1. Who we are Nordis ehf. ("Nordis", "we", "us") is an Icelandic company (registered ID/Kt. 6407260590) authorized by the Icelandic Tourist Board (Ferðamálastofa) to operate as a Day Tour Provider. We are the data controller for the personal data processed through this website, nordis.is. Address: Álhella 5c, Hafnarfjörður, Iceland Email: info@nordis.is Phone: +354 786 7170 This policy explains what personal data we collect, why we use it, how long we keep it and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Icelandic Act on Data Protection and the Processing of Personal Data No. 90/2018.
2. What data we collect Information you give us Inquiry form: contact name, business email, business phone, tentative start date, tour of interest, group size and any special requirements you choose to write. Direct messages: information you send us by email, phone or WhatsApp, including your name, phone number and the content of your message. Account (if you create one): first name, last name, email address and password. Passwords are stored in encrypted form. Bookings and business relations: company details, contact persons, itinerary details, passenger or group information needed to operate a service, and invoicing details. Information collected automatically Technical data such as IP address, browser type, device, pages visited and date and time of access, collected through our hosting platform, server logs and cookies (see section 8). Special requirements. The "special requirements" field may lead you to share dietary, accessibility or health-related information. Please share only what is necessary for us to organize your tour safely. We use this information only to provide the requested service and only with your consent, which you can withdraw at any time.
3. Why we use your data and our legal basis Purpose Replying to inquiries and preparing proposals or quotes Organizing and operating tours and ground services Invoicing, accounting and tax obligations Handling special requirements such as dietary or accessibility needs Managing your account on the website Keeping the website secure and improving it Business communication with partners and travel agencies Analytics and non-essential cookies (if enabled)
Legal basis (GDPR) Steps taken at your request before a contract / legitimate interest in running our business Performance of a contract Legal obligation Your explicit consent Performance of a contract Legitimate interest Legitimate interest Your consent
We do not use your data for automated decision-making or profiling that produces legal effects for you.
4. Who we share data with We do not sell your personal data. We share it only when needed and only with: Service providers that help us run the business, such as our website hosting and e-commerce platform, email and communication tools, accounting and payment providers. Operational partners involved in your tour, such as drivers, guides, accommodation or activity providers, limited to the information they need to deliver the service. Public authorities when required by law, for example the Icelandic Tourist Board, tax authorities or law enforcement. Professional advisers such as accountants, auditors, lawyers and insurers, under confidentiality duties. Contact through WhatsApp is processed by WhatsApp/Meta under their own terms. Our contact page embeds a Google Maps map, which may cause Google to receive technical data such as your IP address when you load it.
5. International transfers Some of our providers may process data outside Iceland and the European Economic Area. When this happens, we make sure the transfer is protected by an adequacy decision, Standard Contractual Clauses approved by the European Commission or another safeguard allowed by the GDPR. You can contact us for more information about these safeguards.
6. How long we keep your data Inquiries and proposals: up to 24 months after our last contact, unless a contract follows. Contracts, bookings and invoices: for as long as required by Icelandic accounting and tax law (currently seven years). Special requirements data: only until the tour is completed, then deleted, unless the law requires longer retention. Account data: until you delete your account or ask us to do so. Server and technical logs: normally no longer than 12 months. When the retention period ends, we delete or anonymize the data.
7. Your rights Under the GDPR you have the right to: Access the personal data we hold about you. Rectify data that is inaccurate or incomplete. Erase your data in the cases provided by law. Restrict how we process your data. Object to processing based on legitimate interest. Data portability, meaning to receive your data in a structured, commonly used format. Withdraw consent at any time, without affecting processing done before withdrawal. To use any of these rights, write to info@nordis.is. We will answer within one month. We may ask you to confirm your identity first. You also have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd), Rauðarárstígur 10, 105 Reykjavík, www.personuvernd.is, or with the supervisory authority of your country of residence.
8. Cookies This website uses cookies and similar technologies. Strictly necessary cookies keep the site working, for example to remember your session or your login. They do not require consent. Analytics or marketing cookies, if we enable them, are used only with your consent, which you can change at any time through the cookie settings or your browser. You can also block or delete cookies in your browser settings, but some parts of the site may stop working properly.
9. Security We use appropriate technical and organizational measures to protect your data against loss, misuse and unauthorized access, including encrypted connections (HTTPS), restricted access to data and the use of reputable providers. No system is completely secure, so please avoid sending sensitive information through channels you do not trust.
10. Children Our website and services are aimed at businesses and adult travelers. We do not knowingly collect personal data from children under 16 without the consent of a parent or guardian. Data about minors who join a tour is provided by the adult or travel partner who makes the booking.
11. Third-party links This website may link to other sites such as social networks or maps. We are not responsible for their privacy practices, so we recommend reading their policies.
12. Changes to this policy We may update this policy from time to time. The latest version will always be published on this page with its update date. If we make significant changes, we will inform you in a suitable way.
13. Contact For any question about this policy or your personal data, contact us: Nordis ehf. Álhella 5c, Hafnarfjörður, Iceland info@nordis.is · +354 786 7170