Effective date: September 17, 2026
This Privacy Policy explains how All Things Iceland ehf. (“All Things Iceland,” “we,” “us,” or “our”) collects, uses, stores and shares personal information when you:
- Visit an All Things Iceland website
- Purchase or access the Iceland Itinerary Blueprint or another digital product
- Download a free resource
- Subscribe to an email list
- Submit a contact form, survey or testimonial
- Communicate with us
- Otherwise use our products or services
1. Data controller
The data controller responsible for your personal information is:
All Things Iceland ehf.
Reykjavík, Iceland
Registration number: 550321-1300
Email: [email protected]
Questions or requests concerning your personal information may be sent to the email address above.
2. Personal information we collect
The information we collect depends on how you interact with All Things Iceland.
Information you provide directly
We may collect:
- First and last name
- Email address
- Country or location
- Billing information
- Customer type, such as individual or company
- Company information, if provided
- Purchase and transaction details
- Workshop or account login information
- Survey answers and feedback
- Testimonials, when submitted
- Messages, support requests and other correspondence
- Travel interests or planning information you choose to provide
- Marketing and communication preferences
Please do not submit sensitive personal information that is unnecessary for us to provide the requested product or service.
Payment information
Payments may be processed by third-party payment providers such as PayPal.
All Things Iceland ehf. does not directly receive or store your complete payment-card details, PayPal password or other full payment credentials. Payment providers process that information under their own privacy policies.
We may receive transaction information such as:
- Your name and email address
- The amount and currency paid
- Payment status
- Transaction identifier
- Purchase date
- Refund or dispute information
- Limited billing information supplied by the payment provider
Information collected automatically
When you visit our website, sales pages or digital-product platform, we and our service providers may automatically collect information such as:
- IP address
- Browser and device type
- Operating system
- Approximate location derived from your IP address
- Referring website or link
- Pages viewed
- Date and time of visits
- Links clicked
- Email opens and clicks
- Cookie and similar technology identifiers
- Website, checkout and course-use information
- Technical error and security information
Where required, non-essential cookies and similar technologies will be used only after obtaining appropriate consent.
3. How we use personal information
We may use personal information to:
- Process purchases and payments
- Create and administer customer accounts
- Deliver the Iceland Itinerary Blueprint and other products
- Provide workshop access and downloadable materials
- Send receipts, access instructions and service communications
- Respond to questions and support requests
- Confirm whether a customer has received the purchased content
- Maintain records of transactions, consent and customer access
- Operate and improve our website, products and services
- Understand how visitors and customers interact with our content
- Diagnose technical problems and protect against fraud or misuse
- Manage customer tags, segments and email sequences
- Deliver requested free resources
- Send marketing communications where legally permitted
- Personalize communications based on the resource requested, product purchased or general travel-planning interests
- Request feedback and testimonials
- Comply with accounting, tax, consumer-protection and legal obligations
- Establish, exercise or defend legal claims
4. Legal bases for processing
Where the General Data Protection Regulation and Icelandic data-protection law apply, we process personal information under one or more of the following legal bases.
Performance of a contract
We process information when necessary to:
- Process and administer your purchase
- Supply the Blueprint or another product
- Provide account access
- Send essential service communications
- Respond to requests relating to your purchase
Consent
We may rely on your consent to:
- Send certain marketing communications
- Use non-essential cookies
- Publish an identifiable testimonial, photograph or other customer content
- Process information for another purpose clearly explained when consent is requested
You may withdraw your consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
Legitimate interests
We may process information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.
These interests may include:
- Operating and improving our business
- Understanding customer engagement
- Protecting our website and products
- Preventing fraud and account sharing
- Maintaining appropriate business records
- Responding to inquiries
- Sending relevant communications to existing customers where permitted
- Measuring the effectiveness of content and marketing
You may object to processing based on legitimate interests in certain circumstances.
Legal obligations
We process and retain information where necessary to comply with applicable laws, including tax, accounting, consumer-protection and regulatory requirements.
Legal claims
We may process information where necessary to establish, exercise or defend legal claims.
5. Email communications
Transactional and service emails
If you purchase a product, we may send emails necessary to:
- Confirm the transaction
- Provide access instructions
- Support your account
- Notify you of material changes affecting the product
- Respond to service questions
- Communicate information necessary to perform our agreement with you
These emails are not marketing emails, and you may continue receiving them even if you unsubscribe from promotional messages.
Marketing emails
We may send newsletters, travel guidance, product information and promotional offers when:
- You have given consent;
- You are an existing customer and the communication is permitted by applicable law; or
- Another lawful basis applies.
Every marketing email will provide a way to unsubscribe. You may also unsubscribe by emailing [email protected].
Unsubscribing from one list may not automatically remove you from every independently subscribed list, but you may ask us to stop all marketing communications.
We may retain limited information on a suppression list to ensure that your unsubscribe request continues to be honored.
6. Customer tags, segmentation and automation
We may use customer tags and automated email sequences to organize communications based on actions such as:
- Requesting the Ultimate Iceland Packing Checklist
- Requesting the Iceland Discount Code Bundle
- Joining a workshop waitlist
- Purchasing the Iceland Itinerary Blueprint
- Clicking or opening certain communications
- Expressing an interest in a particular Iceland travel topic
This helps us send more relevant information and avoid sending inappropriate sales emails to people who have already purchased a product.
We do not use this information to make decisions that produce legal or similarly significant effects about you without appropriate safeguards.
7. Feedback, surveys and testimonials
We may invite customers to complete surveys or provide feedback. Participation is voluntary.
Survey answers may be used to:
- Evaluate and improve the Blueprint
- Understand customer needs
- Develop future products or content
- Address customer concerns
- Create aggregated or anonymized insights
We will not publicly identify you in a testimonial without an appropriate legal basis, such as your permission.
If you authorize us to publish a testimonial, we will use only the name, image, business information or other identifying details covered by that authorization. You may withdraw permission for future use by contacting us, although withdrawal may not affect materials already lawfully published or distributed.
8. Cookies and similar technologies
Our websites and service providers may use cookies, pixels and similar technologies to:
- Keep websites and checkout pages functioning
- Remember preferences
- Maintain account sessions
- Prevent fraud and improve security
- Measure website and email performance
- Understand how visitors arrive at and use our pages
- Support marketing and social-media features
Essential cookies may be used where necessary to provide the website, checkout or customer account.
Analytics, advertising or other non-essential cookies will be handled in accordance with applicable consent requirements.
You can control cookies through the cookie banner, where available, and through your browser settings. Blocking essential cookies may prevent parts of the website, checkout or course platform from working correctly.
9. Service providers and other recipients
We may share personal information with service providers that help us operate our business, including providers of:
- Website hosting
- Course and digital-product hosting
- Checkout and funnel services
- Payment processing
- Email delivery and marketing automation
- Customer support
- Analytics and website performance
- Survey and form services
- Cloud storage
- Accounting, tax and professional advice
- Fraud prevention and information security
Known providers may include Systeme.io and PayPal. Each provider may process information according to its own privacy documentation and its role under applicable data-protection law.
We share only the information reasonably necessary for the provider to perform its services.
We may also disclose information:
- When required by law, regulation, court order or competent authority
- To establish, exercise or defend legal claims
- To protect customers, our business or others from fraud, security threats or unlawful activity
- In connection with a merger, restructuring, sale or transfer of all or part of the business, subject to appropriate protections
We do not sell personal information.
10. Affiliate links and third-party websites
Our websites, emails and products may contain links to third-party websites, booking services, tourism businesses or affiliate partners.
When you follow a third-party link, that organization may collect information under its own privacy policy. All Things Iceland ehf. does not control and is not responsible for the privacy practices of third-party websites.
Some links may be affiliate links. If you complete a purchase through an affiliate link, we may receive information confirming that a qualifying transaction occurred and may earn compensation at no additional cost to you.
11. International data transfers
Some service providers may process personal information outside Iceland or the European Economic Area.
Where required, international transfers will use an approved legal mechanism, which may include:
- An adequacy decision
- Standard contractual clauses
- Another transfer mechanism permitted by applicable law
Additional safeguards may be used where appropriate.
You may contact us for more information about the safeguards relevant to your personal information.
12. Data retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to satisfy legal, accounting, tax, security and dispute-resolution requirements.
Retention periods may vary depending on the information and relationship.
In general:
- Purchase and accounting records may be retained for the period required by Icelandic tax, accounting and business laws.
- Customer-account information may be retained while the account or purchased access remains active.
- Support correspondence may be retained for a reasonable period after the issue is resolved.
- Marketing information may be retained until you unsubscribe, withdraw consent or object, subject to retaining limited suppression information.
- Consent records may be retained to demonstrate compliance.
- Analytics information may be retained according to the applicable provider settings and our legitimate operational needs.
- Information relevant to disputes or legal claims may be retained until the applicable matter and limitation periods have ended.
When personal information is no longer required, we will delete, anonymize or securely dispose of it where reasonably possible.
13. Data security
We use reasonable technical and organizational measures intended to protect personal information against:
- Unauthorized access
- Accidental loss
- Misuse
- Alteration
- Disclosure
- Destruction
These measures may include access controls, password protection, reputable service providers and limiting access to people who need the information for legitimate business purposes.
No internet transmission or storage system can be guaranteed to be completely secure. You are responsible for protecting your account credentials and should contact us if you believe your account or information has been compromised.
14. Your data-protection rights
Depending on applicable law and the circumstances, you may have the right to:
- Request confirmation of whether we process your personal information
- Request access to your personal information
- Request correction of inaccurate or incomplete information
- Request deletion of your information
- Request restriction of processing
- Object to certain processing
- Object to direct marketing at any time
- Request data portability
- Withdraw consent
- Request information about international-transfer safeguards
- Lodge a complaint with a data-protection authority
- Receive safeguards relating to certain automated decisions
These rights are not absolute. A request may be limited where we have a lawful reason or obligation to retain or continue processing information.
To exercise a right, email [email protected]. Please describe your request and identify the email address associated with your account or purchase.
We may request reasonable information to confirm your identity before fulfilling a request. We will respond within the period required by applicable law.
15. Complaints
Please contact us first if you have a question or concern about how your personal information has been handled:
You also have the right to lodge a complaint with the Icelandic Data Protection Authority:
Persónuvernd
Website: https://www.personuvernd.is
If you live in another EEA country, you may also be entitled to contact the data-protection authority in your country of residence.
16. Children’s privacy
Our websites, travel-planning resources and paid products are not directed to children.
We do not knowingly collect personal information from children in circumstances requiring parental or guardian consent without obtaining appropriate authorization.
If you believe that a child has provided personal information improperly, contact [email protected] so we can review and, where appropriate, delete it.
17. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in:
- Our products or business operations
- The service providers we use
- Technology
- Legal or regulatory requirements
The updated version will be posted with a revised effective date.
Where a change materially affects how we use existing personal information, we will provide additional notice or request consent where required.
18. Contact information
For questions, concerns or requests relating to this Privacy Policy or your personal information, contact:
All Things Iceland ehf.
Reykjavík, Iceland
Registration number: 550321-1300
Email: [email protected]
