Privacy Policy
November 2, 2026
PRIVACY POLICY — FLÓRACOLLECTION WEBSITE
Flóra hotels ehf. ("we," "us," "theCompany") respects your privacy. This policy explains how we collect, use,and protect personal data when you visit floracollection.is (“the Website”), incompliance with the General Data Protection Regulation (GDPR) and the IcelandicData Protection Act (Lög um persónuvernd og vinnslu persónuupplýsinga nr.90/2018).
This policy covers the Website only. Personal data processed inconnection with bookings and stays at our hotels is covered by the GuestPrivacy Policy of the hotels, available on the websites of the hotels. Thebooking engine on the Website (BookVisit) processes booking data on behalf ofthe hotel you book with; see Section 5 below.
1. WHO WE ARE
Flóra hotels ehf. is the data controller for personal data collectedthrough this Website, such as contact form submissions, newsletter sign-ups andwebsite analytics. Each hotel is operated by a separate company, which is thecontroller for bookings and stays: Reykjavík Residence Hótel ehf. (reg. no.530906-0940), ODDSSON Midtown hótel ehf. (reg. no. 500620-0210), ODDSSONdowntown hótel ehf. (reg. no. 590115-0530), Tower Suites Reykjavík ehf. (reg.no. 571017-1640), 201 Hótel ehf. (reg. no. 410617-1450) and Port 9 ehf. (reg.no. 510216-1130). Flóra hotels ehf. provides services to these companies undera data processing agreement.
Flóra hotels ehf.
Hagasmári 3, 201 Kópavogur,Iceland
Reg. no. (kennitala) 651116-2790
personuvernd@flora.is
2. WHAT DATA WE COLLECT
Depending on how you use theWebsite, we may collect:
- Contact details you providevia contact forms (name, email, phone number, message content)
- Newsletter sign-upinformation (email address, and name if provided)
- Technical data collectedautomatically via cookies and analytics tools (IP address, browser type, devicetype, pages visited, time on site, referring website)
- Any information you provideif you contact us directly by email or phone
We do not collect payment card details, booking dates,or stay information through the Website itself — this data is collected throughthe booking engine on behalf of the hotel you book with and is covered by theGuest Privacy Policy.
3. HOW WE USE YOUR DATA
We use the data describedabove to:
- Respond to enquiries submitted via contact forms
- Send newsletters orpromotional communications, where you have opted in
- Understand how visitors usethe Website, to improve content and performance
- Maintain the security and proper functioning of the Website
- Comply with legal obligations where applicable
We do not use contact form or newsletter data forautomated decision-making or profiling.
4. LEGAL BASIS FOR PROCESSING
We process your data on thefollowing legal bases:
- Consent (Art. 6(1)(a) GDPR)— for newsletter sign-up and for non-essential cookies, see Art. 88(2) of theIcelandic Electronic Communications Act No. 70/2022
- Legitimate interest (Art. 6(1)(f) GDPR) — for responding to enquiries,maintaining Website security and, for guests of our hotels, sending marketingabout similar services with an opt-out in every email, see Art. 94(2) of ActNo. 70/2022
- Legal obligation (Art.6(1)(c) GDPR) — where retention or disclosure is required by law
You may withdraw consent atany time (see Section 8).
5. THIRD-PARTY DATA SHARING
We do not sell your personaldata. We share data with the following categories of third party wherenecessary:
- BookVisit (Visit Group): the booking engine used by our hotels. Whenyou make a booking, BookVisit processes your booking, contact and payment dataas a processor on behalf of the hotel you book with, under a data processingagreement. That processing is described in the Guest Privacy Policy, availableon the websites of the hotels.
- Analytics and website personalisation providers — used to understandWebsite traffic and usage patterns and to show you relevant content and offers.
- Email/newsletter platform:Klaviyo — used to send newsletters to subscribers.
- Our hosting provider — hoststhe Website and its underlying infrastructure.
Some of these providers, including Klaviyo, process data in the UnitedStates. Such transfers are based on Standard Contractual Clauses under Art. 46GDPR and, where the provider is certified, the EU-US Data Privacy Framework,which applies in Iceland under Decision of the EEA Joint Committee No.169/2024. When handling enquiries we may use AI tools, such as Claude byAnthropic, under a data processing agreement with Standard Contractual Clauses;no payment card data or special categories of data are entered into such tools.
6. COOKIES
The Website uses cookies to operate correctly and to understand visitorbehaviour. Cookies used may include:
- Strictly necessary cookies (required for the Website to function)
- Analytics cookies (used tomeasure Website traffic and performance)
- Functional and personalisation cookies (used to remember your choicesand personalise content, where consent is given)
You can manage or withdrawcookie consent at any time via the cookie settings banner on the Website, orthrough your browser settings. For full details, see our Cookie Policy on theWebsite.
7. DATA RETENTION
We retain personal data only as long as necessary for the purpose it wascollected:
- Contact form submissions: 12months after the enquiry is closed, unless the enquiry leads to a booking, inwhich case the Guest Privacy Policy applies
- Newsletter data: until youunsubscribe or withdraw consent
- Analytics data: for nolonger than the retention period set in the analytics tool, which we review atleast annually
8. YOUR RIGHTS
Under GDPR and Icelandic dataprotection law, you have the right to:
- Access the personal data wehold about you
- Request correction ofinaccurate data
- Request deletion of yourdata, where applicable
- Object to or restrictcertain processing, and receive the data you provided to us in amachine-readable format (data portability)
- Withdraw consent at anytime, without affecting the lawfulness of processing carried out beforewithdrawal
- Lodge a complaint with the Icelandic Data Protection Authority(Persónuvernd), www.personuvernd.is
To exercise any of theserights, contact us at personuvernd@flora.is. We respond within one month ofreceiving your request, see Art. 12(3) GDPR.
9. DATA SECURITY
We apply appropriate technical and organisational measures to protectpersonal data collected through the Website against unauthorised access, loss,or misuse. However, no method of transmission over the internet is completelysecure, and we cannot guarantee absolute security.
10. CHILDREN'S DATA
The Website is not directed at children, and we do not knowingly collectpersonal data from individuals under 13. If you believe a child has provided uswith personal data, please contact us so we can remove it.
11. CHANGES TO THIS POLICY
We may update this policy from time to time to reflect changes in ourpractices or legal requirements. The version published on the Website at thetime of your visit applies. Material changes will be indicated by an updated"last revised" date.
Last revised: October 2026
12. CONTACT
Flóra hotels ehf.
Hagasmári 3, 201 Kópavogur,Iceland
Reg. no. (kennitala) 651116-2790
privacy@floracollection.is