Privacy notice

Who is responsible

Aleksi Partanen, Finnish Lapland Guide, is the controller. Contact: aleksi@finnishlapland.com. We have not appointed a data protection officer.

Analytics and cookies

Without your consent, we count visits to understand which guides are useful. PostHog receives technical data such as the page address, referring page, browser and device type, and IP address. PostHog runs in cookieless mode: visits are counted with a hash that PostHog computes on its servers from this data and a salt that changes daily; the IP address is then discarded and not stored with events. Nothing is written to cookies or browser storage on your device, and session recording stays off. Our legal basis is our legitimate interest in measuring and improving the guides (GDPR Article 6(1)(f)); you can object by emailing us.

With your consent, PostHog also stores an identifier in a cookie and browser storage named “ph_…_posthog” (kept for up to 12 months) so repeat visits can be recognised, and records sessions of how pages are used. The legal basis is your consent (GDPR Article 6(1)(a) and section 205 of the Finnish Act on Electronic Communications Services, 917/2014). Your choice itself is stored in this browser as “fl-analytics-consent”.

You can withdraw consent at any time; this does not affect processing before withdrawal. The button below removes your choice and PostHog’s cookies and storage from this browser, then shows the banner again.

We keep analytics data only as long as needed to compare guide use over time, within the retention limit of our PostHog project. We do not sell personal data or use analytics for advertising.

Contact messages

If you email us, we use your email address and message to answer, handle corrections, and keep a record of the conversation where needed. Our legal basis is our legitimate interest in replying and keeping our content accurate (GDPR Article 6(1)(f)). We delete messages when they are no longer needed for the matter or to document a correction. Do not include sensitive personal information.

Business directory

The directory is being developed and its listings are not yet live. When it launches, we will use limited information about tourism businesses to create, check and maintain a free, factual directory that helps travellers discover services in Finnish Lapland. For sole traders (toiminimi), the business name and business ID are personal data.

Information and sources

Depending on the business, information may include the business or sole trader’s name, business ID, public business contact details, website/domain, services, category, locations, seasonal price information, source and verification records, and a Google Place ID only as a matching key for preventing an opted-out listing from being re-added. All sources are publicly accessible: PRH’s YTJ open data, the business’s own website, and destination management organisation (DMO) partner lists, which we use only to find businesses. We do not collect listing content from Google, Google Maps or Tripadvisor.

Purpose and legal basis

We process this information to publish useful and accurate tourism listings, verify and update them, keep a change history, and honour objections and removal requests. Where information relates to an identifiable person, our legal basis is our legitimate interest in providing and maintaining this directory (GDPR Article 6(1)(f)). We balance that interest against the person’s rights by limiting fields to business-relevant public information, using the sources above, checking information before publication, giving notice and a simple objection route, and removing opted-out listings. Listings will be ordered by a published score. We make no decisions based solely on automated processing that have legal or similarly significant effects on anyone.

Retention

We keep a public listing while the business operates and the listing remains accurate. Source observations and change records are kept only as long as needed to show where a listing came from and to correct it. If a business opts out, we delete its listing and keep only a suppression record (business ID, Google Place ID, domain and normalised name) so it is not re-added. We keep that record while we run the directory, because deleting it would allow the business to be re-imported. Contact us for details about a particular record.

Notice to businesses

Because directory information comes from other sources, we tell the business directly within one month of collecting its information, and in any case before its listing is first published or we first contact it, if that is sooner. We send the notice by email to a public business contact, or by post to the address in the trade register if no email is available.

Your right to object

You can object at any time to directory processing based on our legitimate interest. To object or opt out, email aleksi@finnishlapland.com with the business name and website or business ID, and say whether you want a particular item corrected or the business removed. You do not need to give a reason. We stop showing the listing while we review the objection, and remove it unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the information for legal claims.

Service providers and transfers

Vercel hosts the site. PostHog provides analytics from its EU service. Neon will store directory data when the directory launches; no directory data is stored yet. These providers process data on our behalf under data processing terms. Vercel and PostHog are US-based and may process some data outside the European Economic Area, including in the United States. Such transfers rely on the EU–US Data Privacy Framework adequacy decision where the provider is certified, or on the European Commission’s standard contractual clauses. Ask us for a copy of the relevant safeguards. We do not sell directory data; public listing fields are visible to anyone visiting the site.

Your rights

You may ask for access to your data, correction, erasure or restriction of processing, and object to processing based on legitimate interests. Where processing is based on consent, you may also ask for your data in a portable format. We respond without undue delay and normally within one month, subject to the extension rules in GDPR Article 12(3). You may also complain to the Finnish Data Protection Ombudsman.

Legal references: GDPR Articles 6, 7, 12–14, 21 and 22; Act on Electronic Communications Services (917/2014), section 205.

Changes and questions

We will update this notice if our processing changes. For questions or rights requests, email aleksi@finnishlapland.com.