Privacy Policy

QR Travel (kt. 420126-0260), Suðurlandsbraut 10, 108 Reykjavík, Iceland, runs qrtravel.is and is the controller of the personal data described here. Questions or requests about your data: qrtravel@qrtravel.is.

We sell tours and activities run by independent Icelandic tour operators. When you book, the operator running your tour also receives your booking details and is responsible for how they use them.

• Booking details: your name, email, phone number, nationality, pickup location and any answers the operator asks for (for example dietary needs). We use them to make and manage your booking and to send it to the tour operator. Legal basis: performance of a contract (GDPR art. 6(1)(b)).
• Payment: card payments are handled by our payment provider, Straumur. We never see or store your card number; we keep the amount, status and a payment reference. Legal basis: contract, and our legal obligation to keep accounting records (art. 6(1)(c)).
• Messages to us: when you email us we use your message to answer you. Legal basis: our legitimate interest in helping customers (art. 6(1)(f)).
• Chat assistant (Björk): what you type is sent to our AI provider to write a reply. We don't store chat conversations on our servers; the chat history is kept only in your browser. Please don't share sensitive information in the chat.
• Usage and analytics: which pages are visited and how the site performs. Plausible Analytics is cookie-free and doesn't identify you. Google Analytics and Google Ads only set cookies if you accept them (see Cookies below). Legal basis: consent for Google; legitimate interest for cookie-free statistics.
• Errors: when something breaks we record technical details (browser, page, error) and, for a small share of visits, a replay of the session with all text and form inputs masked, so we can fix the problem. Legal basis: legitimate interest.

We share personal data only as needed to run the site and your booking:

• Tour operators: the operator running your tour receives your booking details.
• Bókun (booking system) and Straumur (card payments), both in Iceland.
• Supabase (database, hosted in the EU) and Vercel (website hosting).
• Google (Analytics and Ads, only with your consent; also the optional page translation).
• Plausible (cookie-free statistics, EU) and Sentry (error monitoring).
• Anthropic (the AI behind the chat assistant) and Resend (sending our emails).

Some of these providers are based in the United States. Where data leaves the European Economic Area, it is protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. We never sell your personal data.

• Booking and payment records: 7 years, as required by Icelandic accounting law (lög um bókhald nr. 145/1994).
• Emails with customers: up to 2 years after the matter is closed.
• Analytics data: Google Analytics keeps it for up to 14 months.

Always on (needed for the site to work): your currency and language choice, wishlist, recently viewed tours, and the payment reference used to confirm your booking after payment. If you book, your contact details are saved in your own browser to fill in the form next time.

Partner referrals: if you arrive through a link from one of our partners, a cookie (qrt_ref) remembers the partner for up to 90 days so we can pay them a commission if you book.

Only with your consent: Google Analytics and Google Ads cookies, used to measure visits and bookings from our ads. Until you accept, Google receives only cookie-free signals.

You can change your choice at any time: cookie settings.

Under the GDPR (Icelandic Act no. 90/2018) you can ask us for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. Where we rely on your consent, you can withdraw it at any time. Email qrtravel@qrtravel.is and we'll reply within one month.

You can also complain to the Icelandic Data Protection Authority, Persónuvernd (personuvernd.is).

If we change this policy we'll update the date at the top. See also our Terms & Conditions.