Privacy and Cookies
Last updated: 17 September 2026.
This notice explains how we handle personal information and tracking choices. Essential site functions can run without consent. Analytics and marketing tags stay off until you allow them.
Things to Do in Iceland ehf. is the controller for personal information we use to operate this website, respond to enquiries and administer our customer relationships. Contact us at info@thingstodoiniceland.is or the registered address above about privacy matters.
When you contact us, we process your name, email address, message and the page context submitted with your enquiry to respond and keep a record of the conversation. Our hosting and email providers support this processing. Technical request information, including IP address and browser information, may be processed to operate, secure and troubleshoot the website.
We use this information to take steps you request before entering a contract, to fulfil a contract where applicable, or for our legitimate interests in responding to enquiries and protecting the service. Please do not include payment-card details, passport copies or sensitive health information in the contact form.
Direct tour sales are not open yet. When enabled, booking administration will require contact details, selected tour, date, participant information and any necessary pickup details. We will share the information needed to fulfil the booking with the named tour operator and Bókun, our planned booking platform. We will identify the active payment provider before payment; a provider application does not mean payment processing is already available.
Payment providers will process payment details for authorisation, fraud prevention, refunds and their legal obligations. We will use transaction references, amounts and payment status to administer the booking. Necessary booking processing is based on the contract, legal obligations and legitimate interests in preventing fraud and resolving disputes. Operators and payment providers may also act as independent controllers for their own services and legal duties. The applicable booking terms are available on our Terms & Conditions page.
The site may use technical storage needed to show pages, remember your consent choice, protect the service, and keep normal website functions working.
If you allow analytics, Google Analytics tags in Google Tag Manager may help us understand which travel pages are useful, which pages need improvement, and how people move through the site.
The site may also send first-party server-side Google Analytics events for meaningful content page requests, planning-interest signals, consented site searches, and placement-level internal navigation clicks. These events use page and planning-topic context, such as content family, region, season, route area, or travel style, so reporting can improve Iceland travel planning content. They are not sent before analytics consent.
If you allow marketing, Google Ads remarketing and Meta Pixel tags may be enabled through Google Tag Manager. The site may also send browser and server-side Meta content-view and planning-intent events after a short visible page view or meaningful content engagement, such as deeper reading, multiple page views, or a planning link click. These tags are not intended to run before marketing consent. If you submit an enquiry after allowing marketing, a Meta conversion event may include hashed versions of your name and email, together with IP address, browser and advertising identifiers, to measure enquiries. Hashing does not make these data anonymous. Your message text is not included in that event.
If you report wrong information, outdated details, broken media, or a website bug, the site sends your message to our editorial inbox with the current page URL, page title, browser context, viewport size, and any optional email address you provide. We use this information to check and repair the site, and we may reply if you include your email.
Access is limited to people and service providers who need the information for the purposes described here, including hosting, email, security and consented analytics or marketing providers such as Google and Meta. We may also disclose information where required by law or necessary to establish or defend legal claims.
Some providers process information outside the European Economic Area. Where this happens, applicable data-protection safeguards are required, such as an adequacy decision or standard contractual clauses. Contact us for information about the providers and transfer safeguards relevant to your data.
We keep enquiry and support records for as long as needed to answer the request, manage the customer relationship and resolve related disputes. Relevant transaction and accounting records are retained for the period required by law. Security logs and optional analytics have separate operational retention periods; information should not be retained merely because storage remains available. You can ask us about the retention period that applies to a particular record.
Depending on the processing and applicable law, you can request access, correction, deletion, restriction or portability of your personal information, and object to processing based on legitimate interests. You may withdraw consent at any time; withdrawal does not undo lawful processing before it. Some records must be retained to meet legal obligations or resolve claims.
Email info@thingstodoiniceland.is to exercise your rights. We may need to verify your identity proportionately. We normally respond within one month and will explain any lawful extension. You may lodge a complaint with Persónuvernd, the Icelandic Data Protection Authority, or your competent supervisory authority.
You can use essential storage only, allow analytics without marketing, allow both optional categories, or adjust each category individually. You can return to this page or use the footer link to change or withdraw your choice later.
