Last updated 2026-11-09
This privacy notice explains how ELDEY hugbúnaður ehf. ("ELDEY", "we", "us"), reg. no. 521211-1720, Engjateigi 9, 105 Reykjavík, Iceland, collects and uses personal information when you use our services: the Eldey Mobile applications for iOS and Android, the Eldey web application and admin portal, the pages at skilmalar.eldeysoft.is, and our support (together the "Services"). Our public marketing website is covered separately; see Our website. If you have questions, contact us at privacy@eldeysoft.is or +354 414 0300.
1. Who is responsible for your data
2. What information we collect
Most of the information in Eldey Mobile is business data that our customers' staff enter while doing their work: orders, customers, products, notes, and similar records. For that data the customer (your employer, or the business whose account you use) is the controller, and ELDEY processes it only on the customer's instructions under our Data Protection Addendum. Questions about that data, and requests to access, correct or delete it, go to the customer's administrator; we help the customer answer them.
ELDEY is the controller for the information described in this notice: the data needed to run your user account and the app on your device, our customers' contact and billing details, and correspondence with our support.
Account information. When ELDEY or a customer's administrator creates a user for you, or you register, we store your name, username or email address, role, and your password in hashed form. If you use two-factor authentication or a passkey, we store the data needed to verify it.
Customer contact and billing information. For the business that holds the subscription: company name, registration number (for a sole trader, the owner's kennitala), postal address, the email address invoices are sent to, and the name, email address and, where given, telephone number of its contact persons. We keep these in our accounting system, which runs in our own hosting environment in the EEA, together with the invoices and payment records of the subscription.
Support correspondence. What you send us by email or telephone when you ask for help, which may include excerpts from your business records.
Device and app information. When you use the mobile applications we receive the device model and operating system version, an app and device identifier, the app version, and, if you allow notifications, a push notification token. Our servers log the IP address, time and requested resource of each request for security and troubleshooting.
Location. Only if your organisation has enabled location features and you allow it on your device. The app reads your location at the moment you take an action that uses it, for example to find nearby customers or to fill a location field on an order. Location is never read in the background or tracked continuously. You can withdraw the permission in your device settings at any time.
Camera. Only when you choose to scan a barcode or take a photo in the app. Images are stored with the record you attach them to, in your organisation's data.
Push notifications. If you allow notifications, we send them through Apple (iOS) or Google (Android). A notification carries the identifiers needed to open the right screen and a short text, which may include business record content such as an order or customer name. You can turn notifications off in your device settings; the token is deleted when you sign out or when your administrator removes the device.
What we do not collect. The Services contain no analytics or advertising tools and set only the cookies needed to sign in and stay signed in, we do not ask users of the applications for a national identification number (kennitala), and we do not buy or receive information about you from third parties.
| Purpose | Information used | Legal basis (GDPR Article 6) |
|---|---|---|
| Creating, securing and operating your account and the applications | Account, device and app information | Performance of a contract (with the customer, for its users) |
| Delivering push notifications you have allowed | Push token, notification content | Performance of a contract; your device permission, which you can withdraw |
| Location features your organisation has enabled | Location at the moment of an action | Your device permission, which you can withdraw; the customer is responsible for its own legal basis as controller of the records |
| Answering support requests | Support correspondence, account information | Performance of a contract; legitimate interest in supporting users |
| Invoicing and account management | Customer contact and billing information | Performance of a contract; legal obligation (Icelandic accounting law) |
| Security, abuse prevention and troubleshooting | Server logs with IP addresses, device identifiers | Legitimate interest in keeping the Services secure |
| Informing you about changes to the Services or these terms | Contact information | Legitimate interest; legal obligation |
We do not use your information for marketing to you unless you have asked us to, and we do not make automated decisions with legal or similarly significant effects about you.
We use a small number of service providers, who process data only on our instructions under written data processing terms:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting of all Services | All data stored in the Services | EEA (currently Ireland; backup copies may be held in another EEA region) |
| Google Ireland Limited (Firebase Cloud Messaging) | Push notifications to Android devices | Push tokens, device and app identifiers, notification content | EEA and United States |
| Apple Distribution International Limited (Apple Push Notification service) | Push notifications to iOS devices | Push tokens, device and app identifiers, notification content | EEA and United States |
| Microsoft Ireland Operations Limited (Microsoft 365) | Our support email | What you send to our support | EEA |
Apple and Google also act as independent controllers when they operate the App Store and Google Play, including app installation, crash reporting and store statistics; their own privacy notices apply to that.
Otherwise we disclose personal information only when the law requires it, for example to a court or a public authority with a legal basis, or as part of a sale or merger of our business, in which case the new owner is bound by this notice. We do not sell personal information.
ELDEY is established in Iceland and stores and processes data within the European Economic Area. Transfers outside the EEA are limited to push notification data sent through Google and Apple, which may process it in the United States. These transfers rely on the EU Standard Contractual Clauses in those providers' terms and on their certification under the EU-US Data Privacy Framework. You can ask us for more information about these safeguards.
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access limited to named administrators protected by multi-factor authentication, logging and alerting, automated encrypted backups, and a written incident response procedure. The measures are described in Annex II of our Data Protection Addendum. No system is completely secure, and you should keep your sign-in details and your device protected.
Under the GDPR and the Icelandic Data Protection Act No. 90/2018 you have the right to ask for access to the personal information we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing rests on your permission, you can withdraw it at any time, which does not affect processing before the withdrawal.
For the business data in Eldey Mobile, your request goes to the organisation whose account you use, which is the controller; we help it respond. For the data ELDEY is responsible for, contact us at privacy@eldeysoft.is. We answer within one month.
If you believe we process your information unlawfully, you have the right to complain to the Icelandic Data Protection Authority, Persónuvernd, https://www.personuvernd.is, or to the data protection authority in the EEA country where you live or work.
The Services are made for business use by adults. We do not knowingly create accounts for or collect information from children under 16. If you believe a child has an account, contact us and we will remove it.
We update this notice when our Services or our processing change. The date at the top shows the current version, and the version history below lists what changed. For material changes we will also notify customers' administrators.
Version history
This notice covers the Services. Our public website, www.eldeysoft.com, is a separate marketing site operated on a third-party platform (Wix) and uses that platform's and other third parties' visitor measurement tools and cookies. The website is being updated and will carry its own cookie and privacy information. Until then, you can block or delete its cookies in your browser; the website works without them.
ELDEY hugbúnaður ehf., reg. no. 521211-1720
Engjateigi 9, 105 Reykjavík, Iceland
privacy@eldeysoft.is, +354 414 0300