Last updated: 8 October 2026
This policy explains what personal data we collect when you visit woodencorner.is or shop with us, why we need it, who we share it with and what your rights are. We follow the EU General Data Protection Regulation (GDPR) as it applies in Iceland, and the Icelandic Data Protection Act (lög nr. 90/2018).
Who is responsible for your data
Wooden Corner Iceland (Viðarhornið), Sylwia Olszewska Kennitala 200874-2859 Laugavegur 27, 101 Reykjavík, Iceland info@woodencorner.is
If you have any questions about your data, write to us at the address above.
What we collect and why
When you place an order
- Name, delivery and billing address, e-mail address and phone number.
- What you ordered, the price, the delivery method and any note you add.
- The payment status. Card details are entered on the myPOS payment page; we never see or store your full card number.
We use this to process and deliver your order, send you e-mails about it, handle returns and complaints, and keep the accounts required by law. The legal basis is the performance of our contract with you (GDPR Art. 6(1)(b)) and our legal obligations (Art. 6(1)(c)).
When you write to us by e-mail or through the contact form, we use your name, e-mail address and message to answer you (Art. 6(1)(b) or (f)).
When you browse the website, our server records technical data such as your IP address, browser and the pages you visit. We use this to run the website and keep it secure (legitimate interest, Art. 6(1)(f)).
If you allow analytics cookies, we use Google Analytics (Google Ireland Limited) to see how visitors use the shop: which pages are viewed, how visitors found us, what device and browser they use, their approximate location (country or city) and which products are added to the cart or bought. Google Analytics does not store your IP address, and we cannot identify you from these statistics. Without your consent no analytics cookies are set. The legal basis is your consent (Art. 6(1)(a)), which you can withdraw at any time with the Cookie settings link at the bottom of every page.
We do not use your data for automated decision-making or profiling.
Who we share it with
We share only what each service needs:
- myPOS processes card payments.
- Pósturinn (Íslandspóstur ohf.) delivers your parcel. For deliveries abroad, Pósturinn’s partner postal services and the customs authorities in your country receive your name, address, contact details and a description and value of the contents.
- Dropp delivers your parcel if you choose a Dropp pick-up point or home delivery, and receives your name, address, phone number and e-mail address.
- Our web host (wphost.pro, on servers in Germany) stores the website, the order database and our mailbox, and sends our order e-mails.
- Our accounting and inventory system (Regla) keeps sales records.
- Google provides Google Analytics (only with your consent) and Google Fonts.
- Our accountant and public authorities receive data when the law requires it, for example the tax authority.
Some providers, such as Google, may process data outside the European Economic Area. Such transfers are protected by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.
We never sell your data.
Cookies
We use cookies that are needed for the shop to work, such as keeping your cart, remembering your language and storing your cookie choices. We also use a cookie that records how you found our shop (for example a search engine or a link), which helps us understand our orders. You can review and change your choices at any time with the Cookie settings link at the bottom of every page.
With your consent, Google Analytics sets the cookies _ga and _ga_*, which tell visits and visitors apart. They are kept for up to 2 years.
The website loads its fonts from Google Fonts. When a page loads, your browser connects to Google’s servers, and Google receives your IP address.
How long we keep it
- Order and accounting records: 7 years, as required by the Icelandic Bookkeeping Act (lög um bókhald nr. 145/1994).
- E-mails and messages: as long as needed to answer you and to handle any later questions about your order.
- Server logs: a short time, for security only.
- Google Analytics statistics: 14 months, then Google deletes them automatically.
Your rights
You have the right to:
- see the data we hold about you and get a copy of it;
- have incorrect data corrected;
- have your data deleted, unless we must keep it by law (for example accounting records);
- restrict or object to how we use your data;
- receive your data in a common format (data portability);
- withdraw your consent at any time, for example for cookies.
To use any of these rights, e-mail info@woodencorner.is. We will reply within one month.
If you think we handle your data wrongly, you can complain to the Icelandic Data Protection Authority, Persónuvernd (personuvernd.is), or to the data protection authority in your own country.
Changes
We may update this policy, for example when we add a new service. The date at the top shows the latest version.