Privacy policy

We collect only the personal data reasonably necessary to operate the platform, process bookings and provide the services you request.

Contact information

This may include:

• name;

• email address;

• telephone number, where required;

• nationality, where required by an activity operator for operational, safety or regulatory purposes.

Booking information

When you make a booking, we may collect:

• activity or experience booked;

• booking date and time;

• number of travellers;

• traveller names where required;

• meeting or pick-up location;

• accommodation or pick-up information;

• selected extras;

• booking reference;

• special requests;

• information requested by the activity operator.

For certain activities, operators may require information such as age, height, weight, clothing size or other information necessary for safety or operational purposes.

We aim to collect such information only when it is necessary for the activity concerned.

Payment information

We may process:

• amount paid;

• currency;

• transaction reference;

• payment status;

• refund information;

• payment method.

Card and wallet payments are handled by third-party payment providers.

Guide to Lapland does not receive or store your complete payment card number.

Account information

If you create a Guide to Lapland account, we may collect:

• email address;

• account profile information;

• authentication information.

Passwords are not stored in readable form.

Communications

If you contact us, we may retain relevant correspondence, including emails and customer-service messages, so that we can respond to your request and maintain appropriate records.

Technical information

When you use our website, certain technical information may be processed automatically, including information necessary for security, website operation, session management and fraud prevention.

Your data is shared only where a booking cannot happen without it:

• The operator running your activity — the details they need to receive you at the meeting point
• Bókun (Iceland) — the reservation platform through which bookings reach operators
• Stripe (Ireland) — card payments
• YabandPay — Alipay and WeChat Pay
• Resend — sending your confirmation and voucher emails
• Hetzner (Germany / Finland) — where the site and database are hosted

We do not sell personal data, and we do not share it for advertising.

We process personal data for the following purposes:

To process and manage your booking

We use your information to:

• create and confirm bookings;

• transmit necessary booking information to the activity operator;

• issue booking confirmations and vouchers;

• manage amendments and cancellations;

• process refunds;

• respond to booking-related requests.

The legal basis for this processing is generally the performance of a contract or taking steps at your request before entering into a contract.

To process payments

Payment-related information is processed so that we can receive payments, issue refunds and reconcile transactions.

The legal basis is generally the performance of a contract and, where applicable, compliance with our legal obligations.

To communicate with you

We may send operational messages concerning your booking, including:

• booking confirmations;

• vouchers;

• schedule changes;

• meeting-point information;

• cancellation notices;

• important information supplied by the operator.

These are service communications and are necessary for us to provide your booking.

To comply with legal obligations

We may process and retain information where necessary to comply with Finnish or EU legal requirements, including accounting, taxation and regulatory obligations.

To protect our platform

We may process limited personal and technical information where necessary to:

• prevent fraud;

• protect our systems;

• investigate misuse;

• maintain the security and integrity of the platform.

Where applicable, this processing is based on our legitimate interests in operating a secure booking service.

We share personal data only where reasonably necessary to operate the platform, complete your booking, process payments or comply with legal obligations.

Activity operators

Relevant booking information is provided to the local operator responsible for delivering the experience you booked.

Operators receive only the information reasonably necessary to provide the activity, manage safety requirements and identify your booking.

Booking technology providers

We use third-party booking systems to transmit and manage reservations.

These currently include:

Bókun — reservation and booking technology.

Depending on the activity, other booking or reservation technology providers may also be used.

Payment providers

Payments may be processed through providers including:

Stripe — card and supported digital-wallet payments.

YabandPay — including supported Alipay and WeChat Pay transactions.

Payment providers process payment information according to their own privacy policies and legal obligations.

Email and communications providers

We use service providers including:

Resend — for sending booking confirmations, vouchers and service emails.

Hosting and infrastructure

Our website and database infrastructure may be hosted by:

Hetzner — hosting and infrastructure services in Europe.

We may change or add service providers as our platform develops. Where required, we enter into appropriate data-processing arrangements with service providers handling personal data on our behalf.

We do not sell personal data.

We do not provide personal data to third parties for their own unrelated advertising purposes.

Your existing policy already identifies these main recipients.

• Some service providers or activity operators may process personal data outside the European Economic Area (EEA).

  Where personal data is transferred outside the EEA, we take appropriate measures required by applicable data-protection law.

  Depending on the destination and recipient, these measures may include:

  • an adequacy decision adopted by the European Commission;

  • Standard Contractual Clauses approved by the European Commission;

  • other lawful transfer mechanisms permitted under the GDPR.

• We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to comply with legal obligations.

  Different categories of information may therefore have different retention periods.

  Booking and transaction records

  Booking, payment and refund records may be retained for the period required under Finnish accounting, taxation and other applicable legislation.

  Account information

  Account data may be retained for as long as your account remains active and for a reasonable period afterwards where necessary for security, dispute resolution or legal compliance.

  Customer-service correspondence

  Customer-service communications may be retained for a reasonable period where necessary to manage bookings, resolve disputes, prevent fraud or maintain business records.

  Where personal data is no longer required, it will be deleted or anonymised where reasonably practicable.

• Under the General Data Protection Regulation (GDPR), you may have the right to:

  • request access to your personal data;

  • request correction of inaccurate personal data;

  • request deletion of your personal data;

  • request restriction of processing;

  • object to certain processing;

  • request data portability where applicable;

  • withdraw consent where processing is based on consent.

  These rights are subject to applicable legal conditions and exceptions.

  For example, we may be required to retain certain booking and payment records even if you request deletion because Finnish law requires those records to be retained. Your existing draft already recognizes this accounting-record exception. Privacy policy · Guide to Lapla…

  To exercise your rights, contact:

  support@guidetolapland.com

  We may ask for reasonable information to verify your identity before processing your request.

  We will respond within the time limits required by applicable data-protection law.

  You also have the right to lodge a complaint with the competent data-protection supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman.

• Guide to Lapland uses cookies and similar technologies required for the operation of the website.

  Essential cookies may be used for purposes such as:

  • maintaining your browsing session;

  • keeping items in your basket;

  • keeping you signed in;

  • enabling checkout;

  • maintaining website security.

  If we use analytics, advertising or other non-essential cookies, we will provide appropriate information and, where required by law, request your consent before those cookies are activated.

  This wording is safer than the current absolute statement that you use only essential cookies and no tracking cookies, because the current version would become inaccurate as soon as analytics or marketing technology is added. Your present draft currently makes that absolute claim.

• If you make a booking on behalf of another person, you are responsible for ensuring that you are authorised to provide their personal information to us and to the relevant activity operator.

  Where appropriate, you should make those travellers aware of this Privacy Policy.

• We use reasonable technical and organisational measures designed to protect personal data against:

  • unauthorised access;

  • accidental loss;

  • alteration;

  • disclosure;

  • misuse.

  However, no internet-based service can guarantee absolute security.

• Our website may contain links to activity operators, payment providers or other third-party websites.

  Those third parties may process personal data independently and according to their own privacy policies.

  Guide to Lapland is not responsible for the privacy practices of third-party websites that are not operated by us.