Hostel Fjördur, Suðurgata 18, 220 Hafnarfjörður, is the data controller for the information described here. This policy is written to meet the EU General Data Protection Regulation (GDPR) as implemented in Iceland.
What we collect
- When you book: your name, email address, phone number, country, dates of stay, number of guests, room selection, any special requests, and payment status.
- When you contact us: your name, email, phone number and the content of your message.
- When you leave a review: the name and country you choose to display, your ratings and your review text.
- Automatically: a session cookie that keeps you signed in to your booking and remembers your language choice. We do not run advertising or third-party tracking cookies.
Why we collect it
- To perform our contract with you — taking your booking, sending your confirmation and door code, and having you stay with us.
- To comply with the law — Icelandic accommodation providers must keep certain guest records, and tax law requires us to keep transaction records for seven years.
- For our legitimate interests — preventing fraudulent bookings, and improving the site.
Who we share it with
Only where necessary: our payment processor, our email delivery provider, and our hosting provider. We do not sell your data and we do not share it for marketing purposes. If you booked through a third-party platform, that platform is a separate data controller with its own policy.
How long we keep it
- Booking and transaction records: seven years, as required by Icelandic tax law.
- Contact and group enquiries: two years.
- Published reviews: until you ask us to remove them.
- Server logs: 90 days.
Your rights
You have the right to access the data we hold about you, to have it corrected, to have it deleted where we are not legally required to keep it, to restrict or object to processing, and to receive your data in a portable format. Email info@hostelfjordur.is and we will respond within 30 days.
If you are not satisfied with our response you may complain to the Icelandic Data Protection Authority (Persónuvernd), personuvernd.is.
Security
The site is served over HTTPS, passwords are stored hashed, and access to guest data is limited to staff who need it to do their job.