SitePass Privacy Notice

Last updated: 17 October 2026

Controller and contact

TG-Travel ehf. (Icelandic company number 561208-0500), Skógum, 861 Hvolsvöllur, Iceland, is the controller. Contact [email protected] with privacy questions or requests.

Information we use

Cameras may capture vehicles and people. Automatic number-plate recognition records images, plate readings, detection times and inferred visits. Staff may correct readings. For unpaid visits, we may obtain registered-owner details from the vehicle register where necessary and lawful.

For purchases, we use the plate, visit date, vehicle category, email address, order and payment references, payment status and failure information. We record acceptance of the purchase terms and limited checkout diagnostics. Rapyd handles card data; we do not store full card numbers or security codes. A plate and email address are required to buy online.

Why we use the information

We use purchase data to provide the pass, confirm payment, send receipts and provide support under the purchase contract (Article 6(1)(b) GDPR). We keep required accounting records to meet legal duties (Article 6(1)(c)).

Cameras and related records help us manage access, match payments, correct readings and follow up unpaid fees. Checkout diagnostics help resolve errors and protect the service. These are our legitimate interests (Article 6(1)(f)); we limit the processing to what is necessary and take visitors' rights into account.

Where information is stored and shared

Video stays on the on-site UniFi recorder; plate and visit records are stored in SitePass on Microsoft Azure. Access is limited to authorised TG-Travel and SitePass personnel. Ecwid handles orders and Rapyd payments. We may provide necessary records to advisers or collection providers for a specific claim, or to authorities as the law permits or requires.

How long we keep information

We keep personal data for as long as needed to provide SitePass, resolve payment and visit issues, handle complaints or claims, and meet legal obligations. Camera footage may be overwritten as storage cycles. Purchase and accounting records are kept as required by law.

Your rights

You can request access, correction, erasure or restriction, or object to our legitimate-interest processing. Data portability may apply to information you provide for a purchase. Legal exceptions and other people's privacy may limit these rights. Contact [email protected] with the plate and visit date if relevant; we may verify your identity. You can complain to the Icelandic Data Protection Authority (Persónuvernd) at island.is/s/personuvernd.