Last updated: 3 October 2026
This policy explains how The Arctic Marketplace collects and uses personal data on arctic-market.com. It is based on Icelandic Act no. 90/2018 on Data Protection and the Processing of Personal Data, Regulation (EU) 2016/679 (GDPR) and, for cookies and marketing by email, the Electronic Communications Act no. 70/2022.
1. Controller
The controller is Sindri Már Bergmann Tryggvason, reg. no. 151195-3349, who operates The Arctic Marketplace (sole proprietor).
Skógartröð 7, 600 Akureyri, Iceland · telephone +354 888 7299 · info@arctic-market.com
Please send privacy enquiries and requests to info@arctic-market.com.
2. What information we collect, why and on what legal basis
| Information | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, email address, telephone number, delivery address and order contents | Process, produce and ship orders, send confirmation and provide service | Contract – Article 6(1)(b) |
| Designs, text, images or logos you send us for personalised products | Prepare a proposal and produce the item | Contract – Article 6(1)(b) |
| Payment information from the payment provider (amount, payment status and reference number). Never card numbers. | Confirm payment, issue refunds and keep accounts | Contract and legal obligation – Article 6(1)(b) and (c) |
| Invoices and order records | Meet obligations under the Accounting Act no. 145/1994 and the Value Added Tax Act no. 50/1988 | Legal obligation – Article 6(1)(c) |
| Enquiries through website forms (Contact, Request a quote, Contractor): name, company, email, telephone, message, job location, deadline and uploaded files (e.g. logos, mockups, images) | Answer enquiries and prepare quotes | Steps at your request before entering into a contract – Article 6(1)(b) |
| Information for contractor services under a quote (e.g. job location and images or video from drone inspections) | Carry out the work and deliver results to the client | Contract – Article 6(1)(b) |
| User account and VIP membership (name, email, encrypted password, orders and reservations) | Login, order history, pre-sales and reservations | Contract – Article 6(1)(b) |
| Communications by email and telephone | Answer enquiries, complaints and return requests | Contract and legitimate interests – Article 6(1)(b) and (f) |
| Mailing list registration (newsletters and offers): email, name if provided, registration date and method, consent confirmation and unsubscribe record | Send newsletters and offers by email; see section 3 | Consent – Article 6(1)(a) |
| Technical information in server logs (IP address, time, browser, requested URL) | Website operation and security | Legitimate interests – Article 6(1)(f) |
Without your name, email and delivery address we cannot fulfil an order. There is no automated decision-making or profiling. We never sell personal data.
3. Newsletters and marketing emails
We send newsletters and offers by email using Brevo (see section 5). You receive these emails only if you have signed up:
- You signed up to the mailing list. You enter your email in the website signup form or at checkout and tick the consent box yourself. The box is never pre-ticked. After registration we send you a confirmation email, and you are not added to the list until you click its confirmation link. Legal basis: consent under Article 6(1)(a) GDPR and Article 94(1) of the Electronic Communications Act no. 70/2022.
Email addresses from enquiries, quote requests and the contractor form are not added to the mailing list unless you sign up separately.
Unsubscribing. Every email contains an unsubscribe link and the sender’s name and address. Unsubscribing is as easy as signing up: one click is enough, and you can also send a request to info@arctic-market.com. Unsubscribing takes effect immediately. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.
Opens and clicks. Brevo counts how many people open an email and click its links, but this counting is anonymous and is not linked to individual recipients. Email links pass through a Brevo URL before you reach the destination.
4. Card information
Card information is never entered, processed or stored on The Arctic Marketplace website, and we never see your card number. Payment takes place on the hosted payment page of the payment provider, which processes card information under its own privacy policy. We receive only information on whether payment succeeded and a reference number.
5. Recipients and processors
We share personal data only to the extent necessary:
| Recipient | Role | Information | Location and transfer basis |
|---|---|---|---|
| Hostinger | Hosting the website, database and email (info@arctic-market.com) | All data stored by the website and email | Hostinger is headquartered in the EEA (Lithuania). Processing under a data processing agreement (Article 28 GDPR). |
| the payment provider, Katrínartún 4, 105 Reykjavík | Payment acquiring (Visa, Mastercard, Apple Pay, Google Pay) | Amount, order number and data you enter on the payment page | Iceland (EEA). the payment provider processes card information as an independent controller. |
| Sendinblue SAS (Brevo), 9-17 rue Salneuve, 75017 Paris, France | Sending newsletters and marketing emails, registration forms and managing unsubscribes | Email, name if provided, registration, consent and unsubscribe information, and anonymous open and click counts | Data is hosted in the EU (France and Belgium). Processing under a data processing agreement (Article 28 GDPR). Brevo uses sub-processors outside the EEA, including in the United States and India, for example for content delivery and network security, customer service and technical support. Such transfers rely on the European Commission’s Standard Contractual Clauses (Article 46 GDPR) and, where applicable, the EU-US Data Privacy Framework (Article 45 GDPR). |
| Print service providers and manufacturers, including outside the EEA | Production and shipment of items made to order | Name, delivery address, telephone/email, order contents and design files | Inside and outside the EEA. Transfers outside the EEA rely on the European Commission’s Standard Contractual Clauses (Article 46 GDPR) or, where applicable, an adequacy decision (Article 45 GDPR). |
| Pósturinn, and for business orders the agreed carrier (e.g. Pósturinn or a carrier offered by the manufacturer) | Delivery and customs clearance | Name, address, telephone and, where applicable, email | Delivery in Iceland. |
| Skatturinn (the tax authority) | Tax reporting | Accounting records as required by law | Iceland. Legal obligation. |
The online shop runs on WordPress and WooCommerce on our server at Hostinger.
6. Retention periods
| Data | Retention period |
|---|---|
| Order and accounting records | 7 years from the end of the relevant financial year (Article 20(1) of the Accounting Act no. 145/1994) |
| Enquiries and quote requests that do not result in business, including attached files | Up to 24 months |
| Designs and logos for orders | Up to 24 months from the last order, unless you request earlier deletion |
| User accounts and VIP membership | Until you delete the account or request deletion |
| Email correspondence | As long as needed for the business relationship, unless it forms part of accounting records |
| Mailing list (newsletters and marketing emails) | Until you unsubscribe. After unsubscribing, we keep your email and consent/unsubscribe information on a suppression list for 24 months to prevent further emails and demonstrate consent. They are then deleted. |
| Server logs | For a limited period according to the hosting provider’s settings |
7. Your rights
You have the right to access information about you, have it corrected or deleted (unless we are legally obliged to retain it, e.g. accounting records), restrict processing, object to processing based on legitimate interests and receive information in a machine-readable format. You may withdraw consent and object to marketing emails at any time, and we will then stop sending them (see section 3).
Send your request to info@arctic-market.com. We respond within one month.
If you believe processing breaches the law, you may complain to Persónuvernd, Laugavegur 166, 105 Reykjavík, postur@personuvernd.is, www.personuvernd.is.
8. Cookies and browser storage
The website uses only strictly necessary cookies and browser storage, meaning what is needed to provide the service you request: shopping cart, login, language selection and previewing your own logo. Under Article 88(2) of the Electronic Communications Act no. 70/2022, such storage does not require consent. We use no analytics, marketing or advertising cookies.
| Name | Purpose | Type | Duration |
|---|---|---|---|
wp_woocommerce_session_* | Links the cart to your visit | Necessary, first-party | Up to 2 days |
woocommerce_cart_hash, woocommerce_items_in_cart | Keep track of cart contents | Necessary, first-party | Session |
wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie | Login to a user account or VIP membership | Necessary, first-party | Session, or up to 14 days if “remember me” is selected |
pll_language | Remembers your chosen language | Necessary, first-party | Up to 1 year |
am_logo_v1, am_logo_adj_v1 (browser storage, localStorage) | Store your uploaded logo and its settings to preview it on products. The logo stays only in your browser until you send an enquiry. | Necessary, first-party | Until you remove the logo or clear your browser |
| the payment provider cookies on the payment page | Secure payment and fraud prevention | Necessary, third-party, under the payment provider privacy policy | According to the payment provider policy |
You can delete or block cookies in your browser settings. The cart, login and payment process may then stop working.
If we ever introduce cookies that are not necessary, we will first ask for your consent and update this policy.
9. Changes
The latest version of this policy is always published on this page with its date.