Privacy Policy

Last updated: October 20, 2026

Abba-labba-lá at Skáld Hotel is committed to protecting the personal data of our guests and of visitors to abbalabbala.is. This policy explains what personal data we collect, for what purposes, on what legal basis, with whom it may be shared, how long it is kept and what rights you have. The policy is based on Act No. 90/2018 on Data Protection and the Processing of Personal Data and the EU General Data Protection Regulation 2016/679 (GDPR).

1. Data Controller

The controller responsible for processing personal data is:

Abba-labba-lá / Skáld Hotel
Hafnarstræti 80–82, 600 Akureyri, Iceland
Email: [email protected]
Phone: +354 595 2002

Contact us at the email address above if you have questions about this policy or wish to exercise your rights.

2. What Personal Data Do We Collect?

We collect only the data that is necessary in each case:

  • Table reservations: name, email address, phone number, date and time, number of guests and any comments you choose to provide. Reservations are made through the Dineout booking system.
  • Allergies and special requirements: if you tell us about food allergies, intolerances or other special requirements, this may be considered health data. We use it solely to prepare for your visit and only with your consent.
  • Communications: name, email address, phone number and the content of your inquiry when you contact us by email, phone or social media.
  • Gift cards: information about the purchaser and recipient needed to process and redeem gift cards, as well as payment and accounting information.
  • Technical data: IP address, browser and device type, language setting and time of visit, which are generated when you use the website and are necessary for its operation and security.
  • Cookies: see Section 4 for details.

3. Purpose and Legal Basis for Processing

We process personal data on the following legal bases (Articles 6 and 9 GDPR):

  • Performance of a contract (Article 6(1)(b)): to receive and confirm table reservations, process gift cards and provide the services you request.
  • Legal obligation (Article 6(1)(c)): to comply with legal obligations, such as those under the Accounting Act No. 145/1994.
  • Legitimate interests (Article 6(1)(f)): to respond to inquiries, ensure the security and functionality of the website and prevent misuse.
  • Consent (Article 6(1)(a) and Article 9(2)(a)): for non-essential cookies and for processing information about allergies and special requirements. You can withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
We never sell personal data and do not use it for automated decision-making or profiling.

4. Cookies

Cookies are small text files stored on your device when you visit the website. We use:

  • Essential cookies: which are required for the website to work, e.g. a cookie that remembers your selected language (wp-wpml_current_language, valid for 1 day), cookies that provide security and protection against misuse, and a cookie that remembers your cookie choices. These cookies do not require consent.
  • Other cookies: such as statistics or marketing cookies, and third-party content, are only enabled if you have consented to them.

Change privacy settings: You can view, change or withdraw your cookie consent at any time by clicking the fingerprint button in the bottom left corner of the screen. You can also delete or block cookies in your browser settings, but this may affect how the website works.

5. Sharing with Third Parties

We share personal data only when necessary to provide our services, when required by law or when you have given your consent. Processors who handle data on our behalf do so under a data processing agreement and only on our instructions. They include:

  • Dineout – booking system for table reservations. When you book a table, Dineout's terms and privacy policy also apply.
  • Hosting and IT services – operation, hosting and maintenance of the website.
  • Cloudflare – content delivery (CDN), security and protection against attacks.
  • Skáld Hotel – shared handling of guests, gift cards and accounting.
The website contains links to external sites such as Google Maps, Instagram, Facebook and LinkedIn. When you follow such links, the privacy policies of those companies apply, and we are not responsible for their processing.

6. Transfers Outside the EEA

Some of our service providers may process data outside the European Economic Area (EEA), e.g. in the United States. In such cases, we ensure that the transfer is based on appropriate safeguards, such as a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework) or standard contractual clauses.

7. Retention Period

We do not keep personal data longer than necessary for the purposes for which it was collected:

  • Table reservations and allergy information: a maximum of 12 months after your visit, unless longer retention is required due to a legal obligation or dispute.
  • Inquiries and communications: while the matter is being handled and for a reasonable period afterwards, generally no longer than 2 years.
  • Accounting records (e.g. for gift cards): 7 years under the Accounting Act No. 145/1994.
  • Cookies: for the period stated in the cookie settings.

8. Data Security

We take appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure or destruction. The website is encrypted with SSL/TLS (HTTPS), and access to data is restricted to staff who need it.

9. Your Rights

Under data protection law, you have the following rights:

  • Access to the personal data we process about you and a copy of it.
  • Rectification of inaccurate or incomplete data.
  • Erasure of data (the “right to be forgotten”) when it is no longer needed.
  • Restriction of processing in certain cases.
  • Data portability in a machine-readable format.
  • Objection to processing based on legitimate interests.
  • Withdrawal of consent at any time, including via the fingerprint button in the bottom left corner of the screen.
To exercise your rights, send a request to [email protected]. We respond to requests without undue delay and within one month. We may need to verify your identity before processing a request.

10. Complaints to the Data Protection Authority

If you believe that the processing of your personal data violates the law, you can file a complaint with Persónuvernd, the Icelandic Data Protection Authority. More information is available at www.personuvernd.is. However, we encourage you to contact us first so that we can resolve the matter.

11. Children

Our website and services are not directed at children under 13, and we do not knowingly collect personal data about them. Table reservations for children should be made by a parent or guardian.

12. Changes to This Policy

We may update this privacy policy, for example due to changes in the law or our services. The latest version is always available on this page, and the date of the last update is shown at the top.