Opens in a new tab

Privacy Policy

Last updated: 10/28/2026

Ós Restaurant is committed to responsibly handling the personal data of guests and others who contact us. In this policy, we explain what information we collect, how we use it, and what rights you have.

We process personal data in accordance with Act No. 90/2018 on Data Protection and the Processing of Personal Data and the General Data Protection Regulation (GDPR).

1. Data Controller and Contact Information

The data controller for the processing of personal data under this policy is:

Eyr Veitingar ehf, operator of Ós Restaurant
ID number: 5701251760
Address: Eyravegi 2, 800 Selfoss
Email: [email protected]

You can contact us at the email address above with questions about data protection or to exercise your rights.

2. What information do we collect and why?

We collect the information necessary to fulfill your requests and provide services. Depending on your interactions with us, this may include:

  • Inquiries and Communication: Contact information and the content of requests you send us, for example, via email or an inquiry form. We use this to respond to you and follow up on your request.
  • Transactions and Invoicing: Information about purchases, payments, and the information required for issuing invoices and accounting records.
  • Website Usage: Technical information, such as IP address, browser type, and records of errors or website access, depending on its setup. This is used to ensure the operation and security of the website.

Information is usually received directly from you. It may also come from a booking service you use or an individual booking on your behalf.

Necessary contact information must be provided for us to process a booking or request. Other information is optional unless otherwise stated.

3. On what basis do we process the information?

The processing of personal data is based on the following legal grounds, as applicable:

  • Contract or pre-contractual measures, when we accept bookings and provide requested services.
  • Legal obligation, including for accounting and invoicing purposes.
  • Legitimate interests, such as responding to general inquiries, ensuring website security, and protecting our rights in case of disputes. We assess these interests in relation to your rights.
  • Consent, when necessary, for example, for optional cookies or electronic marketing.

If we offer newsletter registration, consent is obtained separately. You can withdraw it at any time by unsubscribing or by contacting us.

4. Allergies and Special Needs

This information is used solely to accommodate your needs and is only accessible to those who require it to provide the service. It is deleted when no longer needed for the visit, unless there is a specific legitimate reason for longer retention.

You can withdraw your consent by contacting us. Withdrawal does not affect the lawfulness of processing that occurred before it was received.

5. Service Providers and Disclosure of Information

We may grant service providers access to personal data to the extent necessary, for example, for booking systems, web hosting, email services, payments, and accounting.

When a service provider processes information on our behalf, we enter into a data processing agreement with them as required by law. Some service providers, such as payment services, may be independently responsible for certain processing and will then provide their own privacy statements.

We also disclose information when legally obliged to do so or when it is necessary to establish, assert, or defend legal claims.

If personal data is transferred outside the European Economic Area, a legitimate transfer basis must be ensured. [Specify whether such transfers occur, to which countries, and on what basis, along with how information about appropriate safeguards can be obtained.]

6. Retention and Security

We do not store personal data longer than necessary for the purpose of processing.

Longer retention may be necessary due to legal obligations or disputes.

We implement appropriate technical and organizational measures to protect the information. Access is limited to those who need it for their work.

7. Cookies

The website may use cookies and similar technologies. Essential cookies are used to ensure the website’s functionality. If optional cookies are used, for example, for analytics or marketing, consent is requested before they are activated.

More information about cookies

8. Your Rights

Under the conditions of data protection laws, you may have the right to:

  • Receive information about processing and access your personal data.
  • Have inaccurate or incomplete information corrected.
  • Have information deleted or its processing restricted.
  • Object to processing based on legitimate interests.
  • Receive your own information in a machine-readable format and have it transferred to another party.
  • Withdraw consent at any time.

You can always object to the use of your personal data for direct marketing.

Requests can be sent to [email address]. We will respond without undue delay and generally within one month. If the deadline can be extended, we will inform you of this and the reasons within one month. We may request necessary verification of your identity before processing a request.

You also have the right to lodge a complaint with the Icelandic Data Protection Authority. More information is available at personuvernd.is.

9. Changes to the Policy

We will update the policy when there are changes to the processing of personal data or when otherwise necessary. The current version is published on osrestaurant.is along with the date of the last update.