Privacy policy
Last updated 20 October 2026
This policy explains what personal data Victory Studio collects, why, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Icelandic Act on Data Protection and the Processing of Personal Data (no. 90/2018).
Who is responsible
The data controller is Victor Jakob Gressier, trading as Victory Studio, kennitala 270893-2369, Bankastræti 2, 101 Reykjavík, Iceland. Contact: victor@mama.is.
What we collect
- Contact details — name, company, email address and phone number you give us.
- Billing details — billing address, kennitala, invoices and payment history.
- Card information — card brand, last four digits and expiry date only. Full card numbers and security codes are entered directly with our payment provider and are never received or stored by us.
- Project information — content, files and correspondence related to your website or service.
- Technical data — standard server logs (such as IP address and browser type) kept by our hosting provider for security.
Why we use it, and our legal basis
- To deliver the services you order, send invoices and take payments — performance of a contract.
- To keep accounting records as required by the Icelandic Bookkeeping Act (no. 145/1994) — legal obligation.
- To keep our systems and your website secure and prevent fraud — legitimate interest.
- To reply to enquiries you send us — legitimate interest or steps prior to a contract.
We do not sell personal data, and we do not use it for advertising.
Who we share it with
We use a small number of trusted service providers who process data on our behalf under data-processing agreements:
- Our licensed card payment provider — to process card payments and store cards securely.
- Vercel — website hosting.
- Supabase — secure database for client and billing records.
- Resend — sending invoices and service emails.
Some of these providers may process data outside the European Economic Area. Where they do, transfers are protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. We may also disclose data where required by law.
How long we keep it
Accounting records, including invoices and payment records, are kept for seven years as required by Icelandic law. Other client and project data is kept while we work together and deleted or anonymised within 12 months after the relationship ends, unless you ask us to delete it sooner.
Cookies
This website does not use advertising or tracking cookies. A strictly necessary cookie is set only when signing in to our private administration area.
Security
Data is transmitted over encrypted connections (HTTPS), access to our systems is restricted and protected by authentication, and payment data is handled by a PCI DSS-compliant provider.
Your rights
You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. To use any of these rights, email victor@mama.is; we reply within one month.
If you believe we have handled your data unlawfully, you can lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd), personuvernd.is.
Changes
We may update this policy. The date at the top shows when it was last changed, and significant changes will be notified to active clients by email.