Privacy Policy
Version 2.0 — effective 1 December 2026. Replaces the “Personal Data” section of the Terms & Conditions dated 1 August 2025. English translation; the Icelandic version prevails.
This policy explains what personal data Regla ehf. collects, why, on what legal basis, how long we keep it, who we share it with, how we use it to develop our services, and what rights you have. Processing is governed by Act no. 90/2018 on Data Protection and the GDPR as incorporated into Icelandic law.
1. Who we are
Regla ehf., reg. no. 521208-0230, Suðurlandsbraut 50, 108 Reykjavík (“Regla”, “we”) provides cloud-based accounting, project accounting, payroll, invoicing, point-of-sale and related software to businesses in Iceland.
Privacy contact: personuvernd@regla.is, tel. 520 1200, or by post marked “Persónuvernd”. Our Data Protection Officer can be contacted at the same address.
2. Our two roles
- Regla as controller. For data about our customers’ contact persons and users, website visitors, people who contact us, newsletter subscribers, course participants, job applicants and suppliers, we decide why and how the data is processed. This policy covers that processing.
- Regla as processor. Data our customers enter in our systems – such as payroll, accounting and sales data – and customer content sent to us for support (including attachments and POS screen recordings) is processed on the customer’s behalf and on its instructions. The customer is normally the controller. If you are, for example, an employee of a Regla customer, please contact your employer first about your payroll data.
3. What we collect and why
| Who | Data | Purpose | Legal basis |
|---|---|---|---|
| Customers’ contact persons and users | Name, kennitala, email, phone, company, role, login details, subscription and billing information | Provide the service, manage users, invoice, send service notices | Legitimate interests in managing the business relationship (Art. 6(1)(f) GDPR); contract where the individual is the customer (Art. 6(1)(b)); legal obligation for accounting records (Art. 6(1)(c)) |
| Users of our systems | Usage data: log-ins, features used, navigation, error messages, device and browser, IP address, time stamps | Operation, security, troubleshooting, capacity management and service improvement (section 5) | Legitimate interests in a reliable and secure service |
| People who contact us (form, email, phone, chat, help centre) | Name, contact details, the enquiry and our replies. Calls are not recorded. | Answer enquiries, manage support cases, improve support (section 5) | Legitimate interests; contract where you are the customer |
| People visible in POS screen recordings | On-screen actions, transaction information and other data shown during a recorded POS support session | Debug and diagnose the reported POS issue only | Processed on the customer’s behalf and on its instructions |
| Website visitors | IP address, device and browser information, pages visited, cookie identifiers | Operate and secure the website, statistics, marketing | Necessary cookies: legitimate interests; other cookies (analytics and marketing): consent, which you can change or withdraw at any time in the website’s cookie settings. See our Cookie Policy. |
| Newsletter subscribers and marketing contacts | Name, email, company; whether a newsletter is opened and which links are clicked | Send news, product updates and offers | Consent, or the existing-customer rule in Article 94 of Act no. 70/2022 on Electronic Communications |
| Course and event participants | Name, contact details, company, participation; dietary or accessibility needs if you tell us | Organise courses and events, invoice | Contract or legitimate interests; explicit consent for any needs that reveal health or religion |
| Job applicants | CV, application, references, interview notes | Assess applications | Steps prior to a contract; consent for longer retention |
| Suppliers and partners | Names and contact details of contact persons | Manage the business relationship | Legitimate interests |
Sources. Mostly from you or your employer. We also use public registers such as Registers Iceland (Þjóðskrá Íslands) and the company register of Skatturinn to verify identity and keep records up to date.
Marketing. We send electronic marketing with your consent or, for our own similar products to existing customers, under Article 94 of Act no. 70/2022. Every message identifies Regla and has a free, easy unsubscribe link.
Kennitala. We use the kennitala only where it serves a clear purpose and is necessary for secure identification (Article 13 of Act no. 90/2018).
Required information. Forms and sign-up show which details are required. Without them we cannot create an account or provide the service you ask for; other details are optional.
POS screen recordings. Our services team sometimes records the screen while debugging a POS issue. You are told before recording starts. Recordings are used only to fix that issue, are accessible only to the staff handling it, and are deleted when no longer needed.
Sensitive data. We do not ask for sensitive data (e.g. health, religion, trade union membership) to administer accounts or provide support. However, customers using the payroll system often record such data about their employees, e.g. trade union membership for union dues or sickness for sick pay. We process that data on the customer’s behalf and on its instructions.
4. How long we keep data
| Data | Retention |
|---|---|
| Regla’s own invoices and accounting records | 7 years from the end of the financial year; annual accounts 25 years (Article 20 of Act no. 145/1994) |
| Customer data in Regla’s systems (incl. accounting and payroll data, and invoices customers send to their own customers) | For the duration of the business relationship; after the subscription ends, we delete the data in periodic clean-ups, no later than 12 months after the subscription ends, unless the customer asks us to keep it longer. If a customer returns within that time the data may still be available, but we do not guarantee it. Customers are responsible for the statutory retention of their own accounting records. |
| Customer account and contract information | For the duration of the customer relationship |
| Enquiries and support cases | 3 years from closing the case |
| POS screen recordings | Until the issue is resolved, max. 60 days |
| Activity history in the system (who did what, and when) | As part of customer data, for the duration of the business relationship unless the customer deletes it; thereafter as for other customer data |
| Technical usage and system logs | 12 months; security logs up to 24 months |
| Newsletter list | Until you unsubscribe; we then keep only what is needed to respect your opt-out |
| Job applications | 6 months after the recruitment closes, unless you agree to longer |
| Data compiled for model training | Deleted as soon as the source data is deleted, the customer opts out of training, or it is no longer needed |
5. Service development and AI
Regla may use data to train machine learning models that make Regla’s services more automated and accurate. The following rules apply:
- Training is limited to defined purposes that improve services for Regla’s customers, such as reading invoices, suggesting accounting and VAT categories and detecting errors.
- Before personal data is used, we document the purpose, legal basis (normally legitimate interests) and safeguards, and carry out a data protection impact assessment where required.
- We remove or pseudonymise direct identifiers; never use sensitive data, data about children, passwords, bank details or POS recordings; and test models so they do not reveal data.
- Website analytics data is not used for training.
- We do not sell personal data, and external AI providers may not train their own models on our or our customers’ data.
- AI suggests; people decide. No decisions with legal or similarly significant effects are made by AI alone.
- You can object to training on your data at any time (section 8). We then stop using it and assess what is needed for existing datasets and models, which may include deletion or retraining.
6. Who we share data with
We do not sell personal data. We share it only with:
- service providers that process data on our behalf, e.g. for hosting, operation and backup of our systems, sending email, invoices and payslips, office software, support systems, newsletters, website analytics and customer relationship management. They are bound by agreements imposing obligations equivalent to ours;
- third parties that you or your company connect to the service, e.g. banks, accountants, auditors, Skatturinn or pension funds;
- debt collectors for unpaid invoices;
- public authorities where required by law;
- a buyer or successor in a merger or sale of Regla, with equivalent protection.
7. Transfers outside the EEA
Where a provider processes data outside the EEA, we use a valid transfer mechanism, such as the EU–US Data Privacy Framework (where the recipient is certified) or standard contractual clauses with any necessary additional safeguards. Regla’s systems and customer data are hosted within the EEA. Some providers, e.g. for support systems, website analytics and website hosting, may process data in the United States. You can ask us for details of locations and a copy of the safeguards.
8. Your rights
You have the right to access your data, have it corrected or erased, restrict processing, receive data you provided in a portable format, object to processing based on legitimate interests (including model training and direct marketing), and withdraw consent at any time.
Your right to object. You can object at any time to processing based on our legitimate interests – including the use of your data for model training – and to direct marketing. We stop direct marketing immediately, and stop other processing unless we have compelling legitimate grounds that override your interests.
Send requests to personuvernd@regla.is; no special wording is needed. Requests are free. We reply within one month; if we need up to two more months for a complex request, we tell you why within the first month. We only ask for proof of identity if we have reasonable doubt. If we refuse a request, we explain why.
You can complain to Persónuvernd, Laugavegur 166, 105 Reykjavík, www.personuvernd.is.
9. Security
We protect personal data with technical and organisational measures appropriate to the risk, including hosting in ISO/IEC 27001-certified data centres within the EEA, encryption in transit and at rest, multi-factor authentication and restricted staff access, regular backups to a separate location, and system monitoring.
10. Children
Our services are for businesses. Customer records may include people under 18, such as young employees; that data is processed on the customer’s behalf and is never used for training.
11. Changes
We notify customers of material changes by email and in the service at least 30 days before they take effect. The current version is always on this page, and earlier versions are available on request.