Privacy Policy

Last updated: 02/09/2026

This Privacy Policy explains what personal data we collect about you, the purposes for which we use it, how long we retain it and the rights available to you as a data subject.

By using our website, submitting a contact form or contacting us through any of our communication channels, you acknowledge the processing of your personal data as described in this Privacy Policy.

1. Who We Are

Atelier Travel is a travel brand operated through two legal entities, depending on the destination and service concerned.

Portugal

ATI LDA
Licensed Travel Agency
RNAVT No. 13443
NIF: 516 469 169
Rua Clube Desportivo da Póvoa
4490 695 Póvoa de Varzim
Portugal

Iceland

Atelier Travel ehf.
Licensed Day Tour Operator
Kennitala: 580823 0410
VSK: 152293
Hallgerðargata 1A
105 Reykjavík
Iceland

For services provided in Portugal or through the Portuguese travel agency activity, ATI LDA is the relevant entity responsible for processing personal data.

For private day tours and related tourism experiences operated in Iceland, Atelier Travel ehf. is the relevant entity responsible for processing personal data.

We manage the website https://ateliertraveliceland.com and the associated communication channels, including contact forms, email, telephone, WhatsApp and social media.

You can contact us by email at info@ateliertraveliceland.com or by telephone or WhatsApp at +354 866 8950.

2. What Personal Data We Collect and How We Obtain It

We collect personal data that you provide directly to us, as well as certain technical data generated automatically when you browse our website.

2.1 Data Provided Directly by You

Depending on the service or enquiry, we may collect:

Contact details: name, email address, telephone number and WhatsApp number.

Enquiry and service information: preferred destination, preferred date, number of participants, type of experience requested, group profile, interests, preferences relevant to the requested service and any additional information submitted through our forms or communication channels.

For private day tours in Iceland, this information may include the preferred date, number of participants, preferred type of day tour, pickup information and other details required to prepare or operate the requested day tour.

Contractual and administrative data: tax identification number, billing address, invoicing information, identification details where legally or operationally required and communication history.

We ask users not to provide sensitive personal information unless it is specifically necessary for the requested service.

2.2 Data Collected Automatically

When you visit our website, certain technical information may be collected automatically, including:

IP address.

Browser type and operating system.

Date and time of access.

Pages visited.

Time spent on the website.

Interactions with the website.

Technical information about your device and network.

This information may be collected through cookies and similar technologies for security, statistical analysis, website performance and improvement purposes.

3. The Purposes for Which We Use Your Data and the Legal Basis

We process personal data only when there is a valid legal basis for doing so.

Responding to Contacts and Information Requests

Examples of use: responding to enquiries, preparing quotations, providing information about services and answering questions submitted through our contact channels.

Legal basis: steps taken at your request before entering into a contract or legitimate interest.

Preparing and Managing Requested Services

For services provided by ATI LDA, this may include preparing and managing travel agency services within the scope of its licensed activity.

For services provided by Atelier Travel ehf. in Iceland, this is limited to preparing, booking and operating private day tours and tourism experiences forming part of those day tours.

Examples of use: preparing personalised proposals, confirming dates, coordinating participants, arranging transportation during a private day tour, organising guiding services and coordinating activities or experiences included in the booked day tour.

Legal basis: performance of a contract or steps taken at your request before entering into a contract.

Communication with Clients and Interested Parties

Examples of use: sending proposals, booking confirmations, operational information, service updates and responses to enquiries.

Where legally permitted, we may also send marketing communications.

Legal basis: performance of a contract, legitimate interest or consent, depending on the communication.

Website Improvement and Statistical Analysis

Examples of use: analysing website usage, improving navigation, identifying technical issues and understanding how users interact with our content.

Legal basis: consent where required for cookies or similar technologies, or legitimate interest where legally permitted.

Compliance with Legal and Regulatory Obligations

Examples of use: issuing invoices, maintaining accounting and tax records, complying with tourism regulations and responding to legally valid requests from competent authorities.

Legal basis: legal obligation.

4. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with applicable legal obligations.

As a general rule:

Contacts and enquiries: up to 2 years after the last relevant interaction, unless a longer period is justified.

Clients and contractual records: for the period required by applicable accounting, tax and legal obligations, which may be up to 10 years.

Website and analytics data: according to the retention periods configured for the relevant tools and cookies.

Marketing data: until consent is withdrawn, the user objects to the processing or the information is no longer necessary for the relevant purpose.

After the applicable retention period, personal data is deleted, anonymised or securely archived where retention is legally required.

5. Who We Share Your Data With

We do not sell personal data.

Personal data may be shared only when necessary with:

Technology and service providers: hosting providers, website maintenance providers, communication platforms, analytics providers, payment service providers and other technology suppliers necessary to operate the website or provide the requested service.

Tourism and operational partners: transport providers, guides, activity providers and other suppliers involved in delivering the requested service or private day tour.

For private day tours operated by Atelier Travel ehf. in Iceland, personal data is shared only with suppliers necessary for the preparation or operation of that day tour.

Professional advisers: accountants, legal advisers, auditors or other professional service providers where required.

Public authorities: where disclosure is required by law or by a legally valid request from a competent authority.

Service providers that process personal data on our behalf are required to process it only according to our instructions and in accordance with applicable data protection legislation.

6. International Data Transfers

ATI LDA is established in Portugal and Atelier Travel ehf. is established in Iceland.

Portugal is a member of the European Union.

Iceland is not a member of the European Union but is part of the European Economic Area and is subject to the European data protection framework, including the GDPR.

Personal data may therefore be processed within the European Economic Area by the relevant Atelier Travel entity and its service providers.

Where personal data is transferred to a country outside the European Economic Area, we take appropriate measures to ensure that the transfer complies with applicable data protection law.

These safeguards may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses or another legally recognised transfer mechanism.

7. How We Protect Your Data

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

These measures may include:

Secure website connections using HTTPS.

Access controls and password management.

Security measures applied to systems and accounts.

Backups and contingency procedures.

Restricted access to personal data based on operational need.

Confidentiality obligations applicable to employees, contractors and service providers.

Regular review of technical and organisational security measures.

While we take reasonable measures to protect personal data, no internet based system can guarantee absolute security.

8. Your Data Protection Rights

Subject to applicable law, you may have the right to:

Access: obtain confirmation as to whether we process your personal data and receive a copy of that data.

Rectification: request correction of inaccurate or incomplete personal data.

Erasure: request deletion of personal data where the legal requirements are met.

Restriction of processing: request that processing be limited in certain circumstances.

Data portability: receive personal data in a structured, commonly used and machine readable format where applicable.

Objection: object to processing based on legitimate interests or to the use of personal data for direct marketing.

Withdrawal of consent: withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise your rights, contact us at info@ateliertraveliceland.com or through the contact form available on our website.

We may request additional information where reasonably necessary to verify your identity before responding to a request.

9. Cookies and Similar Technologies

We use cookies and similar technologies for purposes including:

Essential website functionality: ensuring that the website operates correctly and securely.

User preferences: remembering preferences such as language selection and other website settings.

Traffic analysis: understanding how visitors use the website and improving its performance and content.

Marketing and campaign measurement: measuring the effectiveness of marketing campaigns where the user has provided the required consent.

Non essential cookies are activated only where the required consent has been obtained.

You can manage your cookie preferences through the cookie management tool available on the website.

For more information, please refer to our Cookie Policy.

10. Links to Third Party Websites

Our website may contain links to third party websites, including activity providers, tourism partners, social media platforms and other external services.

We are not responsible for the privacy practices, security or content of third party websites.

We recommend reviewing the privacy policy of any external website before providing personal data.

11. Complaints and Supervisory Authorities

If you believe that your personal data has been processed in a way that does not comply with applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.

Portugal

Comissão Nacional de Proteção de Dados, CNPD

https://www.cnpd.pt

Iceland

Persónuvernd, Icelandic Data Protection Authority

https://www.personuvernd.is

You may also contact us directly before submitting a complaint so that we have the opportunity to address your concerns.

12. Updates to this Privacy Policy

Atelier Travel may update this Privacy Policy whenever necessary to reflect changes to our services, legal requirements, data processing practices or website functionality.

The latest update date will always be indicated at the beginning of this Privacy Policy.

Where required by applicable law, we will provide appropriate notice of significant changes.

The most recent version of the Privacy Policy published on the website applies from the date indicated above.