Privacy Policy
Last updated: 3 September 2026
Aurora Experts is a subsidiary of Ultimate Iceland ehf., an Icelandic tour operator. This policy explains what personal data we collect when you book a tour or use our website at auroraexperts.is, why we collect it, who we share it with, and what rights you have over it.
We are the data controller for the information described here. If you have any question about this policy, or want to exercise any of the rights set out below, email us at hello@auroraexperts.is.
What we collect
When you book a tour, we collect your name, email address, phone number, the number of people in your party, your pickup location, and any information you give us about your booking — for example if you need a booster seat, or if you tell us about a medical condition relevant to the tour.
If you write to us through the contact form on our website, we collect your name, email address, phone number, the subject you choose and the message you send. You do not need to have booked a tour to use it. Legal basis: our legitimate interests in responding to enquiries.
We do not store your card details. Payments are processed by our payment provider, and card information goes directly to them.
When you visit our website, we collect standard technical information: the pages you visit, the type of device and browser you used, and where you arrived from. This is collected through cookies and similar technologies. Most of it does not identify you personally.
We do not operate user accounts. There is no registration, no username and no password — booking a tour does not create a profile.
Why we collect it, and our legal basis
•
To deliver the tour you booked — contacting you about pickup, confirming or cancelling on the day, and running the tour safely. Legal basis: performance of a contract.
•
To meet our legal and accounting obligations — keeping records of transactions as Icelandic law requires. Legal basis: legal obligation.
•
To improve the website — understanding how visitors use it. Legal basis: legitimate interests, or your consent where cookies require it.
•
To send you marketing, if you have asked to receive it. Legal basis: consent, which you can withdraw at any time.
•
To answer enquiries sent through our contact form. Legal basis: legitimate interests in responding to enquiries.
Who we share it with
We do not sell or rent your personal data.
We share it with the service providers we need in order to operate:
•
Our booking system, which stores your booking and contact details.
•
Booking platforms — if you booked through Viator, GetYourGuide, Airbnb or another reseller, that platform shares your booking details with us and holds its own copy under its own privacy policy.
•
Our payment provider, which processes your payment.
•
Email and messaging providers, used to send booking confirmations and tour status notifications.
•
Website analytics, in aggregated form.
We may also disclose personal data where we are legally required to, or where it is necessary to protect the rights, property or safety of our customers, our staff or the public.
Some of these providers operate outside the European Economic Area. Where that is the case, transfers are made under safeguards recognised by the GDPR, such as the European Commission’s standard contractual clauses.
How long we keep it
We keep booking records for as long as needed to deliver the service and to meet our legal and accounting obligations — in Iceland, financial records are generally retained for seven years.
Because our free Re-Try Tour is valid for four years from the date of the original tour, we keep the booking details needed to honour it for at least that period.
Messages sent through our contact form are kept only for as long as it takes to answer the enquiry, and are not retained afterwards.
Marketing contacts are kept until you unsubscribe.
Your rights
Under the GDPR you have the right to:
•
access the personal data we hold about you
•
correct anything inaccurate
•
request erasure, where we are not required to keep it
•
restrict or object to how we process it
•
receive a copy of the data you gave us, in a portable format
•
withdraw consent at any time, where processing is based on consent
•
complain to the Icelandic Data Protection Authority (Persónuvernd) if you believe we have handled your data improperly
To exercise any of these, email hello@auroraexperts.is. We will respond within one month.
Marketing
If you have opted in to hear from us, every marketing email includes an unsubscribe link. You can also ask us to remove you by email. We will still send you administrative messages about a booking you have made — confirmations, pickup details and tour status notices are not marketing.
Cookies
We use cookies to keep the site working, to remember your preferences and to understand how the site is used. You can control or delete cookies through your browser settings, though some parts of the site may not work correctly without them.
Children
Our tours are not sold to children directly, and our website is not directed at children. We do not knowingly collect personal data from anyone under 13. If you believe we have, contact us at hello@auroraexperts.is and we will delete it.
Bookings for children are made by a parent or guardian, who provides the child’s details as part of the booking.
Security
We take reasonable technical and organisational measures to protect your data, including encrypted connections and restricted access. No system is completely secure, and we cannot guarantee absolute security, but we take the protection of your information seriously and will notify you and the relevant authority if a breach occurs that is likely to affect your rights.
Changes to this policy
We may update this policy from time to time. Significant changes will be posted on this page with a revised date at the top. We encourage you to check back periodically.
Contact
Questions about this policy, or about the data we hold on you: hello@auroraexperts.is