Skyrhúsið ehf., ID no. 480507-0960, (hereinafter: "Skyrhúsið" or "We") respects privacy and places great emphasis on protecting the personal data of our customers. This privacy policy describes how we collect, use, share, and protect personal data, especially that received from Glacier Adventure ehf. (hereinafter: "Glacier Adventure"), ID no. 620415-1620, including tracking data or "cookies" from Glacier Adventure's website, in accordance with Act No. 90/2018 on Data Protection and the Processing of Personal Data and the General Data Protection Regulation (EU) 2016/679.
1. Data Controller
Skyrhúsið ehf. is the data controller for personal data that you provide to us or that we receive from a third party, cf. Article 3(1)(6) of Act No. 90/2018. This means that we are responsible for determining the purposes and means of the processing of your personal data.
2. What personal data do we collect and how?
We collect personal data in several ways:
- Directly from you: When you book accommodation through our website, communicate with us via email or phone, or otherwise when you use our services. This may include your name, email address, phone number, nationality, payment information, and details about your booked accommodation.
- From Glacier Adventure ehf.: With your explicit consent, provided to Glacier Adventure ehf., we receive your name and email address from Glacier Adventure ehf. for the purpose of sending you marketing material and accommodation offers. This transfer takes place on the basis of Article 9(1)(1) of Act No. 90/2018. We may also, with your explicit consent, receive tracking data or "cookies" from Glacier Adventure ehf., to target marketing material and accommodation offers on social media.
- Cookies: Our website uses cookies to improve user experience. Further information on the use of cookies can be found in section 6.
3. Purpose of processing personal data
Skyrhúsið processes personal data for the following purposes, in accordance with the principle of purpose limitation, cf. Article 8(1)(2) of Act No. 90/2018:
- To provide services and process bookings: The primary purpose is to process your accommodation bookings, confirm services, and send you necessary information for your stay.
- For marketing purposes: Personal data received from Glacier Adventure ehf., along with data we collect directly, is used to send you marketing material and offers for our accommodation and services. This is based on your consent, cf. Article 9(1)(1) of Act No. 90/2018. Specifically, tracking data, received from Glacier Adventure ehf. and/or collected on Skyrhúsið's website, is used to target marketing material and accommodation offers on social media, cf. Article 94 of the Electronic Communications Act No. 70/2022. This processing is based on your explicit consent.
- To improve our services: We use tracking data to analyze our website usage and improve our services and customer experience.
4. Disclosure of personal data to third parties
Skyrhúsið generally does not disclose personal data to third parties, except in the following cases:
- Service providers: We may use service providers who process personal data on our behalf (e.g., booking systems, payment processors). In such cases, we enter into written agreements with them, which stipulate their obligations regarding data protection and information security, cf. Article 25 of Act No. 90/2018.
- Laws and regulations: We may disclose personal data if we are legally obligated to do so, e.g., due to requests from authorities or courts.
- Glacier Adventure ehf.: As stated in section 2, we receive tracking data from Glacier Adventure ehf. with your explicit consent. Glacier Adventure and Skyrhúsið may be joint controllers for the processing of tracking data for marketing purposes. This means that both parties jointly determine the purposes and means of processing. In such cases, we will enter into a joint controllership agreement in accordance with Article 26 of Act No. 90/2018, defining the roles and responsibilities of both parties regarding the protection of personal data.
5. Security of personal data
Skyrhúsið implements appropriate technical and organizational measures to ensure the security of personal data, cf. Article 8(1)(6) of Act No. 90/2018. This includes protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage. We ensure that only employees who need access to personal data for their work receive such access and that they are bound by confidentiality.
6. Browser Cookies
Skyrhúsið's website may use cookies to improve user experience. Cookies are small text files that are stored on your computer or other devices when you visit the website. They allow us to collect data about website usage. This information is used to better adapt the website to the user and improve our services. We primarily share tracking data with CookieHub, Cloudflare, Google Analytics, Google Ads, Matomo, Meta Pixel, Pinterest, TikTok Marketing, and YouTube.
You can disable cookies at any time in your browser settings, but please note that this may affect the functionality of the website. For cookies that are not essential for the website's functionality, we ask for your consent when you visit our website. We also use tracking data, including from Glacier Adventure ehf., to target marketing material on social media. This includes the use of tools such as Meta Pixel, Google Ads, and TikTok Marketing to display personalized advertisements based on your previous interactions with Glacier Adventure and/or Skyrhúsið. This processing is based on your explicit consent, which you provide to Glacier Adventure and/or Skyrhúsið.
7. Your rights
You have the following rights regarding your personal data, cf. Chapter 3 of Act No. 90/2018:
- Right to information: The right to receive information about the collection and processing of personal data.
- Right of access: The right to obtain confirmation as to whether personal data concerning you are being processed and, if so, to access the data, cf. Article 17 of Act No. 90/2018.
- Right to rectification: The right to have inaccurate or incomplete personal data rectified without undue delay.
- Right to erasure ("right to be forgotten"): The right to have personal data concerning you erased without undue delay, e.g., if the data is no longer necessary for the purpose for which it was collected.
- Right to restriction of processing: The right to restrict the processing of personal data to certain actions.
- Right to object to processing: The right to object to the processing of personal data, especially if the processing is for marketing purposes, cf. Article 21 of Act No. 90/2018.
- Right to withdraw consent: If processing is based on your consent, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn, cf. Article 10(3) of Act No. 90/2018.
- Right to lodge a complaint: You have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd) if you believe that Skyrhúsið has violated data protection legislation.
8. Data retention period
Personal data is not retained longer than necessary for the purpose of processing, cf. Article 8(1)(5) of Act No. 90/2018. We delete or anonymize personal data when the purpose of processing has been achieved, unless a legal obligation requires otherwise.
9. Tengiliðaupplýsingar
If you have any questions about this privacy policy or Skyrhúsið's processing of personal data, please contact us at:
Skyrhúsið Guesthouse
Hali, 781 Höfn, Iceland
[email protected]
TEL: 478-8989
