Privacy Policy

This Privacy Policy outlines how isotop.to ("we," "us," "our," or the "Company") collects, processes, uses, and protects your personal data when you visit our website, use our services, or submit an order (collectively, the "Site" and "Services"). By accessing or using the Site or Services, you agree to the practices described in this policy. If you do not consent, please do not use our Site or Services.

We handle your personal data responsibly and in full compliance with Icelandic data protection legislation, including the General Data Protection Regulation (GDPR) as implemented in Iceland under the EEA Agreement, as well as other relevant Icelandic laws.

Changes to This Privacy Policy

We may update this Privacy Policy occasionally to account for changes in our operations, legal requirements, or technology. Any revisions will appear here with a new "Last Updated" date. Please check back regularly. Your continued use of the Site following changes indicates acceptance of the updated policy.

Who We Are (Data Controller)

The controller of your personal data is:

isotop.to

Email: [email protected]

Note on Operations: While the company is based and operated in Iceland (including primary data processing), physical fulfillment and shipping of orders are handled from facilities in Central Europe to ensure efficient delivery.

Personal Data We Collect

The personal data we collect varies based on your engagement with us:

Voluntarily Provided Data

Contact and identification: full name, billing/delivery address, email address, telephone number

Order-related: payment details (handled securely by our payment processors; full card information is not stored by us)

Account-related (if registered): username/password, past orders, preferences

Correspondence: any details you submit through support tickets, emails, or forms

Automatically Collected Data

Device and technical logs: IP address, browser type and version, device type, operating system, visited pages, access times/dates, referral sources, and usage patterns

Cookies and tracking technologies (detailed in the Cookies section below)

Data from Third Parties

We may receive supplementary data from partners such as payment gateways, logistics providers, analytics services, or anti-fraud tools.

Purposes and Legal Bases for Processing

We process personal data on the following bases under GDPR (contract necessity, legitimate interests, legal compliance, or consent where applicable):

Processing and completing your purchases, including payments, order preparation, and shipment

Managing accounts, sending order confirmations, updates, and responding to support requests

Improving the Site, personalizing content, and understanding user behavior through analytics

Delivering optional marketing messages (only with your explicit opt-in; easy unsubscribe available)

Preventing fraud, abuse, or security risks

Meeting statutory duties, cooperating with authorities, or defending our legal rights

You can withdraw consent for marketing or object to certain processing by contacting us or using provided opt-out options.

Cookies and Tracking Technologies

We deploy cookies, pixels, and comparable tools to support core Site functions, track performance, and enhance security. This includes strictly necessary cookies and optional ones for analytics or advertising.

You can control or disable cookies through your browser or our cookie consent tool (if active). Note that blocking them might restrict access to some features. Refer to our separate Cookie Policy [insert link if you have one] or reach out for more information.

Disclosure of Personal Data

We disclose personal data only as required:

To service providers acting as processors (e.g., payment providers, Central European fulfillment/shipping partners, cloud hosting, analytics vendors) under strict contractual obligations

To limited business affiliates or partners supporting our operations

To Icelandic or international authorities, courts, or regulators when legally mandated or to protect rights, security, or property

We never sell, rent, or otherwise commercialize your personal data to unrelated parties for their independent use.

International Data Transfers

Personal data is mainly processed in Iceland. As Iceland forms part of the European Economic Area (EEA), transfers within the EEA (including to Central European shipping partners) benefit from the GDPR's adequacy framework.

Any transfers outside the EEA/Switzerland are safeguarded by appropriate mechanisms under GDPR and aligned Swiss FADP standards (e.g., adequacy decisions, standard contractual clauses, or binding corporate rules). We provide further details upon request.

Data Retention Periods

We keep personal data only for as long as needed to achieve the stated purposes, satisfy contractual commitments, or meet legal/tax obligations (e.g., retention for accounting purposes). Once no longer required, data is securely erased or fully anonymized.

Data Security Measures

We employ industry-standard technical and organizational safeguards to protect against unauthorized access, alteration, disclosure, or destruction of data. Despite these efforts, absolute security cannot be guaranteed for any online transmission or storage.

Your GDPR Rights

As a data subject, you enjoy the following rights (subject to applicable exceptions):

Access: Obtain confirmation of processing and a copy of your data

Rectification: Update or correct inaccurate/incomplete information

Erasure: Request deletion when lawful grounds exist

Restriction: Limit processing in certain cases

Portability: Receive your data in a structured, portable format

Objection: Oppose processing based on legitimate interests

Withdraw consent: Revoke previously given consent at any time

To exercise these rights, contact us at [email protected]. We aim to respond within one month (extendable under GDPR rules). Requests are generally free unless excessive or unfounded.

Children's Privacy

The Site and Services target adults aged 18 and older. We do not intentionally collect or process data from individuals under 18. If we discover such data, we will remove it immediately. Notify us if you suspect this has happened.

Contact Information

For any inquiries, rights requests, or complaints regarding this Privacy Policy or your data, please contact us:

Email: [email protected]

Thank you for entrusting us with your information—we are committed to safeguarding it with the highest standards.