Privacy & cookies

Last updated: 11 November 2026

Who we are

Hotel Lotus ehf. (Icelandic registration number, kennitala, 460613-0780), Álftamýri 7, 108 Reykjavík, Iceland, operates this website and is the data controller for the personal data described here. You can reach us at hotellotus@hotellotus.is or +354 517 5151.

We follow the Icelandic Data Protection Act No. 90/2018 and the EU General Data Protection Regulation (GDPR).

What this website collects

Browsing the website

Our hosting provider, Kinsta Inc. (EU entity: Blue Cloud Hosting Kft.), which hosts this website in a data centre in the European Union (the Netherlands) and protects it with Cloudflare, keeps standard server logs: your IP address, browser type, the pages you request, date and time, and the referring page. We use these logs only to keep the site secure and running. Access logs are rotated daily and deleted automatically within about a week; error logs, which can also contain an IP address, within about a month.

The website itself does not set cookies for simply reading our pages. Fonts, images and scripts are served from our own domain, not from third-party font services; the only third-party script is the BookVisit booking widget described below.

Contact form

When you send us a message through the contact form, we receive your name, email address, your message and, if you fill it in, your travel dates. We use this information only to answer you. The form sends your message to us by email; a copy is kept in the website’s outgoing-mail log for 30 days so we can check that messages were delivered, and is then deleted automatically. In our mailbox we keep your enquiry only for as long as needed to answer you.

To protect the form from automated spam we use a hidden check, a short time check and a limit on the number of messages per visitor. For that purpose the website keeps an anonymised (hashed) record of your IP address for one hour and a hashed fingerprint of your message for 24 hours; neither can be read back as your address or your text.

Room bookings

Availability searches and reservations are handled by our booking engine, BookVisit (BookVisit AB, Sweden). The search box on our home page and all “Book your stay” buttons take you to BookVisit. The personal data you enter there (name, contact details, payment details, special requests) is processed by BookVisit on our behalf to make and manage your reservation, and by us to host you. Card payments are handled by BookVisit’s payment provider; we never see your full card number. BookVisit may set its own cookies or use your browser’s storage to remember your search; please read BookVisit’s privacy policy for details. BookVisit processes this data under a data-processing agreement with us.

Booking records are kept for seven years, as Icelandic accounting rules require.

Telephone and email

If you call or email us directly, we use your details to answer you and, where you book, to manage your stay. Emails are kept in our mailbox under the same retention as above.

Analytics and marketing

This website does not currently use analytics or marketing cookies, and no visitor-statistics or advertising tools load when you browse it. If we add a visitor-statistics tool in the future, we will describe it on this page first and, where it uses cookies or similar identifiers, ask for your consent before it is switched on.

Cookies

Cookies are small files stored in your browser. This is what this website may use:

Name	Set by	Purpose	Duration	Type
__cf_bm	Cloudflare	Distinguishes people from automated traffic (bot protection) for our hosting provider	30 minutes	Necessary
BookVisit session storage	BookVisit widget	Keeps your selected dates while you book	Until the tab is closed	Functional
wordpress_*, wp-settings-*	This website	Only for staff who log in to edit the site	Session / 1 year	Necessary (staff only)

You can delete or block cookies in your browser settings at any time; the site keeps working without them, although the booking widget may then not remember your dates.

Why we are allowed to use your data

• Performance of a contract (GDPR art. 6(1)(b)): handling your booking and your stay.
• Legitimate interests (art. 6(1)(f)): answering enquiries, keeping the website secure and preventing spam.
• Legal obligations (art. 6(1)(c)): accounting and guest registration rules in Iceland.
• Consent (art. 6(1)(a)): any analytics or marketing cookies we may add in the future. You can withdraw consent at any time.

Who else sees your data

We share personal data only with service providers who process it for us under written agreements: our hosting provider, our email provider (Microsoft, whose Microsoft 365 / Outlook service hosts our mailboxes), BookVisit and its payment provider, and Cloudflare (security and content delivery for our hosting provider). We do not sell personal data. Some providers are based outside the European Economic Area; in those cases transfers are covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

How long we keep data

• Server logs: access logs about a week, error logs about a month.
• Contact form messages: 30 days in the website’s outgoing-mail log; the email itself is kept only as long as needed to handle your enquiry.
• Booking records: seven years, as Icelandic accounting rules require.

Your rights

You can ask us at any time to see the personal data we hold about you, to correct or delete it, to restrict or object to its use, or to receive it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting earlier processing. Write to hotellotus@hotellotus.is and we will answer within one month.

If you are not satisfied with our answer, you can complain to the Icelandic Data Protection Authority, Persónuvernd, Laugavegur 166, 105 Reykjavík, personuvernd.is, or to the data protection authority in your own EEA country.

Security

The website is served over HTTPS. Access to the website’s administration and to our mailbox is restricted to staff who need it. Payment details are handled entirely by our booking and payment providers.

Children

This website is not aimed at children, and we do not knowingly collect personal data from anyone under 16.

Changes to this policy

We may update this page when our services or the law change. The date at the top shows the latest version.