Privacy Policy

1. Data Controller

Journey ehf., kt. 5310250160, Flókagötu 41, 105 Reykjavík, Iceland ("Kling", "we", "us") is the data controller for personal data processed through the Kling platform. You can reach us at hallo@kling.is.

2. What Data We Collect

Merchant Data

When you create a merchant account, we collect:

• Company name, kennitala, and registration details
• Contact person name, email address, and phone number
• Bank account information for payouts
• Login credentials (passwords are hashed and never stored in plain text)

Customer Data

When customers make payments through the Service, we may process:

• Name and email address
• Payment card details (tokenized — we never store full card numbers)
• Transaction history and subscription status
• IP address and device information for fraud prevention

Usage Data

We collect anonymized usage data such as page views and feature usage to improve the Service.

3. Why We Process Data

We process personal data for the following purposes:

• To provide payment processing and subscription management services
• To comply with legal obligations, including anti-money laundering regulations
• To prevent fraud and maintain security of the Service
• To communicate with you about your account and the Service
• To improve and develop the Service

4. Legal Basis

We process personal data based on: (a) performance of our contract with you, (b) compliance with legal obligations under Icelandic and EU law, (c) our legitimate interests in operating and improving the Service, and (d) your consent where applicable.

5. Data Sharing

We share personal data only when necessary to provide the Service:

• Payment processors and card networks to process transactions
• Banks for payout settlement
• Authorities when required by law or regulation

We do not sell personal data to third parties. All data processors we work with are bound by data processing agreements.

6. Data Storage and Security

Data is stored on servers within the European Economic Area (EEA). We use encryption in transit and at rest, access controls, and regular security reviews to protect your data. Payment card data is handled in compliance with PCI DSS requirements.

7. Data Retention

We retain personal data for as long as your account is active and as required by law. Financial transaction records are retained for seven years in accordance with Icelandic bookkeeping law (lög um bókhald nr. 145/1994). You may request deletion of your account data at any time, subject to our legal retention obligations.

8. Your Rights

Under the Icelandic Data Protection Act (lög um persónuvernd og vinnslu persónuupplýsinga nr. 90/2018) and the GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data, subject to legal obligations
• Object to or restrict processing of your data
• Data portability — receive your data in a structured format
• Lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd)

To exercise your rights, contact us at hallo@kling.is.

9. Cookies

We use essential cookies required for the Service to function, such as session cookies for authentication. We do not use third-party tracking cookies or advertising cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes at least 30 days before they take effect. The latest version is always available at this page.

11. Contact

For any questions about this Privacy Policy or how we handle your data, contact us at hallo@kling.is or write to Journey ehf., Flókagötu 41, 105 Reykjavík, Iceland.