Privacy Policy

About This Policy

This policy explains how Centara ehf., Reg. No. 410623-0640, Katrínartún 4, 105 Reykjavík, Iceland ("Centara", "we", "us") processes personal data in connection with the centara.com website, enquiries sent to us, and our relationships with customers and partners. We process personal data in accordance with the Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data and the General Data Protection Regulation (GDPR).

Our Role

Centara as processor. When customers use our eDelivery services, we process invoices, documents and related data on their behalf. For that data, the customer is the controller and Centara is the processor. We process it only on the customer's instructions and in accordance with our agreement with that customer. If your data is contained in documents exchanged through our services, please contact the relevant customer to exercise your rights; we will assist them as required.

Centara as controller. We are the controller for personal data we process for our own purposes: operating the centara.com website, responding to enquiries, and managing our relationships with customers, partners and their contact persons. The rest of this policy describes that processing.

What We Collect and Why

The enquiry form is protected by Cloudflare Turnstile, which automatically checks that the request comes from a person; submissions that fail the check are not sent. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you, and we do not sell personal data.

Cookies and Analytics

The centara.com website sets no analytics or advertising cookies unless you accept them in the cookie bar. If you accept, we use Google Analytics 4 to understand how the website is used: which pages are visited, where visitors come from (approximate location, such as country and city), and which devices and browsers they use. We do not use Google Analytics for advertising; Google signals and ad personalisation are turned off. User- and event-level analytics data is deleted after 2 months; only aggregated statistics are kept longer. For more information, see How Google uses information from sites or apps that use our services.

Google Analytics sets the following first-party cookies:

• _ga: distinguishes visitors, expires up to 13 months after your last visit
• _ga_5L06F0Y4KG: keeps session state, expires up to 13 months after your last visit

Your choice is stored in your browser's local storage, and we ask again after 12 months. You can change or withdraw your consent at any time with the "Cookie settings" link at the bottom of every page; rejecting removes the analytics cookies. Withdrawing consent does not affect processing carried out before the withdrawal.

Who We Share Data With

We share personal data only with service providers that process it on our behalf, under data processing terms that require them to protect it and use it only for the services they provide to us:

• Cloudflare: website hosting, security and bot protection
• Postmark: delivery of enquiries submitted through the website form
• Google Ireland Limited: website analytics, only if you accept analytics cookies
• Microsoft: email and office software

We may also disclose personal data to professional advisers, or to public authorities where we are required to by law.

International Transfers

Some of our service providers process data outside the European Economic Area, in particular in the United States. Where this happens, the transfer is covered by an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or by the European Commission's Standard Contractual Clauses.

How Long We Keep Data

• Website enquiries: for as long as needed to handle the enquiry and any resulting business relationship
• Customer and partner contact data: for the duration of the relationship, and afterwards for as long as needed to meet legal obligations or handle legal claims
• Accounting records: as required by Icelandic accounting law, currently 7 years
• Server and security logs: for a limited period, for security and troubleshooting
• Website analytics: as described under Cookies and Analytics

Data we process on behalf of customers is kept and deleted in accordance with our agreement with each customer.

How We Protect Data

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse, in line with our information security policies. Data is encrypted in transit using TLS, and access to systems that store personal data is restricted to authorised personnel.

Your Rights

Under data protection law you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data erased
• restrict our processing of your data
• object to processing based on our legitimate interests
• receive your data in a portable format
• withdraw consent at any time, where processing is based on consent

To exercise your rights, contact us at support@centara.com. We will respond within one month.

Complaints

If you believe we process your personal data unlawfully, you can lodge a complaint with Persónuvernd, the Icelandic Data Protection Authority (www.personuvernd.is), or with the supervisory authority in the country where you live. We would appreciate the chance to address your concern first.

Changes to This Policy

We may update this policy to reflect changes in our services or legal requirements. The date at the top shows when it was last updated. If we make material changes, we will highlight them on this page and, where appropriate, notify customers directly.

Contact Us

Questions about this policy or our handling of personal data can be sent to support@centara.com.