller

2. Personal data we process

The information processed depends on how you contact TölvuLab and the service requested. It may include:

• name, phone number, email address and preferred contact method,
• device type, manufacturer, model number, operating system and accessories,
• fault descriptions, symptoms, liquid exposure, previous repairs and troubleshooting already attempted,
• information about important data on the device or requests for data recovery,
• communications with TölvuLab, approvals for work, job records, invoices and payment-related information,
• technical website information such as IP address and request data processed by hosting and security providers.

Please do not submit unnecessary sensitive personal information through the enquiry form.

3. Purposes and legal bases

• Enquiries and pre-contract steps: to answer an enquiry, assess a job and take steps requested by the customer before entering into a service agreement.
• Performance of services: to manage devices, communications, approvals, diagnostics, repairs and return of devices.
• Legal obligations: to comply with bookkeeping, tax and other legal requirements.
• Legitimate interests: to secure the website and systems, keep necessary service records, prevent abuse, verify communications and establish or defend legal claims where appropriate.

Processing is based, as applicable, on Article 6 of the GDPR, particularly contractual or pre-contractual necessity, compliance with legal obligations and legitimate interests.

4. Recipients and processors

TölvuLab does not sell personal data. Information is only shared with or made accessible to service providers where necessary for operations or where required by law.

• Formspree receives information submitted through the website form, stores submissions under its service terms and sends notifications to TölvuLab. Formspree states that its service is hosted on AWS in the United States and that it relies on Standard Contractual Clauses (SCCs) as a processor for GDPR transfers.
• Cloudflare hosts and delivers the website and provides DNS, security and network services. Cloudflare may process technical request data and provides a data processing addendum and transfer safeguards for data subject to European data-protection law.
• Google/Gmail is used for email and for receiving notifications related to enquiries and customer communications.

Where a service provider processes data outside the European Economic Area, appropriate safeguards are used where required, such as Standard Contractual Clauses.

5. Retention

Personal data is not kept longer than necessary for the purpose for which it is processed.

• Enquiries that do not lead to a transaction are normally retained for up to 24 months, unless there is a reason for a shorter or longer period.
• Records connected with repairs, approvals, invoices or other accounting documentation may be retained for seven years from the end of the relevant financial year where Icelandic bookkeeping law requires it.
• Information that is no longer required is deleted or anonymised as appropriate.

6. Data on customer devices

TölvuLab may need limited access to the operating system, files or other information on a device in order to perform diagnostics, functional testing or requested data recovery. Access is limited to what is reasonably necessary for the work.

Customers are encouraged to remove unnecessary personal information and make a backup before handing over a device where the condition of the device allows it.

7. Cookies and technical data

At the date of this policy, TölvuLab does not use its own advertising or analytics cookies on the website. Infrastructure providers such as Cloudflare may nevertheless process technical data or set strictly necessary security cookies where required to deliver, protect or maintain the website.

8. Security

TölvuLab aims to use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss or disclosure. Access is limited to what is necessary for operations and service delivery.

9. Your rights

Subject to the applicable conditions under data-protection law, you may have the right to:

• receive information about and access your personal data,
• have inaccurate or incomplete data corrected,
• request deletion or restriction of processing,
• object to processing based on legitimate interests,
• receive data in a portable format where the right to data portability applies.

These rights may be limited where retention or processing is required by law or is necessary to establish, exercise or defend legal claims.

Requests can be sent to hjalp@tolvulab.is. You also have the right to lodge a complaint with the Icelandic Data Protection Authority, Persónuvernd.

10. Changes to this policy

This policy may be updated if processing activities, service providers or legal requirements change. The current version will be published on this page together with the date of the latest update.