Privacy notice

This notice follows the Icelandic Data Protection Act No. 90/2018 and the GDPR.

Who we are

Operient ehf. (kt. 430222-1710), Garðabær, Iceland, is the controller of the personal data described here. Contact: info@operient.is, +354 649 80 44.

When we act for our clients

When a client gives us operational evidence for an assessment, we process it on the client's behalf, as a processor, under the client's instructions and our engagement terms. That evidence should not contain personal data. If any arrives, we delete it and tell the client.

What we collect

• Enquiries — name, organisation, role, work email, the process area or situation you describe, and your message.
• Engagement contacts — names, roles and work contact details of the people we work with, and our correspondence and meeting notes.
• Website use — aggregated visit statistics that do not identify you, and technical logs needed to run and secure the site.

Why, and on what legal basis

• Answering your enquiry and arranging a conversation — steps taken at your request before an agreement, and our legitimate interest in responding to business enquiries.
• Delivering an engagement — performance of the contract with your organisation, and our legitimate interest in working with its named contacts.
• Keeping accounting and engagement records — legal obligation, including Icelandic bookkeeping law, and our legitimate interest in being able to account for our work.
• Running and securing the website — legitimate interest.

Where we rely on legitimate interests, you can object at any time.

Who receives it

Service providers acting on our behalf under written agreements: Website and enquiry form: Base44, Inc., United States. Base44 hosts this website and stores enquiries submitted through the form, as our processor. Transfers outside the EEA are covered by the safeguards in Base44's data processing addendum: the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. Email: Zoho Mail, hosted in Zoho's EU data centre. Website analytics: Plausible Analytics, EU. We do not sell personal data or use it for advertising.

Transfers outside the EEA

Some providers are based in, or can access data from, the United States. Where that happens we rely on standard contractual clauses and assess each provider before use.

How long we keep it

• Enquiries that do not lead to an engagement: deleted after 24 months.
• Engagement contacts and correspondence: for the engagement and 3 years after, unless law requires longer.
• Accounting records: as long as Icelandic bookkeeping law requires, currently seven years.
• Assessment evidence held for a client: deleted within 30 days after the client's access ends, or sooner on request.

Your rights

You can ask for access to, correction or deletion of your personal data, restrict or object to its processing, receive it in a portable format, and withdraw consent where processing relies on it. Contact info@operient.is; we reply within one month. You can also complain to Persónuvernd, the Icelandic Data Protection Authority (www.personuvernd.is).

Cookies

This website does not use cookies for analytics or advertising. Our analytics counts visits without cookies and without identifying you.

We store your language choice in your browser so the site remembers it. It is not used to track you.

Changes

We update this notice when our processing changes and show the date at the top.