Privacy policy

1. Controller

KGBS ehf., ID no. 630625-1300, Vestmannabraut 11, 900 Vestmannaeyjar, Iceland, runs Hljómey, the website hljomey.is, the Hljómey app and the Hljómey games, and is responsible for the processing described here.

Questions about privacy can be sent to hljomey@hljomey.is or by phone on +354 849 1826.

2. The website in general

You do not need to register or give any information to browse the website. No cookies are used to track visitors or advertise, and there are no analytics tools such as Google Analytics or Facebook Pixel on the site. To see how many people visit, we use Vercel Web Analytics, which uses no cookies and stores nothing in your browser. It only records which page was viewed, where the visit came from (e.g. Facebook or Google), country, and device and browser type. IP addresses are not stored and visitors are not tracked across days or websites. The legal basis is our legitimate interest in knowing how the website is used. The site’s fonts and images are hosted on the site itself, so nothing is fetched from Google Fonts or other font services.

The website host (Vercel) logs technical information that comes with every visit, such as IP address, browser type and the page requested. This is done to run the site and protect it from abuse, and the information is kept only for a short time. The legal basis is our legitimate interest in keeping the website running and secure.

3. Videos from YouTube (Google)

The video at the top of the front page is hosted on this website itself, so nothing is loaded from YouTube or Google when the front page opens.

The videos on the Photos page are played from YouTube, operated by Google Ireland Ltd., in privacy-enhanced mode (youtube-nocookie.com). They do not load until you click them. Your browser then connects to Google’s servers, which receive your IP address and technical information about your browser and device, and YouTube may store information in your browser for the player to work. Hljómey receives none of this information.

Google processes the information under its own privacy policy (policies.google.com/privacy) and may transfer it to the United States under the EU–US Data Privacy Framework. If you do not want your browser to connect to YouTube, simply do not click the videos.

4. The Hljómey app

• No sign-in: you do not need to register or give any information to use the app.
• Favourite artists and reminders are stored only on your phone and go nowhere else. Reminders are local notifications shown by the phone itself, and the app asks for permission before turning them on.
• The schedule and venue information are loaded from the Hljómey database (Supabase), which then sees your phone’s IP address. If the database does not respond, the app loads the same information from Google Sheets, and Google receives the IP address.
• The map: on iPhone the maps come from Apple and on Android from Google. The map provider receives your IP address and the area being viewed. The app does not ask for or use your location.
• The Games tab opens the Hljómey games site inside the app, see the next section. Links to e.g. Spotify and Facebook open in your browser, where their terms apply.

5. Hljómey games

• What is collected: the name or nickname you enter when you join, your answers and score, and in karaoke and the guitar party the song you request. You do not need to use your real name.
• Purpose: to run the game and show the standings and winners on screen.
• Legal basis: legitimate interest in running a game you choose to take part in.
• Retention: the information is stored in the Hljómey database (Supabase) and old games are deleted automatically after 30 days.

The games site loads fonts from Google Fonts (Google), code libraries from jsDelivr and cdnjs (Cloudflare), song previews from Deezer and karaoke videos from YouTube (Google). These providers receive your IP address and technical information about your browser when the content is loaded. A game host may also connect to Spotify and MusicBrainz to choose songs.

6. Ticket registration and purchase

• What is collected: name, email, phone number, the number of tickets requested, your status in the ballot and, when you buy, payment and ticket code.
• Purpose: to run the ballot, ensure each person registers only once, contact winners and people on the waiting list, receive payment and deliver tickets.
• Legal basis: steps taken at your request before entering into a contract and performance of a contract, and a legal obligation under the Bookkeeping Act once payment has been made.
• Retention: entries that do not lead to a purchase are deleted automatically six months after registration closes. Information about paid tickets is kept for seven years as accounting records.
• Newsletter: you are only added to the mailing list if you specifically tick the box when registering.
• Previous guests: to give guests from previous years an extra entry in the ballot we keep the email addresses and phone numbers of buyers at earlier Hljómey festivals (from the Midix ticketing system), without names. They are only used to match registrations and are not used to email you. The legal basis is Hljómey's legitimate interest in rewarding loyal guests. You can object and ask to be removed from the list at hljomey@hljomey.is.

7. Newsletter

• What is collected: your email address, the language of the site and where you signed up (e.g. the front page), along with the time.
• Purpose: to send news about Hljómey, such as artist announcements and when ticket sales open.
• Legal basis: your consent, given when you sign up.
• Retention: until you unsubscribe, which you can do at any time with the link in the email or by writing to hljomey@hljomey.is.

8. Web shop

• What is collected: name, email, phone number, delivery method, address and Pósturinn delivery point if the order is sent, any note you write, the products and amounts, and the time of order and payment.
• Purpose: to receive and process the order, send you a confirmation by email, deliver the goods, contact you about delivery, issue a receipt, handle returns, complaints and refunds, and keep accounts.
• Legal basis: performance of a contract with you, and a legal obligation under the Icelandic Bookkeeping Act no. 145/1994.
• Retention: accounting records, including orders and receipts, are kept for seven years from the end of the financial year as the Bookkeeping Act requires, and then deleted.
• Card details: payment is made on the Rapyd payment page. Hljómey never sees or stores card numbers.

9. Storage in your browser

Your shopping cart is stored in your browser (localStorage) so it is kept between pages. It is never sent to us until you place an order, and you can delete it by emptying the cart or clearing your browser data. Hljómey staff who sign in to the admin panel get a sign-in token in their browser. This is necessary for the website to work and does not require consent.

10. Who receives the information

The information is never sold or used for advertising. Only the people who run Hljómey have access to it, and the following processors handle it on our behalf:

• Supabase: database for the newsletter and orders, hosted in Ireland (within the EEA). When you sign up for the newsletter or place an order, your browser connects to Supabase directly and Supabase sees your IP address. Some images on the site are also loaded from there.
• Vercel: website hosting and visitor statistics (Web Analytics). Vercel is a US company, and transfers take place under the EU–US Data Privacy Framework and standard contractual clauses.
• Rapyd: payment provider that receives payments and processes card details.
• ImprovMX: forwards email sent to @hljomey.is addresses, e.g. replies to newsletters and confirmations, to the Hljómey inbox. ImprovMX therefore receives the content of those emails and processes it under its own privacy policy.
• Resend: sends order confirmations and newsletters to subscribers. Resend receives your email address and, when you order, your name and the order details. Resend is a US company, and transfers take place under the EU standard contractual clauses.
• Pósturinn (Iceland Post): receives name, address, email, phone number and parcel weight when goods are sent, so they can deliver and notify the buyer. The postcode and cart weight are sent to Pósturinn on the checkout page to get the shipping price.
• Google: receives your IP address and technical information when a YouTube video plays, when the app loads the schedule from Google Sheets, when a map is shown on Android and when the games site loads fonts. Google is an independent controller for that processing.
• Apple: maps in the app on iPhone.
• Deezer, jsDelivr and Cloudflare (cdnjs): content loaded by the games site, see the section on the games.

No other third parties receive information from the website, the app or the games. This was checked by logging every connection the website makes in a browser and reviewing the code of the app and the games.

11. Links to other websites

The website links to Spotify (artists’ music), the Hljómey games site and other websites. Nothing is sent to them until you click the link, after which that website’s own terms and privacy policy apply.

12. Your rights

You have the right to know what information we hold about you and to get a copy, to have incorrect information corrected, to have information deleted when it is no longer needed, to object to or restrict processing, to receive the information in a machine-readable format, and to withdraw consent at any time.

Send your request to hljomey@hljomey.is. We reply within one month. Note that accounting records may not be deleted before the statutory retention period has passed.

If you believe your information is not handled correctly, you can complain to the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is).

13. Security

All traffic to the website is encrypted (HTTPS). Access to orders and the newsletter list is limited to signed-in staff, and a buyer can only see their own receipt through a private link they receive when ordering.

14. Changes

This policy may change, for example if a new service is added. The latest version is always on this page, and the date at the top shows when it was last updated.