1. Data Controller
Explore Finland Oy ("we", "us") is the data controller for personal data processed through the Platform. We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.
2. Data We Collect
Travellers
- Account data: name, email address (from Google sign-in or guest checkout)
- Booking data: travel dates, group size, selected experiences, order history
- Payment data: processed by Stripe; we do not store card numbers
- Communication data: messages exchanged with suppliers through the platform
- Technical data: IP address, browser type, device information (for security and analytics, with consent)
Suppliers
- Account data: name, email, company name, business ID
- Product data: listings, pricing, availability, images
- Financial data: Stripe Connect account details for payouts
3. Legal Basis for Processing
- Contract performance: processing bookings, payments, and delivering services
- Legitimate interest: platform security, fraud prevention, service improvement
- Consent: analytics cookies, marketing communications
- Legal obligation: tax records, regulatory compliance
4. Cookies
We use essential cookies for site functionality (authentication, cart, sessions) and optional analytics cookies to understand how visitors use the site. You can accept or reject analytics cookies through our cookie consent banner. Essential cookies cannot be disabled as they are required for the site to function.
5. Data Sharing
- Suppliers: receive your name, email, and booking details to fulfil your reservation
- Stripe: processes payments securely under their own privacy policy
- Google: if you sign in with Google, subject to Google's privacy policy
We do not sell personal data to third parties.
6. Data Retention
Account data is retained while your account is active. Booking records are retained for 6 years for tax and legal compliance. You may request deletion of your account at any time.
7. Your Rights (GDPR)
You have the right to:
- Access your personal data
- Rectify inaccurate data
- Request erasure ("right to be forgotten")
- Restrict or object to processing
- Data portability
- Withdraw consent at any time
- Lodge a complaint with the Finnish Data Protection Ombudsman (tietosuojavaltuutettu)
8. Data Security
We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), secure authentication, and access controls.
9. International Transfers
Your data is primarily processed within the EU/EEA. Where data is transferred outside the EEA (e.g., to Stripe's US servers), appropriate safeguards such as Standard Contractual Clauses are in place.
10. Contact
For privacy inquiries or to exercise your rights:
Explore Finland Oy
Email: privacy@explorefinland.fi
