Privacy policy
Hveravík ehf., reg. no. 660488-1469, is responsible for the personal data that reaches us through this website. This page says what we receive, what for and how long we keep it.
What we receive
When you book a trip: your name, email, phone number, the number of guests and the trip you choose. When you send an enquiry: your name, email and what you write. Card details go straight to Verifone and never reach us. The address and country you give also go straight to Verifone, for card security (3-D Secure), and we do not keep them. If the name, email or phone number on a booking is changed, we also keep what it was before, and we record whether each email to you was delivered.
What it is for
To keep track of your booking, send you a confirmation, tell you if a trip is moved or cancelled, and answer enquiries. This rests on the contract for the trip and on our duty to keep accounts. We do not sell the data, share it with advertisers or send marketing email.
How long we keep it
Bookings are part of our accounts and are kept for seven years from the end of the financial year, as the Icelandic Bookkeeping Act no. 145/1994 requires. Enquiries are not stored on the website. They reach us by email, and we delete them once they are no longer needed.
Who works with us
Vercel hosts the website, Neon stores the bookings and Resend sends the emails. Verifone takes card payments. Dinta ehf. built the website and runs it. They only handle the data on our behalf. The database and the web servers are in Frankfurt. Vercel, Neon and Resend are US companies, and transfers to them rely on the EU-US Data Privacy Framework or standard contractual clauses.
Cookies and counting
The website sets no cookies. Three tools count visits without cookies and don't link your visits together: Vercel (which pages are read, where visitors come from, which links are clicked, whether a booking or an enquiry is started and sent, and how fast pages load), Google Analytics (the same counts, set beside searches on Google) and Microsoft Clarity (where people click and scroll, and recordings of how the page is used, with everything you type hidden; never on the booking confirmation page). The counts hold no name, email, phone, booking reference or anything you type. Google and Microsoft may process the data outside the EEA, under the EU–US Data Privacy Framework. Like any web server, they see your device's IP address. Your browser keeps only, while you book, a code that stops the same booking being made or counted twice.
Your rights
You can ask to see the data we hold about you, have it corrected or have it deleted, unless the law requires us to keep it. Write to gunnar@hveravik.is. You can also complain to the Icelandic Data Protection Authority, personuvernd.is.