Privacy Policy

Data controller

This privacy policy applies to personal data collected through the polarcrest.fi website. We comply with the EU General Data Protection Regulation (GDPR, 2016/679).

What data we collect

We collect personal data from the following sources:

• Contact form and revenue forecast: name, email address, phone number, location preference and free-form message.
• Booking system (Hostaway): guest name, email address, phone number, check-in and check-out dates, and number of guests.
• Website analytics (Google Analytics): device type, browser, location (country or city level), pages visited and session duration. Data is collected in anonymised form.

We do not collect sensitive personal data or data relating to minors.

Legal basis and purpose of processing

We process your personal data on the following legal grounds:

• Performance of a contract (GDPR Art. 6(1)(b)): processing bookings and related communications.
• Legitimate interests (GDPR Art. 6(1)(f)): responding to enquiries, sending revenue forecasts and improving the website using analytics data.
• Consent (GDPR Art. 6(1)(a)): analytics cookies used to track website usage.

Retention periods

• Contact form data: 2 years from the most recent contact.
• Booking data: 7 years from the end of the booking (required by Finnish accounting law).
• Analytics data (Google Analytics): 14 months.

We delete data immediately when the retention period expires or the purpose ceases.

Disclosure to third parties

We do not sell or rent your personal data. We use the following service providers to whom data is transferred in order to deliver our services:

• Web3Forms (web3forms.com): contact form processing. Data is stored within the EU.
• Hostaway (hostaway.com): booking system. Data is stored within the EU.
• Google LLC (analytics.google.com): website analytics. Google may transfer data outside the EU under EU-approved standard contractual clauses.

We may disclose data to authorities when required by law.

Security

Our website uses HTTPS encryption. Personal data is accessible only to those individuals who require it for their work duties. Our service providers are committed to complying with GDPR requirements.

Your rights

You have the following rights regarding your personal data:

• Right of access: you may request a summary of the data we hold about you.
• Right to rectification: you may request that inaccurate data be corrected.
• Right to erasure ("right to be forgotten"): you may request that your data be deleted, unless there is a legal obligation to retain it.
• Right to restriction of processing: you may request that we cease active processing of your data.
• Right to data portability: you may request your data in a machine-readable format.
• Right to object: you may object to processing based on legitimate interests.

We will process your request within one month. Submitting requests is free of charge.

Contact and right to lodge a complaint

Send data protection requests by email: [email protected].

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman: tietosuoja.fi.