Privacy Policy

Who we are

Gummi Design ("we", "us", "our") is a small, independently run art and craft project based in Iceland. We sell handmade products and publish articles at gummidesign.is, and we are responsible for the personal information described in this policy.

If you have any questions about this policy or how we handle your data, you can reach us at gummidesign@gmail.com.

Information we collect

We only collect what we need to run the shop, respond to you, and improve the site. Depending on how you use gummidesign.is, this may include:

• Account information — if you create an account: your name, email address and an encrypted password.
• Order information — when you place an order: your name, delivery address, email, phone number, the items ordered and your chosen payment method (bank transfer, cash on pickup, or postal).
• Contact and newsletter — the email address and message you send through our contact form, and the email address you provide if you subscribe to our newsletter.
• Technical information — collected automatically, such as your IP address, browser type, device information, referring page and the pages you visit.
• Cookies and similar technologies — see the "Cookies and analytics" section below.

How we use your information

We use your personal information to:

• Process, fulfil and deliver your orders and communicate with you about them.
• Provide, maintain and secure your account.
• Respond to your enquiries and provide customer support.
• Send our newsletter when you have asked to receive it.
• Understand how the site is used so we can improve it.
• Comply with our legal and accounting obligations.

Legal basis for processing

Under the EU General Data Protection Regulation (GDPR) and Icelandic Act No. 90/2018 on Data Protection, we process your personal information on the following bases: performance of a contract (to handle your orders and account), consent (for our newsletter and non-essential cookies), our legitimate interests (to keep the site secure and improve it), and compliance with legal obligations (such as bookkeeping requirements).

Cookies and analytics

We use cookies and similar technologies to make the site work and to understand how it is used. Essential cookies are always active because the site cannot function without them. Analytics and marketing technologies only run after you give consent through our cookie banner.

When you consent, we use Google Analytics to measure site traffic and Microsoft Clarity to understand how visitors interact with pages. You can change or withdraw your choice at any time through the "Cookie settings" link in the footer.

How we share your information

We do not sell your personal information. We share it only with service providers who help us operate the site, and only to the extent necessary:

• Supabase — hosting of our database and authentication.
• Google Analytics and Microsoft Clarity — website analytics, only with your consent.
• Email delivery providers — to send order confirmations and our newsletter.
• Authorities or advisors — where required by law or to protect our legal rights.

Payment information

We do not process online card payments and we never store card details. Orders are paid by bank transfer, cash on pickup, or postal arrangement. Any bank details you share to complete a transfer are used solely to reconcile your order.

How long we keep your information

We keep personal information only for as long as necessary for the purposes described in this policy. Order and transaction records are retained for as long as required by Icelandic accounting and tax law. Account information is kept while your account is active, and newsletter data until you unsubscribe.

Your rights

Under the GDPR and Icelandic data protection law you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your information ("right to be forgotten").
• Object to or restrict certain processing.
• Receive your information in a portable format.
• Withdraw consent at any time, without affecting processing already carried out.

Exercising your rights and complaints

To exercise any of these rights, contact us at gummidesign@gmail.com and we will respond within the timeframe required by law. If you have an account, you can also update your details or delete your account from your dashboard.

If you believe we have not handled your personal information properly, you have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd), www.personuvernd.is.

Data security

We take reasonable technical and organisational measures to protect your personal information against loss, misuse and unauthorised access, including encryption in transit and access controls. No method of transmission over the internet is completely secure, however, so we cannot guarantee absolute security.

Children's privacy

Our site is not directed at children under the age of 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us so we can remove it.

International transfers

Some of our service providers may process data outside Iceland or the European Economic Area. Where this happens, we rely on appropriate safeguards, such as the European Commission’s standard contractual clauses, to protect your information.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Contact us

If you have any questions about this Privacy Policy or your personal information, please email us at gummidesign@gmail.com.