Privacy Policy
Last updated: [date] · Applies to magninnkaup.is / order2gether.is
ORDER2GETHER is committed to handling the personal data of everyone who takes part in our group buys carefully. This policy explains what data we collect, what it's used for, who gets access to it, and what rights you have.
1. Data controller
The data controller for this processing is:
Magninnkaup ehf. (operating internationally under the ORDER2GETHER brand), co. reg. no. [registration number], [address], Iceland.
Email: privacy@magninnkaup.is
2. What personal data we collect
- Identification data: name, email address, phone number.
- Delivery data: address or chosen pickup location.
- Order data: which group buy you've joined, quantity, date.
- Payment data: processed directly by our payment provider — we never see or store your full card number (see section 4).
- Website usage data, to the extent allowed by your consent to statistics and marketing cookies (see section 6).
- If you take part in the broker or friend-referral programme: which code was used, so discounts and commissions can be calculated.
3. What we use the data for
- To receive and fulfil your order in a group buy, including contacting you about status, delivery and any refund.
- To calculate and pay discounts or commissions linked to broker or friend-referral codes.
- To meet legal obligations, including accounting and consumer-protection law.
- To improve the website and service, based on your consent to statistics cookies.
- To send you marketing content, only where you have given specific consent for that.
4. Payment information and billing
When you sign up for a product in a group buy, the payment is charged from your card to the card company. The card company does not pay out to ORDER2GETHER until the product has been delivered to you. If the minimum number of participants isn't reached, or the product doesn't arrive within the stated deadline, you get the payment back from the card company.
Card processing itself is handled by our certified payment provider, not by ORDER2GETHER directly. We do not store card numbers or security codes (CVV) on our own systems.
5. Sharing with third parties
We only share personal data with third parties where necessary to provide the service:
- Our payment provider, to process and collect payment.
- Freight and delivery providers, to get the product to you.
- Suppliers/manufacturers, to the extent needed for production and quality purposes (e.g. number of units ordered).
- The broker who made a given sale, to the extent needed to calculate commission.
- Public authorities, where we are required to by law.
We never sell personal data to third parties.
6. Cookies
The website uses cookies in the following categories. You choose which categories to allow, apart from necessary cookies which are always active:
- Necessary cookies — ensure basic site functionality, e.g. remembering whether you've already made a cookie choice. These cannot be switched off.
- Statistics cookies — help us understand traffic and usage so we can improve the site. Only active with your consent.
- Marketing cookies — used to show relevant content and measure marketing performance. Only active with your consent.
You can change your cookie choices at any time via "Cookie settings" at the bottom of the page.
7. How long we keep data
We keep personal data only as long as necessary for the purpose it was collected for, or as long as required by law (e.g. accounting records for 7 years under Icelandic accounting law). Data that is no longer necessary is deleted or anonymised.
8. Data security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, including encryption of data in transit (HTTPS) and restricted staff access to sensitive data.
9. Your rights
Under the Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data, and EU Regulation 2016/679 (GDPR), you have the right, among other things, to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Request deletion of your data, provided no legal obligation requires us to retain it.
- Object to processing based on legitimate interests, including direct marketing.
- Withdraw your consent to cookies or marketing at any time.
- Lodge a complaint with the Icelandic Data Protection Authority, Persónuvernd (personuvernd.is), if you believe our processing breaches the law.
10. Changes to this policy
We may update this policy if the service or the legal environment changes. The date of the last update is shown at the top of the page. Material changes will be announced prominently on the website.
Questions about this policy or about your personal data can be sent to privacy@magninnkaup.is.
