Privacy policies

Lapland Hotels City Oy (Business ID: 3432129-1)

Yrjö Kokontie 4, 99300 Muonio

Lapland Hotels Lappi Oy (Business ID: 2199747-9)

Yrjö Kokontie 4, 99300 Muonio

Hotel Haikko Oy (Business ID: 2764547-4)

Haikkoontie 114, 06400 Porvoo

Lapland Safaris Group Oy (Business ID: 0892158-4)

Koskikatu 1, 96200 Rovaniemi

Lapland Hotels & Safaris Services Oy (Business ID: 2041198-2)

Postikatu 1, 96100 Rovaniemi

Lapland Ski Resorts Oy (Business ID: 2448061-9)

Yrjö Kokontie 4, 99300 Muonio

Ylläs Ski Oy (Business ID: 2199743-6)

Yrjö Kokontie 4, 99300 Muonio

(Hereinafter referred to as the “Controller”)

Lapland Hotels City Oy and Lapland Hotels Lappi Oy (Lapland Hotels) form a group together with their subsidiaries. The subsidiaries process personal data as defined in this privacy policy. Lapland Hotels & Safaris Services Oy is the main processor, contact, and administrative body for the processing activities defined in this privacy policy.

Lapland Hotels & Safaris Services Oy
Postikatu 1, 96100 Rovaniemi
Email: gdpr.tietosuoja@laplandhotels.com

a) Customer, partner, and marketing register
b) Order register
c) Passenger register

The basis for registration is a business relationship with the customer or partner confirmed by a contract with the controller, a separate consent for processing customer data, the legitimate interest of the controller, or legislation. The purpose of the registers is to maintain the personal data required for cooperation between the controller’s customers and partners, ensure smooth customer service and the provision of benefits and services, enable marketing, as well as business planning and development.

The statutory purpose of the passenger register is to maintain public order and safety, prevent and investigate crimes, and serve statistical purposes. The information contained in the passenger register is also processed for customer service purposes.

Personal data is collected and processed with the customer or partner for the following purposes:

• Executing and confirming room purchases, program service purchases, lift ticket purchases, or other service/product purchases for the customer, as well as conveying related information to the service provider.

• Offering membership benefits.

• Executing and confirming purchases made through the online store for the customer.

• Producing and delivering the agreed services for corporate clients, as well as managing billing and customer relationships.

• Analyzing and developing products, services, and business, as well as compiling statistics.

• Collecting feedback, deviation, and satisfaction data.

• Advertising, marketing, and direct marketing. The data subject has the right to opt out of direct marketing targeted at them.

• Implementing the legitimate interests of the controller, such as responding to legal claims.

• Fulfilling the controller's statutory obligations.

Name and personal identity code or date of birth of minors
The controller may ask adult customers to enter the names or nicknames of minors in order forms. This data related to minors is not used for any other purpose than delivering the ordered product or service and fulfilling the legal obligations of accommodation service providers.

Cookies
Cookies are used to speed up page functionality, simplify login, and better tailor the content of the site to the user. You can find more detailed information about the purpose, basis, and content of the data collected via cookies in the cookie policy.

The registers may contain the following information:

a) Customer, partner, and marketing register

• Type of customer relationship: customer/partner/Club member

• Customer number

• Identification details (name, email, phone number, address, personal identity code)

• Contact person(s)

• Role of contact persons (Corporate clients)

• Billing information

• Membership points accumulation (Club members)

• Use of cookies

b) Order register

• Identification, contact, and billing information contained in the customer, partner, and marketing register

• Ordered and delivered services

• Information collected in connection with services provided by our partners

• Health or other sensitive information reported by the customer, such as information about diseases, allergies, and family

c) Passenger register

• Customer identification details

• Names and personal identity codes or dates of birth of spouse and minor children

• Country of arrival in Finland

• Personal identity code

• Nationality

• If the person is not a citizen of a Nordic country or their residence is not in Finland, the number of travel documents

• For users of the self-check-in online service, a digital copy of the travel document and the information it contains including a identification photograph

• Arrival date and possibly departure date

The primary source of personal data is the information provided by the customer or partner at the start of cooperation or during it, as well as information collected for research purposes from feedback, deviation, and satisfaction surveys related to the cooperation. Personal data is also accumulated from visits to customer service points. Personal data may be collected in connection with the purchase of additional services. Data may also be purchased from registers intended for marketing use as a secondary source.

The controller does not utilize personal data collected from customers in automated decision-making.

Data concerning the data subject may be disclosed within the controller and its subsidiaries and affiliates for the purposes described. Otherwise, data is disclosed only within the limits permitted and mandated by law.

Services may be provided using service providers located outside the EU or EEA. These services are essential for the practical implementation of the services. In such cases, personal data may be transferred outside the EU or EEA.

The personal data transferred outside the EU or EEA will primarily consist of cookie data, for example, information on how many users visit the website and how they navigate the site, but ensuring the quality, integrity, and accurate functioning of critical information systems for service provision may, on a case-by-case basis, also require the transfer of other personal data outside the EU or EEA. In these instances, individual pieces of information regarding specific data subjects may be transferred randomly, and such transfers will be conducted only to the extent necessary to resolve the specific case.

The controller has ensured adequate technical and organizational security measures with service providers. For example, standard contractual clauses approved by the EU Commission are used in contracts with service providers, and the transfers are based on a decision from the EU Commission regarding the adequacy of data protection in the recipient country. For further information, please contact the email address mentioned in section 2.

The starting point for processing personal data is the respect for the rights and freedoms of the data subject at all stages of data processing, and ensuring that the legal basis for processing personal data is established. The controller collects and processes only those personal data that are necessary for operations.

Access to digital materials is granted only through personal usernames and passwords to authorized employees, professionals, or partners. Access rights are of different levels, and each user is granted the minimum necessary access rights relevant to their tasks. Employees are trained and instructed to consider data security when handling personal data.

Personal data is stored only on secure devices. The controller’s IT devices are equipped with appropriate antivirus and firewall software, which is set to automatically download and install new software updates. Personal data is stored on encrypted cloud servers.

Customer/partner data is retained in the register for at least 1 year after the termination of the customer relationship and the fulfillment of all obligations, unless otherwise agreed or required by legislation.

Right of the data subject to access their data (right of inspection)
The data subject has the right to verify what information regarding them has been stored in the register. The inspection request must be submitted in writing and signed to the email address mentioned in section 2 of this privacy statement. The data subject should be prepared to verify their identity according to the instructions provided by the controller.

Right of the data subject to request rectification, deletion, or restriction of processing
The data subject may request the correction of their information upon becoming aware of an error or upon discovering an error themselves. If the data subject can rectify the error, they must promptly correct, delete, or complete any incorrect, unnecessary, or outdated information. If the data subject is unable to correct the information themselves, a request for correction must be made.

If the data subject cannot correct the information themselves, the correction request should be submitted in writing to the email address mentioned in section 2 of this privacy statement. The data subject should be prepared to verify their identity according to the instructions provided by the controller.

The data subject also has the right to request the controller to restrict the processing of their personal data, for example, when the data subject is waiting for a response to a request for rectification or deletion of their data.

The controller reserves the right to limit the number of free requests for rectification and deletion to one per year.

Right of the data subject to data portability
To the extent that the data subject has provided information to the registers, which is processed based on the data subject's consent or instruction, the data subject has the right to receive such data in a generally machine-readable format and the right to transfer this data to another controller.

Upon written request for transfer, the controller will provide the information described in the right of inspection section within a reasonable time, considering the extent of the information being provided. The data subject should be prepared to verify their identity according to the instructions provided by the controller.

Other rights
The data subject has the right to lodge a complaint with the competent supervisory authority if the controller has not complied with applicable data protection regulations in its operations.

In all matters and requests related to personal data, the data subject should contact the email address mentioned in section 2.

This privacy notice applies only to sites maintained by the data controller, and we are not responsible for the privacy practices of other sites. The site may contain links to third-party sites. We recommend that users review the privacy notices of any other sites they use.

Leadoo user tracking

We use Leadoo user tracking to monitor how visitors move around our website and combine this data with user information collected, for example, via chat interactions. Leadoo uses ETag tracking, which is technically different from cookie-based tracking but is governed by the same rules as cookies.

Check Leadoo Marketing Technologies Oy's privacy policy (https://leadoo.com/privacy-policy/) to learn more about what is tracked in the system. For GDPR purposes, we act as the controller and Leadoo as the data processor. If you do not want to be tracked, you can clear your browser's cache. For more information on how Leadoo operates, check https://leadoo.com/privacy-policy-processor/

The controller may change this privacy statement. The modified privacy statement will be available on the website so that users are always aware of how their personal data is being processed. Last updated on 1.7.2024.

1. Joint data controllers

Lapland Hotels City Ltd
Business ID: 3432129-1

Lapland Hotels Lappi Ltd
Business ID: 2199747-9

Hotel Haikko Ltd
Business ID: 2764547-4

Lapland Safaris Group Ltd
Business ID: 0892158-4

Lapland Ski Resorts Ltd
Business ID: 2448061-9

Ylläs Ski Ltd
Business ID: 2199743-6

2. Contact information for registry matters

Lapland Hotels City Ltd / Lapland Hotels Lappi Ltd
Yrjökokontie 4, 99300 Muonio
Email: gdpr.tietosuoja@laplandhotels.com

3. Name of the registry

Camera Surveillance Registry

4. Purpose and legal basis for processing personal data

The basis for registration is a business relationship established through an agreement between the customer or partner and the data controller, a separate consent for camera surveillance, and the legitimate interest of the data controller.

Personal data is collected and processed with the customer or partner for the following purposes:

• Ensuring the personal safety of employees and customers

• Protecting property

• Monitoring the proper functioning of the production process

• Preventing and investigating situations that threaten safety, property, and the production process

• Preventing and investigating obvious work-related hazards and threats

• Preventing and investigating crimes against property

• Ensuring the employee's interests and rights upon the employee's separate request

5. Contents and sources of the registry

The camera surveillance registry consists of digital video recordings from surveillance cameras. In addition to images, the registry records information about the monitored area or the machine where the camera is located, as well as the date and time of the recorded events.

The source of personal data in the registry is the video recording collected by the surveillance cameras and other related information.

6. Data disclosure

Data concerning the registered individual is stored on servers of the service provider that offers camera surveillance, from which data is accessed through a technical connection. Data is disclosed only within the limits permitted and required by law, for example, to law enforcement authorities in cases of suspected crimes.

Personal data is not transferred outside the EU or EEA.

7. Data security and retention

The basis for processing personal data is the respect for the rights and freedoms of the registered individual in all stages of data processing, ensuring that the legal basis for processing personal data is established. The data controller collects and processes only those personal data that are necessary for the operation.

Access to digital material is restricted to authorized employees using personal usernames and passwords. Access rights vary by level, and each user is granted the minimum necessary access for their tasks. Employees handling data are trained and instructed to consider data security when processing personal data.

Personal data is stored only on secure devices. The IT equipment used for processing has appropriate antivirus and firewall software that is set to automatically download and install new software updates. Personal data is stored on servers located within the EU and protected by the latest encryption methods.

The data controller retains personal data only for as long as necessary to fulfill the processing purposes defined in section 4 above. To ensure these purposes and the realization of the rights of the registered individuals, data is retained in the registry for 90 days, after which it is destroyed.

8. Other rights related to the processing of personal data

Right of access

The registered individual has the right to check what information has been stored about them in the registry. Requests for access must be submitted in writing and signed to the contact point mentioned in section 2 of this privacy statement. The registered individual must be prepared to verify their identity according to the instructions provided by the data controller.

Right to rectification, erasure, or restriction of processing

The registered individual can request correction of their data upon receiving information about an error or discovering an error themselves. If the registered individual has the opportunity to correct the error, they must promptly correct, erase, or complete the erroneous, unnecessary, or outdated data. If the registered individual cannot correct the information themselves, a request for correction must be made.

If the registered individual is unable to correct the data themselves, the correction request must be made in writing to the contact point mentioned in section 2 of this privacy statement. The registered individual must be prepared to verify their identity according to the instructions provided by the data controller.

The registered individual also has the right to request that the data controller restrict the processing of their personal data, for example, while waiting for a response to a request for correction or erasure of their data.

The data controller reserves the right to limit free requests for corrections and erasures to once per year.

Right to data portability

If the registered individual has provided data to the registry that is processed based on their consent or a commission, they have the right to receive such data in a machine-readable format and to transfer this data to another data controller.

Upon written request for transfer, the data controller will provide the information described in the right of access section within a reasonable time, considering the extent of the information to be provided. The registered individual must be prepared to verify their identity according to the instructions provided by the data controller.

Other rights

The registered individual has the right to lodge a complaint with the competent supervisory authority if the data controller has not complied with applicable data protection regulations.

9. Contacts

For any questions and requests related to personal data, the registered individual should contact the data controller's designated party mentioned in section 2.

10. Changes to the privacy statement

The data controller may change this privacy statement. The amended privacy statement will be available on the website to ensure that users are always informed about how their personal data is processed. Last updated on 1.7.2024.