Privacy and Cookies
Last updated: 28 October 2026.
This notice explains how we handle personal information and tracking choices. Essential site functions can run without consent. Analytics and marketing tags stay off until you allow them.
Things to Do in Iceland ehf. is the controller for personal information we use to operate this website, respond to enquiries and administer our customer relationships. Contact us at info@thingstodoiniceland.is or the registered address above about privacy matters.
When you contact us, we process your name, email address, message and the page context submitted with your enquiry to respond and keep a record of the conversation. Our hosting and email providers support this processing. Technical request information, including IP address and browser information, may be processed to operate, secure and troubleshoot the website.
We use this information to take steps you request before entering a contract, to fulfil a contract where applicable, or for our legitimate interests in responding to enquiries and protecting the service. Please do not include payment-card details, passport copies or sensitive health information in the contact form.
Booking administration uses contact details, the selected tour, date, participant information and necessary pickup details. When we arrange a tour reservation, we share only the information needed with the service provider delivering the tour and our booking platform, Bókun. Where payment processing is available, the payment provider is identified at the secure payment step. Payment-card details belong in that provider’s secure interface, never in a message to us.
Payment providers will process payment details for authorisation, fraud prevention, refunds and their legal obligations. We will use transaction references, amounts and payment status to administer the booking. Necessary booking processing is based on the contract, legal obligations and legitimate interests in preventing fraud and resolving disputes. Operators and payment providers may also act as independent controllers for their own services and legal duties. The applicable booking terms are available on our Terms & Conditions page.
Contact and participant details marked as required are needed to arrange your booking. Without them, we cannot complete it. Optional information is identified on the form.
We store booking, access and transaction records in our server database. We use Bókun for supplier bookings, Straumur and its payment service providers for secure card processing, PayDay for invoices and credits, and Zoho for booking email. The secure card interface sends card details directly to the payment service providers; we do not store card numbers or security codes. Clearing your browser does not delete server records.
While the secure payment form is open, its component sends checkout-attempt and diagnostic data to Straumur’s technology provider, Adyen. This payment-provider processing is separate from our optional website analytics and marketing controls.
The site may use technical storage needed to show pages, remember your consent choice, protect the service, remember access and keep your booking selection working. Your cookie preference is stored for up to 180 days. Guest access uses a secure session cookie for up to eight hours, with a 30-minute inactivity limit. One-time access links expire after 15 minutes.
To restore an unfinished checkout after refresh, we temporarily save your contact details, tour selection, pickup, add-ons and booking answers on our server behind your secure checkout cookie. We do not save card details or your agreement to booking terms in this draft. Access expires with the checkout session, at most eight hours after it starts. The draft is removed when a booking is created, or by scheduled cleanup after expiry. Clearing cookies ends access but does not itself delete a server record.
When you choose a light or dark appearance, the functional ttd-appearance cookie remembers that choice for up to one year. It stores only the appearance, contains no personal details, and is not used for tracking. Change the choice in the header or footer, or remove it by clearing this website’s cookies.
If you allow analytics, Google Analytics tags in Google Tag Manager may help us understand which travel pages are useful, which pages need improvement, and how people move through the site.
The site may also send first-party server-side Google Analytics events for meaningful content page requests, planning-interest signals, consented site searches, and placement-level internal navigation clicks. These events use page and planning-topic context, such as content family, region, season, route area, or travel style, so reporting can improve Iceland travel planning content. They are not sent before analytics consent.
If you allow marketing, Google Ads remarketing and Meta Pixel tags may be enabled through Google Tag Manager. The site may also send browser and server-side Meta content-view and planning-intent events after a short visible page view or meaningful content engagement, such as deeper reading, multiple page views, or a planning link click. These tags are not intended to run before marketing consent. If you submit an enquiry after allowing marketing, a Meta conversion event may include hashed versions of your name and email, together with IP address, browser and advertising identifiers, to measure enquiries. Hashing does not make these data anonymous. Your message text is not included in that event.
If you report wrong information, outdated details, broken media, or a website bug, the site sends your message to our editorial inbox with the current page URL, page title, browser context, viewport size, and any optional email address you provide. We use this information to check and repair the site, and we may reply if you include your email.
Access is limited to people and service providers who need the information for the purposes described here, including hosting, email and security providers, and consented analytics or marketing providers such as Google and Meta. We may also disclose information where required by law or necessary to establish or defend legal claims.
Some providers process information outside the European Economic Area. Where this happens, applicable data-protection safeguards are required, such as an adequacy decision or standard contractual clauses. Contact us for information about the providers and transfer safeguards relevant to your data.
We keep enquiry and support records while handling your request and any resulting booking, complaint or dispute. Relevant transaction and accounting records must be kept for the legally required period. Security-log retention depends on the hosting provider and the time needed to investigate an incident. You can ask us about the retention period that applies to a particular record.
Depending on the processing and applicable law, you can request access, correction, deletion, restriction or portability of your personal information, and object to processing based on legitimate interests. You may withdraw consent at any time; withdrawal does not undo lawful processing before it. Some records must be retained to meet legal obligations or resolve claims.
Email info@thingstodoiniceland.is to exercise your rights. We may need to verify your identity proportionately. We normally respond within one month and will explain any lawful extension. You may lodge a complaint with Persónuvernd, the Icelandic Data Protection Authority, or your competent supervisory authority.
You can use essential storage only, allow analytics without marketing, allow both optional categories, or adjust each category individually. You can return to this page or use the footer link to change or withdraw your choice later.
