1. Parties and scope
These terms ("the terms") govern access to and use of the Varhugi service available at varhugi.is ("the service").
The service is operated by Valdimar Már Pétursson, Reykjavík ("Varhugi", "we", "us").
The service is intended for companies, institutions and other organisations that use it in the course of their business or activities ("the customer"). The service is not intended for consumers for private use.
Whoever creates a workspace, purchases a subscription or accepts the terms on behalf of a customer confirms that they have sufficient authority to do so. Varhugi may rely on such a confirmation unless there is specific reason not to.
Varhugi's data processing agreement, published at varhugi.is/vinnslusamningur, forms part of the contractual relationship between the parties whenever Varhugi processes personal data on the customer's behalf.
Where a separate written agreement has been made between Varhugi and the customer, that agreement prevails over these terms to the extent they conflict.
2. The service
Varhugi provides, among other things, online security-awareness modules, quizzes, certificates, a dashboard for organisations, reports and related services.
Varhugi endeavours to keep the service working well and available, but does not warrant that it will always be uninterrupted, error-free or available without disruption. Temporary unavailability may result from maintenance, updates, faults, security incidents or third-party services, among other things.
Varhugi may develop and change the service, including its appearance, functionality and individual features. Significant changes shall not unreasonably impair the core functionality the customer has already paid for in the current subscription period.
3. The nature of security training
The service is an education and training tool intended to strengthen the security awareness of staff. The service:
- does not replace technical security measures, access controls, security policy, risk assessment, procedures or monitoring,
- does not guarantee that an individual will recognise or prevent a particular cyberattack,
- does not guarantee that the customer will be free of security incidents or data breaches,
- and does not guarantee that the customer meets any particular legal, regulatory, contractual or supervisory obligation.
The customer is responsible for assessing which measures it needs to take to comply with the legislation and requirements that apply to its operations, including, where relevant, requirements concerning data protection, information security and cybersecurity.
A certificate issued in the service confirms only that a registered user completed a particular module and, where applicable, achieved the required result in a quiz at the recorded time. A certificate does not constitute professional certification, a competence assessment or confirmation of the security of the company in question.
Guides, templates, policy documents, checklists and other Varhugi material are general education and do not constitute legal, technical or other professional advice on the customer's specific circumstances.
4. Customer obligations
The customer is responsible for its use of the service and, among other things, for:
- having a sufficient legal basis and the necessary authority to register staff or other individuals in the service,
- giving registered individuals the necessary information about the processing of their personal data,
- ensuring that information entered into the service is correct to the best of its knowledge,
- limiting administrator access to those individuals who need it,
- protecting credentials and preventing unauthorised access,
- and notifying Varhugi without undue delay if misuse or unauthorised access to an account is suspected.
It is not permitted to:
- use the service for unlawful or fraudulent purposes,
- attempt to circumvent access controls or other security measures,
- carry out unauthorised security testing, scanning or attacks on the service,
- disrupt or attempt to harm the operation of the service,
- copy, reproduce, resell or redistribute training material without Varhugi's written permission,
- or use automated means to retrieve or copy the service's content unless specifically permitted.
5. Intellectual property
All intellectual property in the service, including the software, training material, quizzes, text, images, design, trademarks and databases, belongs to Varhugi or the relevant licensors.
The customer receives a limited, non-transferable and non-exclusive licence to use the service and its content in its own operations for as long as a valid subscription is in place.
The customer may use reports, certificates and other output created specifically for it and pass them to relevant third parties, such as auditors, clients or supervisory authorities. Such documents may not be altered in a way that suggests Varhugi confirmed something other than what the service actually records.
6. Data and personal data
The customer retains its rights to and control over the information it enters into the service.
Where Varhugi processes personal data on the customer's behalf and on its instructions, the customer is generally the controller and Varhugi the processor, unless the nature of the particular processing dictates otherwise. Such processing is governed by Varhugi's data processing agreement.
Varhugi processes personal data only in accordance with applicable data protection law, the data processing agreement, Varhugi's privacy policy and the customer's documented instructions, as applicable, and applies appropriate technical and organisational measures to protect it having regard to the nature of the processing and the risk involved.
Varhugi may use statistical information about the use of the service for development, analysis and improvement, provided the information has been anonymised so that it cannot reasonably be traced back to individual users or customers.
Varhugi's privacy policy is published at varhugi.is/personuvernd.
7. Subscription, prices and payment
Fees for the service follow the subscription tier and price list in force at the time of purchase, as published at varhugi.is/verd, unless otherwise specifically agreed. Prices exclude value added tax unless stated otherwise.
A subscription may be monthly or annual and renews automatically at the end of each subscription period unless cancelled before renewal.
Price changes do not apply retroactively. Varhugi gives at least 30 days' notice of an increase in subscription fees, and the new price applies from the start of the next subscription period after the change takes effect. A customer who does not accept a price change may cancel the subscription before the new price applies.
A free tier, where offered, is provided free of charge and without any commitment by Varhugi to keep it unchanged or to continue offering it.
If an invoice is not paid when due, Varhugi may charge default interest and costs to the extent permitted by law. If an invoice remains unpaid 14 days after its due date, Varhugi may, after reasonable warning, restrict or suspend access to the service until payment is received.
8. Termination, suspension and return of data
The customer may cancel a subscription at any time. Cancellation takes effect at the end of the subscription period already paid for. Subscription fees paid are generally not refunded unless a separate agreement or mandatory law provides otherwise.
Varhugi may temporarily suspend or restrict access to the service if:
- the customer materially breaches the terms,
- use of the service appears unlawful or fraudulent,
- the security of the service or of other customers is threatened,
- or action is necessary to prevent harm or misuse.
Where circumstances allow, Varhugi shall notify the customer of such a suspension and give it a reasonable opportunity to remedy the breach.
After a subscription ends the customer has up to 30 days to request an export of the data the service supports exporting. After that period Varhugi may delete the data or anonymise it in accordance with its retention policy and the data processing agreement, unless retention is required or permitted by law.
Data that Varhugi needs to retain for accounting, legal claims, security or evidence of the contractual relationship, including the record of acceptance of these terms, may be retained longer as legitimate need or legal obligation requires.
9. Liability and limitation of liability
Varhugi provides the service with reasonable professional care and endeavours to maintain appropriate security and operational reliability. The service cannot, however, prevent all security incidents, human error, cyberattacks or service interruptions.
To the extent permitted by law, Varhugi is not liable for indirect or consequential loss, such as loss of profit, revenue, business opportunities or reputation, or loss due to business interruption.
Varhugi is not liable for a security incident at the customer solely because an employee of the customer had previously completed training in the service.
To the extent permitted by law, Varhugi's aggregate liability to the customer in connection with the service shall not exceed the subscription fees the customer paid Varhugi for the service in the twelve months preceding the event on which the claim is based. Where the customer uses only free services, Varhugi's liability is limited to the extent permitted by law.
No limitation of liability in these terms limits liability to the extent that this is prohibited by mandatory law, including liability for intent or gross negligence. The limitations of liability in these terms do not limit the independent rights of data subjects under applicable data protection legislation.
10. Third-party claims
The customer is liable for Varhugi's loss and reasonable costs arising from a third-party claim to the extent the claim results directly from:
- the customer's unlawful use of the service,
- the customer's material breach of these terms,
- or the customer having registered or had information processed without the necessary authority.
This does not apply to the extent the claim results from a breach, negligence or act of Varhugi.
A party that becomes aware of such a claim shall notify the other party without undue delay and cooperate reasonably in handling it.
11. Third-party services
The service relies on third-party services such as hosting providers, email services, payment processing and other technical infrastructure. Varhugi is responsible for the selection and management of such providers to the extent required by law or contract. The use of sub-processors for the processing of personal data is governed by Varhugi's data processing agreement.
12. Force majeure
Neither party is in breach of its obligations because of events beyond its reasonable control that could not reasonably have been prevented. Such events include natural disasters, major telecommunications or power failures, armed conflict, government orders, strikes or extensive disruption at essential service providers.
A party affected by such an event shall, as far as possible, mitigate its effects and restore its obligations to normal as soon as practicable.
13. Changes to the terms
Varhugi may change these terms as the service, the business or the legal environment develops.
Where a change is material, the customer is notified at least 30 days in advance, unless the change is required sooner by law, a government order or an urgent security need. A new version is published at varhugi.is/skilmalar together with its effective date.
If a change has a materially adverse effect on the customer's rights, the customer may cancel the subscription before the change takes effect.
Changed terms are deemed accepted when an administrator of the customer confirms them in the service's dashboard, or when the service continues to be used after they take effect following reasonable notice, whichever comes first.
14. Communication and electronic notices
Varhugi may send notices relating to the service, its security, payments or the contractual relationship electronically to the email address registered for a workspace administrator, or by notice within the service. The customer is responsible for keeping its contact details correct and up to date.
15. Governing law and disputes
These terms and the contractual relationship between the parties are governed by Icelandic law. Should a dispute arise, the parties shall first seek to resolve it by agreement. Failing that, the dispute shall be brought before the District Court of Reykjavík, unless mandatory law provides otherwise.
The Icelandic version of these terms prevails in case of any discrepancy between it and a translation.
Should an individual provision of the terms be held invalid or unenforceable, this does not affect the validity of the remaining provisions.
The customer may not assign its rights or obligations under the agreement without Varhugi's consent. Varhugi may assign the agreement or the operation of the service to a company that takes over the relevant business, provided this does not materially diminish the customer's rights under the current subscription.
16. Contact
Questions about the service or these terms may be sent to info@varhugi.is. Information about the operator of the service is published on the About page at varhugi.is.