What personal data we collect when you visit our website, book a stay or contact us, why we collect it, and what rights you have. Questions about your data: info@laplandglowhotel.fi.
Last updated: 19 October 2026
1Who we are
The controller of your personal data is:
Lapland Glow Hotel Oy (runs Lapland Glow Chalets) Business ID 3253007-3 Olleronvaarantie 57, 96100 Rovaniemi, Finland info@laplandglowhotel.fi · +358 41 325 3257
We follow the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act (1050/2018) and other applicable law.
2Why we process your data, and on what legal basis
Purpose
What we use the data for
Legal basis
Bookings and your stay
Handling your booking, check-in, your stay, breakfast and the services you ask for, and keeping in touch with you about them
Contract (GDPR Art. 6(1)(b))
Traveller notification
Every accommodation business in Finland must record a traveller notification for each guest
Legal obligation (GDPR Art. 6(1)(c); Act on Accommodation and Food Service Operations 308/2006)
Dietary needs and allergies
Arranging your breakfast and meals safely
Your explicit consent (GDPR Art. 9(2)(a))
Payments and accounting
Processing payments, refunds and later charges, and keeping accounting records
Contract and legal obligation (GDPR Art. 6(1)(b) and (c); Finnish Accounting Act)
Customer service
Answering your questions by email, phone, WhatsApp or our website forms
Steps taken at your request before a booking, and our legitimate interest in answering you (GDPR Art. 6(1)(b) and (f))
Newsletter
Sending our newsletter if you have signed up
Consent (GDPR Art. 6(1)(a))
Website analytics
Understanding how our website is used, only if you accept analytics cookies
Consent (GDPR Art. 6(1)(a))
Advertising
Measuring our ads on Google, Facebook and Instagram, and showing our ads to people who have visited our website, only if you accept marketing cookies
Consent (GDPR Art. 6(1)(a))
Northern lights forecast
Loading tonight's cloud and aurora forecast from open-data services when you open a page that shows it (your IP address is passed to them)
Legitimate interest in showing the forecast (GDPR Art. 6(1)(f))
Safety and legal claims
Protecting our guests and property, handling damage and settling disputes
Legitimate interest (GDPR Art. 6(1)(f))
Giving us your booking details is necessary for us to accept your booking. The traveller notification details are required by law.
3What data we process
Contact and identity details: name, phone number, email address, address, nationality and date of birth.
Booking details: arrival and departure dates, estimated time of arrival, chalet, number of guests, extras, requests and booking history.
Traveller notification: the details required by law, such as full name, date of birth, nationality, address, country of arrival in Finland and travel document number. Some of these do not apply to residents of Finland or citizens of Nordic countries.
Payment details: payment method, payment and refund information, and invoices. We do not store your payment card details.
Messages: emails, WhatsApp messages, website form messages and notes from phone calls with us.
Dietary needs and allergies: only if you tell us, and only to arrange your stay.
Group bookings: the name list, nationalities and group leader's contact details given by the group.
Activity bookings: if you ask us to arrange activities, the details needed for them, such as names, ages and pick-up times, and for Christmas visits the names, wishes and letters you share with us.
Website data: if you accept analytics or marketing cookies, information about how you use our website, such as pages viewed, device, browser, approximate location and whether you came from one of our ads. See our Cookie Policy.
Newsletter: your email address and the date you signed up.
4Where the data comes from
We receive data mainly from you, or from the person who makes the booking for you or your group. If you book through Booking.com, Expedia or Airbnb, we receive your booking details from that channel. Website data is collected through cookies only if you accept them.
5Who we share data with
We do not sell your personal data. We share it only when needed for the purposes above:
Booking and guest systems: Vitec Hotellinx (booking system), SiteMinder (channel manager, which passes bookings from booking channels to our booking system), Speeron NEXT (check-in system) and iLOQ Manager (door lock system).
Payments: Paytrail Plc, which processes card and bank payments.
Activities: Oy Lapland Legacy Ltd (Business ID 3527984-9), which provides the activities, transfers and winter clothing rental we arrange for you, as a separate controller under its own privacy policy. If you book a day out online, you book directly in the partner's booking system (Bókun), and the partner handles that booking and payment.
Website analytics: Google Ireland Limited (Google Analytics), only if you accept analytics cookies.
Advertising: Google Ireland Limited (Google Ads) and Meta Platforms Ireland Limited (Facebook and Instagram advertising), only if you accept marketing cookies. Meta acts as a joint controller with us for the data collected on our website, under Meta's Controller Addendum.
Forecast data: the Finnish Meteorological Institute, Open-Meteo (Switzerland) and the NOAA Space Weather Prediction Center (United States) receive your IP address when your browser loads the northern lights forecast.
Messaging: WhatsApp Ireland Limited, if you contact us through WhatsApp.
Newsletter: the email marketing service we use to send our newsletter.
Website hosting and email: Nordichost, with servers in Finland.
Accounting: providers of accounting and financial administration services.
Booking channels: if you book through Booking.com, Expedia or Airbnb, that channel is a separate controller of the data you give to it, under its own privacy policy.
Authorities: we give traveller notification data to the police, and data to other authorities, when the law requires it.
Our service providers process data on our behalf, under our instructions and data processing agreements.
6Transfers outside the EU and EEA
Some of our service providers, such as Google, Meta and WhatsApp, may process data in the United States. When data is transferred outside the EU or EEA, the transfer is protected by the EU–U.S. Data Privacy Framework, the European Commission's standard contractual clauses or another safeguard required by the GDPR.
7How long we keep data
Data
How long we keep it
Traveller notifications
One year from the date the notification is signed, as required by law
Booking and customer data
36 months after the end of your stay
Dietary needs and allergies
Until the end of your stay
Accounting records
Up to 10 years, as required by the Finnish Accounting Act
Messages and enquiries
24 months from the date we received the message
Newsletter
Until you unsubscribe
Damage and dispute records
Until the matter is settled and any limitation period has passed
Access the personal data we hold about you (GDPR Art. 15).
Correct inaccurate or incomplete data (Art. 16).
Delete your data, unless we must keep it by law, for example traveller notifications and accounting records (Art. 17).
Restrict the processing of your data in certain situations (Art. 18).
Receive the data you have given us in a machine-readable format (Art. 20).
Object to processing based on our legitimate interest, and to direct marketing at any time (Art. 21).
Withdraw your consent at any time, for example by unsubscribing from the newsletter or changing your . This does not affect processing done before you withdrew it.
To use your rights, email info@laplandglowhotel.fi. We reply within one month. We may ask you to confirm your identity before we act on a request.
Complaints. If you think we process your data unlawfully, you can complain to the Finnish Data Protection Ombudsman, or to the data protection authority in the EU country where you live or work.
Office of the Data Protection Ombudsman Lintulahdenkuja 4, 00530 Helsinki (visiting address) P.O. Box 800, 00531 Helsinki, Finland tietosuoja@om.fi · +358 29 566 6700 · tietosuoja.fi
9Automated decisions
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
10Security
We protect personal data with appropriate technical and organisational measures. Access is limited to people who need the data for their work, and our service providers are bound by confidentiality and data processing agreements.
11Changes to this policy
We may update this policy when our services or the law change. The date of the latest update is shown at the top of this page.
12Contact
For anything about your personal data, email info@laplandglowhotel.fi or write to Lapland Glow Hotel Oy, Olleronvaarantie 57, 96100 Rovaniemi, Finland.
