Privacy policy

Draft. This document has not yet been reviewed by a lawyer and may change before it takes effect.

1. Who we are

[Company name ehf.], kennitala [000000-0000], [Street address], [000] Reykjavík, Iceland provides Hordio. This policy explains how we handle personal data on hordio.com and in the Hordio service. Questions: privacy@hordio.com.

2. Two roles

For the account information of the people who use Hordio (name, email address, sign-in data), and for our customer relationship, we are the controller.

For the data customers register in Hordio, such as employees and the assets they have, the customer is the controller and we are the processor. That processing is governed by our data processing agreement, which forms part of the terms of service.

3. What we collect as controller

• Account: name, email address, password (stored only as a secure hash), preferred language, the organizations you belong to and your role.
• Customer and billing: company name, kennitala, address, VAT number and billing email. Payment card details are handled by Paddle and never reach us.
• Security and logs: IP address, browser, time of sign-in and of actions, kept to protect the service and investigate errors and abuse.
• Communication: emails you send us.

4. Why, and on what basis

• To provide the service and our agreement with you (GDPR art. 6(1)(b)).
• To keep the service secure, prevent abuse and improve it (legitimate interest, art. 6(1)(f)).
• To keep accounting records, as required by Icelandic law (legal obligation, art. 6(1)(c)).
• To send emails about your account, reminders you have turned on, and important changes to the service. We do not send marketing emails without your consent.

5. The website

hordio.com uses no cookies, no analytics and no tracking. The web server keeps short technical logs (IP address, page, time) to deliver the site and protect it.

The Hordio app uses only the cookies needed to keep you signed in and to protect forms against forgery.

6. Who processes the data for us

We use the following sub-processors. Each is bound by an agreement that protects the data:

Transfers outside the EEA are made on the basis of an adequacy decision (such as the EU–US Data Privacy Framework) or the EU standard contractual clauses.

7. How long we keep data

• Account data: while you have an account; deleted when the account is deleted.
• Customer data in an organization: while the subscription lasts. After a trial or subscription ends, the organization is read-only and is deleted 60–90 days later, after notice by email.
• Accounting records: 7 years, as Icelandic law requires.
• Security logs: up to 12 months. Backups: up to 35 days.

8. Security

Data is encrypted in transit (HTTPS) and at rest. Access within the company is limited to those who need it. Passwords are stored as secure hashes, and every change in an organization is logged.

9. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to processing, and to receive your data in a portable format. Contact privacy@hordio.com. If your data is registered in Hordio by your employer, contact the employer first; we will help them answer.

You can complain to the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is) or the authority in your country.

10. Changes

We will publish changes to this policy here and notify customers by email about material changes.