GAZA COMPANY EHF.
gaza.is
Last updated: 19 October 2026
Introduction
Gaza Company respects the privacy of its customers and visitors. This Privacy Policy explains how personal information is collected, used, stored, and shared when customers visit https://gaza.is, place an order, or contact the company.
We process personal data in accordance with applicable Icelandic data protection legislation, including Act No. 90/2018 on Data Protection and the Processing of Personal Data, and the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.
This Privacy Policy explains what personal data we process, why we process it, the legal bases for processing, how long we retain it, when it may be shared, and the rights available to you.
Data Controller
The company responsible for processing personal data is:
Gaza Company ehf.
Kennitala: 631224-1720
Location: Safamýri, 108 Reykjavík, Iceland
Email: gaza.iceland@gmail.com
Telephone: +354 768 5356
Website: https://gaza.is
Customers may contact us by email regarding their personal data and privacy rights.
Personal Information We Collect
Depending on how customers interact with our website, we may collect names and contact information; billing and delivery addresses; email addresses and telephone numbers; order details and transaction records; customer communications and inquiries; technical information needed for website operation and security; and information voluntarily submitted through website forms.
Depending on the website functionality and technologies in use, technical information may include IP addresses, browser and device information, website activity, security logs and cookie identifiers.
Where applicable, we may also process information about marketing preferences, subscription status and consent or withdrawal records.
Payment card information is handled through the payment services used by the website. Gaza Company does not intentionally collect or store complete payment card numbers in its own customer database.
We aim to collect only the personal data necessary for the purposes described in this Privacy Policy.
How We Use Personal Information
We use personal information to process and fulfill orders; arrange payments and delivery; communicate with customers; handle returns, complaints and support requests; maintain financial and accounting records; protect the website and prevent fraud; and meet legal obligations.
We may also use personal data to resolve disputes, establish, exercise or defend legal claims, and maintain and improve the security and operation of our services where appropriate.
We do not sell customers’ personal information to advertisers or data brokers. Marketing emails, where offered, will be sent only when a lawful basis exists and applicable marketing and privacy requirements are met.
Legal Basis for Processing
We process personal data only where a lawful basis under applicable data protection legislation exists. Depending on the purpose, this may include the following legal bases under the GDPR:
Performance of a contract: To accept orders, process purchases, arrange delivery, process refunds, and provide customer service connected with a purchase.
Legal obligations: To meet applicable accounting, tax, consumer protection, and other statutory requirements.
Legitimate interests: To operate and protect the website, prevent fraud, protect the company’s legal rights, and respond to certain business inquiries, where these interests are not overridden by individuals’ rights and freedoms.
Consent: Where required by law, for optional marketing communications or non-essential cookies and similar technologies.
Where processing is based on consent, individuals may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
The applicable legal basis depends on the specific processing activity. Where required, additional information about the purpose and legal basis will be provided at the point of collection.
Payments
Payments made through Gaza Company are processed by the payment service providers available at checkout. Relevant providers may process information needed to authorize transactions, prevent fraud, and comply with financial regulations.
Depending on the payment method, this may include payment details, transaction identifiers, billing information and information needed to meet applicable legal and regulatory obligations.
Customers should consult the privacy information provided by the payment provider for details of its own processing activities.
Payment providers may act as independent controllers or processors, depending on the services they provide and the circumstances of the processing.
Gaza Company does not intentionally collect or store complete payment card numbers in its own customer database.
Delivery Services
To deliver orders, we may share the recipient’s name, delivery address, telephone number, and relevant shipment details with the selected delivery provider. Only information reasonably necessary to arrange delivery will be shared.
Delivery providers may process personal data in accordance with their own privacy notices and applicable data protection requirements.
Website Technology and Cookies
Our website may use cookies or similar technologies required for essential functions such as shopping cart management, checkout, and website security.
Additional analytics, advertising, or other optional cookies may be used only if those services are enabled and in accordance with applicable consent requirements.
Where consent is legally required, non-essential cookies and similar technologies will only be used after the required consent has been obtained. Visitors may be able to manage their preferences through the website’s cookie consent interface.
Where applicable, visitors can change or withdraw their cookie preferences at a later time.
Essential technologies that are strictly necessary for a service requested by the visitor may be used where permitted by applicable law without consent.
The website’s cookie information or consent interface should identify the actual cookie categories, purposes, retention periods and relevant third-party providers.
Sharing Information With Service Providers
Gaza Company may share information where reasonably necessary with website hosting and maintenance providers, payment processors, delivery companies, accounting providers, and technical support or website security services.
Other recipients may include customer support providers, business communication providers, professional advisers and public authorities where disclosure is required or permitted by law.
Service providers are required to handle personal data in accordance with applicable data protection requirements.
Where a service provider processes personal data on our behalf, we will implement appropriate contractual and organizational safeguards as required by applicable data protection legislation.
Some third parties may act as independent controllers and determine their own purposes and means of processing. In those cases, their own privacy notices may also apply.
We may disclose information to public authorities when legally required.
International Data Transfers
Some technology providers may process personal information outside Iceland or the European Economic Area.
Where personal data is transferred to a country outside the EEA, we will ensure that the transfer complies with applicable data protection legislation.
Depending on the circumstances, this may include reliance on an applicable adequacy decision, appropriate safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism.
Where required, information about the relevant transfer safeguards and how to obtain a copy of them will be made available upon request.
Personal data will only be transferred internationally where there is a lawful basis and the requirements of applicable data protection legislation are satisfied.
Data Retention
We retain personal information only for as long as necessary for the purpose for which it was collected, or longer when required by law.
Retention periods depend on the type of information, the purpose of processing and any applicable legal obligations. In general:
- Order and transaction records are retained for the period necessary to administer purchases, handle returns and disputes, and meet applicable accounting and tax requirements.
- Accounting records are retained for the applicable statutory retention period under Icelandic law.
- Customer inquiries and correspondence are retained for a period appropriate to the inquiry, customer service needs and any related legal claims or obligations.
- Marketing information is retained while the relevant lawful basis remains valid and the information is necessary for the marketing purpose, subject to applicable requirements and any necessary suppression records.
- Technical and security logs are retained for a period appropriate to website security, troubleshooting, fraud prevention and other legitimate operational purposes.
When personal data is no longer required, we will delete it, anonymize it, or otherwise dispose of it securely, subject to any legal obligation to retain it.
Data Security
We take reasonable technical and organizational measures to protect personal information against unauthorized access, loss, misuse, and disclosure.
These may include access controls, secure website connections, restricted account permissions, and appropriate security practices.
Access to personal data is limited to persons and service providers who need it for legitimate business or legal purposes.
Where a personal data breach occurs, we will assess and respond to it in accordance with applicable legal requirements, including any applicable notification obligations.
No internet-based service can guarantee absolute security.
Your Privacy Rights
Subject to applicable law, individuals may have the right to access their data, correct inaccurate information, request deletion, restrict processing, object to certain processing, receive portable data where applicable, withdraw consent, and lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd).
The right to erasure, restriction and data portability is subject to the conditions and exceptions established by law.
You have the right to object at any time to the processing of personal data for direct marketing purposes.
To exercise these rights, email gaza.iceland@gmail.com.
We may request information reasonably necessary to verify your identity before responding to a request.
We will respond to requests within the time limits established by applicable law, normally within one month of receipt. Where permitted by law, this period may be extended in certain circumstances, and we will inform you of the extension and its reasons.
You may lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd):
https://island.is/en/o/the-data-protection-authority
Children’s Privacy
The online store is intended for customers legally able to enter into purchases.
We do not knowingly collect personal data from children for purposes for which an appropriate legal basis or required authorization is absent.
Where we become aware that personal data has been collected or processed unlawfully, we will take appropriate steps to address the situation, which may include deleting the information where legally appropriate.
Nothing in this section limits any rights that children may have under applicable data protection legislation.
External Websites
Our website may contain links to external websites and third-party services.
Gaza Company is not responsible for privacy practices of independent websites. Visitors should review their privacy policies before providing personal information.
Where third-party services are integrated directly into our website, their technologies may process personal data as described in the relevant cookie information or other applicable notices.
Changes to This Privacy Policy
Gaza Company may update this Privacy Policy to reflect changes in website functionality, business operations, or applicable law.
Updated versions will be published at https://gaza.is/privacy-policy/ with a revised date.
Where required by law, we will provide additional notice of material changes.
Contact
For questions about this Privacy Policy or personal data processing, contact:
Gaza Company ehf.
Email: gaza.iceland@gmail.com
Telephone: +354 768 5356
Location: Safamýri, 108 Reykjavík, Iceland
We will handle privacy inquiries and requests in accordance with applicable Icelandic data protection legislation and the GDPR.