Privacy Policy

What we collect

Information you give us when you order or get in touch — your name, contact, delivery and billing details, and the contents of messages you send us. We also collect basic, cookieless page analytics that don't identify you. If you accept analytics cookies, we additionally use Google Analytics; until you do, it runs in consent-denied mode and sets no cookies on your device.

When you use the contact form or the sign-up form, our servers briefly see your IP address. We use it only to count requests so the forms can't be flooded, and the counter is deleted after 60 seconds.

How we use it

• Process, deliver and support your orders.
• Answer your questions and provide customer support.
• Keep the site secure and gradually improve it.
• Send you product updates — only if you opt in, and you can unsubscribe any time.

Who we share it with

Trusted service providers who help us run the shop — payment processors, shipping carriers, email and customer-service tools — under contract and only for those tasks. If you accept marketing cookies, we also share limited data with Meta to measure our ads. We never sell your personal data.

Your choices

• Ask for a copy of your data, or ask us to correct or delete it.
• Unsubscribe from marketing emails at any time.
• Manage cookies from the cookie banner or your browser settings.

Who is responsible for your data

Harmonix ehf. is the controller of the personal data described in this policy — the data this website and our online store collect. The Elevate companion app is a separate matter, and is covered under “Hearing data and the Elevate app” below. We are registered in Iceland, with company registration number (kennitala) 561123-1870 and VAT number 157642. Our registered office is: Reykjavíkurvegur 64, 220 Hafnarfjörður, Iceland. For anything to do with your data, email support@harmonix.is and write “Privacy” in the subject line.

Why we are allowed to use your data

European data protection law (the GDPR) says we must have a lawful basis for everything we do with your personal data. These are ours.

• Your orders. To take, deliver and support an order we use your name, contact details, and delivery and billing address. The basis is performance of our contract with you. Without this information we can't sell you anything.
• Answering you. When you write to us through the contact form we use your name, email address and message so we can reply. The basis is our legitimate interest in answering people who get in touch — or our contract with you, if your message is about an order you've placed.
• Marketing email. We only send you marketing if you ask us to. The basis is your consent. Every mailing list we run in Klaviyo is double opt-in: we email you a confirmation link when you sign up, and you are added only once you click it. The sign-up form on our home page works differently — it doesn't create a Klaviyo profile at all, it simply emails your address to our team. You can withdraw consent at any time from the unsubscribe link in any email, or by writing to us. Withdrawing doesn't make the emails we already sent unlawful.
• Analytics cookies. Google Analytics only measures your visit if you accept analytics cookies in the cookie banner. The basis is your consent. Until you accept, Google Analytics runs in consent-denied mode and sets no cookies on your device. If you have accepted, a purchase you make is also recorded in Google Analytics, and Google Ads uses that record to count which ads led to a sale. We don't send Google your name, email address or phone number. For an order that includes Elevate, we tell Google not to use the purchase to personalise ads.
• Ad measurement. If you accept marketing cookies, Meta's tracking code records which of our pages you view and what you add to your cart, and when you buy SonaVue or TravelerAI we tell Meta about the purchase. That shows us which ads work. The basis is your consent, which you can withdraw at any time in Cookie settings. Elevate and our hearing pages don't load Meta's code at all, and Elevate purchases are never sent to Meta.
• Basic site measurement. We also use Vercel's cookieless analytics and page-speed measurement. These run on every visit, set no cookies and don't identify you. The basis is our legitimate interest in knowing the site works and how fast it is. If you'd rather we didn't, you can object — see your rights below.
• Keeping the site up. We briefly count requests against an IP address so our forms can't be flooded. The basis is our legitimate interest in protecting the site and our ability to answer real customers.
• Records we have to keep. We keep order and payment records for as long as Icelandic bookkeeping and tax law requires. The basis is our legal obligation.

Where your data goes

We use a small number of service providers to run the shop. They act only on our instructions, under contract, and they may not use your data for their own purposes. We never sell your personal data.

• Shopify — our shop, checkout and payments. When you check out you're handed over to Shopify's own hosted checkout. Card details are handled there and never touch this website.
• Vercel — hosting for this website, plus the cookieless measurement described above.
• Google — Google Analytics and Google Ads, and only if you accept analytics cookies.
• Meta — the tracking code and purchase reports described above, and only if you accept marketing cookies. When we report a purchase, your email address, phone number, name, address details and customer number are sent in hashed (scrambled) form, together with your IP address and browser type, so Meta can match the purchase to an ad you saw.
• Judge.me — product reviews. After a purchase, Judge.me may email you to ask for a review. If you write one, it is published on our site under the name you give. The basis is our legitimate interest in showing genuine reviews; you can ignore the request or opt out of these emails.
• Gorgias — the customer-service system we use to answer your messages, including messages sent to our Facebook page.
• Klaviyo — our marketing email list, if you sign up for it.
• Resend — delivery of the emails that our contact and sign-up forms generate.
• Upstash — the short-lived request counters that protect our forms.

Several of these providers are based in, or store data in, the United States, so some of your data is processed outside the European Economic Area. Each of them provides data-protection terms for international transfers as part of the standard contract we have with them. If you want to know which safeguard applies to a particular provider, ask us and we will tell you what we hold.

Your rights in the EEA and the UK

If you're in the European Economic Area or the United Kingdom, the GDPR gives you these rights over your personal data.

• Access — ask whether we hold data about you, and get a copy of it.
• Rectification — have anything wrong or incomplete corrected.
• Erasure — ask us to delete your data, where we have no continuing reason and no legal duty to keep it.
• Restriction — ask us to pause using your data while a dispute about it is sorted out.
• Portability — get the data you gave us in a common, machine-readable format, or have us send it straight to another company where that's technically possible.
• Objection — object to any processing we base on our legitimate interests, including the basic site measurement above. You can always object to direct marketing, and we will stop.
• Withdraw consent — take back any consent you've given us, whenever you like.

To use any of these, email support@harmonix.is. It's free. We'll reply within one month, and tell you if we need longer because the request is complicated. We may have to ask you for enough information to be sure it's really you.

We don't make decisions about you by automated means alone, and we don't profile you in any way that has a legal effect on you or affects you similarly significantly.

How long we keep your data

Different data has a different lifetime. These are ours.

• Order and payment records — 7 years from the end of the accounting year, because Icelandic bookkeeping law requires it.
• Messages you send us through the contact form — we keep them for as long as the warranty on the product they might concern: 2 years in Iceland and the rest of the EEA, 1 year elsewhere. An enquiry is often the first record of a fault, so we keep it for as long as you could still bring a claim about it. After that we delete it.
• Marketing list — until you unsubscribe. After that we keep only a suppression record, so we don't email you again by mistake.
• Your cart — the cart cookie on your device lasts 30 days.
• Your region choice — that cookie lasts 12 months.
• Your cookie choice — stored on your own device until you change it or clear your browser storage. It never leaves your device.
• Flood protection — the request counter tied to your IP address is deleted after 60 seconds.
• Google Analytics — two periods are set in our Google Analytics account: event data is deleted after 2 months, and user-level data after 14 months. The user-level period restarts every time you visit again, so for a returning visitor that data is kept for 14 months from your most recent visit rather than your first.

Complaints

If you think we've handled your data badly, please tell us first — support@harmonix.is — and we'll try to put it right. You also have the right to complain to a data protection authority. In Iceland that is Persónuvernd, the Icelandic Data Protection Authority (personuvernd.is). If you live elsewhere in the EEA you can complain to your own country's authority, and in the United Kingdom to the Information Commissioner's Office (ico.org.uk).

Your California privacy rights

If you live in California, you can ask for access to the personal information we hold about you, ask us to correct or delete it, and asking never affects the service you get from us. We don't sell your personal information. If you opt in to marketing cookies, sharing with our email and advertising partners may count as 'sharing' under California law — you can withdraw that at any time via Cookie settings in the footer. If we ever go further than this, a clear 'Do Not Sell or Share My Personal Information' link will appear here first.

Hearing data and the Elevate app

This website doesn't collect or store hearing-test results, audiograms or any other health data. If you use Elevate, the hearing check and your fitting settings happen in the companion app on your phone, not here.

That app is listed in both stores as Harmonix OTC, and in both it is published by Huizhou Jinghao Medical Technology Co., Ltd. — the company in Huizhou, Guangdong, China that manufactures Elevate. It is not published by Harmonix ehf.

• App Store — apps.apple.com/us/app/harmonix-otc/id6756475067, listed by Huizhou Jinghao Medical Technology Co., Ltd.
• Google Play — play.google.com/store/apps/details?id=com.upixels.jinghao.harmonix.elevate, listed by the same company.

Because they publish it, Harmonix is not the controller for personal data the app processes, and this policy does not cover it. Please read that company's own privacy notice before you use the app: the one linked from its Google Play listing is at jamen-guojian.github.io/privacy-policy/otc-privacy.html, and it names Huizhou Jinghao Medical Technology Co., Ltd. as the controller. What arrangement exists between Harmonix and that company about app data is not set out in this policy.

What the app collects is not established, and we will not guess. Both store listings declare that it collects no data at all. The privacy notice linked from its Google Play listing, however, describes collecting contact details, device identifiers and technical information read from the hearing aids. The notice linked from its App Store listing is a different document again, and does not appear to be about this app. We have not been able to reconcile these, so we state none of them as fact. If it matters to you, ask the publisher before you use the app.

If you're not sure where to send a request about data the app holds, write to support@harmonix.is and we'll tell you who to ask.

Keeping your data safe

We protect your information with appropriate technical and organisational safeguards, and we keep it only for the periods set out under “How long we keep your data” above.