Privacy policy

1. Introduction

Thank you for visiting our website. Your privacy is important to us, and we are committed to protecting your personal data.

Blue Lagoon Skin Science Ltd., company registration no. 671296-2819, Norðurljósavegur 9, 241 Grindavík, Iceland (referred to in this Privacy Policy as “we”, “us” or “our”) operates retail stores offering skincare products, cosmetics and other household products, as well as an online store.

This Privacy Policy explains what personal data we collect, why we collect it, and how we use it. It also outlines your rights in relation to the processing of your personal data in accordance with the General Data Protection Regulation, (EU) 2016/679 (the “GDPR”).

The data controller responsible for your personal data is:

Blue Lagoon Skin Science Ltd.

Email: skinscience@bluelagoon.is

Address: Urriðaholtsstræti 2-4, 210 Garðabær, Iceland

2. Personal Data We Collect

We collect and process personal data that is necessary to provide our products and services, communicate effectively with our customers, ensure the security and protection of our premises and assets, and market our products and services.

We will only process personal data where there is a valid legal basis for doing so under applicable data protection laws, including the legal bases set out in Article 6 of the GDPR.

2.1 Online Store

When you purchase products through our online store, we process the personal data necessary to fulfil your order, communicate with you as required, and deliver your order.

Name - required to process and fulfill your order.
Email address - used to send payment confirmation, order status updates, and to contact you regarding your order if necessary.
Telephone number - in exceptional cases, we may contact you by phone if we consider it necessary to provide important information relating to your order where email communication is not sufficient.
Address - used for the delivery of the products you have ordered.
Payment information - payment card details are processed securely via our payment service provider, Planet.
Other information you voluntarily provide - for example, gift messages or specific instructions regarding your order.

2.2 Blue Lagoon Skin Science Loyalty Program

If you join the Blue Lagoon Skin Science Loyalty Program, we process the personal data you provide to us when registering for the program in order to administer your membership, including awarding and managing points and rewards linked to your purchases, and to communicate with you in connection with your membership.

We may also send you newsletters, marketing materials, and other promotional information, where you have consented to receive such communications.

You may withdraw from the Loyalty Program at any time.

2.3 Inquiries to Us

When you submit a request, inquiry, complaint or feedback to us, we process your contact details and any other information you provide in order to respond to your inquiry and, where necessary, process and resolve your request.

2.4 Analytics and Market Research

We may use information derived from personal data that has been anonymized to conduct market research and statistical analyses for the purpose of improving our products and services.

2.5 Our Website

When you visit our website, we may collect information about the use of the website through cookies and similar technologies. This information is used to provide website functionality, analyze website usage, and, where you have provided your consent, support marketing activities.

Detailed information about the cookies and similar technologies we use, including their purposes, providers, and retention periods, is available in our Cookie Declaration, which can be accessed through our cookie banner. For general information about our use of cookies and similar technologies, please see our Cookie Policy.

2.6 CCTV Monitoring

We use CCTV cameras at our premises for security purposes and to protect the safety of our guests, employees, and property. Access to CCTV recordings and other information collected through CCTV is strictly controlled, and only specifically authorized employees have access to such information.

CCTV recordings are not retained for longer than 30 days unless they are required to be retained in connection with potential legal matters, such as accidents, theft, or other incidents requiring further review.

3. Legal Basis for Processing Personal Data

We process personal data based on one or more lawful bases under the GDPR, depending on the nature of the processing activity.

We process personal data based on the following lawful bases:

Performance of a contract - Article 6(1)(b) GDPR

Processing of personal data such as name, email address, telephone number, address, and payment information is necessary for the performance of a contract concluded when you place an order through our online store.

Processing of Blue Lagoon Skin Science Loyalty Program membership data, including points and rewards linked to your purchases, is also necessary for the performance of a contract with you when you participate in the Blue Lagoon Skin Science Loyalty Program.

Legitimate interests - Article 6(1)(f) GDPR

In certain cases, we process personal data on the basis of our legitimate interests. This applies, for example, to processing personal data in connection with our communications with customers, such as when we respond to inquiries about specific products or about data subject rights under the GDPR. We have a legitimate interest in responding to such inquiries.

We also process personal data generated through CCTV monitoring on the basis of our legitimate interest in ensuring the security of our premises and protecting our assets.

In addition, we process anonymized information for analytics and market research purposes based on our legitimate interest in improving our products and services.

Consent - Article 6(1)(a) GDPR

In certain cases, we process personal data on the basis of your consent. This applies to receiving newsletters, marketing communications, and other promotional materials from us.

Where processing is based on your consent, you may withdraw your consent at any time.

Legal obligation - Article 6(1)(c) GDPR

In some cases, we process personal data where it is necessary to comply with a legal obligation to which we are subject, such as obligations under applicable accounting and bookkeeping laws.

Vital interests - Article 6(1)(d) GDPR

In exceptional cases, we may process personal data where it is necessary to protect the vital interests of an individual. This may apply, for example, in the event of a medical emergency occurring at one of our premises.

4. Sharing of Personal Data with Processors and Third Parties

We do not sell personal data.

We may share personal data with processors who provide services to us or provide services to our customers on our behalf where this involves processing personal data on our instructions. This may include, for example, providers of IT services, cloud solutions, payment services, and other services necessary to support our operations.

An example of a processor is our parent company, Blue Lagoon Ltd., which provides us with various support services, including IT, human resources, management, and finance services.

Where third parties act as data processors on our behalf, we ensure that appropriate data processing agreements are in place, requiring personal data to be handled securely, confidentially, and only for the purposes we specify. Processors only have access to the personal data necessary to perform their specific tasks and are prohibited from using it for any other purpose.

Some of these third parties may be located outside Iceland. We will not transfer personal data outside the European Economic Area (EEA) unless permitted under applicable data protection laws, for example where the European Commission has adopted an adequacy decision for the destination country or where appropriate safeguards are in place, such as Standard Contractual Clauses.

We may also disclose personal data:

When required by law, for example under a court order or at the request of law enforcement or other public authorities.
To our legal advisors to protect the company’s legal rights or the rights of our staff.

In addition, we may use third-party providers to assist us with website analytics, marketing, and improving our services. Depending on the service provided, these providers may act as our processors or as independent controllers. We only use non-essential cookies and similar technologies where you have provided consent. Further information about the cookies and technologies used on our website, including their purposes and providers, is available in our Cookie Declaration, which can be accessed through our cookie banner.

5. Retention of Personal Data

We do not retain personal data for longer than permitted by law or necessary for the purposes for which it was collected. Applicable legal obligations may determine the retention period, for example up to seven years following the end of the relevant financial year in accordance with applicable accounting and bookkeeping laws.

Once the applicable retention period has expired, we securely delete or anonymize personal data so that it can no longer be identified as personal data.

6. Payments and Security

Payments are processed through the payment service provider Planet. All payment transactions are protected and certified in accordance with the PCI DSS (Payment Card Industry Data Security Standard) to ensure the secure handling of payment card data.

Our websites are secured using SSL certificates with high-level encryption SSL (Secure Sockets Layer) enables secure, encrypted communication between the website and your browser.

7. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

Access - request access to the personal data we hold about you and information about how we process it.
Correction - request that inaccurate or incomplete personal data be corrected.
Restriction of Processing - request that we restrict the processing of your personal data in certain circumstances, such as where you challenge the accuracy of the data or where you believe the processing is unlawful.
Erasure - request deletion of your personal data where applicable, for example where the data is no longer necessary for the purpose for which it was collected or where you withdraw your consent where processing is based on consent. This right does not apply where we are required to retain personal data by law.
Data Portability - receive personal data you have provided to us in a structured, commonly used, and machine-readable format, and request that it be transferred to another controller where the processing is based on your consent and carried out by automated means. This right must not adversely affect the rights and freedoms of others.
Withdrawal of Consent - withdraw your consent at any time where processing is based on your consent. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Object to Processing - object to processing based on our legitimate interests. You also have the right to object at any time to processing carried out for direct marketing purposes, including marketing communications such as newsletters.
Lodge a Complaint - lodge a complaint directly with the Icelandic Data Protection Authority (Persónuvernd) if you believe your rights have been violated.

If you wish to exercise any of the rights listed above, please contact us at gdpr@bluelagoon.is.

8. Children Under the Age of 13

We do not knowingly collect personal data from children under the age of 13 without appropriate involvement or authorization from a parent or legal guardian.

If a parent or legal guardian becomes aware that personal data has been provided by a child under the age of 13 without appropriate authorization, they should contact us immediately. If we become aware of such collection or use, we will take appropriate steps to address the situation, including deleting such data where required.

9. Job Applicants

If you apply for a position with us, we will process the personal data you provide as part of your application, such as your name, contact details, CV, cover letter, qualifications, interview notes, references, and any other information relevant to the recruitment process.

We process this information for the purpose of managing the recruitment process, assessing your suitability for employment, and taking steps at your request prior to entering into an employment contract.

We retain applicant data only for as long as necessary for the recruitment process and, where you have provided your consent, for a limited period thereafter to consider you for future employment opportunities.

Applicants also receive separate information describing how we process personal data during the recruitment process.

10. Personal Data Breaches

In the event of a personal data breach, we will notify the Icelandic Data Protection Authority (Persónuvernd) without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.

If the breach is likely to result in a high risk to your rights and freedoms, we will also inform you directly without undue delay, unless otherwise required by applicable law.

11. Questions and Complaints

If you have any questions about this Privacy Policy or how we process your personal data, please contact us at:

Email: gdpr@bluelagoon.is

Mail: Urriðaholtsstræti 2-4, 210 Garðabær, Iceland

If you believe that our processing of your personal data does not comply with applicable data protection laws, you have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd). Further information is available on its website: www.island.is/en/o/the-data-protection-authority