Privacy policy

Privacy Policy - Visit Iceland

We handle personal data with care, use it for clear purposes and make sure you understand how and why.

This policy covers Business Iceland’s (Visit Iceland´s) services, projects and external communications, but not recruitment or employee matters.

Business Iceland (Íslandsstofa), registration no. 690986-1599, Kristínargata 1, 102 Reykjavík, Iceland, is the controller of the personal data processing described here. The processing is governed by Act No. 90/2018 on Data Protection and the Processing of Personal Data and the EU General Data Protection Regulation (GDPR).

What information do we process and why?

We only process information needed for our activities, primarily names, job titles, workplaces, email addresses, telephone numbers and mailing-list subscriptions. We also record enquiries, services provided, communications and participation in projects and events. Electronic communications may generate information about IP addresses, email opens and link clicks, where permitted.

We use this information to provide services, manage partnerships and events, follow up on communications, understand needs and markets, develop services and assess the results of our activities.

Surveys

We conduct surveys among businesses, partners and consumers. Surveys may be anonymous or identifiable. We may record who has responded in order to send reminders. We inform participants about the purpose of each survey, whether responses can be traced to individuals and how the results will be used.

Where do we obtain the information?

We usually receive information directly from you, for example when you make an enquiry, register for an event or mailing list, or participate in a project or survey.

We also obtain contact details from businesses, partners, registration systems and publicly available sources, such as company websites.

What is our legal basis for processing?

The legal basis depends on the purpose of the processing.

Processing contact details and information about communications, services and partnerships is based, among other grounds, on Business Iceland’s legitimate interests in carrying out its activities, developing services and evaluating results. Processing may also be based on a contract, a legal obligation or consent.

Marketing emails are based on consent or another legal basis under the laws governing electronic communications.

Emails and newsletters

We send newsletters, event information and other marketing material when you have requested it or another legal basis permits us to do so. You can unsubscribe using the link in an email or by contacting us.

We may still send essential messages concerning enquiries, services and participation even if you have unsubscribed from marketing emails.

We may measure email opens and link clicks to improve our communications. Where consent is required, we only do so with your consent, which you may refuse or withdraw.

Business Iceland websites

When you visit our websites, including Visit Iceland, information such as your IP address, device and browser details, and website usage may be recorded.

We use cookies to ensure our websites function and, with your consent, for analytics and marketing. You can change your choices in the cookie settings.

Who can access the information?

Our staff only have access to information they need for their work. Our service providers may process information on our behalf, including for IT, hosting, contact management, email, events and surveys. We require appropriate security and data processing agreements in accordance with data protection rules.

We may share information with partners for projects or events where permitted, and inform you about such sharing at registration where applicable. We provide information to public authorities when required by law.

How long do we retain the information?

We retain information for as long as needed for the purpose of processing or to meet legal obligations. We consider, among other things, whether communications or projects are ongoing, whether the person remains a contact, and whether follow-up or the establishment, exercise or defence of legal claims requires retention.

Information about services and participation may be retained longer to analyse trends and results, where permitted. We use anonymised data whenever possible.

How do we protect the information?

We take appropriate measures to protect information against unauthorised access, alteration, loss and other unlawful processing.

Transfers of information outside the EEA

We aim to process and host information within the European Economic Area (EEA). However, service providers may process it outside the EEA or access it from there. In such cases, we ensure there is a lawful basis for the transfer and appropriate safeguards.

Your rights

You may request information about the processing of your personal data and access to it, and, where applicable, rectification, erasure, restriction of processing or provision of data in electronic form.

You may object to processing based on legitimate interests and may always object to direct marketing. You may withdraw your consent at any time.

These rights may be subject to conditions and exceptions under data protection law.

How can you contact us?

If you have questions about the processing of personal data or wish to exercise your rights, email islandsstofa@islandsstofa.is with “Data Protection” in the subject line. You may also call +354 511 4000 or write to Business Iceland, Kristínargata 1, 102 Reykjavík, Iceland.

We normally respond within one month and will let you know if the law permits a longer response period.

You may also lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd) at www.personuvernd.is.

Changes to this policy

The current version of this policy is published on the Business Iceland website and reviewed as needed.

Approved by the Board of Business Iceland on 22 October 2026.