Privacy Statement
1. General
Sparnaður ehf. (VAT no. 570902-2450, Garðatorg 7, 210 Garðabær, hereinafter referred to as “Sparnaður”, “the Company”, “we”, us”) cares about personal privacy protection. The Company strives to ensure that the processing of personal data is always in accordance with applicable privacy laws. This notice contains information on the personal data that the Company collects on individuals during its operations and the purposes of data collection. It also contains information about other data recipients and how long we retain data, as well as information on the basis on which Sparnaður collects personal data, the rights of individuals, and other important information related to Act no. 90/2018 on Data Protection and the Processing of Personal Data.
2. What is personal data, and the processing of personal data?
Personal data is all information that can be traced to a specific individual, such as information about the individual’s name, ID number, address, email address, phone number, finances, health, IP address, and more. A more detailed definition of personal data can be found in Article 3, items 2–3 of the Act on Data Protection and the Processing of Personal Data. The processing of personal data refers to all processing and use of personal data, such as collection, registration, storage, modification, or deletion. A more detailed definition of the processing of personal data can be found in Article 3, item 4 of the Act on Data Protection and the Processing of Personal Data.
3. How does the Company process personal data?
Sparnaðurðs data processing is carried out on a legitimate basis and in accordance with Act no. 90/2018 on Data Protection and the Processing of Personal Data. The Company also ensures that personal data is not further processed in a manner that is incompatible with the original purpose of processing. The Company will ensure compliance with the following principles:
- Personal data is processed in a fair manner.
- Personal data is only collected for clear purposes.
- That no more than the necessary personal data is collected.
- Personal data is accurate and updated when necessary.
- Personal data is not retained longer than necessary.
- That the security of personal data is protected through appropriate safeguards.
4. What personal data does Sparnaður collect?
Sparnaður collects various personal data on individuals depending on the company's activities. Sparnaður seeks to collect only the personal data that is necessary for the purpose of the processing. Sparnaður collects the following personal data about customers:
4.1. Sales of pension plans by commission:
The personal data collected by Sparnaður when selling pension plans is basic information (name, e-mail address, telephone number, and address), salary information, employer information, and passport information for identity verification.
4.2. Sales of savings plans by commission:
The personal data collected by Sparnaður when selling savings plans is basic information (name, e-mail address, telephone number, and address), the savings amount, and passport information for identity verification.
4.3. Loan prepayment services:
For loan prepayment services, Sparnaður must retain the name, e-mail address, telephone number, home address, and loan information of an individual.
4.4. Sales of insurance by commission:
In commission sales of insurance for Vátryggingafélag Íslands hf. (VÍS), Sparnaður acts as a data processor as defined by the Act on Data Protection and the Processing of Personal Data. The personal data collected by Sparnaður in connection with these activities is basic information (name, telephone number, and address), health information, family information, financial information, information on the type of insurance, and insurance amounts.
5. Why does Sparnaður collect personal data?
The purpose of data collection is primarily to:
- Fulfil contractual obligations.
- Provide customers with requested services.
- Offer individuals insurance with VÍS (child insurance, critical illness insurance, and life insurance).
- Offer individuals insurance with Versicherungskammer Bayern (growth insurance).
- Assist with debt payment services, asset management, and providing customers with financial security.
- Enable calculation of the benefits of making down payments on the principal of loans.
- Transfer payments for customers’ loans.
- Fulfil legal obligations, e.g., those of the Accounting Act no. 145/1994.
6. What is the legal basis for Sparnaður’s collection of personal data?
Sparnaður collects and processes personal data on the following legal basis:
- To fulfil a contractual obligation.
- On the basis of your consent.
- To fulfil a legal obligation.
- To protect the legitimate interests of the Company.
7. How long does Sparnaður retain personal data?
Sparnaður only retains personal data for as long as it is necessary for the Company. When personal data is no longer needed, the Company deletes it in a secure manner.
8. From whom does Sparnaður collect data?
Sparnaður collects personal data directly from the individual concerned. If personal data is collected from third parties, Sparnaður will do its utmost to inform the individual.
9. When and why does Sparnaður disclose personal data to third parties?
Sparnaður discloses personal data to third parties hired by the Company to carry out pre-determined work, such as service providers, agents, or contractors. In those cases, the Company enters into a processing agreement with the party in question. Such agreements stipulate the party’s obligation to follow Sparnaður's instructions on the processing of personal data and a prohibition on using the data for other purposes. The party is also obligated to ensure the security of the data in an appropriate manner.
Sparnaður must share personal data with the following parties in connection with commission sales of pension plans and insurance:
- Versicherungskammer Bayern, located in Germany (Bayern Líf).
- PM-Premium Makler GmbH (Sparnaður offers Versicherungskammer Bayern products through the German insurance broker PM-Premium Makler GmbH).
- Customers’ employers.
- Premium ehf., which collects contributions from Versicherungskammer Bayern fund members from employers.
- Vátryggingafélag Íslands hf.
10. Transferring personal data outside the European Economic Area
Strict conditions apply to the transfer of personal data to countries outside the European Economic Area. The Company does not do so under any circumstances unless there is sufficient authorization to do so according to Act no. 90/2018 on Data Protection and the Processing of Personal Data.
11. Your rights
If you have consented to the processing of certain personal data, you are entitled, according to Act no. 90/2018 on Data Protection and the Processing of Personal Data, to withdraw your consent at any time. However, this right does not affect the legality of the processing that took place before consent was withdrawn. You also have the right to access your data, the right to have incorrect or misleading information corrected, the right to have your personal data deleted, the right to prevent the processing of your personal data, and the right to transfer your data. You should keep in mind that your rights are subject to various conditions.
12. Security of personal data
Sparnaður has taken appropriate technical and organizational security measures to ensure the security of personal data according to Act no. 90/2018 on Data Protection and the Processing of Personal Data. This includes only providing access to personal data to employees that require the data to carry out their work duties. In addition, the Company regularly provides employees with appropriate security training.
13. Contact information for Sparnaðar
Name: Sparnaður ehf.
Address: Garðatorg 7, 210 Garðabær
Email: sparnadur@sparnadur.is
Address: Garðatorg 7, 210 Garðabær
Email: sparnadur@sparnadur.is
Please e-mail personuvernd@sparnadur.is if you have any further questions about Sparnaður’s processing of your personal data.
14. The right to file a complaint with the Icelandic Data Protection Authority
If you doubt that Sparnaður is processing your personal data in accordance with Act no. 90/2018 on Data Protection and the Processing of Personal Data, you have the right to file a complaint with the Icelandic Data Protection Authority (www.personuvernd.is).
15. Revision of this Privacy Notice
This privacy notice was approved on 20.12.2021 and will next be revised on 28.12.2023.