Privacy Policy
Last updated: 5 October 2026
1. Who is responsible for your data
The data controller is Canna medica ehf., Tjarnargata 3, 230 Reykjanesbær, Iceland, email [email protected].
2. What we collect
- Booking details — your name, email address, the topic you choose, your preferred times, and anything you write in the request form.
- Session material — code, documents, screenshots or data you choose to share with us so we can prepare for and deliver the session.
- Billing details — the name, address and tax identifiers needed to issue an invoice. We do not receive or store card numbers; payment is handled by our payment service provider on its own hosted checkout page.
- Correspondence — emails you exchange with us, including follow-up questions.
- Technical data — this website is static and sets no tracking cookies. Our hosting provider may log IP addresses and request metadata for security and operations.
3. Why we use it and on what basis
- To schedule, prepare and deliver your session and send the written summary — performance of a contract.
- To take payment and issue invoices, and to keep accounting records for as long as the law requires — legal obligation.
- To answer your questions and improve our service — legitimate interest.
- To send you marketing emails, only if you ask us to — consent, which you can withdraw at any time.
4. Who we share it with
Only the service providers we need to deliver the service, each bound by contract to use the data solely for that purpose:
- Our payment service provider, Rapyd, which processes your payment on its hosted checkout and shares with us the payment status and the last four digits of the card used.
- Our video-conferencing provider for the session itself.
- Our email and hosting providers.
- Our accountants and advisers, where required to meet legal obligations.
We do not sell personal data and we do not share it with advertisers.
5. International transfers
Some providers may process data outside your country. Where that happens we rely on recognised safeguards such as adequacy decisions or standard contractual clauses.
6. How long we keep it
- Session material: deleted within 30 days after the follow-up period ends, unless you ask us to keep it for a further engagement.
- Booking details and correspondence: for 24 months after your last session.
- Invoices and payment records: for the period required by tax and accounting law in Iceland.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email [email protected]. You also have the right to complain to your local data protection authority.
8. Security
Session material is stored in access-controlled systems and shared only with the engineer delivering your session. Card data is never handled by us; our payment service provider is PCI DSS compliant.
9. Children
Our services are for businesses and professionals and are not directed at children under 16.
10. Changes
We may update this policy from time to time; the latest version is always on this page with its date at the top.
11. Contact
Canna medica ehf., Tjarnargata 3, 230 Reykjanesbær, Iceland. Email: [email protected]