Privacy policy
Last updated: August 6, 2026
Flow Lapland Oy is committed to protecting the privacy of its customers and website users. This Privacy Policy explains how we collect, process, and protect your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national legislation.
1. Data Controller
Company: Flow Lapland Oy
Business ID: 3619997-1
Address: Rovakatu 11, 96100 Rovaniemi
Email: info@flowlapland.fi
Contact Person for Privacy Matters: Antti Arvola, antti@flowlapland.com
2. What Personal Data We Collect and Why
We collect personal data primarily to manage bookings, provide customer support, execute activities safely, and comply with our legal obligations.
A. Basic Identification and Contact Information
Data collected: Full name, email address, phone number.
Purpose: Sending booking confirmations, receipts, critical tour updates (e.g., schedule changes, weather alerts), and handling customer support.
B. Tour Execution and Safety Information
● Data collected:
Clothing and shoe sizes (for selecting appropriate thermal gear).
Dietary requirements and food allergies (for organizing snacks, campfire meals, and beverages).
Information regarding physical fitness or health conditions (voluntarily disclosed by the customer to ensure safety during activities).
● Purpose: Ensuring customer safety, comfort, and compliance with statutory activity safety regulations (Finnish Consumer Safety Act).
C. Payment Details and Booking History
Data collected: Booking history, selected services, receipts, and payment method details.
Purpose: Payment verification, accounting, and managing refunds. (Note: We do not store or process full credit card numbers; payments are handled via secure third-party payment gateways).
3. Legal Bases for Processing Data (GDPR)
We process your personal data based on the following legal grounds:
Contract Performance: Data is required to execute the booked tour or experience (GDPR Art. 6(1)(b)).
Legal Obligation: Compliance with statutory obligations, such as accounting laws and consumer safety standards (GDPR Art. 6(1)(c)).
Legitimate Interest: Conducting business, managing customer relationships, and maintaining operational safety (GDPR Art. 6(1)(f)).
Consent: Health details (such as allergies or physical limitations) are processed based on your explicit consent to ensure a safe experience (GDPR Art. 9(2)(a)).
4. Data Sharing and Third Parties
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
We may share necessary data with trusted service providers (data processors) who enable our operational systems:
Booking System: Bokun (Tripadvisor LLC) – for managing bookings and customer details.
Payment Processors: Secure payment service providers (e.g., Stripe)
Accommodation & Transport Partners: If your tour includes transfers or subcontracted services, we share only necessary details (e.g., name and pick-up point).
Authorities: We disclose data to authorities only when required by law (e.g., rescue services or police in emergencies).
5. Data Transfers Outside the EU/EEA
We primarily process data within the EU/EEA. If we use international system providers (e.g., cloud platforms or global reservation tools), we ensure transfers comply strictly with GDPR using EU Commission-approved Standard Contractual Clauses (SCCs) or other valid transfer mechanisms.
6. Retention Period
We retain your personal data only as long as necessary to fulfill the purposes described in this policy:
Booking and Customer Data: Retained for the duration of the customer relationship and for a reasonable period thereafter to resolve potential claims or inquiries.
Accounting Records: Retained for 6 years following the end of the financial year, as required by Finnish accounting legislation.
Health/Allergy Data and Clothing Sizes: Deleted or anonymized shortly after the completion of the tour and necessary post-tour operations.
7. Your Rights Under GDPR
As a data subject, you have the following rights under EU data protection law:
Right of Access: Request confirmation of whether we process your data and receive a copy of your personal data.
Right to Rectification: Request correction of inaccurate or incomplete information.
Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data, provided we do not have a legal obligation to retain it (e.g., accounting).
Right to Restrict or Object: Limit or object to how we process your data under certain circumstances.
Right to Withdraw Consent: Withdraw your consent at any time for data processed based on consent (e.g., dietary or health information).
Right to Lodge a Complaint: File a complaint with a supervisory authority (in Finland, the Office of the Data Protection Ombudsman – www.tietosuoja.fi).
To exercise any of these rights, please contact us at: info@flowlapland.fi.
8. Data Security
We employ appropriate technical and organizational measures to safeguard your personal data against unauthorized access, disclosure, loss, or misuse.
Our website and booking systems use encrypted HTTPS protocol (SSL/TLS).
Access to personal data is restricted strictly to authorized personnel and partners who need the information to perform their duties.
9. Changes to This Policy
We continuously improve our services and may update this Privacy Policy from time to time. The most current version will always be available on our website.