Privacy Policy
1. Who we are
Secretspotsiceland EHF (Kennitala 610823-2030, VAT Number 152431), Tangabryggja 18, 110 Reykjavík, Iceland, operates this website and the private Iceland tours described on it. This policy explains what information we collect when you use this site or get in touch, and how we use it.
2. Information we collect
When you submit the contact or inquiry form, we collect the details you provide: your name, email address, phone number, travel dates, group size, and anything you tell us about your trip.
If you subscribe to our newsletter, we collect your email address, together with the fact that you consented and when.
We don't collect payment information through this website.
3. How we use your information
We use the information you submit only to respond to your inquiry, plan your tour, and communicate with you about your booking, and, if you have consented to analytics, to measure where inquiries come from, as described in section 7. We do not sell your information, and we do not use it for advertising or marketing without your separate consent.
4. How we store and protect it
Your information is kept only for as long as needed to respond to your inquiry and, if you book a tour, to deliver and keep a record of that booking. We take reasonable steps to protect it from unauthorised access.
5. Sharing your information
We don't share your information with third parties, except where necessary to deliver your tour (for example, a partner vehicle or accommodation provider you've asked us to coordinate with) or where required by law.
We also use service providers that process data on our behalf under contract. The relevant ones for this website are Google (website measurement and spam protection, described in sections 7 and 8), Resend, which delivers the inquiry emails and our newsletter (section 9), Vercel, which hosts the site and processes server logs, and the technical provider that operates our own measurement service (section 7). We do not sell or share your personal information for cross-context behavioural advertising.
6. Your rights
You can ask us at any time what information we hold about you, ask us to correct it, or ask us to delete it. To do so, contact us using the details below.
You also have the right to object to or ask us to restrict processing, to receive a copy of your data in a portable format, and to withdraw consent at any time where we rely on it (see section 7 for cookies). Withdrawing consent does not affect processing that already took place.
If you are in Iceland or the EEA and believe we have handled your information improperly, you can lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is).
7. Cookies, analytics and measurement
This website uses cookies and similar technologies. Strictly necessary cookies are the ones the site needs to work and to stay secure; these are set without asking, because the site cannot function without them. Everything else, the measurement and analytics described below, is only loaded once you have given your consent.
For measurement we use two Google services. Google Tag Manager loads and manages our measurement tags. Google Analytics 4 tells us how visitors find and use the site: pages viewed, approximate location derived from your IP address, device and browser type, and interactions such as which tour pages you open, how far you scroll, which FAQ questions you expand, and whether you submit the contact form. Google Analytics stores cookies in your browser and assigns a randomly generated identifier to your device. We use this to understand traffic in aggregate, not to identify you by name, and we do not use advertising, remarketing or cross-site tracking cookies.
We also run our own measurement service, hosted at bot.kromagency.es. It is only loaded once you have consented to analytics. It records the pages you open during a visit and how you reached the site, such as the campaign link or the ad click identifier you arrived with, together with your device and browser type and the approximate location (country, region and city) derived from your IP address. The IP address itself is only stored shortened, so that it no longer points to a single connection. We use this to see which pages and campaigns lead to inquiries; its cookies and browser-storage entries are listed on our Cookie Policy page. If you send the contact form, the name, email address and phone number you entered are also sent to it, encrypted in transit. It keeps them only as irreversible SHA-256 hashes, together with the domain of your email address (the part after the @), and uses them to attribute inquiries to the visits that led to them and to recognise the same inquiry sent twice. If Google Analytics has not already recorded the inquiry from your browser, the service records it there itself and passes on the hashes of your email address and phone number, so that the inquiry is linked to your visit. We never use them for advertising.
Legal basis: strictly necessary cookies rely on our legitimate interest in operating a secure, working website (Article 6(1)(f) GDPR). Google Tag Manager, Google Analytics, our own measurement service and the cookies they set rely on your consent (Article 6(1)(a) GDPR, together with the consent requirement in the Icelandic Electronic Communications Act).
Transfers outside the EEA: Google Tag Manager and Google Analytics are provided to us by Google Ireland Limited, and your data may be transferred to Google LLC in the United States and processed there. Those transfers are covered by the European Commission’s Standard Contractual Clauses and by Google LLC’s certification under the EU–US Data Privacy Framework.
Changing or withdrawing your consent: use the “Cookie settings” link in the footer of any page to reopen the consent choices and change or withdraw what you agreed to. You can also delete or block cookies in your browser settings, or install Google’s browser add-on to opt out of Google Analytics across all sites. Withdrawing consent stops any further analytics collection; it does not delete data already collected, which you can ask us to erase under section 6.
A full inventory of every cookie this site uses is on our Cookie Policy page, linked in the footer. It lists each one by name, who provides it, what it is for and how long it lasts.
8. Spam protection on our contact form
Our contact form is protected by Google reCAPTCHA, which checks whether a submission comes from a person rather than an automated script. To make that check, reCAPTCHA collects your IP address, information about your browser and device, and your interaction with the page, and sends it to Google. The form cannot be submitted without it.
We rely on our legitimate interest in keeping the form usable and free of spam and abuse (Article 6(1)(f) GDPR). As with the services in section 7, data may be transferred to Google LLC in the United States under the safeguards described there. Google’s handling of this data is governed by the Google Privacy Policy and the reCAPTCHA Terms of Service.
9. Newsletter
If you tick the box in the newsletter section of this website, we add your email address to our mailing list and use it to send you occasional emails about hidden places in Iceland, when to photograph them, and tour news. We ask for nothing but your email address, and we never pass the list on to anyone else.
Legal basis: your consent (Article 6(1)(a) GDPR). It is separate from the consent on the inquiry form, which only covers answering that inquiry. Subscribing is never a condition of getting a reply or booking a tour.
Every email we send carries an unsubscribe link, and you can also ask us to remove you using the contact details in section 10. Unsubscribing stops any further emails; it does not affect emails already sent, and you can ask us to erase your address under section 6.
The list is held and the emails are sent by Resend (Resend, Inc.), which processes your email address on our behalf under a data processing agreement. Resend is based in the United States, so your email address is transferred to and stored there.
10. Contact us
Questions about this policy or your information? Reach us at +354 845 4057 or by post at Tangabryggja 18, 110 Reykjavík, Iceland.
