Privacy and cookies

Controller and contact

Bjorn Thoroddsen, Reykjavík, Iceland, is the controller for personal data processed through this website. Send privacy requests to bjornthoroddsen@gmail.com.

Website delivery and security

The hosting provider may process IP address, time, URL, browser, and device details in technical access and security logs. The legal basis is the controller’s legitimate interest in operating a secure and reliable website. Logs are kept for the shortest period offered by the hosting configuration, except when a security incident requires longer investigation.

Vercel provides hosting and Vercel Blob delivers licensed images and files. Neon Postgres stores website content and the data needed for administrator access, including permissions, accounts, and sessions. Only allow-listed administrators can sign in with Google OAuth; the website then receives the verified email address and basic profile details from the Google account. The legal basis is the controller’s legitimate interest in secure content administration.

Contact form

The form collects your name, email address, enquiry type, optional organization or venue, message, and site language. It emails this information to the controller through the configured SMTP and mailbox provider; the website does not keep a separate contact database.

For booking requests, the legal basis is taking steps at your request before entering a contract. For general and press enquiries, the basis is the legitimate interest in receiving and answering the enquiry. General, completed, or unanswered enquiries are deleted within 12 months. Active booking records are kept longer only where a contract or legal record-keeping duty requires it.

Name, email, and message are required to submit the form; without them we cannot reply. The other fields are optional.

Abuse prevention

Cloudflare Turnstile evaluates technical browser signals and the IP address to distinguish people from automated abuse. The website also uses the IP address for short-lived submission rate limiting. The basis is the legitimate interest in protecting the form and mailbox. The site keeps only a temporary attempt count for approximately 10 minutes; Cloudflare processes its security data under its Turnstile terms.

Google Analytics

With your consent, we use Google Analytics 4 to measure visits, viewed pages, selected actions, campaign sources, and general device and location information. Names, email addresses, and contact-form messages are not sent to Google. The legal basis is consent, and no analytics request is sent before you accept.

Event data is retained for 14 months. Google Signals, advertising links, remarketing, user-provided data, and granular EEA device and location collection are disabled. You can decline or withdraw consent at any time through Privacy settings in the footer; further measurement stops and accessible Google Analytics cookies are removed.

YouTube and Spotify

You can enable External media (YouTube/Google and Spotify) in Privacy settings, which loads those players without a separate prompt. You may instead activate one player: this grants consent for that provider and can show its other players on the page. The connection may send your IP address, browser details, and the requested page or media to that provider. You can change or withdraw the choice through Privacy settings in the footer, or use the external link instead.

Processors and transfers outside the EEA

Recipients or processors may include Vercel (hosting and Vercel Blob), Neon (Neon Postgres for content, administrator access, and sessions), Google (Google OAuth for administrators, consented Analytics, and activated YouTube), Cloudflare (Turnstile), Spotify, and the configured SMTP or mailbox provider. Some may process data outside the EEA. Where that occurs, the transfer relies on an applicable adequacy decision or European Commission Standard Contractual Clauses with supplementary measures where required. You may request details of the safeguards through the privacy contact above.

Browser storage

Your rights

You may request access, correction, erasure, or restriction, and object to processing based on legitimate interests. Data portability applies where its legal conditions are met. You may withdraw consent without affecting processing that was lawful before withdrawal. Requests are answered without undue delay and normally within one month.

The website makes no automated decisions and performs no profiling with legal or similarly significant effects. You may lodge a complaint with the Icelandic supervisory authority, Persónuvernd.

Questions

Send a privacy request directly to bjornthoroddsen@gmail.com or use the contact page.