This policy explains what personal data reykjavik.tours handles, and it is written to match how the site actually works, not a template. The short version: we do not run analytics, advertising or tracking of any kind, we set no cookies of our own, and the only personal details we receive are the ones you type into the contact form or send us by email.
Who is responsible. The website reykjavik.tours is published by Reykjavik Tours, Vesturgata 54, 101 Reykjavik, Iceland. For anything about this policy or your data, write to [email protected] or use the contact page.
This policy applies to the website in all of its languages. It was last updated on 13 September 2026.
What happens when you read a page
Delivery through Cloudflare. Every request to the site passes through Cloudflare, Inc., which delivers the pages quickly from a location near you and protects the site against attacks. To do that, Cloudflare necessarily processes your IP address, the page requested, your browser's user agent and similar technical data. Cloudflare may set a strictly necessary security cookie to tell people from automated traffic; it is not used for tracking or advertising. Cloudflare acts as our processor; see Cloudflare's privacy policy.
Our server. The site itself is hosted on a virtual server in the Netherlands. Like almost every web server, it writes a short access log of each request: IP address, date and time, the address requested, the response, the referring page and the browser's user agent. The logs are used only to keep the site running and secure, and they are deleted automatically after 14 days.
No analytics, no advertising. The site does not use Google Analytics or any other analytics or advertising service, social media pixels, or tracking scripts. Fonts and maps are served from our own server, so reading a page does not contact Google or any map company.
Photos from partners. Photographs on hotel and multi-day trip listings are loaded directly from the servers of Booking.com and TourRadar, because that is how those partners provide them. When your browser loads such a photo, the partner's server receives your IP address and the usual technical request data. We have no control over and receive nothing from that request.
The legal basis for all of the above is our legitimate interest in delivering a secure, working website (Article 6(1)(f) GDPR).
Settings stored in your browser
Two small preferences are kept in your browser's own storage, never on our server and never shared:
- the currency you pick for prices, saved only when you choose one, so the next page shows the same currency; - a note that you closed the offer bar, kept for the current browser session only.
Neither identifies you, and neither is a cookie. You can remove both at any time by clearing your browser's site data.
When you follow a link to a partner
Many pages recommend tours, places to stay and other travel products, and link to the partners who sell them: GetYourGuide, Booking.com through Stay22, TourRadar, Viator and Amazon. The links carry a code that tells the partner the visit came from this site, so we can be paid a commission if you book. The code identifies this website and the page, not you. Once you are on a partner's site, that partner decides what it collects and which cookies it sets, under its own privacy policy. We receive only commission reports without your name or contact details.
See the affiliate disclosure for how these partnerships work.
When you write to us
The contact form asks for your email address and your message, and optionally your name and a topic. The page also records which language and page you wrote from. To keep automated spam out, the form uses Cloudflare Turnstile, a check that runs in your browser and sends technical signals and your IP address to Cloudflare to confirm a person is sending; see Cloudflare's Turnstile privacy addendum. The Turnstile script is loaded on the contact page only.
When you send the form, the message is stored on our server and delivered to our inbox by email through FormSubmit (formsubmit.co), a form-to-email service. Emails you send to [email protected] are forwarded to our mailbox by Cloudflare Email Routing.
We use what you send only to read and answer your message, and we keep it for as long as the conversation needs, and for no longer than 12 months after the last message, unless you ask us to delete it sooner. The legal basis is our legitimate interest in answering you, or the steps you ask us to take before any agreement (Article 6(1)(b) and (f) GDPR).
Who else sees the data
We do not sell, rent or trade personal data, and we do not share it for anyone else's marketing. The only parties that process it on our behalf are the ones named above: Cloudflare (delivery, security, spam protection and email forwarding), our server host in the Netherlands, FormSubmit and our email provider. Cloudflare and FormSubmit may process data outside the European Economic Area; where they do, they rely on the safeguards the GDPR requires, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
Your rights
Under the GDPR, which applies in Iceland as part of the European Economic Area, and under the UK GDPR, you have the right to ask what personal data we hold about you, to have it corrected or deleted, to restrict or object to its use, and to receive it in a portable form. To use any of these rights, write to [email protected]; we answer within one month.
You also have the right to complain to a data protection authority. In Iceland that is Persónuvernd, the Icelandic Data Protection Authority. In the United Kingdom it is the Information Commissioner's Office, and in the European Union the authority of the country where you live.
Readers in the United States. We do not sell or share personal information as the California Consumer Privacy Act defines those terms, and we do not use it for targeted advertising. You may ask us what we hold and have it deleted at the same address.
Children. The site is not directed at children under 16 and we do not knowingly collect their data.
Changes to this policy
If the way the site handles data changes, for example if we ever add a statistics tool, this page is updated first and the date at the top changes with it. Where a change needs your consent, we ask for it before it applies.