Data Protection Policy

PURPOSE

Primex ehf. ("The Company") is committed to the protection and security of personal data in its possession at any given time. The Company processes personal data provided to it as the data controller.

RECORDING AND PROCESSING

The Company records only those data about employees and other individuals that it is required to retain in accordance with laws and regulations, collective agreements, employment contracts, the data subject's consent, or other legitimate interests of the controller.

The Company does not use automated decision-making, such as profiling, in connection with the processing of personal data.

The Company limits processing to what is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract; to comply with a legal obligation; or to protect vital interests of the data subject.

SECURITY, STORAGE AND RETENTION

The Company emphasizes secure storage of personal data through appropriate technical and organizational safeguards

Personal data will not be used for purposes other than those disclosed at the time of collection. The Company does not disclose personal data to third parties except on the basis of a legal authorization, regulatory order, court order, written data processing agreement, or the relevant employee's consent. The Company reserves the right to disclose anonymized data to third parties for legitimate purposes.

Data retained from electronic surveillance are stored in accordance with applicable rules on electronic monitoring. Other personal data are not retained longer than necessary and are erased when no longer useful.

YOUR RIGHTS

Subject to the conditions set out in applicable legislation, you have the right to: access, rectification, and erasure; restriction or objection to processing; and data portability. You also have the right to lodge a complaint with the competent supervisory authority.

PRIVACY NOTICE TO EMPLOYEES (EXCERPT)

In connection with your employment, the Company, as the data controller, will collect and process your personal data for the purposes specified herein. Examples of data processed include: national ID number, contact details, job title and department, payroll and bank information, time records, information on education and previous employment, and performance evaluations. Health data and trade union membership may also be processed in connection with payroll administration and reimbursements.

Recordings from security cameras are retained for no more than 30 days. Access to recordings is limited to those who require it for their duties.

PRIVACY NOTICE TO APPLICANTS (EXCERPT)

For the handling of applications, the Company processes: name, date of birth, e‑mail, home address, telephone number, education and employment history, diplomas, references, and results of tests/evaluations related to the recruitment process. Data may be transferred to system and cloud service providers. The general retention period for application data is six months.

REVIEW

This Data Protection Policy is reviewed regularly and updated where necessary.