+354 832 5000 Explore Tours

Privacy Policy

What we collect, why, and who else sees it

Last updated: 29 September 2026

This page explains what personal information Tours with Thor collects through this website, why we collect it, who else receives it, and how long we keep it.

1. Who is responsible for your information

Tours with Thor is run by Thorlakur Helgason, a sole trader based in Reykjavík, Iceland. He is the data controller for this website.

Iceland is part of the European Economic Area, so this site is run under the EU General Data Protection Regulation as it applies in Iceland through the Data Protection Act No. 90/2018.

This website was built and is maintained for us by WebCentersUSA.

2. What you send us through the forms

We only ever receive what you choose to type into a form. There are four on this site.

Contact form

Your name, your email address, and your message.

Tour booking request

Your name, email address and phone number, the size of your group, which tour you want and on what dates, your pickup and dropoff locations, and any message you add. The pickup location is usually your hotel or guesthouse, so please give us only what we need in order to collect you.

Gallery photo submission

The photo file you upload, plus your name, email address and which tour you were on. Photographs often carry hidden information added by the camera or phone that took them, which can include the date and the GPS position where the picture was taken. We do not read or use that information, but it travels inside the file, so please only send photos you are happy to hand over.

Gallery testimonial

Your testimonial text, your name, your email address and which tour you were on.

3. Photos and testimonials are published

Photos and testimonials are sent to us so that they can appear on this website, next to the name you give us. Sending one is how you give us permission to publish it. Please do not send a photograph of someone who has not agreed to appear on a public website.

Changed your mind? Email info@ToursWithThor.com and we will take it down.

4. Why we are allowed to use it

Under the GDPR we have to name a lawful basis for each use:

  • Answering an enquiry or arranging a tour — we need your information to take the steps you have asked for, and then to carry out the tour.
  • Publishing a photo or testimonial — your consent, given by sending it. You can withdraw it at any time.
  • Checking submissions for spam — our legitimate interest in keeping automated junk out of our mailbox without losing a genuine message.
  • Keeping a record of enquiries, and understanding how the site is used — our legitimate interest in running the business, being able to show what was agreed, and improving the website.

5. Information collected automatically

Google Analytics

This site uses Google Analytics 4 to count visits and see which pages people read. It sets cookies in your browser and sends Google your IP address, your rough location (usually which town), your browser and device, and which pages you looked at. We also record the fact that a form was successfully sent, as a number — that record holds no name, email address, phone number or message text.

Google describes its own handling of this in Google's Privacy Policy. You can stop Google Analytics collecting your visit with Google's opt-out browser add-on, or by blocking cookies as described in section 8.

The map on our home page

Our home page shows a Google Maps window. It loads directly from Google when the page opens, which means Google receives your IP address and may set its own cookies, exactly as if you had opened Google Maps yourself.

Both of these load as soon as you open the page. We do not show a cookie banner asking first. If you would rather they did not run, block cookies or use the opt-out linked above before browsing.

Fonts and other page files

Everything else the page needs — the typefaces, images, styles and scripts — is served from this website itself. No other company sees your visit because of them.

Cookies this site sets

This site also sets two small cookies of its own on every visit: tours-with-thor-session, a session cookie that lets the site tell one visit apart from the next while you move between pages, and XSRF-TOKEN, a security cookie the forms on this site use to check that a submission really came from this site. Both are created by the software the site runs on, hold a random code rather than anything about you, are sent only to this website, and expire 120 minutes after your last page view. If you block them, every page still reads normally, but the forms will not send.

Server logs

Our web host keeps ordinary access logs, which include IP addresses and the pages requested. These are standard hosting records used for security and troubleshooting.

6. Who else receives what you send

A form submission on this site is first checked for spam (see below), then goes to three places:

  1. Our mailbox. The message is emailed to us at info@ToursWithThor.com, on our own domain. Photo submissions arrive as an attachment.
  2. WebCentersUSA. WebCentersUSA built and maintains this website, and receives a blind copy of every submission — including any attached photo. They hold this copy as an independent record so that a message which never reaches our mailbox can still be found and answered. They use it for nothing else and pass it to nobody.
  3. This website's server. A one-line record of each submission is written to a log file on the server, described in section 7.

Spam checking

Before a submission is delivered, it is checked by CleanTalk, an anti-spam service run by CleanTalk Inc. The check sends CleanTalk the email address, name and IP address of the sender and the text of the message — for a booking, the tour and the pickup and dropoff locations too; for a photo, only the tour name. A photo itself is never sent. CleanTalk answers whether the submission looks like spam, and keeps what it receives for a short period under its own privacy policy at cleantalk.org/privacy.

A submission CleanTalk flags as spam is not delivered to our mailbox. A copy marked as caught goes to WebCentersUSA's archive instead, so a genuine message caught by mistake can still be found and answered. If you sent us something and heard nothing back, email info@ToursWithThor.com and we will look for it.

The companies that handle information on our behalf are:

  • 20i — web hosting and our email, in the United Kingdom.
  • WebCentersUSA — website maintenance and the backup copy above, in the United States.
  • Google — analytics and the map, in the United States.
  • CleanTalk — spam checking of form submissions, in the United States.

Because three of those are outside the European Economic Area, your information is transferred out of the EEA. Those transfers rely on the European Commission's standard contractual clauses, or on the EU–US Data Privacy Framework where the company takes part in it.

Apart from that, we share your information only where the law requires it, or where it is needed to protect someone's safety or our legal rights. We do not sell it, and we do not give it to advertisers.

7. How long we keep it

  • The submission log on the server — 365 days. Older entries are deleted automatically.
  • Emails in our mailbox, and the WebCentersUSA copy — kept while they are useful for answering you and for our records of tours booked, then deleted.
  • Published photos and testimonials — kept on the site until you ask us to remove them.
  • Google Analytics — kept for the retention period set in our Analytics account. This data is grouped together and is not used to identify you.

8. Your rights

You can ask us to:

  • send you a copy of the personal information we hold about you;
  • correct it if it is wrong;
  • delete it;
  • stop or limit how we use it, or object to a use based on our legitimate interest;
  • send it to you, or to someone else, in a portable form;
  • withdraw consent for a published photo or testimonial.

Email info@ToursWithThor.com and we will answer within one month. There is no charge.

If you are unhappy with how we have handled your information, you can complain to Iceland's data protection authority, Persónuvernd, or to the authority in the EEA country where you live.

Cookies. Every browser can block or delete cookies in its settings. Blocking them stops Google Analytics recognising your visit and stops the map loading. It also stops the forms sending, because they rely on the security cookie described in section 5. Every other page reads normally.

9. Children

This site is aimed at adults booking tours, and we do not knowingly collect information about children. If you believe a child has sent us something, email info@ToursWithThor.com and we will delete it.

10. Changes to this policy

If we change what we collect or how we use it, we will update this page and change the date at the top.

11. Contact us

Thorlakur Helgason — Tours with Thor
Reykjavík, Iceland
Email: info@ToursWithThor.com
Phone: +354 832 5000

See also our Terms of Service.