Privacy policy
Last updated
MudShark ehf. runs this website and is responsible for the personal data it receives. This page sets out what that data is, what it is used for, who receives it, how long it is kept, and what rights you have.
1.Who is responsible
MudShark ehf., reg. no. 440214-0530, Freyvangur 22, 850 Hella, Iceland. Email: mudshark@mudshark.is. Phone: +354 691 1849.
The company is small and is not required to appoint a data protection officer. Magnús H. Jóhannsson handles every privacy request himself.
2.The contact form
When you send a message from the About page, we receive your name, your email address and the message. It reaches MudShark as an email and is not saved in the website's database. We use it only to reply to you.
Magnús deletes the email 90 days after the last reply. If it leads to a booking, the section on how long data is kept applies.
Legal basis: steps taken at your request before a contract (GDPR Article 6(1)(b)).
3.Bookings
When a tour is booked we record your name, email, phone, the tour, the date, the number of guests and the payments, and where you are staying and any notes if you give them. We need this to run the tour, pick you up and issue an invoice. Bookings made by phone or email are recorded the same way.
Your name, email and phone number are required to book on the website. Without them we can neither confirm the booking nor reach you before the tour. Where you are staying and notes are optional.
We use notes only to plan the tour. We need no information about anyone's health, so please leave it out of them.
There is no newsletter. Apart from Magnús writing to you about the tour itself, these are the only emails we send to your address:
- a confirmation once a booking has been paid by card, on the website or through a payment link
- a secure payment link, if you book by email or phone or send a booking request
- a reminder the day before the tour
- one email after the tour asking you to write a public review of it on Tripadvisor or Google
- an acknowledgement of a booking request, if you send a request instead of paying on the website
- a refund notice, if a payment arrives too late for the booking to be confirmed
If you pay by card, on the website or through a payment link we send you, the payment is made through Teya. Teya receives the card details; we receive only whether the payment succeeded, the amount and the payment's reference numbers, which are kept with the booking. We never store card numbers.
Legal basis: the contract for the tour (Article 6(1)(b)) and a legal obligation (Article 6(1)(c)). The review request rests on our legitimate interest (Article 6(1)(f)): we want to hear how the tour went, and public reviews help other travellers find us.
You can object to the review request at any time (GDPR Article 21). Reply to any email from us, or write to mudshark@mudshark.is, and we will not send it. Your booking and the reminder before the tour are not affected.
Each booking attempt records a hash computed from your IP address. It lets us limit the number of attempts, so that no one can hold every free date at once. The IP address itself is not saved, and the hash is deleted after one day. Legal basis: our legitimate interest in protecting the booking system from abuse (Article 6(1)(f)).
4.Visitor statistics
The site counts visits on its own server. For each page view it records the address of the page, the language, the country the visit came from and the site that linked to it. Your IP address itself is never saved in these records, and nothing is stored on your device.
To tell visitors apart on the same day, a one-way hash is computed from the IP address, the browser, the date and a secret key. The key is not kept in the database, and it does not change. Because the date is part of the hash, the same visitor gets a new value every day. Without the key, the values of different days cannot be linked. Whoever holds the key and already knows a visitor's IP address and browser can, however, compute that visitor's value for any day.
Records are deleted after 24 months. Legal basis: our legitimate interest in knowing how the site is used (Article 6(1)(f)).
6.How long data is kept
In the website's database, data is kept for the periods below. It is then deleted automatically.
- Bookings, with the guest's name and email, the amounts, payments and refunds: seven years from the date of booking. The Icelandic Bookkeeping Act (no. 145/1994) requires us to keep accounting records.
- Phone number, where you are staying and notes: 90 days after the tour, when the link to your booking's page also stops working. If a refund on the booking is still owed or unresolved, they are kept until it is settled.
- Bookings that were never completed and where no payment went through: 30 days from when they were started. If a payment went through, or it is uncertain whether one did, the seven-year rule above applies.
- Payment notifications from Teya: 24 months.
- Hashes from booking attempts: one day.
- Visitor statistics: 24 months.
- Records of cookie consent: four years.
Messages from the contact form never reach the database. The section on the contact form above applies to them.
Magnús deletes emails about bookings and enquiries from MudShark's mailbox 90 days after the tour or the last reply, whichever is later. Invoices are kept with the accounts.
7.Who receives the data
These companies process the data for us:
- Datatech ehf. (Vefapp), reg. no. 420115-0240, builds and runs the website, and has access to the data to do so.
- Vercel Inc. hosts the website. The servers that run it are in Frankfurt, and each request passes through whichever server in Vercel's global network is nearest to you.
- Supabase Pte. Ltd. (Singapore) runs the database together with Supabase, Inc. (United States). The database is hosted in Frankfurt, and data may be transferred to Singapore and the United States under the European Commission's standard contractual clauses.
- Resend Inc. sends the website's emails and stores the email data in the United States.
- Google (Google Workspace) hosts MudShark's email. Enquiries and bookings arrive there and are kept there.
Vercel, Resend and Google are US companies and may process the data in the United States. Such transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. You can get a copy of the clauses by writing to us.
Vercel, Supabase and Resend keep technical logs, such as IP addresses, the pages requested and whether an email was delivered. The logs are kept for a limited time.
Card payments on the website, including through a payment link, go through Teya Iceland hf., a card acquirer licensed in the European Economic Area. Teya processes payment data as an independent controller, under the card schemes' rules and payment services law. When Teya's payment form opens, Teya receives your name, email and phone number, the booking reference, the tour, its departure time, the amount and a link back to your booking's page. You then type your card details straight into that form. See Teya's privacy notice.
Our bookkeeper receives the sales records from bookings to keep the accounts: the guest's name, the booking reference, the tour and its departure time, the amounts and Teya's transaction numbers.
We do not sell personal data and share it only with the recipients above, or where the law requires it.
8.Your rights
You have the right to:
- know what data we hold about you and get a copy of it
- have wrong data corrected
- have data deleted, unless the law requires us to keep it
- object to processing based on legitimate interest, or have it restricted
- receive the data you gave us in a machine-readable format
- withdraw consent at any time
We make no decisions about you based solely on automated processing.
Send your request to mudshark@mudshark.is. We reply within one month.
You can also complain to the Icelandic Data Protection Authority (Persónuvernd), personuvernd.is, email postur@personuvernd.is.
9.Changes
If this policy changes, the new version is published here and the date at the top of the page is updated.