Privacy Policy
A.V partar ehf., reg. no. 510526-1040 (hereinafter referred to as "the Company"), is committed to ensuring the security, confidentiality and reliability of the personal data processed within the Company. This privacy policy applies to personal data of individuals who do business with the Company, individuals who contact the Company, contacts acting on behalf of legal entities doing business with the Company, and other contacts (hereinafter referred to as "the customer" or "you").
The purpose of this privacy policy is to inform you about what personal data the Company collects, how such personal data is used, and who has access to the information.
If you need further information about how this policy affects you, you are welcome to contact the Company's data protection officer. The data protection officer's contact details are set out at the end of this policy.
1. Purpose and legal obligation
The Company's privacy policy is based on Act No. 90/2018 on Data Protection and the Processing of Personal Data (hereinafter referred to as "the Data Protection Act") and Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter referred to as "the Regulation" or "GDPR").
2. What is personal data?
For the purposes of this privacy policy, personal data means any information relating to an identified or identifiable individual, that is, information that can be traced directly or indirectly to a particular individual. Data that cannot be linked to an identifiable person is not considered personal data.
3. Personal data the Company processes about customers
We collect and retain various personal data about our customers. Different information may be collected about you depending on whether you do business with the Company in your own name or act on behalf of a legal entity doing business with the Company.
When we act for individuals, we collect the following information about customers:
- contact details, such as name, address, telephone number and email address;
- identification number (kennitala);
- credit rating information;
- information from communications; and
- invoicing information, including VAT number and specific invoicing requirements.
When we act for legal entities, we collect information about their representatives, mainly:
- contact details, such as name, telephone number, email address and communication history.
The Company may also collect information about the political connections of individuals in a risk group within the meaning of the legislation on measures against money laundering and terrorist financing. Individuals belonging to such a risk group are those who hold or have held a senior public position, their immediate family members, and individuals known to be their close associates. Where applicable, due diligence may also be carried out on customers applying to enter into a business relationship with the Company.
In addition to the above, we may also collect and process other information that customers or their representatives/contacts provide to us themselves, as well as information necessary for our operations, including our principal activity, which is the import of vehicle spare parts. We have a legitimate interest in ensuring that our customers receive good service, and the above information is processed solely for that purpose. The information may also be processed on the basis of a legal obligation, irrespective of the service the Company has undertaken to provide to customers, for example in relation to money laundering rules or accounting legislation.
Personal data is generally collected directly from the customer or their contact. However, information may also come from third parties, such as Creditinfo, public authorities, courts, customers' service providers, counterparties and others, as well as from websites, social media and databases. If information is obtained from a third party in other cases, we will inform our customers accordingly.
The above information is retained for up to four years from the end of the transaction, or from the end of the business relationship where there has been an ongoing business relationship. Information covered by accounting legislation is retained for seven years from the end of the relevant financial year. Some information may be retained for longer, as its processing may prove necessary in order to establish, exercise or defend legal claims. In such cases the retention period is based on the limitation period for claims, which may be up to fourteen years.
4. Processing relating to others who contact us and visit our websites
We generally process contact details and communication history of those who contact us. Visits to our website are recorded through the use of necessary cookies, and this processing is based on our legitimate interests. We also collect anonymous statistical information about the use of the website.
5. Direct marketing
We regularly send out direct marketing material to promote our services and attract new customers. The processing of email addresses for this purpose is based on the Company's legitimate interest in marketing.
If recipients do not wish to receive such material, they can unsubscribe by clicking the designated link in the email.
6. Disclosure to third parties
Your personal data may be disclosed to third parties on the basis of applicable laws or regulations, for example to public authorities, courts or the police. Your personal data may also be provided to third parties who supply us with IT services or services related to processing that form part of the Company's operations. We do not transfer personal data outside the EEA unless this is permitted under the Data Protection Act on the basis of standard contractual clauses, your consent, or a notice from the Icelandic Data Protection Authority regarding countries that provide adequate protection for personal data.
7. Security of personal data
Appropriate technical and organisational measures are in place to ensure the security of your personal data.
8. Changes and corrections to personal data
The personal data we process must be both accurate and relevant. If information about you is incorrect, you have the right to have it corrected. If information is incomplete, you have the right to have it completed by providing further information.
9. Your rights
You may request confirmation as to whether or not we process personal data about you. If we do, you may request access to that information and to details of how the processing is carried out. You may also have the right to a copy of the information. You may have the right to have information that you have provided to us, or that originates from you, transmitted directly to a third party. You may also have the right to have personal data about you erased without undue delay, for example where its retention is no longer necessary for the purposes of the processing, where you withdraw your consent to the processing, or where the legal basis for the processing no longer exists. Where processing is based on consent, you may withdraw your consent at any time.
The rights described above are not absolute. The Company may be required by law to refuse a request for erasure of or access to data. The Company may also refuse your request where the rights of others outweigh yours, for example on grounds of privacy.
10. Complaints to the Data Protection Authority
You have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd).
11. Contact details
The data protection officer of A.V partar ehf. is Friðjón B. Gunnarsson. His email address is fbg@fbg.is and his telephone number is 779-0900.
12. Changes
This policy may be amended from time to time. Amendments take effect as soon as the policy has been published on our websites.
This privacy policy was last updated on 23 September 2026.