Privacy & Cookies Policy

Cicloexplorer

Effective Date: January 1, 2026

Website: [https://cicloexplorer.com](https://cicloexplorer.com)

Contact: [email protected]

Cicloexplorer operates guided cycling expeditions in Iceland. Because Iceland is part of the European Economic Area (EEA), we comply fully with the European General Data Protection Regulation (GDPR) and the Icelandic Data Protection Act (Act No. 90/2018 on Data Protection and the Processing of Personal Data).

This Privacy and Cookies Policy explains how we collect, use, disclose, and protect your personal information when you browse our website, submit an inquiry, book a tour, or communicate with our team.

1. Data Controller (Ábyrgðaraðili)

The data controller responsible for the processing of your personal data is:

  • Project / Commercial Name: Cicloexplorer
  • Representatives: Emilio Mateo & Germán Martínez García
  • Official Email: [email protected]
  • Lead Supervisory Authority: Persónuvernd (The Icelandic Data Protection Authority), Laugavegur 166, 105 Reykjavík, Iceland ([email protected]).

  • For the management of our cycling routes and travel services, we operate in strategic partnership with Boreal Travel ehf., which acts as the technical organizer and legal data controller for the execution of travel contracts.
  • Agency Name: Cicloexplorer
  • Operational Partner (Legal Controller): Boreal Travel ehf.
  • Identification Number (Kennitala): 470809-0190
  • Address: Nesvegur 45, 107 Reykjavik, Iceland
  • Contact Email: [email protected] (copying [email protected])
  • Supervisory Authority: Persónuvernd (Icelandic Data Protection Authority).

2. Personal Information We Collect

We collect only the personal information strictly necessary to handle your inquiries, manage your booking, ensure your safety during expeditions, and comply with statutory obligations.

  • Inquiry & Pre-Booking Data: Full name, email address, phone number / WhatsApp, preferred travel dates, bike choice (gravel, e-bike, or personal bike), and riding experience level provided through our inquiry and contact forms.
  • Booking & Passenger Details: Full legal name (as shown on your passport), date of birth, nationality, home address, passport number (when required for local logistics/manifests), and emergency contact details.
  • Health, Dietary & Technical Data: Dietary restrictions or allergies (communicated to hotels and accommodations), medical conditions relevant to strenuous physical activity in Arctic wilderness, and physical measurements (height and inseam for bike rental sizing). Health details are treated as special category data and processed solely with your explicit consent for safety and rescue readiness.
  • Payment Information: Transaction details, billing address, and payment confirmation. Cicloexplorer does not store credit card numbers or banking credentials. All payments are processed through secure, PCI-DSS-compliant third-party gateways (e.g., Stripe, WooCommerce Payments, or authorized bank transfer systems).
  • Automated Website Data: IP address, browser type, device information, operating system, and browsing activity collected via cookies and analytical tags.

3. Legal Bases for Processing (Art. 6 & Art. 9 GDPR)

We process your data under the following legal bases:

  1. Performance of a Contract: To process bookings, coordinate hotel accommodation, adjust bike fit, arrange 4×4 luggage transfer, and guide your expedition safely.
  2. Explicit Consent: To send newsletters and marketing communications, process relevant health/dietary details for trip safety, and deploy non-essential cookies. You can withdraw your consent at any time.
  3. Legal Obligations: To maintain accounting and financial records, issue valid invoices, and comply with tax and tourism regulations in Iceland and the EU.
  4. Legitimate Interests: To improve route planning, secure our website from fraud, analyze web traffic, and address customer service inquiries.

4. How We Share Your Information

Cicloexplorer does not sell, rent, or trade your personal information. We disclose data solely to trusted third parties involved in operating your tour:

  • Accommodations & Field Partners: Hotels, guesthouses, and local lodges along the route for room reservations, check-in, and catering arrangements.
  • Emergency & Safety Services: Local search and rescue teams (Landsbjörg / ICE-SAR), medical providers, or civil defense authorities in the event of an accident or emergency evacuation.
  • Technical Service Providers: Web hosting, database services, payment gateways, and email management systems under strict data processing agreements.
  • Legal and Regulatory Bodies: Icelandic or European authorities where required by law.

5. International Data Transfers

All primary data processing occurs within the European Economic Area (EEA), ensuring standard GDPR protections. If any third-party service provider (such as cloud hosting or analytics) stores information outside the EEA, transfers are governed by European Commission Adequacy Decisions or Standard Contractual Clauses (SCCs) to guarantee equivalent data security.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • Booking & Transaction Records: Retained for 7 years following tour completion in accordance with Icelandic and EU accounting and commercial laws.
  • Medical & Emergency Data: Deleted within 60 days following the conclusion of your expedition.
  • Inquiries & General Correspondence: Retained for up to 24 months to assist with future booking requests, unless you request earlier deletion.
  • Marketing Subscribers: Retained until you click “Unsubscribe” or withdraw consent.

7. Your Data Protection Rights

Under GDPR and Icelandic Act No. 90/2018, you hold the following rights:

  • Right of Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete information.
  • Right to Erasure (“Right to be Forgotten”): Request deletion of your data when it is no longer required for legal or contractual purposes.
  • Right to Restrict Processing: Limit how we use your data under specific statutory conditions.
  • Right to Data Portability: Receive your data in a structured, machine-readable format.
  • Right to Object: Object to the processing of your data based on legitimate interests or for direct marketing.
  • Right to Withdraw Consent: Revoke any consent previously granted without affecting past lawful processing.

To exercise any of these rights, email us at [email protected]. If you believe our data handling violates applicable law, you have the right to lodge a complaint with Persónuvernd at [email protected].

8. Media and Expedition Photography

During expeditions, Cicloexplorer staff may capture photographs and video footage for editorial, promotional, and social media purposes.

  • As detailed in our Booking Terms, participants may opt out of appearing in promotional imagery by emailing [email protected] prior to the trip.
  • Photographs taken by individual guests remain their own property, but participants must respect fellow travelers’ privacy when sharing media publicly.

9. Cookies Policy

What Are Cookies?

Cookies are small text files stored on your computer or mobile device when you visit cicloexplorer.com. They help the website function efficiently, remember your preferences, and provide analytical data.

Categories of Cookies We Use

  1. Strictly Necessary Cookies: Essential for the core technical operation of the website, user authentication, and shopping cart / checkout functionality. These cookies do not require prior consent and cannot be turned off.
  2. Performance & Analytics Cookies: Used to evaluate how visitors interact with our site (pages visited, time on page, traffic sources) using tools like Google Analytics. All IP addresses are anonymized. These are placed only with your consent.
  3. Marketing & Targeting Cookies: Used to assess the effectiveness of advertising campaigns (e.g., Google Ads or Meta Pixel) and deliver relevant expedition promotions to users on other platforms. Placed strictly with your consent.

Managing Cookies

When you first visit cicloexplorer.com, a cookie banner allows you to accept all cookies, reject non-essential cookies, or adjust specific preferences. You can also configure or disable cookies at any time directly through your web browser settings (Chrome, Safari, Firefox, Edge).

10. Updates to This Policy

We review and update this Privacy and Cookies Policy periodically to reflect operational changes, new route requirements, or legal amendments. Any revisions will be published on this page with an updated “Effective Date.” For significant changes affecting existing bookings, we will notify affected travelers directly by email.