Privacy Policy

1. Who we are

Controller: Journey Iceland, Urðarholt 5, 270 Mosfellsbær, Iceland.

Contact for any privacy matter: hello@journeyiceland.is.

2. What data we collect

When you send an "Check availability" / contact request we collect the information you provide: your name, email address, phone number (optional), preferred date, group size, the tour or transfer selected, the language of the request and any message you add.

When you contact us by WhatsApp, phone or email, we receive the details you choose to share.

With your separate consent, we may take photos or short videos during a tour (see "Image consent" below).

Our hosting providers automatically process limited technical data (such as IP address and basic request logs) needed to deliver and secure the website.

3. Why we use your data and on what legal basis

To answer your enquiry and to take steps to prepare and provide the service you ask about — legal basis: performance of, or steps prior to, a contract (Art. 6(1)(b) GDPR).

To communicate with you and keep reasonable business and accounting records — legal basis: our legitimate interests and legal obligations (Art. 6(1)(c) and (f) GDPR).

To use guest photos/words as testimonials or marketing — only where you have given consent (Art. 6(1)(a) GDPR).

4. How long we keep it

We keep enquiry details only as long as needed to handle your request and to meet our record-keeping and accounting obligations, after which they are deleted.

Photos or testimonials shared with your consent are kept until you withdraw that consent.

5. Who we share it with

We use a small number of trusted service providers who process data on our behalf, under contract and only on our instructions:

• Supabase — secure database storage of form submissions (servers within the EU / Frankfurt);

• Vercel — website hosting and delivery;

• Google Workspace — our business email;

• where used: Cal.com — date/availability scheduling, and myPOS — secure card payments arranged after a booking is confirmed.

We never sell your personal data.

6. International transfers

Our database is hosted within the European Economic Area (EEA). Where a provider necessarily processes data outside the EEA (for example in the United States), the transfer is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. Payments

This website does not take payments. If you proceed with a booking, payment is arranged separately through a secure payment link or a card terminal (myPOS). Your card details are handled by the payment provider and are never stored by us.

8. Cookies

This website uses only the strictly necessary technologies required for it to function (for example, remembering your chosen language). We do not use advertising or third-party tracking cookies. If this changes, we will update this policy and ask for consent where required.

9. Your rights

Under the GDPR and Act No. 90/2018 you have the right to access your data, to rectification, erasure, restriction of processing, data portability, and to object to processing. Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, simply email hello@journeyiceland.is.

10. Image consent

We photograph or film guests only with their explicit consent, and only use such images as testimonials or marketing if you agree. You can ask us to remove your images at any time and we will do so.

11. Complaints

If you believe we have not handled your data properly, please contact us first so we can put it right. You also have the right to lodge a complaint with the Icelandic Data Protection Authority:

Persónuvernd, Rauðarárstígur 10, 105 Reykjavík · postur@personuvernd.is · www.personuvernd.is.

12. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available on this page, with the date it was last updated shown above.