MyIceland Data Processing Agreement

1. Background and roles

1.1 The Operator uses the MyIceland customer self-service portal (the “Service”) to let its customers view, manage, and modify their tour bookings, and to browse and select additional tours. The Service is provided under MyIceland’s subscription terms (the “Main Agreement”), of which this DPA forms part.

1.2 In providing the Service, MyIceland processes personal data relating to the Operator’s customers on the Operator’s behalf.

1.3 For the purposes of Applicable Data Protection Law, the Operator is the controller and MyIceland is the processor in respect of the personal data described in Annex 1. This DPA governs that processing.

1.4 The Operator may itself be a processor or joint controller in relation to a party further upstream; nothing here alters the Operator’s own obligations to its customers as controller.

2. Definitions

2.1 “Applicable Data Protection Law” means Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) as it applies in the European Economic Area and, in Iceland, the Act on Data Protection and the Processing of Personal Data No. 90/2018 (lög nr. 90/2018), together with any other data protection law applicable to the processing.

2.2 “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, “Personal Data Breach”, and “Supervisory Authority” have the meanings given in the GDPR.

2.3 “Sub-processor” means any third party engaged by MyIceland to process Personal Data on the Operator’s behalf in connection with the Service.

2.4 “Persónuvernd” means the Icelandic Data Protection Authority.

3. Scope and instructions

3.1 MyIceland processes Personal Data only to provide the Service and only on the Operator’s documented instructions, including with regard to transfers of Personal Data to a third country, unless required to process by a law to which MyIceland is subject. In that case, MyIceland will inform the Operator of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

3.2 The Operator’s instructions are constituted by this DPA, the Main Agreement, and the configuration choices the Operator makes in the Service. The details of the processing are set out in Annex 1.

3.3 MyIceland will inform the Operator if, in its opinion, an instruction infringes Applicable Data Protection Law.

4. Processor obligations

MyIceland will:

4.1 (Documented instructions) Process Personal Data only as set out in section 3.

4.2 (Confidentiality) Ensure that persons authorised to process the Personal Data are bound by an appropriate duty of confidentiality.

4.3 (Security) Implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by GDPR Article 32. The measures in place are described in Annex 2.

4.4 (Sub-processors) Engage Sub-processors only in accordance with section 5.

4.5 (Data-subject rights) Taking into account the nature of the processing, assist the Operator by appropriate technical and organisational measures, insofar as possible, in fulfilling the Operator’s obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR. Where a Data Subject contacts MyIceland directly, MyIceland will, without undue delay, refer them to the Operator and notify the Operator.

4.6 (Compliance assistance) Assist the Operator in ensuring compliance with its obligations under GDPR Articles 32 to 36, taking into account the nature of the processing and the information available to MyIceland.

4.7 (Deletion or return) At the Operator’s choice, delete or return all Personal Data to the Operator after the end of the provision of the Service, and delete existing copies, unless Applicable Data Protection Law requires storage. The mechanics are in section 9 and Annex 1.

4.8 (Audit and information) Make available to the Operator all information necessary to demonstrate compliance with GDPR Article 28, and allow for and contribute to audits, including inspections, conducted by the Operator or an auditor it mandates, on reasonable notice (at least 30 days), no more than once per year except where required by a supervisory authority, and subject to confidentiality.

5. Sub-processors

5.1 The Operator gives MyIceland general authorisation to engage the Sub-processors listed in Annex 3.

5.2 MyIceland will inform the Operator of any intended addition or replacement of a Sub-processor, giving the Operator at least 30 days to object before the new Sub-processor begins processing Personal Data. Notice is given by email to the Operator’s account contact, or by an in-product notice.

5.3 Where MyIceland engages a Sub-processor, it will impose data-protection obligations no less protective than those in this DPA, by written contract. MyIceland remains fully liable to the Operator for a Sub-processor’s performance.

6. Personal data breaches

6.1 MyIceland will notify the Operator without undue delay, and in any event within 72 hours of becoming aware of a Personal Data Breach affecting the Operator’s Personal Data.

6.2 The notification will include, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Information may be provided in phases without undue further delay.

7. International transfers

7.1 MyIceland processes and stores the Operator’s customer Personal Data within the European Economic Area (hosting and database in Amsterdam, Netherlands).

7.2 MyIceland will not transfer the Operator’s customer Personal Data outside the EEA without an appropriate Chapter V transfer mechanism (adequacy decision, the EU-U.S. Data Privacy Framework where the recipient is certified, or the EU Standard Contractual Clauses) and without informing the Operator. Current Sub-processors and their locations are in Annex 3.

8. Liability

8.1 Each party’s liability under or in connection with this DPA is subject to the limitation of liability set out in the Main Agreement (MyIceland Terms of Service, section 10). Nothing in this DPA excludes liability that cannot be excluded under Applicable Data Protection Law.

9. Term and data handling on exit

9.1 This DPA takes effect when the Operator accepts the Main Agreement and continues for as long as MyIceland processes Personal Data on the Operator’s behalf.

9.2 On termination, MyIceland will, at the Operator’s choice, delete or return the Operator’s customer Personal Data and delete existing copies within 30 days, unless law requires retention. This includes records in the event log (Annex 1).

10. Governing law

10.1 Governed by the laws of Iceland, with the Icelandic courts having jurisdiction, save where the Main Agreement provides otherwise.

11. Precedence

11.1 On a data-protection matter, this DPA prevails over the Main Agreement in the event of conflict.

Annex 1: Details of processing

Subject matter. Provision of the MyIceland customer self-service booking portal, enabling the Operator’s customers to view, manage, and modify bookings and to browse and select additional tours.

Duration. For the term of the Main Agreement, plus any retention required by law or under section 9.

Nature and purpose. Retrieving booking data from the Operator’s booking platform for display; relaying customer-initiated changes (reschedule, pickup change, contact-information update, cancellation request) back to the booking platform; sending transactional emails (tickets, confirmations, change notifications); where Apple Wallet passes are switched on for the Operator’s portal, issuing a tour ticket as an Apple Wallet pass when a customer asks for one and keeping that pass up to date when the booking changes; and recording event records for security, abuse prevention, and operational analytics.

Types of Personal Data: booking reference, customer name, email, phone, tour and departure details and guest count, pickup/meeting-point location (may include a hotel or home address), customer-initiated change selections, IP address (hashed in the event log; raw IP transiently in hosting logs), User-Agent, a MyIceland-generated session identifier, the records of sign-in links and signed-in sessions described below, and, for a ticket that a customer adds to Apple Wallet, the pass record and, for each device that holds the pass, a device identifier generated by Apple Wallet and a push token (also described below).

The authoritative booking record (full contact details, any payment data) is held by the booking platform, not MyIceland.

Persistence note. MyIceland works on a relay basis: it keeps no copy of the booking record, which is read from the booking platform when needed. Persisted data is limited to: (a) event-log records holding the booking reference and product/booking codes, tour and departure details, the pickup/meeting-point location, the User-Agent, and a session identifier, with the customer’s email address and IP address stored only in one-way hashed form; customer name and phone number are stripped before storage and are not persisted; (b) sign-in link records: each Manage-booking link in a transactional email, and each sign-in link the Operator’s staff create, is stored with the customer’s email address in plain text, the booking reference and the link’s dates, so that the link can sign that customer in (a link works for 7 days); (c) customer session records: a one-way hash of the customer’s email address and the booking reference, for a signed-in session, which ends 90 days after its last use; (d) short-lived in-memory caches reset on redeploy; (e) transactional-email content passed to the email Sub-processor; (f) Apple Wallet pass records, one for each tour booking for which a customer has asked for an Apple Wallet pass: the booking reference and product/booking codes, a one-way hash of the customer’s email address, the pass’s authentication token, a one-way hash of the token in the sign-in link carried on the pass, and the content shown on the pass (tour and departure details, the pickup time where one is shown, the guest count, the pickup/meeting-point location, which may be an address the customer wrote, and the ticket’s barcode value), with no customer name, email address or phone number; and (g) Apple Wallet device registrations: for each device that holds such a pass (at most ten per pass), the device identifier that Apple Wallet generates for the pass provider and the device’s push token, both in plain text because Apple’s update protocol needs them back in that form. The full set of Types above is processed (e.g. for display and relay) but not all of it is persisted in the event log.

Categories of Data Subjects. The Operator’s customers (travellers) who hold or make bookings.

Retention. Event-log records, sign-in link records and customer session records are retained for the duration of the Operator’s account and are deleted when the account is closed or terminated, in line with section 9 (deletion or return within 30 days of termination, unless retention is required by law or to investigate a security incident). MyIceland does not currently apply a shorter fixed time-based purge, so records persist for the life of the account rather than for a set number of days. These records are minimised but remain personal data: customer name and phone are not stored, and in the event log and session records email and IP are held only in hashed form (sign-in link records hold the email in plain text, as above), but the records retain booking and operational identifiers that may be linked to an individual using additional information held by the Operator or its booking platform. The persisted fields are listed in the Persistence note above; the technical and organisational measures are in Annex 2. Short-lived caches are reset on each redeploy.

Retention of Apple Wallet records. An Apple Wallet device registration is deleted when the customer removes the pass from Apple Wallet and the device reports this to the Service, when Apple reports that the device’s push token is no longer valid, when the pass is issued again after the booking’s email address has changed, and when the pass is retired. The Service retires a pass at its first check of that pass 14 days or more after the tour starts; from then on the pass is no longer updated and its sign-in link no longer works. These checks run only while Apple Wallet passes are switched on for the Operator’s portal. Apple Wallet pass records themselves, including those of retired and cancelled passes, are not deleted on a schedule: MyIceland does not currently apply a time-based purge to them, so they persist for the life of the Operator’s account and are deleted when the account is closed or terminated, in line with section 9.

Annex 2: Technical and organisational measures (GDPR Article 32)

These are the measures in place on the date at the top of this agreement.

Hosting and residency. Application, PostgreSQL database, and logs hosted on Railway infrastructure in the EEA (Amsterdam, Netherlands). Railway, a US company, runs its service from the USA.

Encryption in transit. All connections use HTTPS/TLS.

Encryption at rest. The database is encrypted at rest, as confirmed in the hosting provider’s (Railway’s) data processing security measures. Data in transit is encrypted via TLS.

Access control. Admin access is protected by signed, expiring authentication tokens; customer lookup is authenticated against booking reference and email. Production database and hosting-console access is limited to the operator of MyIceland.

Pseudonymisation / minimisation. In the event log, customer email and IP address are stored only as one-way SHA-256 hashes, and customer name and phone number are stripped before storage (never persisted). Booking and product references, tour and departure details, the pickup/meeting-point location, and the User-Agent are retained in plaintext as the minimum needed for security, abuse-prevention, and operational analytics. These remaining fields are pseudonymous identifiers, linkable to an individual only with additional information held by the Operator or its booking platform, so the records remain personal data in pseudonymised form, not anonymised. Sign-in link records are the exception: they hold the customer’s email address in plain text, because a link must know whom it signs in.

Rate limiting. Per-IP and per-operator request limits protect the Service and the upstream booking platform.

Logging. Operational event logging for security and abuse detection.

Backups. The database is backed up daily by the hosting provider (Railway), with restore capability, per the hosting provider’s documented security measures.

Sub-processor controls. Sub-processors under written contracts with equivalent obligations (Annex 3, section 5).

Annex 3: Authorised Sub-processors

Client-side third parties. The portal also loads resources that transmit the customer’s IP to third parties: Google Fonts and the jsDelivr CDN. The embedded Bókun widget injects Google Analytics into the page. (Fonts and CDN may be self-hosted later to remove this; Bókun widget flows are governed by the Operator’s relationship with Bókun.)

Apple Wallet. A ticket that a customer adds to Apple Wallet is fetched by the customer’s own device from MyIceland and is then kept by Apple Wallet on the customer’s devices. MyIceland does not send the pass to Apple. Apple states that the device sends Apple the information needed to display the pass, including what is visible on it, and that Apple stores it with the customer’s Apple Account for as long as the pass remains in Wallet. Apple provides Apple Wallet to the customer under Apple’s own terms and privacy policy. A pass shows the tour, its date and times, the pickup or meeting-point location (which may be an address the customer wrote), the guest count, the booking reference, the ticket’s barcode, the Operator’s name and contact email, and a link that signs the customer in to the portal. It does not show the customer’s name, email address or phone number.