PRIVACY
Privacy policy
How IceExpo handles contact enquiries, analytics consent, cookies and your privacy rights.
Last updated: 16 October 2026
Who is responsible and what this policy covers
Nexum ehf., company ID 510220-1370, Skútuvogur 3, 104 Reykjavík, Iceland, operates IceExpo and is the controller responsible for personal data processed through www.iceexpo.is. For privacy questions or requests, contact [email protected] or call +354 567-8004.
This policy covers the IceExpo marketing website and its contact form. Exhibition websites, ticket purchases and accounts on the IceExpo platform have their own applicable privacy information. This website has no account registration, Meta or TikTok pixels, or advertising remarketing tags. We do not sell personal data.
We process personal data under Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data and the General Data Protection Regulation (GDPR), as applicable in the European Economic Area (EEA).
When you contact us
Our form collects your first name, last name, email address and message. A telephone number is optional. We use this information to answer your enquiry, arrange a demonstration and discuss the services you request. Please do not include sensitive personal information that is unnecessary for your enquiry.
The legal basis is our legitimate interest in communicating with people who contact our business (GDPR Article 6(1)(f)). Where your request concerns entering into a contract with us, we also process the information to take steps at your request before a contract (Article 6(1)(b)). Providing the required fields is necessary to send the form and receive a reply; you can also contact us by email or telephone.
Messages are delivered to the Nexum team by email using Amazon Web Services Simple Email Service (AWS SES). We do not use contact-form submissions to subscribe you to marketing emails or send their contents as analytics events.
Technical operation and security
When you visit, our hosting and security providers process technical information such as your IP address, requested URL, request time, browser information and response status. This helps deliver pages, diagnose errors and prevent abuse. Our contact service also uses temporary IP-based submission limits and anti-spam checks.
We use Hetzner for hosting and Cloudflare for delivery and security. These functions are based on our legitimate interest in operating a reliable, secure website (Article 6(1)(f)). Cloudflare may use strictly necessary security cookies when its protection features require them. These are distinct from optional analytics. Fonts are served from our own website.
Google Analytics and your choice
We use Google Analytics 4 only after you allow analytics in the cookie banner. It helps us understand page visits, interactions, referral sources, approximate location and device or browser characteristics so that we can improve the website. Google processes identifiers and technical information for this purpose. According to Google, Google Analytics does not log or store IP addresses.
The legal basis for analytics is your consent (Article 6(1)(a)). Advertising storage, advertising personalisation and Google signals are disabled in our website integration. You can reject analytics and continue using the website, including the contact form.
You can change your choice or withdraw consent at any time through Cookie settings in the footer. Withdrawal stops future analytics collection by this site and removes the Google Analytics cookies it can access. It does not affect the lawfulness of processing before withdrawal or automatically erase previously collected data; you can contact us about a deletion request.
Cookies and local storage
We store your analytics preference in browser local storage under iceexpo.analytics-consent.v1 for 180 days. It records your choice and its expiry, not your browsing history. This is necessary to remember and respect your preference; clearing your browser storage removes it.
If you consent, Google Analytics uses first-party cookies such as _ga and _ga_38YH3Z29H0 to distinguish browsers and maintain measurement state. Our integration sets their expiry to 180 days; activity while consent remains valid may renew cookie expiry. Cookie lifetime is separate from how long analytics reports are retained.
Your browser also lets you delete or block cookies and local storage. Doing so may cause the consent banner to appear again.
Search Console and external websites
We use Google Search Console to review search visibility, indexing and reports about how people find our pages in Google Search. Search Console is separate from Google Analytics. Our use of it does not install a visitor-tracking script or cookie on this website.
Links to exhibition websites and other external websites take you to services with their own privacy practices. This policy does not cover their processing.
Who receives information and international transfers
Access is limited to authorised Nexum personnel and service providers who need the information for the purposes above. Providers include Hetzner, Cloudflare, AWS SES and Google Analytics, as well as providers of our business email services. We may also disclose information where a legal obligation requires it or where necessary to establish, exercise or defend legal claims.
Some providers operate globally, so information may be processed outside the EEA, including in the United States. Where such transfers occur, applicable safeguards include an adequacy decision or the European Commission’s Standard Contractual Clauses under the relevant provider’s data-processing terms. You can contact us for information about the safeguards relevant to your data and how to obtain a copy.
How long we keep information
We keep enquiries and correspondence for as long as needed to respond, complete requested follow-up and manage the resulting business relationship. We assess continued retention by the status of the enquiry, contractual or statutory record-keeping duties and whether information is needed for a legal claim. Information no longer needed for these purposes is deleted or anonymised.
Technical and security records are retained for the period needed to investigate errors, detect abuse and resolve security incidents, subject to the relevant provider’s retention arrangements. Analytics retention follows the configured Google Analytics retention controls and the need to evaluate website performance; aggregated reports may be retained longer than individual event data. Browser preference and analytics-cookie lifetimes are described above.
You may ask us for information about the retention applicable to your personal data or request deletion. Records needed to comply with law or address legal claims may be retained despite a deletion request.
Your rights and complaints
Subject to the conditions in data-protection law, you may request access, correction, deletion or restriction of processing, and receive data you provided in a portable format where the right to portability applies. You may object to processing based on legitimate interests, taking account of your particular situation, and withdraw consent at any time.
Send requests to [email protected]. We may ask for information reasonably necessary to confirm your identity. We normally respond within one month; if a lawful extension is needed, we will tell you within that month. We do not use your data for solely automated decisions producing legal or similarly significant effects.
You may complain to Persónuvernd, the Icelandic Data Protection Authority, at personuvernd.is, or to another competent EEA supervisory authority. You do not have to contact us before making a complaint.
Changes to this policy
We update this policy when our processing or relevant requirements change. The date shown on this page identifies the latest version. Where a change requires new consent, we will ask for it before starting that processing.