Reykjavik Energy's Privacy Policy

On the processing of personal data of Orkuveitan's customers.

1. General

Reykjavik Energy and its subsidiaries operate in accordance with Act No. 136/2013 on Reykjavik Energy. The OR Group consists of the parent company and its subsidiaries, including Ljósleiðarinn ehf., Veitur ohf., Orka náttúrunnar ohf., and Carbfix ohf. The companies are engaged in the processing, production, and sale of electricity, hot and cold water, and steam, as well as the operation of basic systems such as electricity distribution, district heating, sewerage, and data transmission, in addition to other activities of a similar nature. OR sells these products and services to customers for payment.

Reykjavik Energy provides its subsidiaries with general support and specialist services, including in the areas of customer service and finance, in accordance with the Act on Reykjavik Energy. Each of these companies is considered a controller for the processing of personal data about customers at the respective company. However, each of them hands over or authorises the parent company to process personal data about its customers so that the purpose of processing personal data according to this statement and the statement of each company can be achieved. A service and processing agreement has been made between the companies, the parent company and each subsidiary, which describes this. With respect to the customer, OR guarantees that all processing of personal data by OR complies with Information Security and Data Protection Policy and subsidiaries, laws on data protection and the processing of personal data, and rules set thereunder. This document, which is intended to supplement the policy, contains information and education on the items that Orkuveita Reykjavíkur is required to provide regarding the collection and processing of personal data about customers.

There is a contractual relationship between OR/subsidiaries and customers for the provision of goods and/or services. In order to provide and deliver them, it is necessary to obtain, register, save, and process personal data about customers so that the aforementioned parties can fulfill their obligations to the customer in question. This does not involve the processing of sensitive personal data.

With respect to the customer, OR guarantees that all processing of personal data by the company complies with OR's privacy policy, the Act on Data Protection and the Processing of Personal Data, and rules set pursuant to them. This document, which is intended to supplement the policy, contains information and education on the matters that OR is obliged to provide regarding the collection and processing of personal data about customers.

2. Purpose of processing personal data about customers

Orkuveitan collects and processes specified personal data about the customer for the purpose of providing them with the product and service that Orkuveitan has agreed to provide and to collect the required payment for that service. This is also done to ensure the best possible quality of products and services at all times.

Personal data may also be processed for the purpose of analyzing market opportunities with a view to offering additional or new services.

The purpose of processing personal data may also be other than that stated above. For example, Orkuveitan carries out electronic surveillance where the purpose is specific in each case, but such processing is primarily carried out to ensure the safety of employees, the quality of Orkuveitan's services, and for security and property protection purposes: Camera surveillance in and around Orkuveitan's structures, telephone monitoring in the service centre, tachographs in Orkuveitan's vehicles, and with voice stations on the Tetra communication system. Electronic surveillance is subject to the Data Protection Authority's rules on electronic surveillance and guidance documents in Orkuveitan's operating manual, which discuss, among other things, the purpose of the surveillance in each case, who is subject to it, where and when it is applied, what Orkuveitan's obligations are in this regard, and what the rights of employees are.

Orkuveitan guarantees that personal information about customers will not be used for any purpose other than that defined above, except with the full knowledge and/or consent of the customer.

3. What is the legal basis for processing customers' personal data?

The processing of personal data about customers is primarily necessary for the execution of a contract between Orkuveitan and the individual in question regarding the company's provision of products and/or services. In addition, some processing may be based on law, e.g. the Public Archives Act No. 77/2014, the Bookkeeping Act No. 145/1994, and the Annual Accounts Act No. 3/2006.

Where consent is the basis for the processing of personal data about customers, special terms and conditions apply which the customer has accepted when giving their consent. Such terms and conditions will not be changed without the customer's consent.

4. Type of personal data processed

The utility company primarily collects and processes the following information about customers:

Name
National ID number
Address
Phone number
Email address
Bank accounts
Credit card information is encrypted for 24 hours and then deleted
Usage history – readings/invoices
Failure History - Operational Disruptions
Default Information
Contact information
Applications for services/products from the Orkuveitan Group
Personal data provided in recorded phone calls to the Orkuveitan Customer Service Center
Security cameras in public areas in and around the premises of Orkuveitan and its subsidiaries
Telecommunications data for Ljósleiðarinn's customers, if processed

When a customer communicates with Orkuveitan on social media, e.g., submits a meter reading or other information, the rules of the respective medium regarding the protection and storage of personal data apply. Where applicable, Orkuveitan transfers the relevant communication/information to its systems, where its protection and storage are handled in accordance with Orkuveitan's privacy policy and the rules established for its implementation.

5. Cookies

Orkuveitan collects information through the use of cookies. Cookies are small text files stored in the user's browser. We use cookies on our website to identify users. The use of cookies enables us to provide users with a better experience and contribute to the further development of the website.

Orkuveitan uses various types of cookies on its website. Firstly, there are essential cookies that ensure the proper functioning of the website. Secondly and thirdly, there are statistics and preference cookies that collect anonymous statistical information and remember user settings on the website. Fourthly, there are cookies used for marketing purposes, which collect information about user activity in order to tailor advertisements and other content to each user.

For further information on the processing of personal data by Orkuveitan using cookies, please refer to the information on cookies on the company's website.

6. Recipients of personal data about customers

Customer information is stored at Orkuveitan or on behalf of the company in Iceland or with a partner within the EEA, where the rules on the processing of personal data are the same as in Iceland. Personal data will not be disclosed to a third party except on the basis of legal authorisation, a government directive, a court ruling, a processing agreement or the customer's consent.

7. Retention period - How long personal data about customers is retained

Orkuveitan retains customers' personal data for the period stipulated by law and as necessary for the purpose of the processing. As Orkuveitan is publicly owned, the company is subject to the Public Archives Act and therefore has a duty of preservation and delivery in accordance with it. The company is therefore subject to certain restrictions regarding the deletion of data. Data that is authorised for deletion under a special permit from the Reykjavík Municipal Archives will be deleted in accordance with the authorisation granted in each case.

8. The customer's right to object, access, rectify, and erase/restrict processing

A customer has the right to object to the collection of personal data by Orkuveitan if they believe that it is not consistent with its purpose, that the principle of proportionality is not observed, or if they believe that the same purpose can be achieved by less intrusive means.

A customer may request information about the processing of their personal data by Orkuveitan, provided that the interests of others do not prevent it. Such a request shall be processed as quickly as possible and no later than one month from its receipt.

A customer may have the right to demand that incorrect, misleading, or incomplete personal data about them be rectified and/or deleted.

9. Customer's right to submit complaints and comments

If a customer wishes to raise an objection, complaint, or comment regarding the processing of personal data, it should be directed to the company. If the relevant unit does not respond, the customer can contact the Data Protection Officer of the Orkuveitan Group. dataprotectionofficer@or.is (see more details below).

The customer is also entitled to submit the processing of personal data to the Data Protection Authority (www.personuvernd.is)

10. Accuracy and reliability of information

The utility company is responsible for the reliability of the information and for ensuring that customer information is always updated in accordance with their notifications of changes and taking into account the purpose of the processing.

The customer is responsible for informing Orkuveitan of any necessary changes to their information.

11. Security of customers' personal data

Orkuveitan ensures the security of personal data through technical and organisational measures. These measures are further detailed in Orkuveitan's information security policy and relevant guidance documents in Orkuveitan's operations manual.

Access to personal data about customers is limited to those employees who require such access to achieve the purpose of the processing. Employees are informed and aware of their obligation to maintain the confidentiality and security of the personal data they have access to. Their confidentiality and non-disclosure obligations continue to apply even after their employment ends.

Other than as provided for above, the processing of personal data about employees is governed by Act No. 90/2018 on Data Protection and the Processing of Personal Data, and the measures implemented by Orkuveitan on the basis thereof.

The Data Protection Officer for Orkuveitan is Hörður Helgi Helgason, an attorney at Landslög, Borgartún 26, 105 Reykjavík. Phone: 520-2900, personuverndarfulltrui@or.is.

Useful links