Data Protection
Data Protection and processing of personally identifiable information
Premium ehf.
(reg. no. 561210-0630, Aðalgata 34, 580 Siglufjörður), must collect and process personal information about employees. 'Personal information' refers to any kind of information that can be used to identify a specific individual. An individual is considered identifiable, directly or indirectly, by reference to an identifier such as their name, identification number, location data, online identifier, or one or more factors specific to them in its physical, physiological, genetic, mental, economic, cultural, or social form.
The company collects and processes necessary information about its staff, such as their name, identification number, address, email, telephone number, attendance, salary, and communication. This processing is necessary for the fulfilment of the employment contract and legal obligations, to safeguard the legitimate interests of the company, and to ensure its normal operation.
The company only shares personal information with third parties who are hired by the company to perform certain work, f.ex, service providers who host data or who handle payroll calculations for the company. In such cases, the company makes a processing agreement with the relevant party, and all such agreements stipulate the third party's obligation to follow the company's instructions on the processing of personal information. A third party is not allowed to use the data for other purposes than stipulated in the contract. The third party is obligated to ensure the security of the information.
The company may also need to share information with third parties who are not bound by the company's instructions on their processing when there is a legal obligation, for example, with the Director of Internal Revenue in regard to salary payments.
The company keeps accounting records for seven years. Other employee information is deleted 2 years after an employee quits.
Employees have rights under data protection laws, such as to revoke their consent (when applicable), the right of access to data, the right to correct wrong or misleading information, the right to demand personal information to be deleted, the right to prevent the processing of personal information, the right to transfer their own data, and the right to lodge a complaint with the Data Protection Authority or other supervisory organisations. However, it should be noted that individuals' rights may be subject to conditions.
If employees have further questions about how Sparnaður handles their personal information, they are free to direct inquiries to the company’s data protection representative.