Privacy Policy

Hellarnir við Hellu ehf., trading as Caves of Hella (“Caves of Hella”, “we”, “us” or “our”), respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect personal data when you visit https://www.cavesofhella.is/, contact us, make a booking or purchase, or otherwise interact with us.

1. Who is responsible for your personal data?

The data controller is:

Hellarnir við Hellu ehf. (Caves of Hella)
ID / Kennitala: 700819-1320
Ægissíða 4
851 Hella
Iceland
Email: info@cavesofhella.is
Telephone: +354 620 6100

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have a concern about how we process your personal data, please contact us using the details above.

2. What personal data do we collect?

The personal data we collect depends on how you interact with us.

Information you provide to us

This may include:

  • Your name.
  • Email address.
  • Telephone number.
  • Billing and transaction information.
  • Booking details, including the date and type of tour, number of participants and related reservation information.
  • Information you include when contacting us by email, telephone, a contact form or another communication channel.
  • Information necessary to arrange private tours, group tours, gift cards or other services.
  • Dietary, accessibility or other requirements that you voluntarily provide where they are relevant to a tour or service.
  • Any other information you voluntarily provide to us.

Information collected automatically

When you use our website, certain technical information may be collected automatically, including:

  • IP address.
  • Browser type and version.
  • Device type and operating system.
  • Date and time of access.
  • Pages visited and interactions with the website.
  • Referring website or source.
  • Technical logs and information used for security, diagnostics and website operation.
  • Cookie identifiers and similar information where you have consented to their use.

Information received from third parties

Where you make a reservation, purchase or payment through a third-party booking, ticketing or payment provider, we may receive the information required to administer your booking or transaction, such as your name, contact details, booking details, payment status and transaction reference.

Payment card information may be processed directly by the relevant payment service provider. Where this is the case, we do not need to receive or store your full payment card details.

3. Why we use your personal data and our legal bases

We process personal data only where we have a valid legal basis under applicable data protection law.

Bookings, purchases and providing our services

We use your personal data to:

  • Process and administer reservations and purchases.
  • Provide tours and other services you have requested.
  • Send booking confirmations and important information relating to your visit.
  • Manage cancellations, changes, refunds and customer service enquiries.
  • Process gift card orders and other purchases.

Legal basis: Processing is necessary to enter into or perform a contract with you.

Responding to enquiries

We use information you provide when you contact us to respond to your questions, requests or enquiries.

Legal basis: Taking steps at your request before entering into a contract and/or our legitimate interest in communicating with customers and responding to enquiries.

Accounting and legal obligations

We may retain and process transaction, invoice and booking information where required by accounting, tax, consumer protection or other applicable laws.

Legal basis: Compliance with our legal obligations.

Website operation and security

We process limited technical information to operate, maintain and secure our website, prevent misuse, troubleshoot technical problems and protect our systems.

Legal basis: Our legitimate interests in operating a secure, reliable and functional website.

Analytics, optional cookies and similar technologies

Where required by law, we use analytics, marketing, preference or other non-essential cookies and similar technologies only after obtaining your consent.

Legal basis: Your consent.

Marketing communications

If you expressly subscribe to marketing communications, we may use your contact details to send you relevant news, offers or information from Caves of Hella. You can unsubscribe at any time using the unsubscribe option provided in the communication or by contacting us.

Legal basis: Your consent, where consent is required by applicable law.

Special requests

If you voluntarily provide information concerning allergies, health, accessibility or similar requirements so that we can accommodate you safely during a visit, such information will only be used for that purpose and handled with particular care. Where this information constitutes special-category personal data, we process it only where a valid legal basis and an applicable condition for such processing exist, including your explicit consent where required.

4. Cookies and consent management

Our website may use cookies and similar technologies. Some cookies are strictly necessary for the website to function and do not require consent. Other cookies may be used for purposes such as preferences, analytics, embedded content or marketing and are used only where permitted by applicable law.

When you first visit our website, you may be asked to choose which optional cookies and technologies you wish to allow.

You can review, change or withdraw your cookie consents at any time by clicking the fingerprint button in the bottom-left corner of the screen.

Withdrawing your consent does not affect the lawfulness of processing carried out before you withdrew it. Refusing or withdrawing consent to optional cookies will not prevent you from using the essential functions of the website, although some optional content or functionality may be unavailable.

You can also control or delete cookies through your browser settings. Please note that blocking strictly necessary cookies may affect the operation of the website.

5. Embedded content and third-party services

Our website may contain content or functionality supplied by third parties, such as maps, reviews, videos, social-media features, booking systems, payment services or other embedded services.

These third parties may receive technical information such as your IP address and may use cookies or similar technologies when their services are loaded. Where consent is legally required before such a service may be activated, we aim to prevent it from loading until you have provided the relevant consent.

Third-party providers process personal data according to their own privacy policies where they act as independent data controllers.

6. Who do we share personal data with?

We do not sell your personal data.

Where necessary for the purposes described in this Privacy Policy, personal data may be shared with or processed by categories of recipients including:

  • Website hosting, maintenance and technical service providers.
  • Booking, reservation and ticketing service providers.
  • Payment service providers and financial institutions.
  • Email and communications service providers.
  • Analytics and consent-management providers, where applicable.
  • Professional advisers such as accountants, auditors, lawyers or insurers.
  • Public authorities or other parties where disclosure is required by law.
  • Other service providers acting on our instructions and helping us operate our business.

Where a supplier processes personal data on our behalf as a data processor, we require the processing to be governed by appropriate contractual and data-protection safeguards.

7. International transfers

We aim to use service providers that process personal data within Iceland, the European Economic Area (“EEA”) or other jurisdictions offering an appropriate level of data protection.

Some of our service providers or their infrastructure may be located outside the EEA. Where personal data is transferred to a country outside the EEA that has not been recognised as providing an adequate level of data protection, we take appropriate measures as required by applicable data protection law. These may include the European Commission’s Standard Contractual Clauses or another legally recognised transfer mechanism, together with additional safeguards where necessary.

You may contact us if you would like further information about safeguards applicable to an international transfer of your personal data.

8. How long do we keep personal data?

We keep personal data only for as long as necessary for the purpose for which it was collected, including to meet legal, accounting, tax and reporting obligations.

Retention is generally determined as follows:

  • Bookings and purchases: kept for the period necessary to provide the service, handle customer service matters and satisfy applicable accounting, tax and legal requirements.
  • General enquiries: kept for as long as reasonably necessary to respond to and follow up on the enquiry, after which the information is deleted or anonymised unless there is another lawful reason to retain it.
  • Marketing information: kept until you unsubscribe or withdraw your consent, unless retention is necessary to maintain a record of your opt-out.
  • Technical and security logs: retained only for as long as reasonably necessary for security, troubleshooting and protection of our systems.
  • Consent records: retained for as long as reasonably necessary to demonstrate and manage your consent choices.
  • Special requests or sensitive information: retained only for as long as necessary to accommodate the relevant booking or service unless longer retention is required or permitted by law.

When personal data is no longer required, we delete it, anonymise it or otherwise securely dispose of it.

9. Is providing personal data mandatory?

Certain personal data is necessary for us to process a booking, purchase, refund or other request. If you do not provide information marked as required or otherwise necessary to provide the service, we may be unable to complete your booking or fulfil your request.

Providing consent for optional analytics, marketing or other non-essential cookies is not a condition of making a booking or using the essential features of our website.

10. Your data protection rights

Subject to the conditions and exceptions set out in applicable data protection law, you may have the right to:

  • Access the personal data we hold about you and receive information about how it is processed.
  • Rectify inaccurate or incomplete personal data.
  • Request erasure of your personal data in certain circumstances.
  • Restrict processing of your personal data in certain circumstances.
  • Object to processing based on our legitimate interests.
  • Object to direct marketing at any time.
  • Data portability for certain personal data processed by automated means on the basis of consent or a contract.
  • Withdraw consent at any time where processing is based on your consent, without affecting processing that took place before withdrawal.
  • Lodge a complaint with a competent data protection supervisory authority.

To exercise any of these rights, please email info@cavesofhella.is.

We may need to request information sufficient to verify your identity before acting on a request. This is intended to ensure that personal data is not disclosed to a person who is not entitled to receive it.

11. Right to complain to the Icelandic Data Protection Authority

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the Icelandic Data Protection Authority:

Persónuvernd
Rauðarárstígur 10
105 Reykjavík
Iceland
Website: https://www.personuvernd.is/

You may contact us first if you wish to give us an opportunity to address your concern directly, but doing so does not affect your right to contact the supervisory authority.

12. Automated decision-making

We do not use your personal data to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

13. Children’s personal data

Our tours and services may be used by families and children, but online bookings should be made by an adult or another person authorised to make the booking.

We do not intentionally request more personal data about children than is necessary to administer a booking or provide the requested service. Where information about a child is provided by an adult making a booking, it will be handled in accordance with this Privacy Policy.

14. Data security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other unlawful processing.

Access to personal data is limited to employees, contractors and service providers who need the information for legitimate business purposes and who are subject to appropriate confidentiality and data-protection obligations.

Although we take reasonable measures to protect personal data, no internet transmission or information-storage system can be guaranteed to be completely secure.

15. Links to other websites

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of websites operated by third parties. We recommend reviewing the privacy information provided by the relevant third party before providing personal data to them.