Privacy Policy

ColdOcean ehf. ("ColdOcean", "we", "us", or "our") operates the website coldocean.com and sells luxury Icelandic marine skincare products. Our registered address is in Iceland. We are the data controller for personal data collected through this website.

We collect the following categories of personal data:

• Identity data: name, email address, billing and shipping address.

• Transaction data: details of products purchased, payment method type (we do not store full card numbers — these are handled by Stripe).

• Technical data: IP address, browser type, device type, pages visited, and time spent on pages.

• Communications data: messages you send us via contact forms or email.

We use your personal data to: process and fulfil your orders; send order confirmations and shipping updates; respond to your enquiries; improve our website and product offering; comply with legal obligations under Icelandic and EU law.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

Where the GDPR applies, we process your data on the following legal bases:

• Contract performance: processing necessary to fulfil your order.

• Legitimate interests: improving our website and preventing fraud.

• Legal obligation: compliance with tax, accounting, and consumer protection law.

• Consent: where you have explicitly opted in (e.g. marketing emails).

We use essential cookies required for the website to function (e.g. shopping cart state). We also use analytics cookies (Google Analytics) only with your consent, as managed by our cookie consent banner.

You can withdraw consent at any time by clearing your browser cookies or adjusting your browser settings.

We share your data only with trusted service providers who process it on our behalf:

• Stripe, Inc. — payment processing (PCI-DSS compliant).

• Google LLC — analytics (Google Analytics 4), subject to your cookie consent.

• Hosting and infrastructure providers operating within the EEA or under Standard Contractual Clauses.

All processors are bound by data processing agreements and may not use your data for their own purposes.

We retain order and transaction data for 7 years to comply with Icelandic accounting law. Analytics data is retained for 14 months. We delete or anonymise all other personal data when it is no longer necessary for the purpose it was collected.

Under GDPR and Icelandic law (Act No. 90/2018), you have the right to:

• Access the personal data we hold about you.

• Correct inaccurate data.

• Request erasure ("right to be forgotten") where no legal retention obligation applies.

• Restrict or object to processing.

• Data portability (receive your data in a machine-readable format).

• Withdraw consent at any time without affecting prior lawful processing.

To exercise any right, email us at [email protected]. We will respond within 30 days.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd): personuvernd.is.

We may update this Privacy Policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of the website after changes constitutes acceptance of the updated policy.