General

Digital Iceland operates the Service System on behalf of the Ministry of Finance and Economic Affairs (the service provider). Government agencies, ministries and other public bodies can use the system (service recipients).

The customer service system makes it easier for public bodies to manage their communication with the public. It does this through a central service request system. The system can receive many types of enquiries, such as emails, phone calls, web chat, contact forms, social media and applications from the Ísland.is application system.

These terms form an agreement between the service provider (Digital Iceland) and the service recipient (an agency or public body) about the service. The terms define the responsibilities of each party for the operation of the customer service system.

By using the service, the service recipient agrees to these terms.

See further information in Appendix I.

1. Definitions

Service recipient: An agency or public body that uses the service.
Service provider: Digital Iceland, on behalf of the Ministry of Finance and Economic Affairs.
Customer service system: The customer service system operated by Digital Iceland. Systems like this have many names, such as ticketing systems, service request systems or CRM systems. The system itself is provided by Zendesk.
Sub-processor: Zendesk Inc. is a sub-processor of Ísland.is under a data processing agreement.
Requester: The individual who submits an enquiry or service request.

2. Obligations of the parties

The service provider holds the contract with Zendesk. It is responsible for the technical setup and basic configuration of the system. The service provider is a processor for the service recipient to the extent that it processes personal data on the service recipient’s behalf.

The service provider undertakes to:

• Manage users in the system. The service recipient’s employees apply for access to the system through Digital Iceland’s central single sign-on (SSO) login portal.

• Support the service recipient in implementing the customer service system.

• Provide training and learning materials for system users.

• Help connect the customer service system to the service recipient’s case management systems.

• Set up the communication channels in the system that the service recipient plans to use, including email, web chat, phone, social media and application systems.

• Manage the general configuration and functionality of the system.

• Issue API tokens as needed.

• Set up integrations in the system, such as web services and webhooks.

• Install approved apps that connect to the system.

• Register and set up OAuth clients.

• Keep the service recipient informed of changes and new features that affect the functionality or services available in the system.

The service recipient has access to the system and acts as the controller for personal data processed in connection with its own use of the system. Examples include communication with requesters and with its own users.

The service recipient undertakes to:

• Assess and process its employees’ requests for access to the system.

• Administer its part of the system and ensure the maintenance and security of the system components it is responsible for.

• Handle further adaptation and configuration of its own part of the system after formal implementation.

• Train its employees after the implementation process is complete.

• Manage and ensure correct forwarding of email addresses in the system. This includes making sure that SPF and DNS records are set up correctly according to technical guidelines.

• Process personal data only in accordance with applicable laws and regulations on data protection and confidentiality.

• Take measures to ensure that system users within its own organisation know and follow its requirements and policies on security, confidentiality and personal data protection.

In all other respects, Digital Iceland’s data protection terms apply to the processing of personal data in the customer service system. This includes the division of responsibilities, unless otherwise agreed.

The service recipient is given access to the service on the basis of the parties’ agreement. By using the service, the service recipient commits to following all rules and terms that apply to the service.

2.1 General provisions on the parties’ obligations

The service recipient is responsible for ensuring that the information does not reach unauthorised persons. It must also ensure that its staff with access to incident records keep the information in them secure.

If the service recipient outsources its systems or their management to a third party, the service recipient always remains responsible for that work.

3. Operation and service

The service provider is responsible for the basic operation of the system. This includes:

• general management of operations

• procurement of the software

• the business relationship with the sub-processor

• general security settings in the system

The service provider provides general training on the system and manages user administration, including creating new users. Users log in to the customer service system through Digital Iceland’s central single sign-on (SSO) login portal.

4. Security

The service provider is responsible for having appropriate technical and organisational measures in place to keep the service secure. These measures must take into account:

• the latest technology

• implementation costs

• the scope, context and purpose of the processing

• the risk of a security breach

Digital Iceland’s customer service system (Zendesk) is a software-as-a-service (SaaS) system. It is hosted in Amazon Web Services (AWS) data centres within the European Economic Area (EEA). The data centres hold various security certifications, including ISO 27001, PCI DSS and SOC 2. Zendesk carries out regular security audits and certifications of the solution.

The system architecture is based on multi-layered security, where different components are protected according to cybersecurity best practices. Network traffic is continuously monitored to make sure it is normal, and vulnerability assessments are carried out regularly. Zendesk collects network traffic data in a central system (SIEM). This system alerts security monitoring to any abnormal traffic or activity.

Attempted attacks and potential risks are monitored around the clock. Zendesk has protection against distributed denial-of-service (DDoS) attacks. It also works with Cloudflare to defend against possible attacks at the network edge.

All network communication with the customer service system is encrypted with HTTPS/TLS. Email communication with the system is encrypted with TLS. Data stored in the system is encrypted with AES-256 keys.

The customer service system meets the technical and organisational requirements of the EU General Data Protection Regulation 2016/679 (GDPR). It also meets the requirements of Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data.

Under the contract, data is stored within the EEA.

The service recipient and the service provider must notify each other as soon as possible if they suspect either of the following:

• accidental, unauthorised or unlawful processing of information

• any kind of security breach involving information obtained from the service

The notification must be sent to the general email address of the party concerned (in the case of the service recipient, island@island.is). The notification must describe the nature of the breach. This includes the estimated number of data subjects affected and the use of the information. The notifying party must also describe the likely consequences of the breach and the measures it has taken or plans to take.

If data protection law requires it, the service recipient is responsible for reporting the breach to the Icelandic Data Protection Authority (Persónuvernd) within 72 hours.

5. Liability

The service recipient shall indemnify and hold the service provider harmless against the following, including legal costs:

• any loss or damage

• claims and proceedings

• liabilities, fines and penalties

• other costs

This applies to anything the service provider may incur as a result of, or in connection with, the actions or omissions of the service recipient. It applies whether these result from neglect, wilful misconduct or negligence by the service recipient or its users when using the service provider’s customer service system. It also applies to anything resulting from a breach of the parties’ agreement.

This indemnity does not limit any other contractual or statutory rights the service provider may have against the service recipient. Paying compensation or an indemnity does not justify a breach of the service recipient’s duties and obligations.

The service recipient is responsible for all damage caused by its own or its users’ use of information exchanged between the service provider and the service recipient.

The service provider is not liable for damage resulting from use of the service if the damage is caused by lack of knowledge, misunderstanding or misuse by the service recipient or its users. The service provider is not liable for damage caused by the service recipient’s equipment not working properly.

The service provider is not directly or indirectly liable for damage caused by the service being shut down without notice. This applies, for example, to faults in the service provider’s software or hardware, faults in connected software or hardware owned by a third party, or any other cause. If errors, interruptions or delays occur in the service provider’s service, its liability is limited to correcting them as soon as possible.

The service provider is only liable for damage suffered by the service recipient if it is caused by gross negligence or wilful misconduct by the service provider’s employees. In such cases, the service provider’s liability covers only direct damage. It never covers indirect or consequential damage, such as business interruption, loss of business or reputational damage.

Liability for damage resulting from breaches of Act No. 90/2018 on Data Protection and the Processing of Personal Data is governed by Article 51 of that Act and Article 82 of Regulation (EU) 2016/679 of the European Parliament and of the Council.

6. Fees

Each licence costs ISK 7,000 per month. The service provider sends invoices for licences at regular intervals. The service recipient only pays for licences that are in use, and the service provider counts these each month. The service recipient can cancel licences from one month to the next, so it is not committed to using the service.

7. Operational security

The parties undertake to support the secure operation of the service. They will also work together on repairs if operational disruptions occur.

If the service recipient becomes aware that the service is not working properly in any way, it must notify the service provider without delay. In such cases, the service recipient may generally not use the service until the service provider has finished its investigation.

The service may need to be closed temporarily for system maintenance, data updates or other technical work. If so, the service provider will notify the service recipient as soon as possible, and at least 24 hours in advance.

The service provider may suspend the service recipient’s access to the service without warning in either of these cases:

• it is necessary because of a suspected security breach at the service recipient

• the service provider considers it clear that the service recipient’s equipment does not meet the service provider’s requirements for using the service

Circumstances beyond a party’s control may prevent the service recipient or the service provider from fulfilling its obligations under the agreement. If this happens, those obligations are suspended. They remain suspended until the circumstances have ended and the parties can fulfil their agreed obligations.

8. Termination

The service recipient only pays for the licences that are in use at any given time. At the end of each month, the service recipient may request cancellation of some or all of its licences. A request to close all licences counts as termination.

9. Confidentiality

The service provider must keep information about the service recipient confidential where that information should not be disclosed. The service provider must ensure that its staff and contractors sign confidentiality agreements or are bound by statutory confidentiality obligations.

The service recipient must respect the confidentiality of users at all times. The service recipient may not request or use information obtained through the service for any purpose other than the following:

• authenticating a user on its website

• direct authentication

• authentication under a delegation of authority

10. Data protection

In accordance with the Data Protection Act No. 90/2018 and Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the service recipient is the controller and the service provider is the processor. This applies to personal data created and handled in the customer service system.

The controller decides the purposes and means of processing personal data. It also guarantees that it is authorised to process the personal data that it asks the processor to process in connection with the service. The processor processes personal data on behalf of the controller. It processes only the personal data it needs to provide the service under these terms.

Among other things, the controller is responsible for ensuring that the processing of personal data is lawful. The processing must be based on Article 9 of the Act and, where applicable, Article 11. It must also comply with the principles of the Act, as set out in Article 8.

11. Changes to the terms

The service provider reserves the right to change these terms. The service recipient will be notified electronically at the email address it has provided, or by another verifiable method. Notice will be given at least two weeks before the new or changed provisions take effect. New or updated terms are also announced on Ísland.is before they take effect.

The service provider may make changes at shorter notice if the law requires them. In such cases, the service provider will try to give notice of the changes as soon as possible.

These terms were updated on 3 November 2026.

This text was translated from Icelandic using a machine translation. Be advised that content generated by machine translation can be inaccurate or flawed.