Privacy policy
1 Privacy Notice
About us
This Privacy Notice provides information about how sp/f KEG (“Egholm”, “Egholm Tours”, “we”, “us”, “our”) processes personal data. The Notice is intended for all parties from whom we collect or receive personal data, such as guests, customers, our employees or employees of our suppliers and business partners, or other third parties.
Our processing of personal data
sp/f KEG is the data controller for the processing of the personal data registered about you. As data controller, we are obliged to ensure that the processing complies with the requirements applicable at any given time under the Faroese Data Protection Act.
sp/f KEG hereby informs you about a number of matters and rights that you have under the Faroese Data Protection Act. This Notice describes in further detail how sp/f KEG processes and protects the personal data for which we are responsible.
sp/f KEG is primarily obliged to provide information about:
- The purpose of our processing of personal data,
- The legal basis for our processing,
- the categories of personal data processed, and
- any recipients of the data.
sp/f KEG is responsible for personal data relating to employees of sp/f KEG, customers, business partners and suppliers in connection with our activities and services.
The processing of personal data will always be carried out on the basis of this Notice. In certain cases, sp/f KEG may issue or provide separate information about the processing of personal data if the processing is not adequately described in this document.
As a general rule, sp/f KEG does not transfer personal data to a third country. However, we may use selected IT providers that have their registered office in, or process data in, a third country, including the USA. In such cases, we ensure that agreements corresponding to the standard contractual clauses are entered into with the provider.
Our processing activities as data controller
Website visitors |
|
Purpose: We process personal data in order to provide specific services, including booking a standard or special tour. In addition, the website uses certain cookies that record information about the visitor’s device (computer/tablet/smartphone) in order to improve our website and provide the visitor with a better experience.
Read more about our use of cookies or change your settings in our Cookie Notice. |
|
Legal basis for processing: We process the data on the basis of consent from the data subject pursuant to section 8(1)(1) of the Faroese Data Protection Act.
In addition, the processing is based on our legitimate interests when we carry out internal analyses of website traffic in order to improve the performance of the website and the visitor experience, pursuant to section 8(1)(6) of the Faroese Data Protection Act. |
|
Categories of personal data: We process ordinary personal data submitted to us by the visitor through the website, including name, address, email address and telephone number, as well as information about applications for support and purpose.
In addition, we process personal data relating to the visitor’s device, IP address and cookie settings. |
|
Source: The data is obtained from the visitor. |
|
Retention period: Read more about this in our Cookie Notice. |
Digital communications |
|
Purpose: The purpose of our processing is to communicate with our customers, employees, business partners and suppliers, as well as to maintain a presence on social media platforms. |
|
Legal basis for processing: The processing is based on our legitimate interests arising from our need to communicate in connection with the day-to-day operation of the company and to advertise on social media, pursuant to section 8(1)(6) of the Faroese Data Protection Act. |
|
Categories of personal data: We process ordinary personal data such as name, job title and other information that may form part of the communication. Digital communications may also include information about another third party that the sender provides to us. |
|
Source: The data is obtained from the person who sends us messages through digital communication platforms. |
|
Retention period: Data that you provide to us on social media may be retained on the platforms until you choose to delete it through your own account. |
Job applications |
|
Purpose: The purpose of the processing is to process job applications and assess the applicant’s qualifications for a current or future position with us. |
|
Legal basis for processing: The processing is based on our legitimate interests in processing and assessing applications, pursuant to section 8(1)(6) of the Faroese Data Protection Act.
In certain cases, an applicant may consent to our retention of the application for a limited period in case a position becomes available at a later date, pursuant to section 8(1)(1) of the Faroese Data Protection Act. |
|
Categories of personal data: We process ordinary personal data submitted by the applicant, including name, address, telephone number and email address, as well as other information submitted by the applicant, such as a CV, examination results, photographs and other material. |
|
Source: The data is obtained from the applicant. During a recruitment process, we may also search for publicly available information about the data subject online and on social media. |
|
Retention period: Job applications are retained until the recruitment process has been completed. Unsolicited applications are deleted 24 months after receipt. |
Management of supplier relationships |
|
Purpose: The processing is necessary for us to manage our contracts with suppliers and to procure and receive goods and services from our suppliers. |
|
Legal basis for processing: The processing is based on our legitimate interest in managing our supplier relationships and developing our services, pursuant to section 8(1)(6). |
|
Categories of personal data: We process ordinary information about the supplier as well as contact details relating to specific employees of the supplier. |
|
Source: The data is obtained from the supplier or the supplier’s employees. |
Regulatory requirements |
|
Purpose: The processing is necessary for us to comply with legal and regulatory requirements. |
|
Legal basis for processing: The processing is necessary for compliance with our legal obligations pursuant to section 8(1)(3). |
|
Categories of personal data: The data we process depends on the legal and regulatory requirements to which we are subject. This may include accounting information and passenger registration. The personal data processed may include names and contact details, as well as information about purchases and bookings. |
|
Source: The data is usually generated internally when it is collected in connection with other processing activities. |
Recipients of data
Service providers: We use various service providers and IT providers in our day-to-day operations. This includes providers that manage and host our website solutions, as well as providers of internal IT systems used for our own administration and operations. Where external IT providers process personal data on our behalf and for which we are responsible, we ensure that the necessary agreements are in place with the relevant providers to ensure an adequate level of data protection.
Banks and payment service providers: In connection with payment for purchased goods and services, we cooperate with banks and payment service providers. Personal data, such as names, payment details and booking information, may be disclosed to these providers in order to process payments securely.
Transport providers: In connection with the transport of ordered goods, we cooperate with transport providers. In such cases, names, contact details and information about the booking may be disclosed to the transport provider to ensure efficient handling.
The police and public authorities: Where necessary, relevant data may be disclosed to the police in connection with establishing theft or other unlawful activity. We may also be required to disclose personal data to public authorities. This may include TAKS, the Social Services, the Working Environment and Fire Safety Authority, the Faroese Food and Veterinary Authority or other relevant authorities, in accordance with applicable rules.
IT security and data protection
We prioritise your right to privacy and have implemented technical and organisational measures to protect the confidentiality, integrity and availability of your personal data.
Your rights and how to exercise them
Under the Faroese Data Protection Act, you have a number of rights, which are described in further detail in Chapter 4 of the Act. These rights are:
- The right to information under sections 23–25
- The right of access under section 26
- The right to rectification under section 27
- The right to erasure under section 28
- The right to restriction of processing under section 29
- The right to data portability under section 31
- The right to object under sections 32–34
- The right not to be subject to decisions based on automated processing
For example, you have the right to access your personal data, to have data deleted where sp/f KEG no longer has a purpose for retaining it and a lawful basis for processing it, and to have your personal data rectified if it is inaccurate.
If you have questions about your rights or wish to request access or similar, you may send us a message through the website or by email.
We recommend that you do not send us sensitive or confidential information in this connection.
Contact
If you have questions about our processing of your personal data or wish to exercise your rights as described above, you are always welcome to contact us.
Sp/f KEG
Undir Kongavarða 102
FO-160 Argir
The right to lodge a complaint with the Data Protection Authority
If you wish to complain about our processing of your personal data, please send us a message through the website or by email describing the matter. We will consider the complaint and respond to you.
If you believe that we do not process your personal data in accordance with the rules of the Faroese Data Protection Act, you may lodge a complaint with the Data Protection Authority. For further information about how to submit a complaint to the Data Protection Authority, please refer to the Authority’s website at www.dat.fo.
Updates
Our Privacy Notice is updated on an ongoing basis when relevant changes occur. The Privacy Notice was last updated on 10 July 2026.10.07.2026