Privacy policy

1. Controller

Gjafaland ehf., kennitala 460519-1280, Aðalstræti 24, 400 Ísafjörður, Iceland. Email: sala@plugg.is. Plugg is the controller of data about its customers (merchants) and users of plugg.is.

2. Data about merchants

Email and password (stored hashed), company name, kennitala and address, store domains, module settings, invoices and payment status, and messages you send us, e.g. module requests.

To verify a company we look it up in the public company registry of the Icelandic tax authority (Skatturinn) and check the store's public pages.

3. Data about store visitors

Modules in stores may process data about store visitors: email addresses in the popup and back-in-stock modules (with product and language), chat messages and details a visitor gives there, cookie choices and statistics on cart add-ons. IP addresses are only stored as an irreversible code (hash) to prevent abuse.

For this the store is the controller and Plugg the processor under the data processing agreement in section 11 of the terms. Visitors who want to exercise their rights should contact the store.

4. Purposes and legal basis

To provide the service and collect payments (contract, Art. 6(1)(b) GDPR).

To meet legal obligations, e.g. bookkeeping (Art. 6(1)(c)).

To keep the service secure, prevent abuse and verify companies (legitimate interests, Art. 6(1)(f)).

5. Sub-processors

Supabase (database and login), Vercel (hosting), Google (Gemini, AI chat answers), Konto ehf. (invoices and claims) and an email delivery service (SMTP). If a store connects its own mail server, that server is used for its emails.

Transfers outside the EEA rely on the European Commission's standard contractual clauses or equivalent safeguards.

6. Retention

Merchant data is kept while the account is active. Invoices and bookkeeping records are kept for 7 years under the Icelandic Bookkeeping Act no. 145/1994.

Store visitor data is deleted when the store or module is deleted, or earlier at the store's request.

7. Cookies

plugg.is only uses necessary cookies for login. Modules in stores use the browser's local storage for functionality, e.g. to remember that a popup was closed or which currency was chosen. Plugg does not use tracking or advertising cookies.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing. Send requests to sala@plugg.is.

You can lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is).

9. Changes

This policy may change. Material changes are announced to merchants by email.