Notification on Data Collection

Read ON Power's Privacy Policy

General

On Power is a subsidiary of Reykjavik Energy (OR) and took over the production and sale of electricity on 1 January, 2014. ON Power also produces hot water for the capital area. Reykjavik Energy and its subsidiaries operate according to Act No. 136/2013 on Reykjavík Energy. The companies engage in the processing, production, and sale of electricity, hot and cold water, and steam, as well as the operation of infrastructure, such as for electricity distribution, district heating, water supply, sewage, and data services, in addition to other comparable activities. Reykjavík Energy sells these products and services to customers for a fee.

ON Power and its customers have a contractual relationship regarding the provision of products and/or services. In order to provide and deliver the products/services, the company must collect, register, store, and process personal information about customers so that ON Power can fulfill its obligations to the respective customer. There is no processing of sensitive personal data involved.

With respect to customers, ON Power guarantees that all processing of personal information by the company complies with ON Power's Policy on Information Security and Privacy (STE-250), the Act on Privacy and Processing of Personal Data, and related rules and regulations. This document, which is provided as a supplement the policy, includes information and education about items that ON Power is obligated to provide concerning the collection and processing of personal data about customers.

Purpose of Processing Personal Information about Customers

ON Power collects and processes the specified personal information about customers in order to provide them with the products and services that have been agreed upon for the stipulated fees.

The processing of information is also performed in order to ensure the best possible quality of products and services. Personal information may also be processed for the purpose of identifying marketing opportunities with the aim of offering additional services or new services.

The purpose of processing personal information may also be other than stated above. For example, ON Power conducts electronic surveillance for specific purposes at any given time, but such processing mainly takes place to ensure the safety of employees, the quality of service, and for safety and asset protection purposes: CCTV monitoring is active in and around ON Power's facilities, phone calls are monitored in the customer service center, tachographs are used in vehicles, and radio monitoring is performed on the Tetra telecommunications system. The Data Protection Authority regulation regarding electronic monitoring, as well as guidance documentation in ON Power's operations manual, apply to electronic monitoring. This includes the purposes of monitoring, who is being monitored and when, ON Power's obligations regarding the monitoring, and information about rights of employees.

ON Power guarantees that personal information about customers will not be used for any purpose other than those specified above, unless with the full knowledge and/or consent of the customer.

On what Authorization is Processing of Customers' Personal Information Based?

The processing of personal data about customers is primarily necessary for the performance of an agreement between ON Power and the individual concerned regarding the company's provision of products and/or services. Additionally, some processing may have a legal basis, e.g., the Public Archives Act No. 77/2014, the Accounting Act No. 145/1994, and the Annual Accounts Act No. 3/2006.

In cases where consent is the basis for the processing of personal information about customers, the processing is subjet to specific terms that the customer has agreed to when giving consent. Such terms may not be changed without the customer’s consent.

Type of Personal Information Processed

ON Power collects and primarily processes the following information about customers:

a. Name
b. ID no.
c. Address
d. Phone number
e. Email address
f. Bank account information
g. Payment card information that is encrypted for 24 hours and then deleted
h. Usage history – readings/bills
i. Interruption history - operational disruptions
j. Information on defaults
k. Communication information
l. Requests for services/products (e.g., ON Key for rapid charging, etc.)
m. Recordings of calls to ON Powers’s customer service
n. Surveillance cameras in public areas in and around ON Power's locations

Customer interactions with ON Power on social media are subject to the rules of the relevant platform regarding the protection and storage of personal information. As applicable, ON Power will transfer the relevant communication/information into its systems and will protect and store the information in accordance with ON Power's policy on information security and personal data protection (STE-250), and rules that have been set to implement the policy.

ON Power collects information through the use of cookies. Cookies are small text files that are stored on users' browsers. We use cookies on our website to identify users. The use of cookies allows us to provide users with a better experience and contribute to further development of the website.

ON Power relies on various types of cookies on its website. First, essential cookies that ensure the proper functioning of the website. Second and third, statistical and preferential cookies that collect anonymous statistical information and remember users' preferences on the website, and fourth, cookies used for marketing purposes, which collect information about user activity to personalize advertisements and other content to each user.

For more information about the processing of personal information by ON Power through cookies, please refer to the cookie policy on the company's website.

Recipients of Personal Information about Customers

Information about ON Power's customers is stored by ON Power, by a party on behalf of the company in Iceland, or with the company's partners within the EEA area, where the rules regarding handling of personal information are the same as in Iceland. Personal information will not be disclosed to third parties unless with a speficic legal basis, by administrative order, court ruling, processing agreement, or with the customer's consent.

Retention period – How Long Personal Information about Customers is Retained

ON Power will store personal information for the duration required by law and as necessary based on the purpose of processing. Since Reykjavík Energy is owned by public entities, the company is subject to laws regarding public archives and, accordingly, has retention and filing obligations. The company is thus subject to certain restrictions regarding the deletion of data. Data that is authorized to be deleted according to a special permit from the City Archives will be deleted in accordance with the permission granted each time.

Customer Rights to Objection, Access, Correction, and Deletion/Restriction of Processing

The customer has the right to object to ON Power's collection of personal information if they believe that it does not comply with its purpose, is not proportionate, or if they believe that the same purpose can be achieved in a less intrusive manner.

The customer can request information about the processing of their information that takes place at ON Power, provided that the interests of others do not prevent this. Such requests shall be processed as quickly as possible and no later than within a month of receiving the request from the customer.

The customer may have the right to demand that incorrect, misleading, or incomplete personal information regarding them be corrected and/or deleted.

Customer Rights to Submit Complaints and Comments

If a customer wishes to submit objections, complaints, or comments regarding the processing of personal information, they should direct them to the company. If there is no response from the relevant unit, the customer may contact the data protection officer of the Reykjavík Energy Group, personuverndarfulltrui (at) or.is (see more details below).

Customers are also entitled to refer the processing of personal infromation to the Data Protection Authority

Accuracy and Reliability of Information

ON Power is responsible for the reliability of information and that customer information is always updated in accordance with their notifications of changes and considering the purpose of the processing.

The customer is responsible for informing ON Power of any changes that need to be made to the information.

Security of Customers' Personal Information

ON Power ensures the security of personal information by technical and organizational measures. Further details regarding these measures are discussed in the company's Information Security Policy and relevant guidance documents in ON Power's Operating Manual.

Access to personal information about customers is limited to employees who necessarily need such access to achieve the purpose of the processing. Employees are informed and aware of their obligation to maintain the confidentiality and security of personal information to which they have access. Their obligation of confidentiality continues even after termination of employment.

Except as provided herein, the processing of personal information about employees is governed by Act No. 90/2018 on Privacy and Processing of Personal Data, and measures implemented by Reykjavík Energy on its basis.

The data protection officer of Reykjavík Energy is Hörður Helgi Helgason, lawyer at Landslög, Borgartún 26, 105 Reykjavík. Phone number 520-2900, personuverndarfulltrui (at) or.is.