GDPR Compliance
Last updated:
REF. Framer¡
Document owner: Ævar Bernburg Kristjánsson
Contact: privacy@konekt.is
Jurisdiction: Iceland / EEA
1. Purpose
This Framework sets out the steps Konekt uses to assess and manage its obligations under the GDPR and applicable Icelandic data-protection law.
Compliance depends on Konekt's actual activities, data flows, legal roles, and applicable law. This document is not a certification or a representation that every requirement has been completed.
2. Roles and Responsibilities
Konekt must identify its role for each processing activity.
Konekt may act as a processor when processing end-customer support data on a business customer's documented instructions.
Konekt may act as a controller for processing where it independently determines purposes and means, such as its own account administration, billing, security, and certain website operations.
These roles must be assessed for each activity rather than assumed globally.
3. Record of Processing Activities
Konekt should maintain a record of relevant processing activities, including:
Purpose and categories of processing.
Categories of individuals and personal data.
Recipients and subprocessors.
International transfers and applicable safeguards.
Retention periods.
Relevant technical and organizational security measures.
The record should be updated when new features, providers, or data flows are introduced.
4. Lawful Basis and Transparency
For each controller activity, Konekt must identify and document the applicable lawful basis and provide clear privacy information.
Where Konekt acts as processor, it must process data according to the applicable agreement and documented instructions, subject to legal requirements.
Privacy information should describe purposes, data categories, recipients, transfers, retention, rights, and contact details as required by law.
5. Processor Agreements and Subprocessors
Where Konekt processes personal data for a business customer, the parties should enter into a data-processing agreement where required.
The agreement should address instructions, confidentiality, security, subprocessors, assistance with rights requests, incident notification, deletion or return of data, and audit or compliance information.
Konekt should maintain a current subprocessor register. Providers should not be listed as active subprocessors unless their role and use have been verified.
6. International Transfers
Konekt must assess where personal data is stored, accessed, and otherwise processed, including by support personnel and subprocessors.
Where a transfer outside the EEA is subject to GDPR transfer rules, Konekt must identify an appropriate legal mechanism, such as an applicable adequacy decision or Standard Contractual Clauses, and assess whether supplementary safeguards are necessary.
The location of a provider's headquarters alone does not establish where data is processed.
7. Individual Rights
Konekt must maintain a process to receive, verify, route, and respond to applicable data-subject requests.
Requests relating to data controlled by a business customer should generally be referred to that customer, with Konekt providing assistance as required by law and contract.
Requests concerning Konekt's own controller activities should be handled by Konekt. Applicable response deadlines must be tracked.
8. Security and Breach Management
Konekt must implement security measures appropriate to the risks of its processing.
Confirmed measures include role-based staff access controls, HTTPS/TLS encryption in transit, encryption at rest, and staff-access audit logs.
Konekt must create and maintain an incident-response process, including incident assessment, documentation, containment, and legally required notifications.
Where the GDPR applies, a controller generally must notify the competent supervisory authority of a personal-data breach without undue delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to individuals. A processor must notify its controller without undue delay. Other notification duties may also apply.
9. Retention and Deletion
Konekt must establish documented retention periods and deletion procedures for each relevant data category, including backups and records retained for legal or accounting purposes.
Business-customer contracts should explain what happens to customer data when services end, including return, export, deletion, and any legally required retention.
10. AI and New Features
Before introducing a new AI use or other high-risk processing, Konekt should assess its purpose, necessity, proportionality, lawful basis, data categories, provider terms, retention, security, and impact on individuals.
Konekt must distinguish AI processing required to deliver a requested feature from any separate use of personal data for model training or fine-tuning.
Where a processing operation is likely to result in a high risk to individuals, Konekt should assess whether a data-protection impact assessment is required before processing begins.
11. Cookies and Tracking
Before using non-essential cookies or similar technologies, Konekt must assess the applicable consent requirements and implement suitable preference controls where required.
The actual technologies, purposes, and providers must match the Cookie Policy and relevant records.
12. Accountability and Review
Konekt should retain evidence of compliance decisions, provider reviews, agreements, risk assessments, retention rules, and incident handling.
This Framework should be reviewed periodically and whenever material changes occur.
13. Contact
Privacy and data-protection enquiries: privacy@konekt.is