MASTERBÍLAR / REYKJANES
Privacy
Data controller
Masterbílar ehf., kennitala 460720-0790, is responsible for the personal information described here. Registered address: Heiðartröð 554, 262 Reykjanesbær, Iceland. Our workshop is at Heiðartröð 544a. For privacy questions and requests, contact info@masterbilar.is.
Enquiries and repairs
We use contact details, vehicle registration, repair information, status history and photographs to respond to contact and fleet enquiries, arrange repairs and document the work. Optional damage photographs are used to assess your enquiry. They are stored privately, are not automatically published or added to a customer status page, and require a separate basis or permission for public use. We remove embedded location metadata and normalise images. Unsubmitted uploads are eligible for cleanup after 24 hours. Photos attached to enquiries that do not become repairs follow the enquiry retention period and are removed with the enquiry. Please do not send unrelated sensitive information. Access to workshop records is limited to authorised staff.
Private customer status links
A private link gives access to selected repair information and photographs without a customer account. Anyone with the link may be able to view that information, so keep it private. Contact us to revoke or replace it. The link expires 90 days after collection; this access period is separate from the retention of repair records.
Google Analytics 4 and cookie choices
Google Analytics 4 is active only for visitors who allow analytics cookies. It measures public website use and interactions such as page views, scrolling, enquiry buttons, telephone links, directions and successful enquiries. Rejecting analytics does not prevent use of the website. The Google tag is blocked before consent. You can withdraw consent through Cookie settings; analytics is disabled and first-party analytics cookies are removed. Staff sign-in uses necessary session cookies. Admin, API and private customer status pages are excluded from marketing analytics. Photo URLs, filenames, registration numbers, VINs and damage descriptions are not sent in our analytics events.
SMS and reviews
Twilio/SMS sending is currently disabled. The system is prepared for repair and collection notifications. A review invitation may be used only after vehicle collection and with the customer’s permission. We will update this information before activating SMS processing. Public use of repair photographs requires a separate permission and privacy check.
Retention policy
Contact and fleet enquiries that do not become a customer relationship or repair are retained for up to 12 months. Repair records, status history and photographs may be retained for up to five years after completion where reasonably necessary for warranties, disputes, repair history or legal claims; this is not a requirement to keep every item for five years. Records forming part of accounting documentation follow the mandatory Icelandic period, currently seven years from the end of the relevant financial year. SMS technical and delivery logs have a 90-day retention limit unless a specific record is needed for a dispute or legal requirement. At the end of the applicable period, data must be deleted or anonymised unless a legal obligation or justified legal claim requires longer retention.
Analytics retention and backups
GA4 user/event data retention is set to 14 months, with reset on new activity switched off. This setting does not set the lifetime of all aggregated reports. Backup copies may be retained under the infrastructure provider’s backup and restore cycle and removed through its applicable rotation, to the extent technically practicable and permitted by law. We do not specify an unverified fixed retention period for provider-managed copies.
Retention reviews
Masterbílar management, reachable at info@masterbilar.is, is responsible for retention reviews and data subject requests. Our retention procedure uses a staff review every three months and authorised manual deletion, not automatic deletion of all records. Reviews cover records already due and those falling due before the next review: eligible data is removed earlier or assigned a deletion date within its limit. Specific accounting obligations or legal claims are documented separately, with restricted access and a further review date. A quarterly review does not extend retention limits.
Service providers and international processing
The website and workshop system are hosted through OpenAI ChatGPT Sites, using Cloudflare Workers, D1 database and R2 object storage. Google processes consented GA4 analytics. Twilio is not currently used to send customer SMS. Enquiries submitted through the website are stored in the workshop system; they are not automatically emailed. Providers may process data outside the EEA. Applicable processing terms provide for transfer safeguards such as adequacy decisions or standard contractual clauses; contact info@masterbilar.is for information about the safeguards applicable to your data.
Your rights
Contact info@masterbilar.is to request access, correction, deletion or restriction, or to object where applicable. Portability applies where the legal conditions are met. You can withdraw analytics consent without affecting processing lawfully performed before withdrawal. We may need to verify your identity and retain specific information where legally required. You may lodge a complaint with Persónuvernd, the Icelandic data protection authority.