Privacy policy
Effective date: 17 March 2026
Last updated: 22 March 2026
1. Data Controller
- Spring & Republic ehf.
- Goðanes 6, 603 Akureyri, Iceland
- Registration no. 6702231590
- Email: support@springandrepublic.com
Spring & Republic ehf. is the data controller responsible for processing your personal data in accordance with the GDPR and Icelandic Data Protection Act. Lög um persónuvernd og vinnslu persónuupplýsínga.
2. What Personal Data We Collect
We collect personal data when you:
- Visit our website
- Place an order
- Subscribe to marketing communications
- Contact customer support
- Participate in campaigns or promotions
Data collected may include:
- Full name
- Email address
- Phone number
- Billing and shipping address
- Order history
- Payment information (processed and stored by third-party payment processors, we do not store your card number)
- IP address
- Device and browser information
- Website behavior (pages viewed, products clicked)
- Date of birth (only if voluntarily provided for birthday communications)
We do not collect sensitive personal data.
3. Age Restriction, Under 16s
This service is not directed at individuals under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected data from a person under 16, please contact us immediately at support@springandrepublic.com and we will delete the data without delay.
In accordance with Article 8 GDPR, processing the personal data of a child under 16 for information society services requires parental or guardian consent. We rely on users to confirm they meet this age requirement.
4. Legal Basis for Processing
We process personal data under the following legal bases:
A. Contractual Necessity
To:
- Process orders
- Delivery products
- Manage returns
- Provide customer support
B. Legal Obligation
To:
- Comply with accounting and tax laws in Iceland
C. Legitimate Interests
To:
- Preventing fraud
- Improve website functionality
- Analyze purchasing behavior
- Improve product offerings
Where processing is based on legitimate interests, we ensure that such interests are not overridden by your fundamental rights and freedoms.
D. Consent
To:
- Send newsletters
- Send SMS marketing
- Send birthday greetings and promotional campaigns
- Use cookies for marketing and tracking purposes
Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
5. Marketing Profiling
If you subscribe to marketing communications, we may:
- Send newsletters and promotional emails
- Send SMS campaigns and seasonal offers
- Send birthday greetings if you have voluntarily provided your date of birth
- Use automated marketing tools to tailor communications based on your order history or browsing behavior. Such profiling does not produce legal or similarly significant effects on you.
You may unsubscribe from email marketing at any time via the link in our emails, from SMS marketing by replying STOP, or by contacting support@springandrepublic.com.
6. Cookies Tracking Technologies
We use cookies and similar tracking technologies. You can manage or withdraw cookie consent at any time through the cookie settings on our website.
Technologies and providers in use include:
- Google Analytics (website traffic and behavior analysis)
- Google Ads (advertising performance measurement)
- Meta Pixel — Facebook / Instagram (advertising and retargeting — see Section 7 for joint controller disclosure)
- Shopify analytics tools (platform analytics)
- Third-party Shopify apps (as applicable)
7. Joint Controller Relationship, Meta Platforms
By using Meta Pixel on our website, Spring & Republic ehf. and Meta Platforms Ireland Limited are joint controllers for data collected at the point of collection, in accordance with GDPR and EU Court of Justice rulings. Meta is solely responsible for data processed on its own platforms. Cookie consent is required before Meta Pixel activates. Meta’s privacy policy: https://www.facebook.com/policy.php
For data rights related to Meta’s platforms, contact Meta directly. For all other queries, contact support@springandrepublic.com.
8. Third-Party Service Providers
We share personal data only with trusted service providers who require it to deliver services on our behalf. We enter into Data Processing Agreements (DPAs) with all relevant service providers as required under GDPR Article 28.
Service providers include:
- Shopify Inc. e-commerce platform and hosting (Processor)
- Payment processors, secure payment handling (Processor)
- Shipping carriers, order delivery (Processor)
- SMS marketing platform — SMS campaign delivery (Processor)
- Meta Platforms Ireland Ltd. — Facebook / Instagram advertising (Joint Controller — see Section 7)
- Google LLC — analytics and advertising via GA4 and Google Ads (Processor / Joint Controller for Ads)
- Accounting service providers — financial compliance (Processor)
9. International Data Transfers
Some service providers may process personal data outside the EEA.
Where this occurs, we rely on adequacy decisions issued by the European Commission and/or Standard Contractual Clauses (SCCs) or other approved safeguards in accordance with GDPR.
10. Data Retention
We retain personal data as follows:
- Accounting and order data: 7 years in accordance with Icelandic accounting law
- Marketing data: until consent is withdrawn or after 24 months of inactivity
- Analytics data: typically, up to 14 months (depending on platform configuration)
- Customer support data: 3 years from last interaction
- Cookie consent records: 3 years from consent date
When data is no longer required, it is securely deleted anonymized.
11. Your Rights Under GDPR
You have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request deletion (right to be forgotten’), where legally possible. Note: accounting and order data retained under legal obligation cannot be erased before the statutory retention period expires.
- Restrict processing in certain circumstances
- Object to processing based on legitimate interests, including direct marketing
- Request data portability in a structured, machine-readable format
- Withdraw consent at any time, without affecting prior lawful processing
- Not be subject to automated decision-making that produces legal or similarly significant effects
We do not carry out automated decision-making that produces legal or similarly significant effects. To exercise your rights, contact: support@springandrepublic.com
We respond to requests within one month as required under GDPR Article 12. We may request verification of your identity before responding.
You also have the right to file a complaint with the Icelandic Data Protection Authority (Persónuvernd): www.personuvernd.is
12. Data Security
We implement appropriate technical and organizational measures to protect personal data, including:
- Encrypted connections (SSL/TLS) across all pages
- Secure third-party payment processors (we do not store card numbers)
- Restricted internal access to personal data on a need-to-know basis
- Regular review of third-party data processor security standards
No transmission over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security. In the event of a breach, we will notify Persónuvernd within 72 hours (GDPR Article 33) and affected individuals without undue delay where there is high risk to their rights (GDPR Article 34). All breaches are documented internally. If you believe your data has been compromised, contact us immediately at support@springandrepublic.com.
13. Changes to This Policy
We may update this Privacy Policy periodically. The latest version will always be available on our website with the updated date.
Cookie Policy
1. What Are Cookies?
Cookies are small text files placed on your device when you visit our website. They help the website function properly, improve performance, and allow us to understand how visitors interact with our site.
Cookies may be set up by us (first-party cookies) or by third-party service providers.
2. Types of Cookies We Use
A. Strictly Necessary Cookies
These cookies are required for the website to function.
They enable:
- Secure checkout
- Shopping cart functionality
- Fraud prevention
- Basic site security
These cookies do not require consent.
B. Analytics Cookies
These cookies help us understand how visitors use our website.
We may use:
- Google Analytics
- Shopify analytics tools
These cookies allow us to:
- Measure website traffic
- Analyze user behavior
- Improve site performance
Analytics cookies are activated only with your consent.
C. Marketing Cookies
These cookies are used to deliver relevant advertising and measure campaign performance.
We may use:
- Meta Pixel (Facebook / Instagram)
- Google Ads
These cookies may track:
- Pages viewed
- Products clicked
- Purchases made
- Interactions with advertisements
Marketing cookies are activated only with your consent.
3. How We Use Cookies
We use cookies to:
- Ensure website functionality
- Improve user experience
- Analyze performance
- Measure advertising effectiveness
- Provide relevant marketing communications
We do not sell cookie data.
4. Consent Management
When you visit our website, you are presented with a cookie banner that allows you to:
- Accept all cookies
- Reject non-essential cookies
- Select cookie categories
Marketing and analytics cookies are not activated unless you provide consent.
Our cookie banner provides an “Accept all” and a “Reject non-essential cookies” option on the first layer with equal visibility.
We do not use pre-ticked boxes and access to the website is not blocked if you reject non-essential cookies.
You may refuse or withdraw consent at any time without affecting your ability to use the website.
You may withdraw or modify your consent at any time via the cookie settings tool available on our website.
Non-essential cookies and tracking scripts are technically blocked until consent is recorded through our consent management platform.
5. Third-Party Services
Some cookies are set by third-party providers, including:
- Shopify Inc.
- Meta Platforms Ireland Ltd.
These providers may process data outside the EEA. Where personal data is transferred outside the EEA, we rely on adequacy decisions and/or Standard Contractual Clauses (SCCs) or other approved safeguards in accordance with GDPR.
We do not control third-party cookies and recommend reviewing their respective privacy policies for more information.
For more information on how personal data is processed, please see our Privacy Policy.
6. Managing Cookies
You can manage cookies in several ways:
- Through our cookie consent tool
- Through your browser settings
- By using third-party opt-out tools (such as Google Ads settings or Facebook ad preferences)
Disabling certain cookies may affect website functionality.
7. Cookie Details
An up-to-date list of cookies used on this website, including cookie name, provider, purpose, and duration, is available through our cookie settings tool. This list may change as we update website features or third-party services.
8. Changes to This Policy
We may update this Cookie Policy periodically. The latest version will always be available on our website with the updated date.
