Privacy notice

Controller and service sellers Yrityspalvelu Kunnari (business ID 2730057-2), Lähteenrinne 2, 96900 Saarenkylä, Finland, operates Travel Lapland. Customer and privacy contact: info@travellapland.fi. Each catalogue business controls its own bookings, customer records and payments. Travel Lapland does not automatically receive purchase or payment card information from the Bókun widget. Browsing, search and technical data You can browse the catalogue without an account. We process connection addresses and technical request information to deliver the service, limit requests and prevent abuse, based on our legitimate interest in a safe and functioning service. Catalogue semantic search runs on our server; its result cache lasts five minutes. Do not enter private or sensitive personal data in searches. Weather is fetched through our server for the selected municipality’s central settlement. We do not share device GPS coordinates or your IP address with the weather provider. Free accounts and sign-in To provide the membership service you request (contract), we process your name, verified email, optional phone number, member ID, language, and the date and version of your acceptance of the terms. Phone numbers are not used for SMS marketing; you may leave yours blank or remove it in settings. Sign-in codes are delivered through Domainhotelli email services. Temporary registration data and queued email content are encrypted on the server; the code verification value is hashed. Codes expire after ten minutes. Expired temporary data and queued jobs are removed by cleanup running approximately every minute. The message in your inbox is a separate copy you manage in your email service. Sign-in tokens last up to 30 days; only a hashed verification value is stored on the server. Native apps use the operating system's secure storage; web tokens remain in memory only. Sign-in requests and code attempts are limited to prevent abuse. Member benefits and optional notifications Member benefits do not require marketing consent. Event, aurora and offer notifications are selected separately and are off by default. Processing is based on your consent. We store your choices and changes with timestamps, region and language. You can withdraw consent in account settings without affecting the lawfulness of earlier processing. Device notification permission is separate. A message already passed for delivery may not be retractable. Expo Push Service and Apple APNs or Google FCM deliver phone notifications. They receive the device notification identifier and message content. We do not add private itineraries, tickets, booking references or payment information to notifications. Processing involved in delivering notifications may take place outside Finland. This section covers entries and tickets you add manually. Purchases and Lapio plans saved to your account are described separately. 5. My trip, tickets and device storage My trip is a local feature requested by signed-in users. Entries, booking references, notes, PDF and image tickets stay on the device or browser used; administrators cannot see them and they are not synchronised between devices. Data is separated by member ID. Local trip data has no separate application-level encryption: protect your device with a lock. Removing the app or browser site data may remove these records. You may share an attachment with an app you choose; that app's practices then apply to the shared copy. Device backup settings can cover local files. Automatic Android app backup is disabled. Notification previews may show your chosen trip entry name on the lock screen; adjust OS preview settings. Language and requested local features are remembered on the device. The public catalogue may be saved offline in the native app; the web version does not use a persistent catalogue cache. Lapio — data processing. A Travel Lapland account is required. Before sending a conversation, we ask for your consent to process messages and your plan with OpenAI. Recent messages, any current plan, destination, language and public service information are sent. Your account contact details are not added. Do not enter personal or health information or booking codes. OpenAI processing may take place outside Finland. Conversation history, an unsent message and the draft plan stay locally on this device until cleared; history retains up to the latest 100 messages. Conversations are not saved to your Travel Lapland account or transferred to another device. Plans you explicitly save remain in your account in Finland until you delete them or your account. Clearing the conversation does not delete saved account plans. You can withdraw consent by unticking the box before your next message; this does not undo earlier processing. Your selected interests stay with the conversation on your device. They are sent to Lapio only as part of a message you submit. Purchases and bookings received from shops The WooCommerce store sends, or the Bókun connection retrieves, the buyer’s email to match a purchase with an existing verified account. We store the seller, order or booking reference, product names and identifiers, quantities, supplied dates, status, available price and refund information, and update times. We do not store payment cards, addresses, passenger documents or the full raw booking payload. The email is not retained in the purchase record. Unmatched purchase records are not stored, and the store is not told whether an account exists. Imported purchases are encrypted on Travel Lapland’s server in Finland for up to two years after purchase, or until account deletion. They are available on other devices after sign-in and included in personal data export. Removing an item clears its content; a secret matching identifier remains for the same retention period to prevent reimport. This does not delete the seller’s own records or external booking system data. API keys are encrypted, never published and removed when the partner disconnects. Plans and attachments added manually remain on the device. Bókun booking forms When you start booking, we process your verified account email, selected service, date, participant counts and answers requested by the seller to carry out your booking request. We send these details to the seller through Bókun. Form data and technical payment redirect identifiers are encrypted in Finland for up to seven days or until account deletion. Answers and payment redirect identifiers are removed once booking confirmation or cancellation is verified. Only the basic purchase details described above remain in My trip. Travel Lapland does not process card details. Bókun and the seller’s payment service process transferred data under their own terms; their processing is not represented as limited to Finland. Cookies and Bókun Catalogue, weather, account services and legal-page responses do not set Travel Lapland session cookies. Admin sign-in uses a necessary Secure, HttpOnly and SameSite-protected session that expires after at most 60 minutes of inactivity. Optional analytics and heart statistics require your consent, as described below. The Bókun embed loads only after a separate Allow and load Bókun choice. You may keep browsing without loading it. Once loaded, the external service receives your IP address and may use cookies. Its non-essential cookies are controlled through the provider's consent settings. Our load choice is not general consent to all external tracking. Disabling the embed prevents loading again but does not delete cookies Bókun already set. Visiting a seller's store directly is subject to that seller's practices. Providers, protection and transfers Hosting is with Hetzner in Finland; email delivery uses Domainhotelli. Administrator-triggered translation sends only public content texts to OpenAI, never member records, sign-in codes, tickets or payment details. Do not place non-public personal data in public content fields. We use HTTPS, restricted administrative access, encrypted temporary sign-in data, hashed tokens and backups. Members' emails, phones and travel plans are not supplied to catalogue businesses for marketing. The controller is responsible for processor agreements and applicable international transfer safeguards. Independent sellers describe their processing in their own notices. Retention, deletion and contacts Profiles and consent history remain while the account is active. Deleting it removes the profile, sign-in tokens, notification devices, consent history and pending sign-in challenges from active records. The app also clears trips and tickets on that device; local copies on other devices must be cleared there separately. Account deletion does not cancel bookings with sellers. Expired sign-in tokens are pruned automatically. Session-linked push devices are removed when their session is signed out or deleted; device tokens not updated for over 90 days are also removed. Push delivery logs are removed after 30 days. Offline sign-out may not immediately reach the server; disable OS notifications if needed. Automatic server backups are encrypted and kept in Finland for 30 days. Each new backup is automatically checked for restore integrity. Separate release rollback copies are kept for administrative recovery; their deletion cycle is managed by the administrator. Restoring a backup must not reactivate a deleted account. Technical logs are limited and rotated. Error logs do not intentionally record codes, tokens or email contents. Contact messages are processed to fulfil requests or contracts or based on legitimate interests in handling the matter. They are removed when no longer needed for handling or possible legal claims. Sellers describe booking-data retention in their notices. Your rights You can view server-held data in the app, correct your name, phone and notification choices and delete your account. Where applicable, you may request access, correction, erasure, restriction and portability, or object to processing based on legitimate interests. Withdraw consent in settings or contact info@travellapland.fi. We normally respond within one month and may verify identity. You may complain to Finland's Data Protection Ombudsman (tietosuoja.fi). We do not make automated decisions about you with legal or similarly significant effects. This notice is updated when practices change. Ask Locals (30 September 2026) We process questions, answers, languages, timestamps and review statuses linked to your account, and the area and introduction in your local responder application, to provide the service you request (contract). Security and abuse prevention rely on legitimate interests. Only administrators see applications and applicants' account details. Original questions are visible to their author and administrators; draft answers to their author and administrators. Approved locals see reviewed questions. Administrators approve responders and each published language version. Public Q&A does not include account details. Do not submit personal information or booking references. You acknowledge the publication process before submitting; this is not marketing consent. Search queries and approved public content are processed on our own server without an external AI service. Ask Locals results are not stored in a persistent application cache. A switch to keyword search is indicated. Rejected applications are deleted 90 days after the last change, unpublished answers after 180 days. Questions older than 180 days are deleted if neither they nor their merged target have a published answer. Cleanup runs daily. Other applications and published content, including original texts, remain until deleted. Data export includes your own records. You can delete a question or your account; deleting the account removes your applications, questions and answers. Deleting a duplicate does not delete another asker's shared target question. Rights requests: info@travellapland.fi. Public transport journey search (1 October 2026) Place search text, the names and coordinates of selected places and the departure time are sent to Digitransit to provide the journey suggestions you request. We do not link searches to member accounts or save a journey history. Journey search does not request device GPS location. Digitransit receives the server connection details; we do not forward member tokens, cookies or user IP headers. Digitransit also processes API calls for statistics, development and incident management under its own terms (https://digitransit.fi/en/developers/apis/7-terms-of-use/). Encrypted place results are valid in the cache for 5 minutes and journey results for 1 minute. Expired files are cleaned every 10 minutes, so they may remain for up to 15 minutes when scheduling operates normally. Search content is not written to application logs. Processing provides the service you request; usage limits and abuse prevention rely on legitimate interests. When you open an operator link, its own privacy practices apply. Predictive place search and maps (1 October 2026) Predictive search sends typed search text to Digitransit after a short typing pause. You always select a place explicitly. Coordinates picked on the map are sent to Digitransit only when you search for a journey. The map background loads from the OpenStreetMap Foundation service only when you open a map. The service receives your IP address, browser or app connection details, tile requests for the displayed area and the Travel Lapland website origin. We do not send search text, member tokens or journey instructions to it. Its privacy policy applies (https://osmfoundation.org/wiki/Privacy_Policy). Your browser caches tiles according to the service headers; the app does not download maps in the background or for offline use. A separate map link carries journey places and geometry in a URL fragment. The fragment is not sent to the Travel Lapland HTTP server, but the link may remain in browser history and sharing it reveals the journey to its recipient. This processing provides the map feature you request and does not create an account journey history. AI use and content sources (2 October 2026) Catalogue descriptions and translations were prepared with AI assistance from public service information. Member records, travel tickets and payment details are not used to prepare them. Service search compares your query with public service descriptions using server-side semantic search. Do not enter personal data in search. Image sources and confirmed AI origin are recorded in the content. Opening a provider’s booking or shop link moves you to an external service with its own privacy practices. Bókun embeds require a separate loading choice. Destination choice and optional location Your selected municipality is saved on your device for your next visit. Its identifier is sent with service searches and weather requests to filter services and show a forecast for the municipality’s central settlement. Location permission is requested only when you choose “Suggest from my location”. Coordinates are matched against municipal boundaries on your device. They are not sent to or stored by Travel Lapland. Your browser or operating system handles permission and location under its own policies. This is a one-time suggestion; the destination changes only after your choice. You can select a municipality without location permission and revoke permission in device or browser settings. Advertisers and business applications (business-2026-10-03) We store the business and contact names, email, phone, website, requested services and destination, and advertising weeks, placements, price, payment status and review history. We use these to handle applications and advertising contracts, verify authority to represent the business, communicate and resolve payments. Contact details remain private. Public website text and source links may be processed using OpenAI for imports and advertising copy; application contact fields are not sent to prepare ad copy. Payment takes place on Stripe’s checkout page. We send the email, order reference, weeks, placements, amount and currency to Stripe. Travel Lapland does not store card details. Processing serves preparation and performance of contracts; communication with a business contact also relies on legitimate interests. Data is retained as required to handle the application, contract, payments, legal claims and accounting. Stripe and OpenAI may process data outside the EEA under their applicable contracts and transfer safeguards. See https://stripe.com/privacy and https://developers.openai.com/api/docs/guides/your-data . Contact the operator listed in this notice for data requests and corrections. Ad selection uses destination, placement, week and rotation, not visitor profiling. Push advertising checks destination and consent to offers. Ad measurement: with consent to optional analytics, we record ad visibility and opens. Measurements contain the campaign, placement, selected area and day. A short-lived receipt valid for up to 10 minutes prevents duplicate measurements. We do not attach your name, email, search text or precise location. Expired receipts are removed by scheduled cleanup. Daily aggregate counts are retained for up to 24 months. Ads also appear without measurement consent. The last splash or pop-up display time is stored on the device to limit repetition. Partner reports show measured impressions and clicks, not unique visitors or confirmed purchases. For weekly billing we retain Stripe customer and payment method identifiers and weekly invoice and payment records. The card number stays with the payment provider. We record pauses, resumptions and refund request reasons, decisions and refund references to administer the contract and payments. These records are available to authorised users of the relevant business or destination and administrators. Partner contact form We store business and contact names, email, optional phone, destination, selected topics, other-topic description, message, any selected service, removal scope, processing status and consent time. Information remains private to our team and is used to handle enquiries, verify business representation and process requested changes. Processing serves requested enquiries and possible contract preparation, and our legitimate interest in responding to business enquiries. Contact messages and details are not sent for AI processing. This form does not request payment details. A reference is saved on the sender’s device to check status; contacts and secret references are not stored in the URL. Information is retained as needed for handling and applicable obligations. Do not include card details, passwords or sensitive personal data. Send data requests to the operator listed in this notice. Form bot protection: forms submitted to our server run an automatic computational challenge verified by our own server. It requires no image puzzles and sends no form data to an external CAPTCHA service. Verification expires and is single-use. To prevent reuse, the server caches a hash of the verification identifier with a validity period of at most 11 minutes. The check uses no device fingerprinting or advertising tracking. Server traffic controls also limit submission rates. After a connection error, a new check runs when you next try to submit. Optional analytics: Google Tag Manager and Matomo may be used only after you allow analytics. Our implementation sends only the public page path and language, not form fields, searches, booking or receipt secrets, or precise location. Google tags may use cookies; our Matomo integration disables tracking cookies and still requires consent. Withdraw approval in Analytics and cookie settings. The choice is stored on your device for up to six months and requested again when tracking settings change. DNT/GPC signals block tracking. Advertising consent for GTM tags remains denied by default. The operator must configure provider agreements, server location, IP anonymisation and retention in the analytics service and update this notice when enabling it. External business websites have their own privacy policies. Form email notifications Business enquiries, listing applications and advertising reservations may notify the operator by email. The notice contains the form type, business name, destination, reference and an admin link requiring sign-in. Contact details, message fields and secret form tokens are excluded. The delivery outbox stores only a reference to the original form and delivery status; completed or cancelled notices are removed after 90 days. Original form retention follows its processing needs. These operational notices support the requested enquiry and are not marketing emails. EVENT SUBMISSIONS, HEARTS AND COOKIE CHOICES We store the business, destination, event details, organiser name and email, and the processing permission version and time. Contact details are used to handle the submission and are not published. Events require admin approval. A device draft is removed after confirmation and expires after seven days. Submission contact details and receipt credentials are deleted once 180 days have passed since both the event end and the last handling. Published event content may remain in the catalogue, but ended submitted events stop appearing. Your favourites and itinerary stay on your device. Hearts from users who opt into statistics affect popularity rankings. Withdraw through Cookie settings or My trip in the native app to remove your device’s hearts from the rankings. The server stores a hash of a random device identifier, favourite service identifiers and an update version, without names, emails or IP addresses in this database. A device contributes one heart per service; removing a favourite reduces the count. Inactive server favourite lists are deleted after 180 days. Devices are counted separately; popularity is not a verified customer review. On the web, choose All, Required or Configure. Required storage supports functions you request, security and remembering choices. Optional page analytics requires permission and respects DNT/GPC. Consent lasts 180 days and is requested again when analytics settings change. Change it through Cookie settings. Withdrawal stops tracking and may reload the page. Form fields, search text and precise location are never sent to page analytics. In the mobile app, you can choose All, Required or Configure. All allows heart statistics and ad measurement. Required covers only storing the functions you request, security and remembering your choices. Under Configure, you can allow each one separately. Your choice is kept on the device for 180 days. You can change it at any time from the Cookie settings button or the My trip view. Withdrawing ad measurement stops the measurement of new impressions and opens. Partner portal and imports: we process the contact person's name, email, access request and approval details to operate company management. Passwords are hashed, authenticator secrets encrypted, and one-time recovery and activation tokens hashed. Access requires administrator verification and two-factor authentication. Active account details are retained while access is valid; pending and revoked requests are deleted 180 days after their last update. Import drafts and history are deleted 30 days after processing ends. Published catalog entries remain separately until changed or deleted. Partners may choose Visit Finland DataHub or a public website as the source. AI imports send public page text to OpenAI's API to generate a draft with storage disabled; provider security logging may still apply. Secret keys, login credentials and private partner personal data are excluded from AI requests. Imports are never published without partner review and approval. DataHub imports require a valid API subscription and compliance with its terms. Companies are responsible for publishing rights and accuracy. Corrections, account closure and deletion requests: info@travellapland.fi. Data location Travel Lapland’s own server database, media library and server backups are stored in Finland. Manually added trip entries, tickets and local favourites stay on your device. This statement about server storage in Finland does not mean all external processing takes place in Finland. Stripe, OpenAI, push delivery providers, map services and separately approved analytics services may process data sent to them outside Finland under their terms and applicable transfer safeguards. The data sent and purposes are described in the relevant sections of this notice. Partner applications also store the Finnish Business ID, selected destinations and confirmation details for the email and listing request. These are used to identify the business, assign services to destinations and process the application. Our team receives a confirmation notification. A free partnership application does not include an advertising order or payment details. Ask Locals Your name, email, phone, area, languages, reasons and tourism connection are visible only to you and administrators. They are used to review your application and contact you. Applications are not published. Rejected applications are deleted after 90 days; others remain until the account or application is deleted. Online store member benefits When you request benefit verification in a partner store, the store sends Travel Lapland your email and coupon ID. We check for an account and send a one-time code to its email. The store receives eligibility for this benefit, not your other account data. The encrypted challenge lasts up to 10 minutes and the grant up to 30 minutes; expired records are removed in the next cleanup, run every 10 minutes. Verification is not used for marketing. The store is responsible for its customer records, order and payment data. Coupon, product and discount information may be published on the service page. Offline trip information and sharing The app caches the last downloaded purchases separately for each account. Copies older than 90 days are not used and are deleted the next time purchases are opened. Manually added plans and tickets remain on the device. Clearing local trips also clears the local purchase copy. Public departure boards may be cached on the device. Sharing previews the selected titles, dates, times and places; booking references, notes and attachments are excluded. You may include booking references in a separate offline file; attachments are not included. You control downloaded or shared copies; Travel Lapland cannot remove them from recipients. Nearby search uses your location only with permission to calculate distances on the device. Opening the map may disclose the viewed area to the map provider as described above. Flight information requests Flight departure and arrival information is retrieved through our server. No Travel Lapland user name, email, booking reference or personal itinerary is sent to Finavia. Flight searches filter the board on the device. Manually saved flights remain in the device itinerary; publishing or sharing is the user’s choice. Shared trips and trip alerts Shared trips are optional. The trip name, participants and the title, date, time and place of entries you choose to share are stored on the server in Finland. Companions see participants’ names and proposals; votes are shown as totals. Tickets, attachments, booking references and private notes are not shared. Invite codes last 7 days. The owner can rotate the code, remove participants or delete the trip; participants can leave. Shared trips expire within 180 days of creation. Deleting your account removes the trips you own and your memberships, proposals and votes. Following a flight stores the airport and flight identifier in your account with your consent. Following ends within 7 days or 12 hours after the scheduled flight. Destination weather-warning subscriptions last 30 days. Stop either subscription in trip alerts. Alert history lasts 7 days. No user identity is sent to Finavia or the Finnish Meteorological Institute; shared caches supply the source data. Push requires device permission and uses Expo’s notification service. Marketing consent is separate. Delivery and immediate updates cannot be guaranteed. Tickets you add and the offline travel pack stay only on this device until you remove them or clear local travel data. The pack shows when it was saved. It cannot update without a connection and does not replace the seller’s confirmation or an accepted ticket. Opening an external map sends the chosen destination to the map provider.