Personal data and how we handle it
Last updated: 21 October 2026
Kritavi takes confidentiality, security and accuracy seriously in everything it does with personal data. In this policy, "the company", "we" and "us" mean Kritavi ehf. (kt. 510926-2500), Litlabæjarvör 17, 225 Garðabær, Iceland.
Purpose of this policy
This policy explains what personal data the company collects, why, on what legal basis, and for how long it is kept. It follows the Icelandic Data Protection Act No. 90/2018 and the GDPR.
When this policy applies
This policy applies when Kritavi is the controller, meaning it decides itself why and how personal data is processed. Examples are data about contacts at clients and partners, people who register for events or contact us through the website, and job applicants.
It does not apply when Kritavi works in a client's systems, for example during implementation, testing or a review. There the client is the controller and Kritavi a processor acting on its behalf. That processing follows the client's instructions and a written data processing agreement, and is covered by the client's own privacy notice.
1. What personal data do we process?
It depends on your relationship with the company.
a) Contacts at clients and partners
If you represent a client, subcontractor or partner, we process:
- name and role
- organisation
- work email and phone number
- correspondence and meeting notes
The purpose is to prepare and perform contracts and to manage business relationships. The basis is performance of the contract with your organisation and the company's legitimate interests.
Before a contract is signed we screen clients and subcontractors against public sanctions lists. This can include the names of directors and beneficial owners. The basis is the company's legitimate interests, and legal obligation where it applies.
We may send client contacts information about similar services, events or short service surveys. You can unsubscribe at any time with the link at the bottom of each email.
b) Interviews and surveys in engagements
When an engagement includes interviews or short surveys of a client's staff, for example about AI use, we record the names of the people we speak with and their answers. Findings are reported so that individual answers cannot be traced to a person, unless that person agrees otherwise. The data is deleted or anonymised within 90 days of the engagement ending.
c) The Kritavi website
If you contact us through the website, we process your name, organisation, role, work email and what you write to us. This is stored in our CRM, hosted in the EU. The basis is steps taken at your request before a contract, and the company's legitimate interest in answering enquiries.
If you sign up for our mailing list we collect your name, email, organisation and role. The mailing list is based on your consent, which you can withdraw at any time.
The website does not use cookies for analytics or advertising. Visits are counted without cookies and without identifying you. Your language choice is stored in your browser so the site remembers it.
d) Events
When you register for an event or meeting organised by Kritavi, in Iceland or abroad, we process your name, organisation, role and email. The purpose is to manage registrations and to follow up, for example by sharing slides or the occasional invitation to similar events. The basis is the company's legitimate interests.
If photos or recordings are taken at a Kritavi event, we say so in advance. We do not publish images in which individuals can be recognised without their consent.
e) Job applications
If you apply for a job at Kritavi we process the information in your CV, cover letter and interviews, and where relevant information from referees you name. The purpose is to assess your suitability for the role. Applications are deleted 6 months after the recruitment process ends, unless you agree to a longer period.
2. Where does the data come from, and how long is it kept?
We mostly get the data from you. In some cases it comes from your organisation, from public registers, or from the person who introduced us.
| Data | Retention |
|---|---|
| Enquiries and registrations that do not lead to an engagement | 24 months |
| Contacts and correspondence | For the relationship and 3 years after |
| Interviews and surveys in engagements | Deleted or anonymised within 90 days of the engagement ending |
| Job applications | 6 months after the recruitment process ends |
| Accounting records | Seven years, under Icelandic bookkeeping law |
3. Who do we share it with?
We do not sell personal data or use it for advertising. We share it only with:
- service providers acting for us under written agreements: Cloudflare (website hosting), Resend (delivery of website form messages), HubSpot (CRM, hosted in the EU), Microsoft 365 (email and documents, within the EU Data Boundary) and Payday ehf. (invoicing and accounting)
- subcontractors working on an engagement, limited to what the work requires and with the same obligations as us
- advisers such as lawyers and auditors, when needed
- public authorities when we are legally required to
Cloudflare, Resend, HubSpot and Microsoft are US companies and may, in limited cases such as support or security monitoring, access data from the United States. Where that happens we rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
4. How do we protect it?
Kritavi's security measures are based on ISO/IEC 27001: access control, multi-factor authentication, encryption and separation of each client's data. Only people who need access for their work have it.
5. What are my rights?
You have the right to:
- access — confirm whether we process data about you, and receive a copy
- rectification — have incorrect or incomplete data corrected
- erasure — when keeping the data is no longer necessary or you have withdrawn consent
- restriction — have processing restricted, for example while a request is being reviewed
- objection — to processing based on the company's legitimate interests
- portability — receive data you gave us in a machine-readable format, where processing is based on consent or contract
- withdraw consent — at any time, where processing is based on consent
These rights are not absolute. If the law or the rights of others prevent us from meeting your request, we will explain why.
6. How do I make a request?
Email info@kritavi.com. We reply within one month. If you are not satisfied with our answer, you can complain to Persónuvernd, the Icelandic Data Protection Authority (www.personuvernd.is).
7. Changes
We update this policy when our processing changes and show the date at the top.