Privacy Policy
The National Museum of Iceland functions according to the National Museum of Iceland Act no. 140/2011 and the Cultural Heritage Act no. 80/2012, and it is a principal museum in the field of cultural heritage. It is responsible for collection, cataloguing, preservation and research on the Icelandic cultural heritage, and mediation in Iceland and abroad.
The policy of the National Museum is to respect privacy at all times and to work only with those personal data which are necessary in order to fulfil the Museum‘s duties under the law. All personal data are processed in accord with legislation and rules on data protection, and care is taken to respect the rights of individuals, e.g. their access rights, under legislation and rules on data protection. Great emphasis is placed upon the application of measures to ensure the security of personal data. e.g. by use of active antiviruses and recognised encryption methods, and by separation of networks such as the visitor network and staff network.
This is the second edition of the National Museum of Iceland Privacy Policy. It was approved by a meeting of departmental heads on 21 September 2021.
Please direct any questions regarding privacy to
personuvernd@thjodminjasafn.is.
All questions on handling of personal data and the National Museum's privacy policy will be answered under guidance from the Museum's Privacy Officer.
What Personal Data is Processed
The National Museum of Iceland processes personal data about:
1. Involved parties in National Museum matters: Contact information (name, phone number, email, and address)and other relevant details contained in case documents. This includes information about those requesting access to view artifacts, borrowing artifacts for exhibitions, or sampling collection items. Other requests, such as for exhibitions, collaborations, and various administrative matters, are also recorded.
2. Employees and Job Applicants: Information provided in applications and generated during the handling of cases is recorded, processed in accordance with the requirements of the State Financial Authority.
3. Visitors: This includes visitors to exhibitions and events at the museum, teachers bringing school groups, individuals booking museum facilities, and other persons connected to the museum. Contact information is recorded in the booking system, photos taken of guests, entries in guest books, names, and email addresses on mailing lists, among other things.
4. Lecturers and Participants in Museum Events: This includes recordings of lectures which are shared on the museum's YouTube channel with the consent of the individuals involved.
5. Survey Respondents: Participants in the National Museum’s surveys for cultural research. Comprehensive information is collected based on consent, either in non-identifiable or identifiable form. The latter is only shared in accordance with data protection laws.
6. Individuals in Photos: At the Icelandic Photography Collection, photographic metadata is processed to enhance the preservation and knowledge value of the images. This information is primarily shared through the Sarpur database. The dissemination of images containing personal data complies with data protection laws.
7. Donors and Sellers of Artifacts: This includes the creators, previous owners, and those associated with artifacts, such as photographers, craftsmen, artists, and others. This information is recorded in the acquisition log and the Sarpur database.
How Personal Data is Processed
All processing of personal data by the National Museum of Iceland is based on legal authority, contracts, or the consent of the individual. The data processing register specifies the legal basis for the processing.
The data protection representative assists and advises on the handling and management of personal data and provides guidance on internal controls to ensure that the National Museum adheres to its own security measures.
The National Museum is required to submit documents to the National Archives of Iceland in accordance with the Public Archives Act No. 77/2014 and retains all documents until they are transferred to the National Archives, in accordance with established rules.
Cookies
The website of the National Museum of Iceland (https://www.thjodminjasafn.is/) uses various types of cookies. Users are informed about the types of cookies used and their purpose.
When users submit inquiries via the web form, only the necessary information to respond to the inquiry is requested. Once the inquiry is received, only the employees involved in answering the inquiry have access to the information. The intermediary in receiving inquiries is the museum's service provider's web system, hosted on a server located in Iceland. Submitted data is automatically deleted from the web system after 180 days, and no further collection or processing of the data occurs.
What is a Cookie?
Cookies are small text files placed on your computer or other smart devices when you visit the National Museum's website. They enable websites to recognize users' devices and remember where they have been online.
There are session cookies and persistent cookies. Session cookies allow websites to link actions of a user during a browser session and are generally deleted when the browser is closed. Persistent cookies remain on the user's device and remember user preferences or actions across multiple sites. The National Museum uses both types.
Cookies on the National Museum's Website
Cookies are either first-party or third-party cookies. This distinction is based on the domain placing the cookie. First-party cookies are set by the website the user is visiting, while third-party cookies are set by a different domaining, while third-party cookies are set by a different domain.
The National Museum's website uses both first-party and third-party cookies. The cookies used include:
First-Party Cookies
The museum uses two types of first-party session cookies to analyse traffic and collect statistical information about the use of the website. These cookies are deleted when you close your browser. The collected information helps to determine which parts of the website are more frequently visited.
The museum also uses one persistent first-party cookie stored on the user’s device for up to two years to identify whether the user has visited the website before and how often.
The use of these cookies is based on the legitimate interests of the National Museum. Users can choose to disable these cookies.
Third-Party Cookies
The website also uses third-party cookies from Google Analytics and Facebook. These cookies are used by Google and Facebook to personalize ads and measure the usage of the National Museum's website. These cookies are stored on the user’s device for up to 24 months. These third-party cookies are classified as marketing cookies, which collect personally identifiable information about users based on their consent, which can be withdrawn at any time.
For more information on how advertisers use such cookies or to opt out, users in the European Union can visit Your Online Choices, and users in the United States can visit
Your Ad Choices.
How to Disable Cookies
Users can change cookie settings and prevent the National Museum from collecting statistical cookies. If consent is given for marketing cookies, it can be withdrawn at any time by disabling cookies on the website or deleting them from the browser.
Instructions for deleting cookies in various browsers can be found on the respective browsers' information pages:
Web Analytics
Google Analytics and Facebook Pixel are used to measure usage on the National Museum's website. Information such as time and date of visit, search terms, referral sites, and browser and operating system types are recorded. This data helps improve and develop the website, making popular content more accessible, determining supported browsers, and measuring marketing effectiveness. This information is not personally identifiable.
SSL Certificates
The National Museum's website uses SSL certificates, ensuring that all data transferred to and from the site is encrypted and secure. SSL certificates prevent unauthorized parties from accessing data sent through the website, such as passwords.