Privacy Policy

TINNA ADVENTURE PRIVACY POLICY

At Tinna Adventure, we are committed to protecting your personal data. This privacy policy sets out how we collect and use the personal information (“personal data”) you provide us with directly or through use of our website (www.tinna-adventure.is)(“Website”) and tells you about your privacy rights and how the law protects you.

Important information and who we are

We at Tinna Adventure are a registered tour operator with the Icelandic Tourist Board. We are the tour division of Bifreiðaverkstæði Sigursteins car mechanics workshop.

For the General Data Protection Regulations (EU)(2016/679) and any updating legislation from time to time. We are the Data Controller of information provided by customers. Our address is Selnes 28-30, 760 Breiðdalsvík, Iceland (“Tinna Adventure,” ”We,” ”Our,” “Us”). We have appointed a data protection officer (DPO) who is responsible for overseeing questions about this privacy policy. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below.

Company registration number: 590405-1320

Icelandic Tourism board registration number: 2019-082

VAT number: 86421

How to Contact Us

If you have any questions regarding your personal data and how We may use it, including any queries relating to this policy, please contact us at info@tinna-adventure.is or by phone in the number (+354) 832-3500

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes.

What is personal data and what is the basis for collecting it?

Personal data means any data or information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which We have grouped as follows:

Identity Data includes first name, last name, username or similar identifier, title, date of birth, gender, and passport or national identity card information, including copies of these documents;
Contact Data includes an email address and telephone numbers;
Financial Data is processed by our payment processor Valitor and is at no point accessible by us.
Transaction Data includes details about the method of payment, the amount and date;
Technical Data includes internet protocol address, your login data, browser type and versions, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this Website;
Profile Data includes purchases or orders made by you, your interests, preferences, feedback and survey responses
Usage Data includes information about how you use our services or submit an inquiry or query through Our Website;
Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences;
Individual Data additional information collected from you concerning the services we provide, including telephone calls which We record; and
Special Categories of Data includes information relating to disabilities or medical conditions which may affect your holiday arrangements and any dietary restrictions which may disclose your religious beliefs.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract you have or are trying to enter. In this case, we may have to cancel the services, but we will notify you if this is the case at the time.

How do we collect personal data?

We use different methods to collect personal data from and about you through:

Direct interactions. You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes, but is not limited to, personal data you provide when you:
- contact us by telephone, contact form or email to make an inquiry;
- use a form on Our Website to sign up for Our e-newsletter;
- request marketing to be sent to you;
- purchase services from us;
- give us some feedback;
- enter a competition on our website or via social media channels, at an exhibition or event or by post.
Automated technologies or interactions. As you interact with Our Website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies. Please see Our cookie policy for further details.

What do We do with your personal data?

We will only use your personal data when the law allows us to, i.e., if We have a legal basis for doing so, as outlined in this Policy or as notified to you at the time we collect your personal data, and for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you, and we will explain the legal basis which allows us to do this. Please note that we may process your personal data without your knowledge or consent, where this is required or permitted by law.

We have set out in the table below a description of all the ways we plan to use your personal data. We also detail the legal basis we rely on to do so. We have also identified what our legitimate interests are, where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Purpose/Activity	Type of data	Lawful basis for processing including the basis of legitimate interest
To register you as a new customer	(a) Identity (b) Contact	Performance of a contract with you
To process and deliver the services including: (a) taking payment (b) contacting you and corresponding with you about the services	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications (f) Sensitive Personal Data	Performance of a contract with you Consent (for use of sensitive personal data, and marketing and communications)
To respond to queries and inquiries	(a) Identity (b) Contact	Necessary for our legitimate interests (to study how customers use our services)
To manage our relationship with you which will include: (a) notifying you about changes to our terms or privacy policy (b) asking you to leave a review or take a survey	(a) Identity (b) Contact (c) Profile (d) Marketing and Communications	Performance of a contract with you Necessary to comply with a legal obligation Necessary for Our legitimate interests (to keep Our records updated and to study how customers use Our services)
To undertake marketing to you	(a) Identity (b) Contact	Consent Legitimate interest
To administer and protect Our business and this Website (including troubleshooting data analysis, testing, system maintenance, support, reporting and hosting of data)	(a) Identity (b) Contact (c) Technical	Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security and to prevent fraud) Necessary to comply with a legal obligation

How your personal data may be shared

Our booking platform is powered by Bokun.io where the booking information is stored. A copy of the booking notification, as well as bookings made outside of the website, will also be stored in our e-mail hosted and secured by 1984.is

At the time of booking, we also ask you for payment information such as credit card number or bank transfer details. We use the utmost level of online security to safeguard your personal data. As it is processed by Valitor you can see their security standards here.

We use MailChimp as a mailing list partner. If you sign up to our mailing list or sign up for our tours your e-mail will be on the appropriate list at MailChimp i.e for newsletters or for followup regarding your tour. As a customer, you will not enter a general mailing list without first providing concent.

On a rare occasion, we need to pass your personal data to third-party suppliers for the fulfillment of our contract. If we cannot give your personal data to the relevant suppliers, third-party supplier or other third parties, we will be unable to fulfill your booking.

On occasions, we may use other companies to provide services on our behalf, such as mailing brochures and marketing material. We only provide third parties with the personal data they require to deliver their services and their use is limited to the services they provide.

How your personal data may be stored

As previously mentioned our data is stored by Bokun.io and our e-mail and web provider 1984.is. Both of whom reside in Iceland. As a local tour operator in Iceland, we do not need to transfer data to suppliers in other countries and for this reason our data your information will no be traveling to other countries.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

Promotional offers from us

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services, and offers may be relevant for you (we call this marketing).

You will receive marketing communications from us if you have requested information from us or purchased services from us and, in each case, you have not opted out of receiving that marketing.

Opting out

You can opt-out of receiving marketing communications from us at any time by contacting us via the following methods.

1. Email us at info@tinna-adventure.is providing your full name, and the email address which you would have used initially.

2. Write to Tinna Adventure, Selnes 28, 760 Breiðdalsvík, Iceland.

3. Call our office on (+354)832-3500.

4. You can also be removed from our email database by clicking the Unsubscribe link located in the footer of all marketing email communications from us.

How do We keep your data secure?

Tinna Adventure is committed to the security of customer information, and we have security procedures in place to protect personal data from the accidental loss, misuse, unauthorized access, alteration or disclosure of information under our control. A secure server protects all the information you provide to us, this is shown as HTTPS:\ before Our Website address in your browser. The secure server software SSL (Secure Socket Layers) encrypts all information you enter before it is sent to us. The information is only de-encrypted when it reaches our server.

Other than in relation to government / public authorities (over whom we have no control), we take appropriate steps to ensure that anyone to whom we pass your personal data for any reason agrees to keep it secure, only uses it for the purposes of providing their services and does not collect any personal data from you in the course performing their services.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

How long do we keep personal data?

We will keep your information for as long as we need it for the purpose it is being processed for. For example, where you book a tour with us we will keep the information related to your booking, so we can fulfill the specific travel arrangements you have made and after that we will keep the information for a period which enables us to handle or respond to any complaints, queries or concerns relating to the booking. The information may also be retained so that we can continue to improve your experience with us and send you marketing materials; this will usually be no longer than 6 years after you have traveled with us.

We will actively review the information we hold and delete it securely, or in some cases anonymize it when there is no longer a legal, business or customer need for it to be retained.

Your rights

Under certain circumstances, you have rights under data protection laws concerning your personal data. These include the right to:

The right to be informed – this is information on for what purpose we are processing it and what personal data we are processing.
The right of access – you have the right to be provided with copies of the personal data of you that we are processing as well as confirmation of the processing we are doing. You can do this by sending a “subject access request” to the contact details noted above for our consideration.
The right to rectification – if you think the personal data that we hold on you is wrong you can tell us, and we will fix it.
The right to erasure (also known as the right to be forgotten) – if you want us to delete the personal data we hold for you permanently, then you can ask us to do so.
The right to restrict processing – if you do not like how we are using your personal data then you can let us know, and we will stop processing it in that way.
The right to data portability – if you want us to pass on your personal data to someone else then please let us know. This transfer should not affect the integrity or otherwise damage your personal data.
The right to withdraw your consent – you can withdraw your consent for us to process your personal data (if we have relied on your consent to process your personal data) at any time by contacting us. If we have relied only on your consent as the basis to process your personal data then we will stop processing your personal data at the point you withdraw your consent. Please note that if we can also rely on other bases to process your personal data aside from consent. Then we may do so even if you have withdrawn your consent.
Rights in relation to automated decision making and profiling – if we use either automated decision making or profiling then you have a right to know. Also, we need your consent if either of these is used to make a decision that affects you. As with all consent, you can withdraw it at any time.

To exercise any of the above rights please email your request to info@tinna-adventure.is.

Where you exercise your right to erasure (and we do not have another legal basis to hold on to that personal data) or where information is deleted in accordance with our retention policy. Please note that after the deletion of your personal data, it cannot be recovered, so if you require a copy of this personal data please request this during the period we retain the data.

Where you exercise your right to request access to the information we process about you, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We will try to respond to all legitimate access requests within one month.

If you believe that any of your personal data which we are processing is inaccurate or incorrect, please contact us immediately by calling Our office on (+354) 832-3500, by emailing info@tinna-adventure.is, or by writing to Tinna Adventure, Selnes 28, 760 Breiðdalsvík, Iceland.

Children

The Website is not intended for children, and we will not knowingly collect any personal data from such persons. We will immediately delete any such data identified as being that of a child.
As part of the services we provide, we may collect information about children from you to perform such services, and we will treat such information securely.

Cookies

You can set your browser to refuse all or some browser cookies or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this Website may become inaccessible or not function properly. For more information about the cookies we use, please see cookie policy.

Remember the risks whenever you use the internet

Tinna Adventure is committed to ensuring that your information is secure and has in place reasonable and proportionate safeguards and procedures to protect your personal data. While We do our best to protect your personal data, we cannot guarantee the security of any information that you transmit to us and you are solely responsible for maintaining the secrecy of any passwords or other account information.

Changes to this Privacy Policy

As and when necessary, changes to this Privacy Policy will be posted here. Where changes are significant, we may also email all our registered users with the new details. Where required by law, we will also obtain your consent to these changes.

This Privacy Policy was last updated on March 11 2020