Nexum
Let’s talk

Nexum · Privacy

Privacy Policy

Last updated:

This policy explains how Nexum ehf. processes personal data when you visit nexum.is or contact us through this website. It covers this company website; our products and other websites may have separate privacy policies.

1. Who is responsible?

Nexum ehf. is the controller responsible for the processing described here.
Company ID (kennitala): 510220-1370.
Address: Skútuvogur 3, 104 Reykjavík, Iceland.
Phone: +354 567-8004.
Privacy enquiries: [email protected].

2. Information we collect and why

Website delivery and security. Our hosting and security providers process technical information such as IP addresses, requested URLs, timestamps, browser information and error records to deliver the website, diagnose faults and prevent abuse. The legal basis is our legitimate interest in operating a reliable and secure website (Article 6(1)(f) GDPR).

Enquiries. When you use our contact form, we receive your name, email address, optional telephone number and message. The form also uses technical timing and IP information to limit spam. Messages are delivered to us by email. We use this information to answer your enquiry, based on our legitimate interest in business communications (Article 6(1)(f)), or to take steps at your request before entering into a contract with you (Article 6(1)(b)), where applicable. Required fields are necessary to respond; you do not have to provide a telephone number. Please avoid including sensitive personal information in your message.

Optional analytics. If you consent, we use Google Analytics 4 to understand how the website is used and improve its content. Data can include page views, interactions, referral sources, approximate location, device and browser information, and cookie identifiers. The legal basis is your consent (Article 6(1)(a)). Google states that GA4 does not log or store individual IP addresses; this does not mean all analytics information is anonymous.

We do not sell personal data, use website analytics for personalised advertising, or make decisions with legal or similarly significant effects based solely on automated processing.

3. Cookies and your choice

Google Analytics is off until you select “Accept analytics”. Scrolling, continuing to browse or closing the page does not give consent. Selecting “Reject analytics” leaves the website and contact form available.

You can withdraw or change your choice at any time using in the footer. Rejecting analytics stops further collection on this browser and removes accessible Google Analytics cookies for this website. Withdrawal does not affect the lawfulness of earlier processing or automatically delete information already collected; contact us if you wish to exercise your data rights.

Your preference applies to this browser and website origin. You may need to choose again on another device, after clearing browser storage, or after the preference expires. If local storage is unavailable, your choice applies to the current page only. With JavaScript disabled, Google Analytics does not load.

4. Recipients and international transfers

Our website hosting, content delivery and security providers, email service providers and Google Analytics may process data needed to provide their respective services. Cloudflare provides content delivery and website security. Google Analytics is provided through Google Ireland Limited and its affiliates, including Google LLC. We may disclose information to competent authorities where legally required, or where necessary to establish, exercise or defend legal claims.

Providers may process data outside the European Economic Area, including in the United States. Where required, transfers rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses. Contact us for information about applicable safeguards and how to obtain a copy.

See Google’s international transfer information, Google’s Privacy Policy and Cloudflare’s Privacy Policy for further information.

5. Retention

Analytics cookie and consent-preference lifetimes are stated above. GA4 user and event data is subject to the standard property’s retention settings, with a maximum of 14 months; retention of user identifiers can restart following a new visit depending on the property settings. Aggregated reports may remain available longer. These server-side retention periods are separate from cookie lifetimes.

Our web server logs are rotated daily and retain 14 rotated files in addition to the current log, normally about 15 days. Security records may be kept longer where needed to investigate an incident or establish or defend legal claims. Infrastructure providers may retain their own operational records for the period necessary to deliver and secure their services.

We retain enquiries for as long as needed to respond and manage any resulting business relationship. Further retention depends on applicable legal obligations, unresolved disputes and the need to establish, exercise or defend legal claims; information is deleted when these purposes no longer require it.

6. Your rights

Subject to the conditions in applicable law, you may request access, correction, deletion, restriction of processing and data portability. You may object to processing based on legitimate interests, and withdraw consent at any time.

Contact [email protected] to exercise your rights. We may ask for information reasonably necessary to verify your identity. We normally respond within one month and will explain any legally permitted extension within that period.

You may complain to Persónuvernd, the Icelandic Data Protection Authority, or to the supervisory authority in the EEA country where you live, work or believe an infringement occurred.

7. Changes

We may update this policy when our practices or legal requirements change. The date above identifies the latest revision. Material changes to consent-based processing will be accompanied by a new consent request where required.