Privacy and cookies

Controller and contact

Björn Thoroddsen, Reykjavík, Iceland, is the controller for personal data processed through this website. Send privacy requests to bjornthoroddsen@gmail.com.

Website delivery and security

The hosting provider may process IP address, time, URL, browser, and device details in technical access and security logs. The legal basis is the controller’s legitimate interest in operating a secure and reliable website. Logs are kept for the shortest period offered by the hosting configuration, except when a security incident requires longer investigation.

Vercel provides hosting and Sanity provides content management and image delivery. They process data under the controller’s contracts and configuration.

Contact form

The form collects your name, email address, enquiry type, optional organization or venue, message, and site language. It emails this information to the controller through the configured SMTP and mailbox provider; the website does not keep a separate contact database.

For booking requests, the legal basis is taking steps at your request before entering a contract. For general and press enquiries, the basis is the legitimate interest in receiving and answering the enquiry. General, completed, or unanswered enquiries are deleted within 12 months. Active booking records are kept longer only where a contract or legal record-keeping duty requires it.

Name, email, and message are required to submit the form; without them we cannot reply. The other fields are optional.

Abuse prevention

Cloudflare Turnstile evaluates technical browser signals and the IP address to distinguish people from automated abuse. The website also uses the IP address for short-lived submission rate limiting. The basis is the legitimate interest in protecting the form and mailbox. The site keeps only a temporary attempt count for approximately 10 minutes; Cloudflare processes its security data under its Turnstile terms.

Google Analytics

With your consent, we use Google Analytics 4 to measure visits, viewed pages, selected actions, campaign sources, and general device and location information. Names, email addresses, and contact-form messages are not sent to Google. The legal basis is consent, and no analytics request is sent before you accept.

Event data is retained for 14 months. Google Signals, advertising links, remarketing, user-provided data, and granular EEA device and location collection are disabled. You can decline or withdraw consent at any time through Analytics settings in the footer; further measurement stops and accessible Google Analytics cookies are removed.

YouTube and Spotify

Players from YouTube/Google and Spotify are not requested until you activate the relevant player. Activation creates a direct connection to that provider, which may receive your IP address, browser details, and the page or media requested. Activating is an affirmative consent to that connection. You can use the external link instead, in which case the provider’s privacy notice applies.

Processors and transfers outside the EEA

Recipients or processors may include Vercel (hosting), Sanity (content and images), Cloudflare (Turnstile), Google (Analytics and YouTube), Spotify, and the configured SMTP or mailbox provider. Some may process data outside the EEA. Where that occurs, the transfer relies on an applicable adequacy decision or European Commission Standard Contractual Clauses with supplementary measures where required. You may request details of the safeguards through the privacy contact above.

Browser storage

Your rights

You may request access, correction, erasure, or restriction, and object to processing based on legitimate interests. Data portability applies where its legal conditions are met. You may withdraw consent without affecting processing that was lawful before withdrawal. Requests are answered without undue delay and normally within one month.

The website makes no automated decisions and performs no profiling with legal or similarly significant effects. You may lodge a complaint with the Icelandic supervisory authority, Persónuvernd.

Questions

Send a privacy request directly to bjornthoroddsen@gmail.com or use the contact page.