Last updated: [DAGSETNING]
Here you can read which personal data Reykjavík Locals handles when you visit our website, book or join a tour, or use Local Walk or our tour apps, the reasons we need it, and your rights. We follow the EU General Data Protection Regulation (GDPR), which applies in Iceland through the Icelandic Data Protection Act No. 90/2018.
1. Who is responsible for your data
The data controller is Local Travels ehf. ("Reykjavík Locals", "we"), kennitala 551026-1750, Urðarbrunni 32, 113 Reykjavík, Iceland. For any privacy question or request, contact us at info@reykjaviklocals.com or +354 659 1971.
2. What data we collect
When you book on our website
- Name, email address, phone number and country of residence.
- Booking details: product, date, time, number of guests and price.
- Payment information: your card is processed by our payment provider. We receive only confirmation of payment and limited details such as the card type and the last four digits, never the full card number.
- Messages you send us.
Information about allergies and dietary needs
If you tell us about allergies, intolerances, pregnancy or other dietary needs, this may count as health information, which the law treats as especially sensitive. We only ask for what we need to arrange your food, we only use it for that purpose, and we pass only what is necessary on to the venues on your tour (for example "one guest: gluten-free"), where possible without your name.
Pub crawl age check
You confirm when you book that every guest is 20 or older. The pub crawl is self-guided, so on the night the bars may look at your photo ID. We do not copy or store your ID.
On the tour
- A guest list with names and dietary needs for the guide.
- Photos or video, if you have not asked not to be photographed (see section 4).
- Notes about any incident on the tour, if something happens that we need to record.
Local Walk
- Your email address and access code or login, pass type, purchase and activation time and expiry date.
- How you use the platform, for example which parts of the walk you have opened and your progress, so the platform works and so we can improve it.
- Technical data such as device type, browser, IP address and error logs, for security and troubleshooting.
- Location: if you allow your browser to share your location, it is used to show where you are on the map. [STAÐFESTA: staðsetning eingöngu unnin í tæki notanda og ekki vistuð hjá okkur – eða lýsa því sem er vistað.]
Bookings through other companies
If you book through an online travel agency such as Viator, GetYourGuide or Tourdesk, that company collects your data under its own privacy policy and passes us the details we need to run your tour (usually your name, contact details, number of guests and any notes you add). Those companies are separate controllers of the data they hold.
Website visits
We do not use advertising cookies or analytics trackers. If you make a booking, we record with it how you found us: the website or search engine you came from, or the campaign tag in the link you followed (for example a QR code on a flyer), and the first page you visited on our site. This information is carried in the page address as you move around our site, not in cookies, and it is only saved if you book. Our hosting provider may also keep standard technical server logs (for example IP address and time of request) for security. See also section 9.
3. Why we use your data and our legal basis
- Taking and managing your booking, sending confirmations, reminders and practical information, running the tour, giving Local Walk access: Performance of a contract (art. 6(1)(b))
- Arranging food for allergies and dietary needs: Your explicit consent (art. 9(2)(a)), which you give when you provide the information. You can withdraw it at any time, but we may then not be able to arrange suitable food.
- Keeping accounting records: Legal obligation (art. 6(1)(c)), Icelandic Bookkeeping Act No. 145/1994
- Checking that pub crawl guests are 20 or older: Legal obligation (Icelandic Alcohol Act No. 75/1998, art. 18) and contract
- Handling questions, complaints and any claims: Legitimate interests (art. 6(1)(f)) in serving our guests and protecting our legal rights
- Keeping our website and Local Walk secure and working, and improving them: Legitimate interests (art. 6(1)(f))
- Knowing how guests found us (the source saved with a booking), so we can see which channels and campaigns work: Legitimate interests (art. 6(1)(f)). We only look at it in summary form.
- One email after your tour asking for feedback or a review: Legitimate interests (art. 6(1)(f)). You can opt out at any time.
- Photos taken on tours for sharing with the group and in our channels: Legitimate interests (art. 6(1)(f)), with the right to opt out. Consent where you are the main subject in marketing.
- Newsletter and offers: Your consent (art. 6(1)(a)), which you can withdraw at any time
- Non-essential cookies (analytics, marketing), if we ever use them: Your consent
Your personal data is never sold, and it is not used for automated decisions that have legal or similarly significant effects on you.
4. Photos
Our guides may take photos or short videos on tours. Tell your guide at the start if you do not want to be included. We will ask you before we use a photo in our marketing where you are the main, clearly identifiable subject. You can ask us at any time to remove a photo of you from our website or social media.
5. Who we share data with
We use trusted service providers (processors) who handle data only on our instructions and under a data processing agreement:
- Booking system and channel manager: Bókun, owned by Tripadvisor LLC (USA). Data may be stored outside the EEA; such transfers are covered by the EU Standard Contractual Clauses or another approved safeguard.
- Payment provider: [GREIÐSLUGÁTT]
- Email service: [TÖLVUPÓSTÞJÓNUSTA]
- Database for bookings, Local Walk and our tour apps: Supabase (Supabase Pte. Ltd., Singapore, supported by Supabase, Inc., USA). Our database is hosted on Amazon Web Services in [SVÆÐI – STAÐFESTA]. Transfers outside the EEA are covered by the EU Standard Contractual Clauses.
- Website hosting: Netlify, Inc. (USA). Transfers are covered by the EU-U.S. Data Privacy Framework, with the EU Standard Contractual Clauses as a fallback.
- Analytics: [GREININGARÞJÓNUSTA, ef notuð]
- Accounting: [BÓKHALDSKERFI / BÓKARI]
We also share limited data with:
- Tasting venues and bars on your tour: number of guests and dietary needs (normally without names).
- The online travel agency you booked through, where relevant, for example to confirm that the tour took place.
- Authorities, insurers or advisers where the law requires it or where it is needed to establish or defend legal claims.
6. Transfers outside the EEA
We aim to keep your data within the European Economic Area. If a provider processes data outside the EEA, we make sure the transfer is protected by an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework, where the provider is certified) or by the European Commission's standard contractual clauses. You can contact us for more information. [LISTA UPP RAUNVERULEGA FLUTNINGA ÞEGAR ÞJÓNUSTUAÐILAR LIGGJA FYRIR]
7. How long we keep your data
- Accounting records (invoices, receipts and payment records): 7 years from the end of the financial year concerned, as required by the Bookkeeping Act No. 145/1994, art. 20.
- How you found us: kept with the booking for the same period as the booking details.
- Booking and contact details: [24 mánuði] after the tour date, unless needed longer for a complaint or claim.
- Allergy and dietary information: deleted within [30 daga] after the tour.
- Guest lists used by guides: deleted within [30 daga] after the tour.
- Local Walk account and usage data: deleted within [12 mánuðum] after your pass expires. Technical logs: up to [90 daga].
- Newsletter: until you unsubscribe.
- Photos: as long as they are used on our channels, or until you ask us to remove them.
- Incident records: as long as needed in case of a claim, normally up to [4 ár / fyrningarfrestur – STAÐFESTA].
8. Your rights
You have the right to:
- get a copy of the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted, where we no longer have a reason to keep it;
- restrict our use of your data in certain cases;
- object to processing based on our legitimate interests, including the review email and photos;
- receive data you gave us in a portable format;
- withdraw your consent at any time, without affecting processing that has already taken place.
Send your request to info@reykjaviklocals.com. We will answer within one month and may need to confirm your identity first.
If you are not satisfied with how we handle your data, you can complain to the Icelandic Data Protection Authority, Persónuvernd, Rauðarárstígur 10, 105 Reykjavík, Iceland, email postur@personuvernd.is, phone +354 510 9600, website personuvernd.is. If you live in another EEA country, you can also contact the data protection authority there.
9. Cookies and local storage
Our website does not use cookies for analytics or advertising. Our fonts and scripts are served from our own website, not loaded from other companies. When you book or use Local Walk and our tour apps, the data is sent to and stored with our database provider (Supabase), and payments are handled by the payment provider (see section 5). How you found us is carried in the page address, not stored in your browser (see section 2). We only use your browser’s storage where it is strictly necessary:
- Local Walk and our tour apps: local storage keeps you logged in, remembers your progress, your name for your photo keepsake and your settings. This stays on your device.
- Photo keepsakes (collages): the photos and videos you add are kept in your browser’s storage (IndexedDB) on your own device. They are not uploaded to us unless you choose to share or send them.
- Payment: when you pay, you are sent to our booking partner’s secure payment page, which may set its own strictly necessary cookies. Their privacy policy applies there.
Strictly necessary storage does not require consent. You can delete it at any time in your browser settings, but the apps may then log you out or lose your progress. If we ever add analytics or marketing cookies, we will ask for your consent first and update this policy.
10. Children
Our bookings are made by adults. Local Walk is not intended for children under 13 to use on their own. If a child takes part in a tour, the parent or guardian gives us the information we need.
11. Security
We use reasonable technical and organisational measures to protect your data, including encrypted connections, restricted access and providers that meet recognised security standards. If a breach occurs that is likely to put your rights at risk, we will notify Persónuvernd and, where required, you.
12. Changes to this policy
We may update this policy. The date at the top shows when it was last changed. If we make significant changes, we will tell you clearly on our website or by email.