This Privacy Policy explains how Gatula ehf. operating Gatula Labs collects, uses, stores and protects personal data when you contact us, request a project, use our website or work with us. Last updated: 2 July 2026.
For website enquiries, project communication, invoicing, customer relationship management and our own business administration, Gatula ehf. is usually the data controller. For systems we build or maintain on behalf of a Client, we may act as a data processor according to the Client's instructions.
We may collect name, email, phone number, company name, project details, messages, budget range, timeline, website URL, invoice details, billing records, technical access information, IP address, browser/device information, server logs and communication history.
If you give us credentials or access to third-party systems, you must have permission to do so.
We use personal data to respond to enquiries, prepare proposals, provide services, manage projects, issue invoices, communicate with Clients, secure systems, troubleshoot issues, improve our website, keep business records and comply with legal obligations.
Depending on the situation, processing may be based on steps before entering into a contract, performance of a contract, legal obligation, legitimate interest, consent, or the need to establish, exercise or defend legal claims.
Our website may use essential technical cookies and may use analytics, performance or security tools to understand website usage and improve reliability. You can control cookies through your browser settings. Some features may not work correctly if essential cookies are blocked.
We may share data with trusted service providers where necessary, including hosting providers, email providers, domain registrars, payment or invoicing providers, analytics tools, cloud platforms, subcontractors and professional advisers. We do not sell personal data.
Some tools used in modern IT work may process data outside Iceland or the EEA. Where required, Gatula Labs aims to rely on appropriate safeguards such as contractual protections, provider security terms or other lawful transfer mechanisms.
We keep personal data only as long as needed for the purpose collected, including project delivery, support, legal, accounting, tax, warranty, security and dispute purposes. Enquiry data may be deleted earlier on request unless we have a legitimate reason or legal obligation to keep it.
Subject to applicable law, you may have rights to access your personal data, correct inaccurate data, request deletion, restrict processing, object to processing, request portability and withdraw consent where processing is based on consent.
Where we build or maintain a Client system, the Client is responsible for telling us what personal data the system may contain and whether special legal, industry or security requirements apply. A separate data processing agreement may be required for systems that process personal data on behalf of the Client.
No website, server, email account, database or online system can be guaranteed as completely secure. Clients should use strong passwords, multi-factor authentication, secure account ownership, limited access and regular internal procedures.
Email us with the details and we will handle the request according to applicable law and project obligations.
