Privacy policy
Last updated:
1. Introduction
AMKA operates the website amka.is. This policy sets out what personal data arises when you use the site, how it is used and what rights you have. We follow Regulation (EU) 2016/679 (GDPR) and Icelandic Act No. 90/2018 on data protection and the processing of personal data.
2. Data controller
AMKA is the controller for the processing described in this policy.
Skeifan 15, 108 Reykjavík, Iceland · Phone: +354 840 9539 · Email: amka@amka.is
3. What data arises
We collect no more than we need. The following arises when the site is used:
- Enquiries — name, email, phone number and the content of your message when you use the contact form or reach us by email or phone. Form submissions are stored in our database and a copy is emailed to AMKA.
- Chat with Evín — the messages you type are sent to Anthropic to generate a reply. Conversation content is not stored, only anonymous usage counts: model, number of tokens and cost. Please do not put personal data in the chat.
- Data on your device — cookies and local storage holding your consent choice, your age confirmation, your saved wine list and your chosen language. The table below lists them.
- Traffic measurement — Vercel Analytics counts visits without cookies and without an identifier. It only loads if you allow statistics.
- Anonymous page views — we record which wine page was viewed and when. No identifier and no cookie is attached, so the view cannot be traced back to you.
- Wholesale accounts — for resellers we hold an email address, a contact person, company details and that company's orders.
4. How the data is used
The data is used to:
- Answer enquiries and provide information about products and services.
- Receive and process reseller orders.
- Keep the site secure and working.
- See which content is read so it can be improved.
Data is never sold. It is not used to build profiles, and no automated decisions are made about you.
5. Legal basis
Processing rests on Article 6 GDPR:
- Consent (6.1.a) for traffic measurement and for remembering your chosen language between visits.
- Legitimate interests (6.1.f) for site security, anonymous page views, and storing your consent choice and age confirmation.
- Contract (6.1.b) for enquiries, quotes and reseller orders.
- Legal obligation (6.1.c) for retaining accounting records.
6. Cookies and data on your device
You can change your choice at any time via here or in the site footer. This is what is stored on your device:
| Name | Category | Purpose | Retention |
|---|---|---|---|
amka_consent | Necessary | Stores your answer to the cookie banner. | 1 year |
amka_age_verified | Necessary | Remembers that your age was confirmed. | 1 year |
amka-wine-list | Necessary | Holds the wine list you save. | 1 year |
amka-locale | Preferences | Remembers the language you chose. | 1 year |
amka-viewed-* | Necessary | Stops the same wine page being counted twice. | Until the browser is closed |
sb-*-auth-token | Necessary | Keeps administrators and resellers signed in. | Until the browser is closed |
Cookies in the Preferences category are not written until you allow them. If you decline, the site always opens in Icelandic.
7. Service providers and transfers outside the EEA
We use the following processors:
- Vercel: website hosting and traffic measurement.
- Supabase: database. The data is held inside the EEA, in Stockholm.
- Anthropic: powers the wine adviser Evín.
- Resend: sends order confirmations and copies of enquiries.
Vercel, Anthropic and Resend are US companies. Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses or on the provider's certification under the EU–US Data Privacy Framework.
8. Retention
Data is kept only as long as the purpose requires:
- Enquiries: up to 3 years.
- Reseller orders: 7 years, as accounting law requires.
- Cookies: up to 1 year from your last visit.
- Anonymous page views and Evín usage counts: kept on, as they contain no identifiers.
- Vercel Analytics measurements: per Vercel's terms.
9. Security
Traffic to the site runs over an encrypted connection. Administrator and reseller accounts require two-factor authentication, and access to data in the database is limited to those who need it.
10. Your rights
Under the GDPR you have the following rights:
- Access — to receive a copy of the data we hold about you.
- Rectification — to have incorrect data corrected.
- Erasure — to have your data deleted.
- Restriction — to restrict processing of your data.
- Portability — to receive the data in a machine-readable format.
- Objection — to object to processing based on legitimate interests.
- Withdrawing consent — to withdraw consent at any time in the cookie settings or by contacting us.
Write to amka@amka.is. We reply within one month.
11. Complaints to the Data Protection Authority
If you believe your data is being handled wrongly, you may complain to the Icelandic Data Protection Authority: personuvernd.is.
12. Changes to this policy
This policy may change. Changes appear on this page and the date at the top is updated with them.
13. Contact
Questions about this policy can be sent to amka@amka.is.