Privacy policy

Introduction

At Miðhraun – Lava Resort and Hlaðan Restaurant, we place great importance on protecting personal data and ensuring that its processing complies with applicable laws, including Act No. 90/2018 on Data Protection and the General Data Protection Regulation (EU) 2016/679 (GDPR).


The purpose of this Privacy Policy is to inform you about how we collect, use, and protect your personal data, as well as your rights in relation to it.


Data Controller

The data controller responsible for processing personal data is:
Miðhraun – Lava Resort and Hlaðan Restaurant
Email: info@lavaresort.is


What is Personal Data?

Personal data refers to any information relating to an identified or identifiable individual, such as:

  • Name
  • Email address
  • Phone number
  • National ID number (when applicable)
  • Payment information

Sensitive personal data is only processed when necessary and in accordance with applicable laws.


What Information Do We Collect?

a) Bookings and Services

  • Name and contact details
  • Reservation details
  • Payment information

b) Communications

  • Information provided in emails or messages

c) Website Usage

  • IP address
  • Usage data (cookies)


Purpose of Processing

We process personal data for the following purposes:

  • To manage reservations and provide services
  • To fulfill contractual obligations
  • To comply with legal obligations (e.g. accounting requirements)
  • To improve our services and guest experience
  • For marketing purposes (where consent is required)

We only collect data that is necessary and use it for clearly defined purposes.


Legal Basis for Processing

Processing of personal data is based on:

  • Contractual necessity
  • Legal obligations
  • Legitimate interests of the company
  • Consent (e.g. for marketing communications)


Data Sharing

We do not share personal data unless:

  • it is necessary to provide our services (e.g. payment processors, booking systems)
  • required by law
  • you have given your consent


Data Retention

We retain personal data only for as long as necessary:

  • Booking data: in accordance with accounting laws
  • Communication data: as needed
  • Marketing data: until consent is withdrawn


Data Security

We take appropriate technical and organizational measures to protect personal data against:

  • unauthorized access
  • alteration
  • loss


Your Rights

You have the right to:

  • access your personal data
  • request correction
  • request deletion (where applicable)
  • restrict processing
  • object to processing
  • request data portability

You also have the right to lodge a complaint with the Icelandic Data Protection Authority (www.personuvernd.is).


Cookies

Our website may use cookies to:

  • improve user experience
  • analyze traffic
  • personalize content

You can manage cookie settings through your browser.


Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website.


Contact

If you have any questions regarding this Privacy Policy or how your data is processed, please contact us: info@lavaresort.is