Privacy Policy

Privacy and confidentiality are an important part of the operations of EB. Einarsson ehf. This policy describes how the company processes personal data when individuals visit einarsson.io, communicate with the company or use its digital solutions.

The policy takes account of Act No. 90/2018 on Data Protection and the Processing of Personal Data and Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (GDPR).

Specific information may also appear in individual solutions before data is collected. If specific information and this policy address the same processing, the more specific information applies to that processing.

The controller of the processing described in this policy is:

Enquiries, requests concerning data subject rights and other privacy-related matters may be sent to hello@einarsson.io.

EB. Einarsson ehf. may act either as a controller or as a processor of personal data.

• The company is a controller when it determines the purposes and means of processing, for example in connection with communications, business, invoicing, operation of its own websites and direct services to individuals.
• The company is a processor when it runs an assessment or other solution for a customer that determines the purpose of the processing, for example a company or public body. Processing then takes place under a processing agreement and the customer’s documented instructions.

The customer is then responsible for having a lawful basis for the processing, providing participants with appropriate information and handling rights requests, unless otherwise specifically agreed.

Depending on the nature of the service, the following information may be processed:

• name, email address and other contact details;
• information about a company, organisation, team or group;
• information about the person who creates or administers an assessment;
• responses to assessment questions and optional free-text answers;
• scores, classifications, summaries, recommendations and other derived results;
• information related to contracts, invoicing and business;
• IP addresses, timestamps, device or browser information, requested URLs, error and operational information, and security and access logs.

Users are encouraged not to enter special-category personal data or the names of others in free-text fields unless it is necessary and there is a clear lawful basis for the processing.

Where processing is based on legitimate interests, it is assessed whether the company’s interests outweigh the rights and freedoms of the individual concerned. Where processing is based on consent, that consent may be withdrawn. Withdrawal does not affect the lawfulness of processing already carried out.

EB. Einarsson ehf. develops and operates web solutions that support, among other things, self-assessment, team development, change work and assessment of the digital maturity of companies and organisations.

This policy currently covers, among others, the solutions PAEI, ChangeReady, TeamCompass and TransformCompass. A more detailed description of the purpose, functionality and use of each solution is available from einarsson.io and, where applicable, in the relevant solution before information is collected.

In the solutions, contact details, information about teams or organisations, responses to assessment questions, optional free-text answers and results calculated from responses may be processed.

The solutions are intended for self-assessment, education, discussion, advisory work and improvement work. They do not constitute a clinical or psychological assessment, and their results should not be the sole basis for decisions about recruitment, terms of employment, performance or other rights of individuals.

Some solutions use specific links or identifiers to provide access to assessment forms, surveys, results or administration of a particular assessment.

A person who receives such a link may be able to open the relevant content without separate login. Result and administration links should be treated as confidential. Users should not forward such links except to those who are authorised to access them, and are encouraged to notify the company if unauthorised access is suspected.

Access links have a limited validity period and can be invalidated. More detailed rules may differ between solutions.

The company’s solutions may calculate scores, classify results and present recommendations based on responses. The processing is intended for self-assessment, education, discussion, advisory work and planning of improvements.

It does not involve automated decision-making that produces legal effects concerning an individual or similarly significantly affects them. Results should not be the sole basis for decisions about recruitment, terms of employment, performance or other rights of individuals.

Assessment responses and results are not used by EB. Einarsson ehf. to train general artificial intelligence models.

EB. Einarsson ehf. does not sell personal data. Information may be processed by processors that provide hosting, databases, email delivery, operational monitoring, security and backup.

The locations and use of processors described above reflect the settings confirmed through technical review and processor dashboards at the effective date of this policy. The Vercel backend compute region and the Resend sending region may change if project settings are changed. The location of Vercel operational logs and other service data, and the exact location of all processing by Titan Email, have not been confirmed.

Processors receive only the access that is necessary and shall be subject to appropriate contractual requirements on privacy, confidentiality and security. Information may also be disclosed to public authorities when required by law.

In PAEI and ChangeReady, assessment results at the effective date of this version are sent directly by email via Resend. They therefore pass both through Resend and to the recipient’s email service and mailbox. The einarsson.io contact form likewise sends name, email address and enquiry content via Resend. Recipients are encouraged to retain such emails and attachments securely. Resend is not used in TeamCompass or TransformCompass.

The TeamCompass and TransformCompass databases at Neon are hosted in Frankfurt, Germany, and are therefore within the European Economic Area (EEA).

Backend functions for einarsson.io, PAEI, ChangeReady, TeamCompass and TransformCompass on Vercel run in Frankfurt, Germany, and are therefore within the EEA. Vercel nevertheless delivers web content via a distributed global content delivery network, and the location of operational logs and other service data is not limited to the compute region. Such data may therefore be processed outside the EEA.

Resend is used for the einarsson.io contact form and for PAEI and ChangeReady results emails. Email is sent from eu-west-1 in Ireland, but the choice of sending region does not determine where Resend account and service data are stored. Email metadata, delivery logs and API records are stored in the United States, and API records may contain request data, including message content. Resend is not used in TeamCompass or TransformCompass at the effective date of this version.

GitHub, Bluehost and Titan Email may process account, author, technical, communications or service data outside the EEA. GitHub does not, however, store assessment responses, assessment results or enquiries from the contact form.

Such processing takes place only on the basis of a lawful ground under Act No. 90/2018 and the General Data Protection Regulation. Where applicable, reliance is placed on an adequacy decision, standard contractual clauses adopted by the European Commission, or other recognised safeguards.

Personal data and confidential information are not retained longer than necessary having regard to the purpose of the processing, customer instructions and legal obligations. General retention rules are as follows:

When the retention period ends, information is erased or permanently anonymised. Anonymisation is considered sufficient only if it is not reasonably possible to re-link the information to an individual, team, company or organisation.

A customer may request a different retention period where there is a legitimate reason and this is consistent with law. When the company acts as a processor, retention and erasure also follow the controller’s documented instructions.

Deletion from an active database does not always immediately extend to existing security backups. Such data will not be returned to active use except for recovery due to an operational or security incident, and is deleted when the relevant recovery window expires.

The company may use necessary cookies or similar technologies to keep the service functioning, manage access and ensure secure operations.

Non-essential cookies, marketing technologies or analytics tools will not be activated unless the user has received appropriate information and given consent where required. If such technology is used, more detailed information will be published about its purpose, providers and duration.

EB. Einarsson ehf. applies technical and organisational measures that take account of the nature of the information, the scope of the processing and the risk associated with it. The measures may include, among other things:

• encrypted communications;
• access control and limitation of administrative access;
• protection of secrets and connection credentials;
• input validation;
• backup and recovery;
• operational, error and security monitoring;
• regular updates and maintenance; and
• procedures for security breaches.

Users are also responsible for retaining access links and results securely.

If a personal data breach occurs, its scope and risk will be assessed and measures taken to limit the impact.

The Icelandic Data Protection Authority (Persónuvernd) will be notified of a breach when the legal conditions for notification are met. Affected individuals will also be notified if the breach is likely to result in a high risk to their rights and freedoms.

When EB. Einarsson ehf. acts as a processor, the controller will be notified of a personal data breach without undue delay.

Depending on the circumstances, an individual may have the right to:

• obtain information about whether personal data concerning them are being processed and obtain access to those data;
• have inaccurate or incomplete data rectified;
• request erasure or restriction of processing;
• object to processing based on legitimate interests;
• receive data in a machine-readable format where the right to data portability applies; and
• withdraw their consent.

These rights are not absolute and may be subject to exceptions under law. Requests should be sent to hello@einarsson.io. It may be necessary to verify the identity of the requester before a request is handled.

Requests will be answered without undue delay and generally within one month. If the company processes the information on behalf of another controller, the request may be referred to that controller.

If an individual considers that the processing of personal data infringes the law, they may contact EB. Einarsson ehf. and ask for the matter to be examined. They also have the right to lodge a complaint with:

The services of EB. Einarsson ehf. are intended for companies, organisations and adults. They are not specifically intended for children.

Before children were offered participation in an assessment, the purpose, lawful basis, age of participants, information provided and whether parental consent was required would need to be specifically assessed.

Assessment responses and results may contain valuable information about the operations, management, staff, processes, technology or security of companies and organisations.

The company treats such information as confidential and uses it only to provide and operate the requested service, unless otherwise specifically agreed or required by law.

Information about particular companies will not be published or used for comparison without a clear lawful basis and appropriate safeguards. Assessment responses will not be used for benchmarking or comparison between companies unless that processing has been specifically enabled and the companies concerned have received clear information about its purpose and arrangements. Such comparative processing is not active at the effective date of this version.

The policy will be reviewed when changes are made to services or solutions, the processing of personal data, processors, laws or official guidance, or security and privacy measures.

The latest version will be published on einarsson.io together with the version number and the date of the most recent update. Material changes will be communicated in an appropriate manner.

Enquiries and requests concerning privacy may be sent to: