We collect what we need to plan your trip, and not much else. We don't sell it, we don't trade it, and we don't follow you around the internet with it.
This page explains what we keep, why we keep it, and how to make us forget it. If anything is unclear, write to us and we'll explain it in plain words.
Introduction
This policy explains what personal data we collect, why we collect it, who we share it with and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and the Icelandic Act on Data Protection and the Processing of Personal Data no. 90/2018.
1. Who is responsible for your data
The data controller is Eskimóar ehf., trading as North of Normal, Skútuvogur 1b, 104 Reykjavík, Iceland. Company ID (kennitala): 671023-0640.
For anything to do with your personal data, contact us at hello@northofnormal.is or +354 414 1500.
What we collect
When you contact us or send an enquiry: your name, email address, phone number, country, and what you tell us about the journey you have in mind, such as dates, number of travellers and interests.
When you book: the names of everyone travelling, contact details, travel dates, flight details, and any requests that help us plan the journey. If you choose to tell us about allergies, dietary needs, mobility or other health matters, we use that information only to arrange your journey safely, and only with your consent.
When you pay: payment details are handled by our payment provider. We do not store full card numbers.
When you sign up for our newsletter: your email address and, if you give it, your name.
When you visit our website: information about how you use the site, such as pages visited, device and browser type, and approximate location. We only collect this through Google Analytics if you accept analytics cookies. See our Cookie Policy.
When you work with us as a partner: the names, roles and contact details of the people we deal with at your company.
Why we use it, and on what legal basis
Answer enquiries and prepare proposals: steps taken at your request before a contract
Plan, book and deliver your journey: performance of a contract
Use health information you share, such as allergies or mobility needs: your explicit consent
Keep accounting and booking records: legal obligation
Send our newsletter: your consent, which you can withdraw at any time
Keep in touch with travel partners and their staff: our legitimate interest in running our business
Understand how our website is used: your consent, given through the cookie banner
4. Who we share it with
We never sell your personal data. We share it only where needed:
Suppliers who deliver your journey, such as hotels, lodges, guides, drivers, restaurants and activity providers. They receive only what they need to deliver their part of your journey.
The travel company that booked you, if you travel through one of our partners.
Service providers who process data on our behalf:
Microsoft (Microsoft 365 and SharePoint), for email, documents and our contact database
MailerLite, for our newsletter
Google (Google Analytics), for website statistics, only with your consent
Framer, which hosts our website
Teya, which processes card payments
Authorities, where the law requires it.
Transfers outside the EEA
We store data in Iceland and elsewhere in the European Economic Area wherever possible. Some of our service providers, such as Google and Microsoft, may process data in the United States. Where that happens, the transfer is protected by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.
How long we keep it
Enquiries that do not lead to a booking: up to 2 years after our last contact
Booking and accounting records: 7 years, as required by Icelandic bookkeeping law
Newsletter subscription: until you unsubscribe
Website analytics: 14 months
Your rights
You have the right to:
see the personal data we hold about you
have it corrected if it is wrong
have it deleted, unless we are required to keep it
restrict or object to how we use it
receive it in a format you can take elsewhere
withdraw your consent at any time, for example by unsubscribing from the newsletter or changing your cookie settings
To use any of these rights, email hello@northofnormal.is. We will reply within one month. We may ask you to confirm your identity first.
If you are not satisfied with how we handle your data, you can complain to the Icelandic Data Protection Authority (Persónuvernd), Laugavegur 166, 105 Reykjavík, postur@personuvernd.is, +354 510 9600. If you live elsewhere in the EEA, you can also contact your local data protection authority.
Children
We only collect information about children when a parent or guardian gives it to us as part of a booking.
9. Security
We use appropriate technical and organisational measures to protect your data, and only people who need it to do their work can access it.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed.