Privacy Policy

Last updated: 14 October 2026

This policy explains how the VADLA guest app (iOS, Android and web at app.vadla.is) handles personal data. The app is operated by KB15 ehf, kennitala 5412170290, Kotabyggð 15, 606 Akureyri, Iceland (“VADLA”, “we”), formerly Viking Cottages and Apartments. We are the data controller. Contact: info@vikingcottages.is, +354 893 5050.

1. Data we collect

Data	Source & purpose
Booking number, name, email, phone, stay dates, home, number of guests, booking amounts	Received from our booking system (The Booking Factory) when you book. Used to sign you in and show your stay, key-box code and house information.
Chat messages	Messages you send to the host in the app, with time stamps. Used to answer you.
Push-notification tokens	Only if you turn on updates. A device token/endpoint from Apple, Google or your browser, linked to your booking, to send stay updates (key code, welcome, check-out, sauna reminders, host replies).
Language preference	English or Icelandic, so notifications use your language.
Private sauna bookings	Date, hour and price of any private sauna hour you book.
Shop orders	Items, total, delivery note and age confirmation (20+) for beer & wine orders.
Payments	Card and wallet payments are processed by our payment processor, Teya. We never see or store your full card number; we receive a payment reference and status only.
Check-out feedback	Your 1–5 rating and optional comment, shown only to the host.
Technical data	Standard server logs (IP address, time, request), kept briefly by our hosting provider for security; failed owner-login attempts are rate-limited by a hashed IP.

We do not use advertising, analytics or tracking SDKs, we do not track you across apps or websites, and we never sell data. The app does not access your location, contacts, camera, microphone or photos.

2. Legal basis (GDPR and Icelandic Act no. 90/2018)

Performance of your booking contract (sign-in, stay information, key code, messages, sauna and orders); your consent for push notifications (you can turn them off at any time in your device settings); our legitimate interest in security and in improving our service (feedback, error logs); and legal obligations (accounting records for payments).

3. Where data is stored (processors)

Supabase – database, hosted in the EU (AWS eu-west-1, Ireland).
Vercel – app hosting and server functions, configured to run in the EU (Dublin, Ireland); static files are served from Vercel’s global network. Vercel Inc. is a US company; transfers are covered by the EU–US Data Privacy Framework and Standard Contractual Clauses.
The Booking Factory – our booking system, the source of booking data.
Teya – payment processing.
Apple, Google and browser push services – delivery of notifications you turned on.
MET Norway, Open-Meteo, NOAA, Veðurstofa Íslands – weather and aurora data. No personal data is sent to them.

4. How long we keep data

Push tokens: deleted automatically 2 days after check-out, or when you sign out or turn updates off.
Chat messages, notifications, feedback, sauna bookings and language preference: [12 months] after check-out.
Booking and payment records: as long as required by Icelandic bookkeeping law (Act no. 145/1994, up to 7 years).
Server error logs: 30 days.
Data on your device: removed when you sign out.

5. Your rights

You may request access to, correction, deletion or a copy (portability) of your data, object to processing based on legitimate interest, and withdraw consent at any time. The app has no separate user account: you sign in with your booking number. To exercise your rights or delete your data, email info@vikingcottages.is with your booking number. We reply within 30 days. You may also complain to the Icelandic Data Protection Authority, Persónuvernd (personuvernd.is).

6. Children

The app is intended for adult guests named on a booking. Shop orders are only for guests aged 20 or older.

7. Changes

We will post any changes on this page and update the date above.

Persónuverndarstefna (samantekt)

Ábyrgðaraðili er KB15 ehf, kt. 5412170290, Kotabyggð 15, 606 Akureyri. Við vinnum með bókunarupplýsingar (bókunarnúmer, nafn, netfang, síma, dagsetningar), spjallskilaboð, tilkynningaauðkenni (ef þú kveikir á tilkynningum), tungumálaval, gufubókanir, pantanir, umsögn við brottför og tæknilegar annálaupplýsingar. Greiðslur fara í gegnum Teya; við sjáum aldrei kortanúmer. Gögn eru hýst hjá Supabase og Vercel innan ESB (Írlandi). Við notum enga auglýsinga- eða rakningartækni. Þú átt rétt á aðgangi, leiðréttingu, eyðingu og flutningi gagna; sendu póst á info@vikingcottages.is. Kvörtunum má beina til Persónuverndar. Enski textinn hér að ofan gildir.