Last updated: 21/09/2026

​

This Security Policy (the "Policy") describes the technical, organizational, and administrative measures ARK — Icelandic Entrepreneurship Association ("ARK", "we", "us", or "our") applies to protect the personal data, payment information, and other data of Members and visitors ("you") who use www.arkentrepreneurship.com (the "Site") and its Subscription services. This Policy supplements ARK's Terms and Conditions and Privacy Policy.

 

1. Scope

 

This Policy applies to all data collected or processed by ARK in connection with the Site, including account registration data, Subscription and billing data, communications, and any data submitted through membership applications, forms, or events.

 

 

2. Data We Protect

​

• Account information: name, email address, organization, and login credentials.

• Subscription and billing information: plan selected, billing cycle, and payment details (processed by our third-party payment processor; ARK does not store full card numbers).

• Communications: messages sent to ARK via email, contact forms, or the Site.

• Usage data: technical information such as IP address, browser type, and Site interaction data collected via cookies or analytics tools.

 

​

3. Technical Safeguards

 

Encryption in transit. All data transmitted to and from the Site is encrypted using HTTPS/TLS.

 

Encryption at rest. Data stored by ARK's hosting and payment providers is encrypted at rest in accordance with those providers' security standards.

 

Payment security. Payment card data is handled exclusively by ARK's PCI-DSS-compliant payment processor. ARK does not directly collect, transmit, or store full payment card numbers on its own systems.

 

Access controls. Access to Member data and administrative systems is limited to authorized ARK personnel and service providers who need it to perform their role, and is protected by unique credentials and, where available, multi-factor authentication.

 

Third-party providers. The Site is hosted and operated using reputable third-party platforms (e.g., website hosting and payment processing providers) that maintain their own industry-standard security certifications and controls.

 

 

4. Organizational Safeguards

​

• Access to Member and payment data is granted on a need-to-know basis and reviewed periodically.

• ARK personnel and volunteers with access to Member data are required to handle it confidentially and in accordance with this Policy.

• ARK maintains procedures to promptly revoke access for personnel or volunteers who no longer require it.

​

​

5. Data Retention

 

ARK retains Member data for as long as necessary to provide Subscription services, comply with legal and accounting obligations under Icelandic law, and resolve disputes. Data no longer needed for these purposes is securely deleted or anonymized.

 

 

6. Incident Response

 

Monitoring. ARK and its service providers take reasonable steps to monitor systems for unauthorized access or unusual activity.

 

Breach notification. In the event of a data breach affecting personal data, ARK will assess the incident, take steps to contain and remediate it, and notify affected Members and, where required, the Icelandic Data Protection Authority (Persónuvernd), without undue delay and in accordance with applicable law.

 

Reporting a concern. If you believe you have identified a security vulnerability or incident affecting the Site, please report it immediately to arkentrepreneurship@proton.me.

 

 

7. Member Responsibilities

 

You also play a role in keeping your account secure. You should:

• Use a strong, unique password for your ARK account;

• Keep your login credentials confidential and not share them with others;

• Notify ARK promptly at arkentrepreneurship@proton.me if you suspect unauthorized access to your account; and

• Keep your contact and payment information up to date.

 

 

8. International Data Transfers

 

Where ARK or its service providers process data outside Iceland or the European Economic Area, ARK takes reasonable steps to ensure such transfers are subject to appropriate safeguards consistent with applicable Icelandic and EU data protection law.

 

 

9. Changes to This Policy

 

ARK may update this Policy from time to time to reflect changes in its security practices or applicable law. Material changes will be posted on the Site with an updated "Last updated" date.

 

 

10. Contact

 

Questions or concerns about this Security Policy, or to report a security issue, can be directed to:

 

• Email: arkentrepreneurship@proton.me