Privacy Policy

1. Who Is Responsible

The controller is David the Guide, Fiskislóð 83, 101 Reykjavík, Iceland, kennitala 6405170930. The company is a travel agency licensed by Ferðamálastofa under licence 2018-022.

For privacy questions, email [email protected] or call +354 693 6333.

2. What This Website Does

The public site is a tour catalogue, a blog and a FAQ. There is no visitor account, no review system and no payment form on this website.

Booking and payment happen in the Bokun widget on the tour page. Bokun is the booking provider. Bokun processes the booking, the payment and the personal data that goes with them, under Bokun's own terms: bokun.io/privacy-policy.

Photographs and video are kept in Directus, the content system for this site, and this website delivers them to your browser.

3. What We Process Here

Analytics, when it is switched on, records a page path with no query and no hash, the referring site's origin, a coarse device type (mobile, tablet or desktop), the page language, and either a page view or a search. The visitor key is an HMAC of a random daily salt, a truncated address (IPv4 kept to the /24, IPv6 kept to the /48), a coarse browser family and the site host. The salt stays in server memory, changes at UTC midnight, and is never stored or written to a log. We do not store the raw address or the user agent, and the browser is not given an analytics identifier. The same person cannot be recognised on the next day.

Search terms are trimmed to 100 characters. A term that looks like an email address or a phone number is not stored.

If a page fails, the browser may send the path, a message and a stack. Emails, long tokens, query strings and addresses are removed from that text before it is logged. The user agent is not logged.

Staff sign in with a password. The cookie __davidtheguide_session is HttpOnly and SameSite=Lax, lasts up to 30 days, and is marked Secure on the production site. We store a hash of the session token. For security, the sign-in audit keeps the address and the browser string. Those audit rows, including the address, are deleted after 90 days.

The contact form sends your name, email and message by email to our inbox. It does not save a copy in the website database. A phone call or a WhatsApp message goes to that service, and this website does not store the conversation.

The language and the currency you choose are kept in the browser's local storage so the next page matches. They are not used as analytics. Tours opened in this tab stay in memory until the tab closes and are not written to disk.

The server holds the address in memory for a few minutes so it can slow repeated requests. That memory is not written to the analytics tables.

4. Why

Analytics and search terms are processed on the legitimate interest of seeing which pages and searches are used, in a form we cannot link to a person on the next day.

Contact messages are processed so we can reply to you.

Staff sign-in, and the address on the sign-in audit, protect the admin tools. The address is kept for 90 days and then deleted.

This website does not send marketing mail, and it does not sell personal data.

5. How Long We Keep It

Analytics events, analytics sessions and search terms are deleted after 180 days by a daily job.

Sign-in audit rows are deleted after 90 days by the same job. That is how long an address from a sign-in stays.

A staff session expires after 30 days, and expired session rows are deleted.

Contact mail stays in the business mailbox under that mailbox's own retention. This website does not run a separate timer for it.

Booking records are kept by Bokun, under Bokun's policy, not by this website.

6. Cookies and Storage on Your Device

This website does not set an analytics cookie and does not store an analytics identifier on your device.

The only cookie is __davidtheguide_session, and it is set only after a staff member signs in.

Language and currency stay in local storage, as described above.

The Bokun widget may set its own cookies. Those are described in Bokun's privacy policy.

7. Your Rights

You can ask for access, correction, erasure, restriction, or a portable copy of personal data we hold, and you can object where we rely on legitimate interest.

You can complain to Persónuvernd, the Icelandic supervisory authority: personuvernd.is.

Email [email protected]. We reply within 30 days.

Because the analytics salt is discarded at midnight, we usually cannot find one person's analytics rows. We can still act on a contact message and on a staff account.

8. Children

This website is not directed at children under 16. We do not knowingly collect their personal data. If you believe we have, email us and we will delete it.

9. Changes

When this policy changes, we post the new text on this page and change the date above.

10. Contact

David the Guide, Fiskislóð 83, 101 Reykjavík, Iceland. Email [email protected]. Phone +354 693 6333.