What data we collect, why, and how you can control it. This policy is based on Regulation (EU) 2016/679 (GDPR) and Icelandic Act No. 90/2018 on the protection and processing of personal data.
The controller responsible for the processing of personal data on this website is Manhattan ehf., Skeifan 15, 108 Reykjavík, Iceland. You can reach us at the email address shown on the "Contact" page or by post at the same address.
Iceland's Data Protection Authority (Persónuvernd) supervises compliance. You always have the right to lodge a complaint with them. See personuvernd.is.
We collect only what is necessary to operate the site and respond to enquiries: your name, email, phone number (optional) and message when you write to us through the contact form; technical data such as IP address, user-agent and timestamp on each request; cookies and local-storage entries as described below.
We do not collect data that qualifies as sensitive under Article 11 of Act 90/2018 (health, ethnicity, political opinions, religion).
Contact form (name, email, phone, message): your consent (Art. 6(1)(a)) and the necessity to take steps toward a possible engagement (Art. 6(1)(b)).
Technical data (IP, user-agent in server logs): our legitimate interests (Art. 6(1)(f)) in keeping the site secure and preventing abuse.
Google Analytics measurement: only if you grant the "Analytics" category in the consent banner. The basis is your consent.
Meta Pixel (Facebook and Instagram): only if you grant the "Marketing" category in the consent banner. The basis is your consent.
We use Google Consent Mode v2 with all categories defaulting to denied. No analytics or marketing cookies are set until you explicitly grant them in the consent banner at the bottom of the screen.
Three cookies / local-storage entries are always active and don't require consent (they're strictly necessary): manhattan-consent (your consent choice, 13-month expiry), manhattan-theme (light/dark preference), and NEXT_LOCALE (language preference).
If you grant marketing, the Meta Pixel sets the _fbp and _fbc cookies, which last 90 days. They tie your visit to our ads on Facebook and Instagram. Withdraw consent and the pixel stops sending data and we delete both cookies.
You can change your choice any time by re-opening the consent banner, clearing cookies in your browser, or visiting the site in a private window.
We host the site on Vercel Inc. (vercel.com) over its Edge Network. Vercel processes technical data such as IPs to deliver the site.
Contact-form emails are delivered through Resend (resend.com).
To prevent abuse, contact-form submissions and sign-in attempts are counted at Upstash (upstash.com). Your IP address is held there as a counter for at most one hour, in a data centre in Frankfurt, Germany.
If you consent to analytics, we use Google Analytics 4 by Google Ireland Limited with IP anonymisation (anonymize_ip).
If you consent to marketing, we use the Meta Pixel by Meta Platforms Ireland Limited, Merrion Road, Dublin. It measures how our ads perform and lets us show them again to people who have visited the site.
All processors above provide the contractual guarantees required by Art. 28 GDPR. Any data transfer outside the EEA is governed by the European Commission's Standard Contractual Clauses (SCCs).
Contact-form emails are kept for as long as needed to respond and at most 24 months, unless a longer period is required by law or by an ongoing business relationship.
Server logs (IP, technical metadata) are retained for up to 90 days.
Google Analytics data is retained for 14 months.
Meta Pixel data follows Meta's own retention rules. The _fbp and _fbc cookies expire after 90 days.
You have the right to: know what information we hold about you; receive a copy; have inaccurate information corrected; have data erased ("right to be forgotten"); restrict processing; data portability; object to processing; withdraw consent at any time without affecting the lawfulness of processing already carried out under that consent.
Email us to exercise any of these rights. We respond within one month of receipt.
The site is served over HTTPS with HSTS. We use a strict set of security headers (Content-Security-Policy, X-Frame-Options, Referrer-Policy, etc.) and never store card details or passwords.
No transmission over the internet is fully secure. If you believe your rights have been breached, contact us and/or Persónuvernd.