Privacy Policy
This Privacy Policy is effective from the date of publication on this website and may be updated from time to time. The most recent version will always be available here.
Your privacy, our responsibility
At Special Tours, many experiences begin the same way: stepping onto a boat in Reykjavík harbour, feeling the cold sea air, and heading out toward the open water in search of something unforgettable – whales surfacing nearby, puffins along the cliffs, or the northern lights appearing above the bay.
That sense of trust and care also guides how we handle your personal data.
We believe privacy information should be clear, transparent, and easy to navigate. In this Policy, we explain what personal data we collect, why we use it, who we may share it with, how long we keep it, and the rights you have in relation to your information.
We’ve organised this Policy to help you quickly find the information most relevant to you – whether you are booking a tour, contacting our team, subscribing to updates, or simply visiting our website.
1. WHO THIS POLICY APPLIES TO
This Privacy Policy explains how Special Tours (“we”, “us”, “the Company”) collects and uses personal data in connection with our services. It applies to:
visitors of our website
customers booking or participating in our tours
individuals contacting our customer support
and other individuals whose personal data we process in connection with our services
In other words, if you interact with us as a customer or website user, this Policy applies to you.
1.1. Who this Policy does not cover
This Policy does not apply to:
job applicants (candidates)
employees
We process personal data in those contexts as well, but under separate, dedicated privacy notices, which provide more specific information relevant to those relationships. If you are applying for a role with Special Tours, please refer to the Recruitment Privacy Notice available on our website.
1.2. Who is responsible for your data
Special Tours acts as the data controller, meaning we are responsible for deciding how and why your personal data is used.
Our contact details:
Special Tours, registration number: 520796-2159
Registered address: Geirsgata 11, 101 Reykjavik
E-mail: info@specialtours.is
1.3. Legal framework
Special Tours is based in Iceland, and we process personal data in accordance with the General Data Protection Regulation (“GDPR”) and other applicable data protection laws within the European Economic Area (EEA).
At the same time, we welcome travellers from all over the world. Depending on your location, additional local data protection laws may also apply.
Regardless of where you are based, we apply a consistent and high standard of data protection, guided by the principles of transparency, fairness, and security.
1.4. Changes to this Policy
We may update this Policy from time to time – for example, to reflect changes in our services or legal requirements. Whenever we do, the updated version will be published on our website.
2. WHAT PERSONAL DATA WE COLLECT AND WHY?
The personal data we collect – and how we use it – depends on how you interact with us. Below is an overview of the main situations in which we process personal data, what information is involved, the legal basis we rely on, and how long we keep that data.
For what purpose do we use your personal data? What personal data do we collect? What legal basis do we rely on? How long do we retain this data?
To process and manage your booking, including confirming and administering your reservation.
This data is required to enter into and perform a contract with you. If you do not provide this information, we may not be able to confirm your booking or secure your place on a tour.
Identification and contact details:
Full name
Email address and phone number
Booking information:
Selected tour, travel dates, number of participants, preferences
Nationality and responses to booking-related questions
Performance of a contract (Article 6(1)(b) GDPR)
Customer identification and booking data: 5 years after completion of the booking
Cancelled bookings (no payment): 6 months after cancellation
To provide and manage your customer account, including giving you access to your booking history, saved preferences, wishlists, and other account features available through our customer portal.
You are not required to create a customer account. However, without an account, certain self-service features and access to historical booking information may not be available.
Identification and contact details:
Full name
Email address
Account data:
Login credentials and authentication information
Account creation date and account status
Customer account content:
Booking history
Saved preferences
Wishlists and other information stored within the account
Article 6(1)(f) GDPR – Legitimate interest: to provide customers with access to account-based features, booking history, saved preferences, and other self-service functionality.
We retain account information for as long as your account remains active.
If your account remains inactive for 5 consecutive years, we may notify you using the email address associated with your account and invite you to log in to keep your account active. If you do not reactivate your account within 30 days after our reminder, your account and the personal data associated with it will be permanently deleted, unless we are required to retain certain information for a longer period to comply with legal obligations or to establish, exercise, or defend legal claims.
To organise and operate your tour, including planning logistics and coordinating with guides, transport providers, and other partners to deliver your experience.
This data is required to provide the booked service. Without it, we may not be able to properly organise or carry out your tour.
Identification and contact data:
Full name
Email address and phone number
Booking and logistics data:
Tour details, travel dates, number of participants
Accommodation address (for pick-up and drop-off)
Logistical requirements and preferences (e.g., timing, coordination needs)
Performance of a contract (Article 6(1)(b) GDPR)
Printed transport coordination data: deleted no later than 7 days after the tour
Information that forms part of booking records: retained in line with booking data (5 years)
To document and investigate accidents, injuries, or safety incidents during tours, including managing follow-up actions and handling potential legal claims.
Providing this data may be necessary in the context of an incident and related legal or safety obligations.
Identification and contact data:
Full name
Contact details (email, phone number)
ID number (where required under local law)
Incident-related data:
Description of the incident, including date, time, and location
Witness statements and staff reports
Health-related data:
Injury details and relevant medical information
Treatment provided or required
Legal obligation (Article 6(1)(c) GDPR) – where reporting or documentation is required
Legitimate interest (Article 6(1)(f) GDPR) – to investigate incidents and protect individuals and the Company
Article 9(2)(f) GDPR – for the establishment, exercise, or defence of legal claims (for health-related data)
Incident and injury records (including reports and documentation) are retained for 10 years after the incident
To communicate with you and provide customer support, including answering inquiries and handling feedback or complaints.
You are not required to provide this data, but without it we may not be able to respond to your request or assist you effectively.
Identification and contact data:
Full name
Email address and phone number
Booking-related data (where applicable):
Booking references and tour details linked to your request
Communication data:
Messages, inquiries, complaints, and feedback
Communication history (email, social media, or phone)
Customer-provided information:
Travel preferences or other information you choose to share
Performance of a contract (Article 6(1)(b) GDPR) – where communication relates to an existing booking or support request connected to our services.
Legitimate interest (Article 6(1)(f) GDPR) – to respond to general inquiries, manage customer communication, and improve our services.
General enquiries (no booking): 12 months after case closure
Support related to bookings: 3 years after completion of the service
Complaints or dispute-related communication: 5 years after resolution
Health-related information shared in communication: deleted within 30 days after the tour unless required for an incident
To process payments and manage financial transactions related to your booking, including payment verification and fraud prevention measures where necessary.
This data is required to perform a contract with you and to help ensure secure payment processing. If you do not provide this information, we will not be able to process your payment or confirm your booking.
Identification and contact data:
Full name
Email address and phone number
Payment and transaction data:
Payment amount, transaction identifiers, payment reference numbers
Payment status and billing information (e.g., invoices, confirmations)
Limited card-related data:
Cardholder name and masked card details (e.g., last four digits)
Fraud prevention and verification data (where required):
identification documents or verification details (e.g., passport or ID information)
card verification information
supporting documentation provided in connection with suspected fraudulent transactions or payment verification requests
Performance of a contract (Article 6(1)(b) GDPR)
We may also rely on legal obligation (Article 6(1)(c) GDPR) to comply with accounting and tax requirements, and legitimate interest (Article 6(1)(f) GDPR) for fraud prevention and transaction security
Payment transaction and financial records are retained for 10 years in accordance with accounting and tax legislation
Fraud prevention and payment verification records are generally retained for up to 3 years after the transaction, unless longer retention is required in connection with an ongoing investigation, dispute, or legal claim.
To take and share photos or video from tours, including making them available to participants and, where agreed, using them for marketing purposes.
You are not required to appear in photos or videos, and your consent will be requested where images or recordings are used for promotional purposes.
Photographs, video recordings or other visual content of tour participants
Legitimate interest (Article 6(1)(f) GDPR) – to provide images or recordings to participants
Consent (Article 6(1)(a) GDPR) – for use of images or recordings in marketing or promotional materials
Photos and videos shared with participants: retained for 2 months after the tour
Photos and videos used for marketing (with consent): 5 years from publication or until consent is withdrawn
Direct marketing communications (email newsletters)
To send you newsletters and travel-related updates (you can unsubscribe at any time)
Identification and contact data:
Name and surname
Email address
Marketing data:
Subscription status and preferences
Engagement data (e.g., email opens, clicks)
Technical data:
IP address (where collected during subscription)
Consent (Article 6(1)(a) GDPR) – where you subscribe to receive marketing communications. You can withdraw your consent at any time by unsubscribing.
We may also send marketing communications to existing customers in relation to similar services where permitted under applicable laws implementing the ePrivacy Directive. In such cases, you will always have a clear opportunity to opt out both when your contact details are collected and in each communication we send.
We keep your subscription data for as long as you remain subscribed to receive our newsletters.
If you stop interacting with our emails, we will normally retain your data for 36 months from your last engagement. Before this period ends, we may contact you to check whether you would like to continue receiving updates.
If you unsubscribe, we will remove your contact details from our mailing list without undue delay.
We keep a limited record of your consent and unsubscribe request for 4 years, to demonstrate compliance with our legal obligations.
To analyse how our website is used and improve performance, functionality, and marketing (you can manage your preferences through our cookie settings)
Online identifiers:
Cookie IDs and device identifiers
IP address, browser type, device information
Usage and behavioural data:
Pages visited, session duration, interactions
Preferences and navigation patterns
Consent (Article 6(1)(a) GDPR) – for non-essential cookies and tracking technologies
Cookies and similar technologies used on our website have different lifespans depending on their purpose.
Some cookies are deleted automatically when you close your browser, while others remain on your device for a defined period to recognise your preferences or improve your experience on future visits.
For more detailed information about the specific cookies we use, please see the Cookies section below.
To maintain records of individuals who have opted out of marketing communications (this ensures we respect your preferences and do not contact you again)
Contact data:
Email address
Preference data:
Opt-out status and reason, date of opt-out
Legal obligation (Article 6(1)(c) GDPR) – to ensure that individuals who have opted out of marketing communications are not contacted again, in accordance with applicable data protection and electronic communications laws Suppression list data is retained for as long as necessary to ensure we continue to respect your opt-out request.
To manage relationships with our suppliers, service providers, and contractors, including coordinating services, managing contracts, and processing payments.
This data is required to enter into and perform a business relationship. Without it, we may not be able to work with the supplier or deliver certain services.
Identification and contact data:
Full name, identification number (where applicable)
Email address and phone number
Professional and business data:
Job title, company name, business contact details
Contractual and financial data:
Contract details, service descriptions, engagement terms
Invoice data, payment details, bank account information, tax identification details
Performance of a contract (Article 6(1)(b) GDPR) – where we work directly with individual contractors
Legitimate interest (Article 6(1)(f) GDPR) – to manage relationships with supplier organisations and their representatives
Legal obligation (Article 6(1)(c) GDPR) – to comply with accounting, tax, and recordkeeping requirements
Supplier and contractual data: retained for 10 years after the end of the contractual relationship
Financial and invoice data: retained for 10 years in line with accounting and tax requirements
3. WHO WE SHARE YOUR DATA WITH?
To provide our services and operate our business, we work with a range of trusted partners and service providers. We only share personal data where it is necessary for a specific purpose, and we always ensure that appropriate safeguards are in place to protect your information.
Depending on the role of the provider and the nature of the service, third parties may process personal data either on our behalf and under our instructions (acting as “processors”), or as independent controllers responsible for their own processing activities. For example, payment providers, banks, social media platforms, and certain analytics or advertising partners may process personal data as independent controllers in accordance with their own privacy policies.
Below we describe the main categories of recipients with whom we may share personal data, depending on how you interact with us. Where relevant, we may also provide additional information about specific recipients upon request.
3.1. Service delivery partners
If you book or participate in a tour, we may share relevant information with partners involved in delivering your experience. This may include:
tour operators and activity providers
accommodation providers (e.g., hotels)
transport providers (e.g., ferry operators, car rental companies)
These partners use your data only to the extent necessary to provide the services you have booked.
3.2. Payment and financial service providers
If you make a payment or book a service with us, your data may be shared with the service providers and financial institutions involved in processing transactions and managing our financial obligations. This may include:
payment service providers (e.g., Teya and similar providers)
banks and financial institutions
accounting and audit service providers
Payment providers, banks, and financial institutions generally process payment-related data as independent controllers in accordance with their own legal and regulatory obligations.
3.3. Communication and customer support providers
If you contact us or communicate with us, we may use external providers to help manage customer support, booking-related communication, and day-to-day operational coordination. This may include:
customer support and ticketing system providers
email, messaging, and communication platform providers (e.g., Microsoft, Meta messaging services, or similar providers)
cloud storage and collaboration tool providers
These providers generally process personal data on our behalf and under our instructions.
3.4. Marketing, social media, and community platforms
If you subscribe to newsletters, participate in campaigns, collaborate with us, or interact with us on social media, we may share your data with providers that help us manage marketing communications, online engagement, and community activities. This may include:
email marketing platform providers (e.g., Klaviyo or similar providers)
messaging infrastructure and email delivery providers
cloud and collaboration providers supporting marketing communications
social media and content-sharing platforms (e.g., Facebook (Meta), Instagram, YouTube, X (Twitter), or similar providers)
Many of these providers process personal data on our behalf and under our instructions. However, when you interact with us through social media platforms or engage with our content there, your personal data may also be processed by the relevant platform provider in accordance with their own privacy policies and terms. This may include platforms such as Facebook (Meta), Instagram, YouTube, X (Twitter), or similar social networks. These platform providers generally act as independent controllers for processing carried out through their own platforms and services.
3.5. Website, analytics, and advertising providers
To help us operate and improve our website, understand how visitors use it, manage advertising campaigns, and improve online visibility, we may share certain personal data with providers supporting website functionality, analytics, advertising, consent management, and search engine optimisation activities. This may include:
analytics providers (e.g., Google Analytics, Hotjar)
advertising and social media platforms (e.g., Google, Meta, LinkedIn, Microsoft Ads)
consent management platform providers
website hosting providers
website optimisation and testing providers (e.g., VWO, Unbounce)
SEO, paid media, and digital marketing support providers
Some of these providers – particularly advertising platforms and social media providers – may process certain personal data as independent controllers for their own analytics, advertising, measurement, and platform improvement purposes.
3.6. IT, cloud, and infrastructure providers
We rely on trusted technology providers to operate our systems, support our day-to-day operations, and store data securely. This may include providers of:
cloud hosting and storage services
internal communication and collaboration tools
booking and reservation systems
customer relationship management systems
IT infrastructure services
accounting and business management systems
These providers generally process personal data on our behalf and under our instructions.
3.7. Legal, safety, and regulatory disclosures
In certain situations, we may share personal data where necessary to comply with legal obligations, respond to lawful requests, protect individuals and property, investigate incidents or disputes, or establish, exercise, or defend legal claims. This may include sharing data with:
regulators and public authorities
law enforcement authorities
insurance providers
legal advisors
emergency services
These recipients act as independent controllers when processing personal data for their own legal, regulatory, or insurance-related purposes.
3.8. Business transfers
If we are involved in a merger, acquisition, restructuring, sale of assets, or similar business transaction, personal data may be transferred as part of that process. Where this happens, we will ensure that any such transfer is carried out in accordance with applicable data protection laws and that your personal data remains appropriately protected.
4. INTERNATIONAL DATA TRANSFERS
Because we work with travellers, partners, and service providers located in different countries, your personal data may in certain situations be transferred to or accessed from countries outside your country of residence, including outside the European Economic Area (“EEA”).
Where personal data is transferred internationally, we take steps to ensure that it remains protected in accordance with applicable data protection laws. Depending on the circumstances, we may rely on:
adequacy decisions issued by the European Commission;
the European Commission’s Standard Contractual Clauses (“SCCs”); or
other lawful transfer mechanisms and safeguards recognised under applicable data protection laws.
Where appropriate, we may also implement supplementary technical and organisational measures designed to protect personal data during international transfers.
Many of our providers operate globally, including providers of cloud infrastructure, communication tools, customer support systems, analytics services, marketing platforms, and social media services.
You may request additional information about international transfers relevant to your personal data, including information about applicable safeguards, by contacting us using the details provided in this Privacy Policy.
5. YOUR DATA PROTECTION RIGHTS
Under the GDPR, you have certain rights in relation to your personal data. You may have the right to:
access the personal data we hold about you, including information about how and why we use it, who we share it with, and how long we keep it. This may include requesting a copy of your booking information, customer support communication, or other personal data associated with your interaction with us;
request correction of inaccurate or incomplete personal data. For example, this may include asking us to update incorrect contact information, travel details, or booking information;
request deletion of your personal data in certain situations, including where the data is no longer necessary for the purpose for which it was collected or where processing was based on consent that you later withdraw. Please note that we may still need to retain certain information where required by law or where necessary for legitimate business purposes, such as handling disputes, enforcing agreements, preventing fraud, or complying with accounting and tax obligations;
request restriction of processing of your personal data in certain situations. This may include temporarily limiting how we use your personal data while we assess a correction request, review an objection, or verify whether processing remains lawful;
object to certain types of processing based on legitimate interests. For example, this may include objecting to customer support follow-ups, or other operational communication not strictly required to provide the service;
withdraw your consent at any time where processing is based on consent. For example, you can unsubscribe from marketing communications or change your cookie preferences through our website settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal;
request transfer of personal data you have provided to us in a structured, commonly used, and machine-readable format, where technically feasible and legally applicable;
not be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you. Please note that we do not currently use personal data for fully automated decision-making of this nature.
You can exercise your rights over your personal data by contacting us at: info@specialtours.is.
To protect your privacy and security, we may need to verify your identity before responding to certain requests, particularly where the request involves access to or deletion of personal data.
We will respond to your request in accordance with applicable data protection laws. In most cases, this means responding within 1 (one) month of receiving your request. If your request is particularly complex or involves multiple requests, this period may be extended by up to an additional 2 (two) months. Where this applies, we will inform you accordingly.
If you believe that your personal data has been processed unlawfully or that your rights have been violated, you also have the right to lodge a complaint with your local data protection authority. If you are located within the European Economic Area (EEA), information about national data protection authorities is available here: https://edpb.europa.eu/about-edpb/about-edpb/members_en
6. ADDITIONAL INFORMATION FOR US RESIDENTS
If you are a resident of a US state with applicable privacy laws, you may have additional privacy rights in relation to your personal information. Depending on your state of residence, these rights may include the right to:
request access to personal information;
request deletion or correction of personal information;
opt out of certain targeted advertising or profiling activities; and
receive additional information about how personal information is processed.
We do not sell personal information in exchange for monetary compensation. However, certain online advertising and analytics activities may be considered “sharing”, “targeted advertising”, or similar processing under applicable US privacy laws.
You may exercise applicable privacy rights by contacting us using the contact details provided in this Privacy Policy.
7. COOKIES AND SIMILAR TECHNOLOGIES
Like most websites, we use cookies and similar technologies to ensure our website functions properly, improve user experience, understand how visitors use our website, and support our marketing activities.
Cookies are small text files stored on your device when you visit a website. Some cookies are necessary for the website to function, while others help us analyse website traffic, remember your preferences, or personalise content and advertising.
Depending on your preferences, we may use:
strictly necessary cookies – required for the website to function properly and securely. These cookies cannot be switched off through our cookie settings tool;
functional cookies – used to remember your preferences and improve website functionality and user experience;
analytics cookies – used to understand how visitors use our website, measure website performance, and improve our services and content;
marketing cookies – used to personalise advertising, measure the effectiveness of campaigns, and display more relevant content across websites and platforms.
As required by applicable law, non-essential cookies are only used with your consent. You can manage your cookie preferences at any time through our cookie settings tool available on the website.
Because the cookies and technologies used on our website may change from time to time as our website and services evolve, the most up-to-date information about the specific cookies in use, including their providers, purposes, and retention periods, is available through our cookie settings tool and cookie declaration accessible on the website.
Some cookies may be placed by third-party providers such as analytics, advertising, or social media partners. Where this happens, those third parties may also process certain information collected through cookies in accordance with their own privacy policies.
Third-party websites
Our website may contain links to third-party websites or services. Please note that we are not responsible for the content, security, or privacy practices of third-party websites. If you visit a third-party website, we encourage you to review their privacy information separately.
8. CONTACT US
If you have any questions about this Privacy Policy, how we process your personal data, or if you would like to exercise your data protection rights, you can contact us using the details below:
Special Tours
Registered address: Geirsgata 11, 101 Reykjavik
E-mail: info@specialtours.is
We will do our best to respond to your inquiry as soon as reasonably possible.