Keldan's terms

1. Keldan's role

In connection with the processing of personal data on the PEP list, Keldan is the data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as „GDPR"), see also Act No. 90/2018 on Data Protection and the Processing of Personal Data (hereinafter referred to as "the Data Protection Act" or "pvl.").

2. Processing and collection of personal data

In connection with the PEP list, Keldan collects information about persons who are politically exposed within the meaning of Act No. 140/2018 on protection against money laundering (hereinafter referred to as "the Money Laundering Act" or "pþvl."). These are individuals who have held senior positions in public service, together with their immediate family members and close associates. The personal data that Keldan processes for this purpose are: name, ID number, position, the name and ID number of the party to whom the individual is connected (if the individual is not, or has not themselves been, in a senior position in public service) and information about the period during which the individual held the position (dates).

Information about individuals on the list is collected from public websites, Registers Iceland, the media and the Register of Companies.

3. Purpose of the processing of personal data and Keldan's legal basis

General personal data

The processing is necessary for the legitimate business interests of Keldan, cf. point 6 of Article 9 of the Money Laundering Act. The interests, fundamental rights and freedoms of the data subject which require the protection of personal data are not considered to override the legitimate interests underlying the processing.

Sensitive personal data

It is clear that some of the above information may be regarded as sensitive personal data, since under point (a) of point 3 of Article 3 of the Data Protection Act an individual's political opinions are sensitive personal data. However, with reference to point 5 of Article 11 of the Data Protection Act, it is permitted to process sensitive personal data that the data subject has manifestly made public themselves. In that regard, Keldan collects and processes only information about political opinions that has appeared in the context of the person concerned having taken part in politics publicly.

4. Disclosure of personal data to third parties

Keldan discloses personal data to its joint controllers, that is to say the obliged entities that subscribe to the list. Keldan may also disclose information to third parties engaged by the company to provide services to Keldan in connection with predetermined work, such as service providers in the field of information technology or hosting. In such cases Keldan enters into a data processing agreement with the party concerned. Such an agreement provides, among other things, for the data processor's obligation to follow Keldan's instructions on the handling of personal data, and the processor may not use it for any other purpose. The data processor is likewise obliged to ensure the security of the information in an appropriate manner. In other cases it may also be necessary for Keldan to disclose personal data to third parties, for example where there is a legal obligation to do so.

Under data protection law, Keldan may only transfer personal data outside the EEA where the transfer is necessary, for example to perform a contract and, in limited cases, for the legitimate interests of the company. Furthermore, Keldan may only transfer such data to countries that ensure an adequate level of protection (in the assessment of the European Commission) or where Keldan has put appropriate safeguards in place.

5. Retention period for personal data

Personal data is retained for as long as there are lawful or legitimate grounds for the processing. Data is therefore erased no later than 18 months after the status of registered individuals has changed such that they are no longer considered to fall within the risk group for political exposure within the meaning of the Money Laundering Act. To ensure the above, Keldan carries out a regular review of the registration of the information and updates it regularly in the light of new information.

6. Rights of individuals

Data protection law provides for various rights of individuals, such as the right of access, the right to data portability, the right to rectification and erasure, and the right to object to or restrict the processing of personal data. Individuals intending to exercise their rights must prove their identity. The rights may be subject to limitations arising, among other things, from law, from the interests of others to whom the information relates, or from significant financial or commercial interests. Requests concerning the above rights are generally free of charge to individuals. Keldan reserves the right to charge a fee where more than one copy of personal data is requested. Keldan also reserves the right to refuse a request that is manifestly unfounded or excessive.

Before an individual is entered on the PEP list, they are sent a written notification that it is intended to enter them on the list, and are given a period of 14 days to submit comments and/or corrections regarding the intended registration.

7. Security and monitoring

Keldan places great emphasis on security in the processing and handling of personal data. Keldan ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by means of appropriate technical and organisational measures.

Should a security breach occur in the handling of personal data where it is confirmed or suspected that personal data has come into the hands of unauthorised parties, the Icelandic Data Protection Authority and, where applicable, the individuals concerned are notified of the breach unless it does not entail a high risk to individuals.

8. Complaint to the Data Protection Authority

If a dispute arises in the handling of personal data, an individual always has the right to submit a complaint to the Icelandic Data Protection Authority by email to the address postur@personuvernd.is.

9. Changes to the privacy policy

Keldan is constantly seeking ways to increase the security of personal data. The privacy policy may therefore change in step with increased security. Changes to the policy take effect upon publication of the updated policy on Keldan's website: www.keldan.is.