Privacy Policy
Privacy Policy
This policy explains what information Norse Adventures collects through the website, inquiries, newsletter signups, analytics, and booking communication, and how we use it.
Effective and last updated: September 24, 2026.
Fjallaþjónustan ehf., trading as Norse Adventures, is the controller of the personal information described in this policy. Our address is Brúarfljót 7e, 270 Mosfellsbær, Iceland. Send privacy questions or requests to adventures@norse.is.
When you contact us, request a tailored itinerary, submit an inquiry, join our mailing list, or book a trip, we collect the information you provide. This may include your name, contact details, travel interests, group details, dates, passenger and emergency-contact details, messages, booking references, payment status, and secure customer-portal access data.
Payment card details are handled by the payment processor and card networks. We normally receive transaction references, status, amount, and related booking information rather than your full card details.
We use inquiry and trip-planning information to take steps at your request before a contract, and booking information to perform our contract with you. We may also process information to meet accounting and other legal obligations, and for legitimate interests such as customer service, fraud prevention, website security, improving our services, and establishing or defending legal claims, provided those interests are not overridden by your rights.
We rely on consent for optional newsletters and other marketing, and for non-essential analytics or advertising cookies. You can withdraw consent at any time without affecting processing that took place before withdrawal.
Replies to your inquiry and messages about bookings, payments, safety, or trip operations are service communications. We send them when needed to answer your request or deliver your trip; they are separate from marketing.
We send newsletters, guide content, and offers only when you have chosen to receive them. You can unsubscribe at any time through the email link or by contacting us. Opting out of marketing does not stop necessary service communications.
Health conditions, medication, allergies, and some dietary information are special-category personal data. We request only information relevant to trip safety and emergency preparation, and ask for your explicit consent before using it. In a genuine emergency, we may also use it where necessary to protect someone's vital interests.
Medical answers are stored in an encrypted record separate from ordinary booking details. The lead booker can complete and update requested forms for passengers in their booking after confirming that the passenger authorized them to do so; invited passengers can also review and manage their own form. Lead-booker submissions and staff access are logged. Within Norse, access is limited to authorized operations staff and guides, and information is shared with relevant trip providers or medical responders only on a need-to-know basis. Medical-form reminder emails never contain health answers. We do not use health or medical-form information for marketing. Withdrawing consent before the trip may affect our ability to operate your trip safely; contact us so we can discuss what can be done.
We do not sell personal information. We share only what is reasonably necessary with guides, accommodation and transport providers, other trip suppliers, and services that support our website, forms, customer communications, booking portal, payments, newsletter, analytics, and advertising. These may include Netlify, Heimdall, myPOS or another payment provider, Mailchimp, Google, Meta, and OpenAI, depending on the service you use and your cookie choices.
A provider may process information outside the European Economic Area. Where that happens, we use an applicable adequacy decision or appropriate safeguards required by data-protection law, such as the European Commission's Standard Contractual Clauses. Contact us for more information about safeguards relevant to your information.
Essential technologies support functions such as security and booking access. With your consent, analytics and advertising tools may collect information such as device and browser type, approximate location, pages viewed, referral source, and online identifiers so we can measure performance and campaign results, build advertising audiences, and show relevant ads on Google and Meta services, including reminders about trips you viewed.
With your consent, we use Google Analytics remarketing to create advertising audiences. We and Google may use first-party Analytics cookies and identifiers together with Google advertising cookies and identifiers to measure advertising and show relevant ads.
With your consent, OpenAI measurement tools help us connect enquiries and completed bookings to ads in ChatGPT. They use first-party browser and ad-click identifiers. A temporary copy in this tab's session storage can preserve these identifiers during checkout for up to 30 minutes; withdrawing consent clears it. On public pages, automatic advanced matching may recognize supported contact information, normalize it and hash it in your browser before sending the hash with conversion events. We do not send enquiry messages, booking access credentials, passenger details or medical information as conversion event data. General advertising scripts remain disabled on private booking, portal and medical pages; a separate consent-controlled sender may report a confirmed purchase using the booking value, currency, an opaque event identifier and permitted attribution identifiers.
When you create a booking with measurement consent, we securely keep that consent and permitted ad-click and browser identifiers with the booking for up to seven days. This lets our booking system report a genuine completed purchase even if you close the confirmation page, and retry temporary delivery failures. We keep an anonymous withdrawal code in your browser for up to eight days so choosing Essential only can cancel measurement that has not yet been sent. The code cannot access your booking. Withdrawal does not undo a report already sent. We do not collect these identifiers for a booking without your current consent.
You can accept or decline optional cookies in our cookie notice, or withdraw consent at any time through Cookie settings in the website footer by choosing Essential only. You can also manage personalized advertising through Google Ad Settings and control cookies through your browser. Some website features may not work as intended if essential storage is disabled.
Manage personalized advertising in Google Ad Settings
How Google uses information from websites using its services
We keep unbooked inquiry records while a request is active and for a limited follow-up period. Newsletter details are kept until you unsubscribe or withdraw consent, after which we may keep a minimal suppression record so we honor your choice. Booking, payment-reference, accounting, and customer-service records are kept for the applicable statutory period and as needed for legal claims.
Encrypted medical-form answers are automatically deleted 30 days after the scheduled trip ends. If a documented safety incident, legal obligation, or claim requires specific information to be retained longer, access remains restricted and it is deleted when that need ends. We may keep non-medical audit information, such as when a form was requested or completed, without retaining the health answers. We delete or anonymize other information when it is no longer needed for the purpose for which it was collected.
We use reasonable technical and organizational measures to protect personal information, including short-lived email verification codes for Booking Portal access and separate encrypted storage for medical answers, but no website, email system, or online service can be guaranteed completely secure. If you believe someone has accessed your booking without permission, contact us.
Under EEA data-protection law, you may request access, correction, erasure, restriction, or portability where applicable. You may object to processing based on legitimate interests and may object to direct marketing at any time. Where processing relies on consent, you may withdraw it at any time. These rights can be subject to legal conditions and exceptions.
Send a request to adventures@norse.is. We may need to verify your identity and will normally respond within one month. You also have the right to lodge a complaint with the Icelandic Data Protection Authority, Persónuvernd.
Newsletter
New departures, field notes from Iceland, and practical planning ideas from the Norse Adventures team.