Skip to main content
Gulur

Privacy Policy of Gulur bíll

Data Controller: Gulur bíll ehf., kt. 581215-0370

Effective Date: 1 October 2026

Gulur bíll ehf. emphasizes responsible and secure processing of personal data. This policy explains what information we process, why we process it, to whom it may be disclosed, how long it is retained, and what rights individuals have.

1. Scope

This policy applies to the processing of personal data in connection with the operation and management of parking facilities, automatic license plate recognition, payments, subscriptions and parking permits, invoicing and collection, customer service, communications with customers, and the use of websites and digital service channels of Gulur bíll.

Specific information disclosures may apply at individual parking lots or for particular services. Information on signs at entrances, in payment systems, or in agreements with land or property owners may therefore supplement this policy.

2. Who is Responsible for Processing

Gulur bíll ehf. is the data controller when the company determines the purposes and means of processing personal data, including for its own customer relations, customer service, invoicing, collection, and the operation of parking facilities where the company makes such decisions.

At some parking lots, the owner, operator, or other manager of the area may be the data controller and Gulur bíll processes information on their behalf as a data processor. Signs or other information for the relevant area shall indicate who the data controller is. Any request received by Gulur bíll regarding another controller will be forwarded to them as appropriate or the individual directed to the correct recipient.

Contact information for Gulur bíll:

3. What Personal Data We Process

We may process the following categories of information, depending on which service is used:

  • vehicle information, such as license plate number, vehicle make/model, and as applicable, photo of the vehicle license plate;
  • parking usage information, such as entry and exit times, location, duration of stay, tariff zone, and status of payment or authorization;
  • identity and contact details, such as name, national ID number when necessary, address, phone number, and email address;
  • payment, invoicing, and claims information, including payment confirmations, invoice numbers, claim status, and collection history; we generally do not retain full payment card numbers;
  • subscription details, parking permits, fleet registrations, and link of a vehicle to an individual, company, or organization;
  • customer service interactions, complaints, requests for correction, and documents submitted by an individual in support of their case;
  • technical information related to websites and systems, such as IP address, device information, event logs, and cookies, as applicable; and
  • other information necessary to provide services, resolve disputes, ensure security, or comply with legal obligations.

4. Where the Information Comes From

Information may be obtained:

  • directly from the individual, for example upon payment, registration, purchase of a subscription, or customer service communications;
  • from ANPR cameras and other technical equipment at parking locations;
  • from the owner or operator of a parking facility, employer, subscriber, or party authorized to register parking permissions;
  • from payment, invoicing, authentication, and collection services; and
  • from public or other lawful registries when necessary and permitted, for instance to direct a claim or communication to the correct party.

5. Purpose and Legal Basis for Processing

  • To provide parking services: Log entry and exit times, calculate fees, verify payment or permission, and grant subscription access. (Legal Basis: Contract or pre-contractual measures)
  • Invoicing and accounting: Issue invoices, maintain accounting records, and perform tax returns. (Legal Basis: Legal obligation)
  • Non-payment and claims: Identify unpaid stays, send notifications, answer inquiries, and collect claims. (Legal Basis: Contract and legitimate interests)
  • Operations and security: Ensure system functionality, traceability, cybersecurity, access control, and prevent misuse. (Legal Basis: Legitimate interests and legal obligation as applicable)
  • Service and dispute resolution: Answer inquiries, correct registrations, and resolve disputes. (Legal Basis: Contract and legitimate interests)
  • Marketing communications and non-essential cookies: Send promotional materials or measure website usage when consent is required. (Legal Basis: In specific cases, legitimate interests)

6. Camera Reading and Automated Processing

In parking areas with automated camera reading, an ANPR system reads license plate numbers upon entry and exit and links them to time, location, tariff schedule, payment, or parking authorization. The purpose is to record parking usage, calculate the correct fee, verify authorization, and identify potential non-payment or misuse.

The system can automatically calculate parking fees and flag an entry for further handling if payment or authorization is not found. Automated readings may be incorrect due to light, weather, dirt, or unclear license plates. Individuals can request a human review, submit comments, and contest a decision or claim.

Cameras are adjusted and positioned with the goal of collecting only the information necessary for the operation and security of the parking facility. Electronic surveillance is clearly marked in the respective area.

7. Disclosures and Recipients

We only share personal data when necessary, permitted, and appropriate. Recipients may include:

  • owners, operators, or managers of the relevant parking lot, depending on who is responsible for the service;
  • technical service providers, such as vendors operating ANPR, parking, permit, hosting, communication, and security systems;
  • payment services, card companies, banks, and authentication services;
  • accounting, invoicing, and business software providers, auditors, and advisors;
  • debt collection agencies, attorneys, and courts when necessary to establish, exercise, or defend legal claims;
  • public authorities, including the police and regulatory bodies, when required by law or a lawful request; and
  • other parties with the explicit consent of the individual or on another valid legal basis.

Service providers processing data on our behalf are only permitted to do so under instructions, a valid data processing agreement, and appropriate confidentiality and security requirements. Entities such as banks and card companies may act as independent controllers for their own statutory processing.

8. Data Transfers Outside the EEA

We strive to process and host personal data within the European Economic Area. If data is transferred to a country outside the EEA, we ensure that authorization exists for the transfer and that appropriate safeguards are in place, such as an adequacy decision, European Commission standard contractual clauses, and, when necessary, supplementary measures. Further details regarding relevant transfers can be obtained by contacting us.

9. Retention Period

We retain personal data no longer than necessary considering the purpose of processing, legal obligations, contractual relationships, security, and potential legal claims. When retention is no longer necessary, data is deleted or anonymized.

  • ANPR images and entries related to regular parking usage: The parking management system used by Gulur bíll is Autopay. The retention period for data in the system is in accordance with Autopay's privacy policy. Their policy can be found at autopay.io/terms/privacy/en.html
  • Payments, invoices, and accounting records: According to applicable accounting and tax laws, generally seven years from the end of the relevant financial year, unless longer retention is necessary.
  • Unpaid fees, claims, and disputes: Until the matter is resolved and for the period thereafter necessary due to statutes of limitations, proof, or legal obligations.
  • Subscriptions and parking permits: While the agreement or permit is active and for one year after its termination, unless legitimate grounds or legal obligations require otherwise.
  • Customer service communications: For one year from the resolution of the matter, or longer if communications relate to a contract, claim, or dispute.
  • Technical event logs and security data: For one month depending on system nature and risk, unless an incident requires longer retention.

10. Security of Personal Data

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction. Measures consider the nature of processing and risk, and may include access controls, authentication, encryption where appropriate, traceability, backups, updates, testing, procedures, training, and confidentiality obligations. Access by staff and service providers is restricted to what is necessary for their duties.

11. Rights of Individuals

An individual may, to the extent legal conditions are met, request:

  • information about and access to personal data processed about them;
  • rectification of inaccurate or incomplete information;
  • erasure of information;
  • restriction of processing;
  • provision of information in a structured, commonly used, and machine-readable format and transfer thereof to another party;
  • to object to processing based on legitimate interests, including direct marketing;
  • to withdraw consent; and
  • human intervention and the right to express points of view when a decision is based on automated processing and has significant effects.

Rights are not absolute and may be limited by the rights of others, legal obligations, legal claims, or other statutory exceptions. We may request information to verify identity and connection to a license plate number before processing a request. We generally respond within one month; this period may be extended by up to two months when requests are complex or numerous, subject to notification within the first month.

12. Complaints and Contact

Requests concerning rights, comments on processing, or inquiries about this policy can be sent to gulur@gulur.is. To locate the correct record, it may be necessary to specify the license plate number, parking location, date, and estimated time. Do not send unnecessary personal data.

Individuals also have the right to lodge a complaint with the Data Protection Authority (Persónuvernd). Further information is available at www.personuvernd.is.

13. Cookies and Similar Technologies

Our websites may use essential cookies to ensure functionality, security, and user preferences. Other cookies, such as for statistics or marketing, are used only with consent where required. Users can modify their choices in cookie settings. A detailed list of cookies, their purpose, service providers, and expiration times shall be published in a cookie banner or dedicated cookie policy.

14. Marketing Communications

If we send electronic marketing communications, we do so on an appropriate legal basis. Such communications can be unsubscribed from at any time using an unsubscribe link or by contacting us. Service notices necessary for contracts, security, or service changes are not considered marketing materials.

15. Amendments to the Policy

We review this policy when changes occur in services, systems, legal requirements, or division of responsibilities. A new version will be published on www.gulur.is with an effective date. If a change is material, special attention will be drawn to it as appropriate.

16. Law and Applicable Standards

This policy is primarily based on Act No. 90/2018 on Data Protection and the Processing of Personal Data and the General Data Protection Regulation 2016/679 as applicable in Iceland. Relevant special rules apply to electronic surveillance, accounting, electronic communications, and debt collection as applicable.