Privacy policy

Last updated: October 22, 2026.

Who we are

PLAIN VALUE ehf., trading as PLAIN VALUE Business Academy, is the controller of the personal information described in this policy.

Our company registration number is 441225-1210 and our address is Mýrargata 29, 101 Reykjavík, Iceland.

For privacy questions or to exercise your rights, email privacy@plainvalue.com, call +354 662 8882 or write to our address above.

This policy covers our website, online store, products, accounts and other communications with you.

Shopify powers our online store, including its related content, features, tools and services.

This policy explains how we collect, use and share personal information when you visit, buy from or otherwise interact with us; it takes priority over our terms of service for the handling of personal information.

Please read this policy carefully. By using the services, you acknowledge this notice of how we handle information; using the website or buying a product does not by itself give consent to optional marketing or tracking.

What we collect and where it comes from

Personal information identifies a person or can reasonably be linked to one, including information inferred about that person; information that has been made anonymous so that it cannot reasonably be linked back is different.

Depending on your interaction with us, we process contact details such as your name, email address, phone number, country and billing address, and any delivery address needed for a product.

Payment providers process the card, bank-account and other financial details needed for your chosen payment method; our order and invoice records include prices, payment method and status, transaction references, confirmations and refunds.

Account information includes your customer and sign-in identifiers, preferences and settings; Shopify handles authentication for our customer accounts.

Transaction information includes products viewed, added to a cart or wishlist where available, bought, returned, exchanged or canceled, together with purchase history and product-access records.

We also process the information you send in support requests or other communications, device and browser details, network information, IP addresses and other identifiers, and information about how and when you use the website and our products.

You provide information directly when you buy, create or use an account, subscribe, ask for help or otherwise communicate with us; technical information also comes from your device, cookies and similar technologies.

Our providers and partners supply information needed for payments, product delivery, sign-in, fraud prevention and the advertising and social-media interactions described below.

We do not obtain third-party contact lists, and we do not pool our customers with those of another company for marketing.

Why we use information

We use information needed to enter into and perform our contract with you to process payments and orders, provide product access and delivery, manage accounts, handle returns and refunds, and send necessary product, order and account messages (Article 6(1)(b) GDPR).

We use order, account and usage information to remember preferences, support reviews where offered, recommend relevant products and improve the website and products; optional tracking follows the choices described below.

For necessary customer support, account security, fraud prevention, service administration and the establishment or defense of legal claims, we rely on our legitimate interests where they are not overridden by your rights (Article 6(1)(f) GDPR).

We process records needed to meet bookkeeping, tax and other legal duties and respond to valid legal demands (Article 6(1)(c) GDPR); other legal claims or investigations are handled under the applicable legal duty or our legitimate interests.

Consent is the basis for customer-list ad sharing and for optional tracking where required (Article 6(1)(a) GDPR); email marketing has its separate rules below.

Some information is needed to complete a purchase, provide access or comply with the law; if you do not provide it, we may be unable to supply the requested product or service.

Optional marketing choices do not change the product price or your right to buy.

Product access and invoices

Our Course Access app shows access instructions on the Thank you and Order status pages, and some order notifications show corresponding links; the app itself sends no emails.

For courses delivered through Tevello, we use enrollment, access and learning-activity information to provide the promised content and functionality.

If a course includes live online sessions, an in-person session or a dedicated Facebook group, its description and access instructions identify the arrangements and the relevant platform.

The Company field is optional: we use what you enter only to show your requested company or national identification number on the Sufio invoice and to record it with the order in our accounting records.

We do not use that field to infer your age, date of birth or other characteristics, or for marketing, segmentation or advertising uploads.

Marketing email and newsletters

Marketing emails. We email you news and offers about PLAIN VALUE ehf.'s products if you sign up for them, for example with the box at checkout. In some countries, including Iceland, the box is already ticked when you buy a product: there we email you as an existing customer unless you untick it, as Article 94(2) of the Icelandic Electronic Communications Act No. 70/2022 and the corresponding rules of your country allow. Elsewhere we email you only if you tick the box or sign up, based on your consent (Article 6(1)(a) GDPR). We choose which emails to send you from the products you have bought and when, as described under "Customer lists for advertising"; this is our legitimate interest in sending you relevant emails (Article 6(1)(f) GDPR). You can unsubscribe at any time with the link in each email or on the My account page, and you can object to direct marketing at any time by emailing privacy@plainvalue.com. If you have bought from us, we stop once five years have passed since your last purchase.

Newsletter. If you subscribe to our newsletter on our website without buying, we email you news and offers about our products based on your consent (Article 6(1)(a) GDPR and Article 94(1) of the Icelandic Electronic Communications Act No. 70/2022). The sign-up box is never ticked in advance. We note on your customer record that you signed up through the newsletter form, and the sign-up does not place you on our customer lists for advertising, and we estimate nothing about you from the sign-up alone. You can unsubscribe at any time with the link in each email.

For purchasers, we stop marketing email five years after the last order; for a non-buyer newsletter subscriber, we use five years from the latest recorded affirmative newsletter opt-in, while the subscription remains active and its source and date can be demonstrated.

Email opens, tags and customer-record creation do not restart that period, and an unsubscribe or objection takes effect earlier.

Subscription and suppression checks also apply to any abandoned-checkout or other marketing automation; transactional order, invoice and account messages remain separate and contain no promotion.

Newsletter sign-up does not authorize customer-list sharing, website tracking or SMS marketing; we do not use SMS marketing in this arrangement.

Customer lists for advertising

When you tick "Show me relevant news and offers in ads" after checkout, or switch it on under My account, you agree to this: "We add your purchase and contact details to the customer lists we share with Meta, Google and LinkedIn to show you and others relevant news and offers in ads." "We" means PLAIN VALUE ehf. Your contact details are your email address, phone number, first and last name, city, state or region, postal code and country. Your purchase details are your customer number in our store, the total value of your purchases with us and which of our products you have bought (we send separate lists, for example of everyone who has bought a particular product). Our partners are Meta (Facebook and Instagram), Google (including Search and YouTube) and LinkedIn. Each partner receives only the details listed here: Meta all of them; Google your email address, phone number, name, postal code and country; and LinkedIn your email address, first name, last name and country. In addition, each partner learns which of our lists you are on. We never send payment details, invoices or any national identification number for this purpose.

In practice, we use these lists to:

• show our ads to you on our partners' platforms;
• leave you out of ads that no longer apply to you, such as ads for products you have already bought. Matching does not always succeed, for example if you use a different email address there, so you may still see some of these ads;
• find new people who resemble our customers (lookalike audiences); here Meta also uses the purchase value to give more weight to customers who buy more;
• let our partners' automated targeting use our lists as a starting point for finding the right people.

We decide which of our lists you are on from the products you have bought and when. This is profiling for marketing. We do not use sensitive personal data for this, and this grouping has no legal effect on you and does not similarly significantly affect you. You can object to this use, and to direct marketing in general, at any time by emailing privacy@plainvalue.com; we then stop all direct marketing to you.

We rely on your consent (Article 6(1)(a) GDPR). It is optional and has no effect on your purchase, price or access to products, and it covers future purchases until you change it. Each time you buy from us again, the page you see after checkout shows your current choice, so that you can change it there as well.

We send the lists from our online store: through the Syncmatic app for Meta and Google, and manually for LinkedIn. Syncmatic is provided by AC App-Commerce UG (haftungsbeschränkt) in Germany, which processes our customer data on our behalf to build and send the lists. Syncmatic hashes email addresses and phone numbers for Meta and Google. When we upload a contact list to LinkedIn, Campaign Manager hashes the email addresses; the first name, last name and country remain readable. Other details are hashed or sent as they are, depending on each partner's format: Meta receives your customer number and purchase value unhashed, and Google your postal code and country, and LinkedIn your first name, last name and country. Each partner compares the details with its own users and uses only the matches. The upload itself is encrypted. Hashing hides the details themselves, but it does not make them anonymous: it is how each partner recognizes its own users. These are the partners covered by our customer-list sharing choice; uploads require your opt-in and eligibility.

We are the controller for selecting customers, asking for your choice and sharing our lists. For instructed list matching, the platform terms describe Meta and Google as processors, while LinkedIn's terms for its advertising products, including contact lists and the Insight Tag, make LinkedIn an independent controller of the data it receives. Each platform is also a controller for processing it determines for its own services. Any joint responsibility applies to the particular jointly determined processing, rather than all subsequent platform activity. Each partner also processes data under its own terms and privacy policy: Meta, Google and LinkedIn. You can exercise your rights with us or with the relevant partner.

Meta, Google and LinkedIn may transfer data to the United States. Their US parent companies are certified under the EU–US Data Privacy Framework, which the European Commission has found to provide adequate protection and which applies in Iceland through the EEA Agreement. If the framework stops applying, these transfers will need another safeguard, such as the European Commission's standard contractual clauses, and we will update this policy. In the EEA, we contract with Meta Platforms Ireland Limited, Google Ireland Limited and LinkedIn Ireland Unlimited Company. Syncmatic's processing in the United States relies on the safeguards in its annexes dated 11 October 2026, accepted for our company on 12 October 2026: the EU–US Data Privacy Framework for the participating service providers and standard contractual clauses where applicable. Syncmatic itself does not claim certification under that framework. You can ask us about these safeguards at privacy@plainvalue.com.

You can withdraw your consent at any time by switching it off under My account or emailing privacy@plainvalue.com. We remove you from our lists at once, and our partners remove you from their audiences when the lists are next updated. The lists we sync automatically are normally updated daily, but removing you can take longer, for example while a partner is still processing an earlier update; the lists we upload manually are updated within 7 days. Withdrawal does not affect the lawfulness of sharing that took place before it.

This choice is separate from marketing emails and from cookies. If you accept marketing cookies, our partners also receive information about your visits and purchases on our website, and sometimes your contact details, as described under "Cookies and website tracking". That does not add you to our customer lists.

We include you in these lists only if you have bought from us within the last five years. We keep your current choice and a history of your changes (each value, when and where you made it, and the version of the wording you saw) with your customer record, so that we can show what you agreed to and when.

Technical logs

When the ad-sharing box loads on the page you see after checkout, or in your account, it contacts a server that our parent company, Abjarna ehf., runs for us at Microsoft Azure. As with any website, the server receives your IP address and browser details. We do not keep your full IP address, your location or your browser details, and we delete these technical logs after 30 days. We use them only to keep the service working and secure, which is our legitimate interest (Article 6(1)(f) GDPR), and never for advertising. Abjarna ehf. also operates our website tracking server containers using Stape Europe OÜ as its sub-processor, with the hosting and content-delivery providers listed in the applicable processing terms. Their tracking request logs are separate from the ad-sharing app's technical logs and follow the periods stated under “Cookies and website tracking”.

Cookies and website tracking

We use Cookiebot to ask for your choices about cookies and similar technologies. Necessary cookies support the website's essential functions. You can change or withdraw your choices in Cookie settings in the footer. Some browser storage is created by our website's theme, Shopify and Stape before you make a choice; in Cookie settings, you can view descriptions of these entries and when they are removed.

Statistics. Google Analytics measures visits, the products viewed and purchases. If you decline statistics, Google's consent mode can still send limited measurement signals without analytics cookies. These signals help Google estimate how our website and ads perform. They are not a promise that no information is sent or that all statistics are anonymous.

We also allow Google, as an independent controller, to use analytics data to improve its products and services, including advertising systems. See how Google uses shared Analytics data.

Marketing. If you accept marketing cookies, Meta, Google and LinkedIn receive information about your visits, products viewed and purchases to recognize visitors, measure our ads and show our ads to you and others. Google signals and the platforms' matching features may link activity with information they already hold.

When your details are known, for example after sign-in or at checkout, Meta receives your email address, phone number, first and last name, city, state or region, postal code, country and customer number, where available. Its matching contact fields are hashed before transmission, while IP address, browser details and event information are also sent. At purchase, Google uses your email address, phone number, name and address details, including street, city, state or region, postal code and country, where available, for matching through its user-provided-data features. This uses hashed contact identifiers together with address details; not every field is hashed. LinkedIn receives your email address hashed, your first and last name in readable form when known, and your country at purchase. Hashing is a form of coding for matching, not anonymization.

When you accept marketing cookies, we and Meta Platforms Ireland Limited are joint controllers for collecting event data on our website through the Meta Pixel and Conversions API and transmitting it to Meta, for the advertising purposes described above. Under Meta's Controller Addendum, we provide this information and Meta handles requests about your rights for the data it stores after transmission; Meta's further processing, its legal basis and how to exercise your rights with Meta are described in Meta's privacy policy.

Our tracking servers. Some website and checkout events pass through our server containers, operated for us by Abjarna ehf. using Stape. They can receive event and known contact details even if you decline marketing cookies. Our server tags restrict the onward sharing of contact details with Google, Meta and LinkedIn according to your Marketing choice. Incoming request logs can contain contact details, IP addresses, page addresses and browser details and are kept for three days on our current Stape plan. Outgoing request logging is normally off. These logs are separate from the ad-sharing app's technical logs described elsewhere in this policy.

Matching and browser storage. Meta's hashed matching details can be kept in a first-party server cookie for up to 90 days and in browser storage until removed or cleared. Our withdrawal controls remove the declared browser entries and expire the server matching cookie when a page reports that Marketing is not allowed. While you are signed in, Stape can briefly write known customer and purchase details in readable form as a page loads; our control removes that stored copy when Marketing is not allowed. This does not mean that the details were never received by our servers or briefly held by the page.

Cookie restoration. We use Stape Cookie Keeper to help restore permitted analytics and advertising cookies in browsers that shorten cookie lifetimes. Its browser identifier is created only when both Statistics and Marketing are accepted and is removed when either is withdrawn. Some Shopify session entries remain until you close the browser tab. Cookie lifetimes can be shortened by your browser; restoration does not guarantee that a cookie survives for its full stated duration.

Separate choices. These website events do not add you to our customer lists for advertising. Customer-list sharing requires the separate choice after checkout or on the My account page. That choice is also separate from email marketing. The Company field and address line 2 are not forwarded through the tracking mappings described here.

The _gtmeec server cookie and gtmeec browser storage support the matching described above; a browser copy can remain until it is removed or cleared.

An audience_segment link parameter can identify the advertising segment associated with a visit; when Marketing is allowed, our _aud_seg cookie can retain that segment for up to 90 days.

Checkout events are routed through Shopify’s custom pixel and our tracking containers; the pixel’s permission setting does not itself prevent receipt by Stape before optional partner gates are applied.

If a cookie choice is missing or expired, a previously stored Shopify choice can still affect startup processing; removing a browser copy or declining a category does not erase information already received.

For Google’s separate uses of business data, see Google’s business privacy information.

Advertising and social-media audiences

We may advertise to people who visited the website, interacted with our product catalog, pages, posts or videos, or resemble or are predicted to respond like an eligible audience; the source and permissions differ from customer-list uploads.

The platforms process interactions under their own terms and choices; Meta supports catalog and lookalike uses, while LinkedIn’s available audience features differ.

For Meta Page Insights, we and Meta Platforms Ireland Limited are joint controllers for the jointly determined creation of events and their aggregation into page statistics; Meta handles the main information and rights-response duties under the Page Insights Controller Addendum.

Our interest in those page statistics is to understand and improve communication with our audience; you can exercise your rights with either us or Meta, and this joint role does not cover every subsequent use by Meta.

Shopify and other recipients

Shopify hosts and operates the store and processes information for us, including through Shopify Forms, Messaging/email, Flow, Bundles, Checkout Blocks, Search & Discovery and the Facebook & Instagram catalog channel where used.

Shopify Network Intelligence is enabled: Shopify combines information about interactions with our store, other merchants and Shopify to provide enhanced features, including personalization, product improvement and ad targeting.

For those separate purposes Shopify is responsible as a controller, including for rights requests; see the Shopify Consumer Privacy Policy and Shopify Privacy Portal.

Our Shopify admin currently identifies the United States as the store’s data-hosting location; providers can also use support and onward-processing locations under their terms.

Abjarna ehf. is our processor for the ad-sharing app and tracking containers, using Microsoft Azure for the app and Stape Europe OÜ as a subprocessor for tracking; Stape’s hosting and content-delivery chain includes Scaleway Solutions S.A.S. and Cloudflare, Inc.

Cookiebot, provided by Usercentrics A/S, processes cookie choices and their evidence on our behalf; Microsoft 365 supports our email and request handling; and Microsoft Dynamics 365 Business Central holds our accounting records, which can include order and customer details from the store, such as what you enter in the Company field. Abjarna ehf. holds the accounts for these three services and is our processor for them.

Sufio s.r.o. processes invoice information on our behalf, and Tevello LLC processes course-enrollment, access and learning information to provide its course platform for us.

Braintree/PayPal processes payments and acts as an independent controller for its payment services; Apple Pay and Google Pay also involve their wallet providers when you choose them. See PayPal’s privacy information.

The payment provider shown at checkout handles the information needed for the method you select under its own privacy notice.

If you use a course’s Facebook group or a live-session platform such as Zoom where specified for the course, that provider also processes your account and participation information under its own terms; we use the information needed to administer your access and deliver the course.

Syncmatic reads and stores customer records across the store, including records outside the segments selected for advertising; restricting uploads to opted-in customers does not restrict that underlying import.

Its main hosting is Google Cloud in the United States, in us-central1, with additional batch processing in other US regions; its covered subprocessors include Google Cloud/Workspace and Sentry for their stated functions.

Our providers receive information needed for their assigned tasks, including hosting, IT support, payments, customer support, product delivery, storage, accounting and analytics; advertising recipients and their distinct roles are described above.

We also share information when you instruct us to do so, including through a chosen integration, or where needed for a lawful business transfer, legal obligation, valid authority request, legal claim or protection of our services and people’s rights.

Other group companies do not receive customer information simply because they are affiliated with us; Abjarna ehf.’s processing role above is separate from using data for its own marketing.

International transfers

Information can be stored or accessed outside your country, including outside the EEA or UK; where required, transfers rely on an applicable adequacy decision or appropriate contractual safeguards, such as the European Commission’s standard contractual clauses and relevant UK arrangements.

The customer-list safeguards above are specific to those recipients; Shopify, Microsoft, Tevello, payment providers and other providers have their own processing and onward-transfer arrangements.

A provider’s participation in the Data Privacy Framework does not cover every company or every processing activity; you can ask us for information about the safeguards relevant to your data or a copy, subject to lawful redactions.

How long information is kept

We keep account and access information while needed to provide your agreed access, and order, support and dispute information while needed to perform the contract, resolve the matter or meet a specific legal duty; we then delete it or make it anonymous unless a justified further purpose applies.

Bookkeeping records and supporting documents are generally retained for seven years from the end of the relevant financial year under Article 20 of Act No. 145/1994; this is separate from marketing eligibility and does not keep a person eligible for advertising.

We keep records of privacy requests and our replies for four years after a request is closed, so that we can show how we handled it.

The five-year marketing limits above are use limits, not a promise to erase every order or account after five years; a minimal suppression record and necessary consent evidence can remain to honor your objection and demonstrate past choices.

Cookiebot’s consent log records part of the IP address, browser information, the domain, consent time and a consent key; Cookiebot deletes individual consent-log entries after 12 months under its service terms.

The ad-sharing app’s Azure logs have a 30-day period, Stape’s current incoming tracking logs have a three-day period, and individual cookie and browser-storage durations appear in Cookie settings; these periods refer to different records.

Syncmatic’s accepted schedule gives snapshot objects a seven-day deletion rule followed by a seven-day soft-delete window, with asynchronous lifecycle execution; covered recoverable transient copies must be deleted within 30 days of an applicable deletion instruction.

Its covered live data is returned or deleted within 30 days of an applicable instruction or termination, and recoverable backups expire within a further 30 days after live deletion; these are separate deadlines.

The schedule distinguishes routine cloud logs (30 days), required platform audit logs (400 days), privacy/support correspondence (up to 12 months after closure where still needed), and unnecessary shopper identifiers or local exports (normally removed within 30 days under the applicable instruction).

Google Cloud’s provider-level deletion process can take up to 180 days after a qualifying instruction; this does not extend Syncmatic’s own accessible-data deadlines, and remaining provider copies or lawful holds must be identified rather than reported as already erased.

Some Syncmatic rights and deletion work requires manual instructions; an automated acknowledgment or removal from an ad list does not prove erasure of all snapshots, backups or historical copies.

Security and other websites

We use appropriate measures to protect information, but no system or transmission is completely secure; please do not send sensitive information through an insecure channel and keep your sign-in details safe.

Links to third-party websites, social-media services or integrations do not by themselves endorse their content, owners or operators, or place their privacy and security practices under our control; we do not guarantee their security or the accuracy, completeness or reliability of their content. Review their terms before sharing information there.

Information you post in public or shared spaces, including social-media groups, can be visible to others and used by them.

Your rights and choices

Subject to the conditions and exceptions in applicable law, you can request access and a copy, correction, erasure, restriction of processing and portability of information, including transfer to another controller where applicable, and object to processing based on legitimate interests.

You can object to direct marketing and its related profiling at any time, without giving a reason; we then stop that direct marketing.

You can withdraw consent for the relevant purpose at any time, without affecting the lawfulness of earlier consent-based processing; withdrawing marketing consent does not stop necessary order or account messages.

Depending on your location, you may also have rights to opt out of sale, sharing or targeted advertising as those terms are defined by local law, and to appeal a decision on a privacy request.

Use the relevant account or cookie control, an email unsubscribe link, or contact our privacy address above; you can also use Shopify’s Privacy Portal for Shopify’s own processing.

We may need proportionate identity verification or evidence that an authorized agent can act for you; we do not discriminate against you for exercising your rights.

We normally respond within one month under the GDPR; if an extension is permitted, we explain it and its reason within that month, and any refusal explains the available complaint or review route.

You can complain to Persónuvernd, the Icelandic Data Protection Authority, or another competent supervisory authority, including in your country of residence or work in the EEA; the EDPB directory lists EEA supervisory authorities.

Children and policy changes

Our products are intended for adults, and no courses for people under 18 are planned. We do not knowingly collect personal information from children below the age of majority applicable to them; a parent or guardian can contact us to request deletion if a child has provided information.

We do not knowingly sell or share personal information of people under 16 for targeted advertising as those terms are defined by applicable law.

We update this policy when practices, legal requirements or operations change, publish the revised version with its updated date and provide any further notice required by law.