Privacy policy
Last updated: 4 October 2026.
Varhugi respects user privacy. This policy explains what personal data we collect, why, and how you control it. It is based on Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data and the EU General Data Protection Regulation (GDPR).
Data controller
The data controller is Varhugi, operated by Valdimar Már Pétursson, Reykjavík. The company registration number will be published here once a company has been formed for the business. You can reach us at info@varhugi.is.
What we collect
We collect only the data needed to provide the service: name, email address, department and role within the company; module progress, quiz results and issued certificates; reports of suspicious messages and policy attestations submitted by staff; the company's registration number where applicable; payment data, handled by our payment provider and not by Varhugi; and technical usage data such as sign-in timestamps, IP addresses and browser type, used for security and operations.
Purpose of processing
Providing the service, issuing and verifying certificates, producing audit reports for your workplace, communicating with users, including sign-in emails and reminders, and keeping the website secure and operational.
Third parties (sub-processors)
We use the following sub-processors to deliver the service: Vercel (hosting and certificate storage, Frankfurt), Neon (database, Frankfurt), Resend (transactional email), Stripe (payments, when on a paid plan), and Upstash (cache for rate limiting and operational markers, Frankfurt). Each receives only the data needed for its function. Data is hosted within the EEA as a rule, but some providers are US companies, and any transfer outside the EEA relies on the EU's Standard Contractual Clauses (SCC) or the EU-US Data Privacy Framework. When you sign in with Microsoft or Google, authentication happens with that company as an independent controller; Varhugi receives only your name and email address after sign-in. The processing is described in detail in the Varhugi Data Processing Agreement at varhugi.is/vinnslusamningur.
Retention
Training data is kept while the account is active. When an account is deleted, personal data is removed within 30 days unless law requires otherwise (accounting records: 7 years). Certificates, however, remain stored so they can be verified later on the public verification page, as this is core to the service; for that retention Varhugi is an independent controller towards the certificate holder. If deletion of certificates is specifically requested, for example by email, they are deleted as well.
Your rights
You have the right to access the data we hold on you, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing. Send requests to info@varhugi.is. If you use Varhugi as an employee of a company, the company is the controller of the data it records about you, and we refer requests there where appropriate, unless they concern your certificates. You may also lodge a complaint with the Icelandic Data Protection Authority (personuvernd.is) if you believe we have not complied with the law.
Cookies
We use only essential cookies, those that keep you signed in and remember the language you chose. No third-party cookies are used on varhugi.is, for marketing or for analytics. To count visits we use Vercel Web Analytics, which does not use cookies and does not identify individual users.