MEET FINLAND
Privacy notice
Effective date: 7 November 2026 · version 2026-11-07-v1.
Who is responsible
Northfolk Oy, Business ID 3624593-1, is the controller for Meet Finland’s enquiries and bookings. Company correspondence address: Männistöntie 84, 92500 Rantsila, Finland. Privacy contact: [email protected].
Privacy contact: [email protected].
Information and purposes
| Information | Why we use it | Legal basis |
|---|---|---|
| Contact details, enquiry and requested trip details | Answer your enquiry and prepare a booking you request | Steps before entering a contract |
| Booking details and information needed for participants' arrangements | Manage and deliver the booking | Contract with the booker; legitimate interests in arranging the agreed service for other participants, as applicable |
| Payment references, invoices and transaction records | Handle payments, refunds, accounting and legal duties | Contract and legal obligations, as applicable |
| Relevant correspondence and necessary security records | Resolve problems, protect the service and handle legal claims | Legitimate interests in secure operations and protecting legal rights |
| Optional website analytics identifiers and usage information | Understand how the website is used and improve it | Consent |
We normally receive information from you. If a lead booker supplies details for other participants, we receive the necessary information from that person. Please share this notice with the people whose details you provide. Operators and payment providers may also send us information about fulfilment, payments or refunds.
Providing information needed for a requested booking is voluntary, but without essential contact, participant or payment information we may be unable to arrange or deliver it.
Please do not put medical records or other unnecessary sensitive information in an enquiry. If an activity requires particular health or accessibility information, we explain what is necessary and the applicable basis for handling it before collecting it.
Who receives information
We share information needed for the requested service with relevant guides, activity operators and transport providers. We can check general availability without sharing unnecessary participant details.
We also use service providers for booking administration, payment processing, hosting, email and, if you consent, analytics. Professional advisers and authorities may receive information where necessary for accounting, legal obligations or a legal claim.
| Service | Purpose | Data handling |
|---|---|---|
| Cloudflare | Website hosting, delivery and protection | Technical request data; privacy notice and DPA. |
| Resend | Enquiry email delivery to [email protected] | Enquiry content and delivery metadata; privacy notice and DPA. |
| Google company email | Receives and stores enquiries sent to our company mailbox | Company communication and follow-up; privacy notice. |
| Bókun / Tripadvisor LLC | Booking calendar, cart and checkout after you load the service | Booking and participant information; privacy notice and DPA. |
| Stripe | Payment processing in Bókun checkout | Payment, billing and security information; privacy notice. We do not receive full card details. |
| Google Maps via Bókun | Maps that may appear in the requested booking service | Relevant device/network information under Google’s privacy notice. |
| Optional analytics | Currently disabled | No optional analytics tag is configured on this website. |
A service provider may process information for us or act as a separate controller for its own legally required purposes. The table identifies the relevant role and links to applicable provider notices. We do not sell your personal information.
International transfers
Cloudflare delivers and protects this website. Resend sends enquiry emails to our company inbox, hosted through Google. Bókun administers bookings and Stripe processes payments. These providers and their subprocessors may process information in the EEA and elsewhere, including the United States. Where required, international transfers use applicable adequacy decisions or contractual safeguards such as standard contractual clauses. The linked provider notices and data-processing terms describe their arrangements. Contact us for information about the safeguards relevant to your information.
You can ask [email protected] for information about relevant transfer safeguards and how to obtain a copy.
How long we keep information
We retain information for its purpose and delete or anonymise it when it is no longer needed.
- Enquiries that do not become bookings: normally up to 12 months after the last substantive contact, unless a booking, legal obligation or claim justifies keeping necessary information longer.
- Operational booking information: while needed to deliver the booking, handle refunds and complaints, and establish or defend legal claims. We review participant and operational details after the activity and remove information no longer needed for the service, accounting or a legal claim.
- Accounting records: for the legally required period. Transaction vouchers and related accounting evidence are generally retained for at least six years from the end of the calendar year in which the financial year ended; financial statements and certain accounting records are retained for at least ten years from the end of the financial year.
- Security logs and optional analytics: Cloudflare processes technical request data to deliver and protect the site. Our enquiry handler does not create a customer database or log message content. Anti-spam counters expire after ten minutes and accepted-submission hashes/references after 24 hours; expired entries are removed on the next request or when the server instance ends. Enquiries are sent through Resend and retained in our company mailbox under the enquiry-retention criteria above. Optional analytics is currently disabled.
- Consent records: for as long as reasonably necessary to demonstrate the relevant consent and handle related obligations.
A legal hold, outstanding dispute or other legal requirement may justify retaining the necessary information longer. It does not justify keeping every participant detail indefinitely.
Your choices and rights
Subject to the applicable conditions, you can request access, correction, deletion, restriction or portability of your personal information. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time without affecting processing already carried out lawfully.
Use Cookie settings to change optional website choices. Contact [email protected] for other requests. We may need proportionate information to verify your identity.
You may complain to the Finnish Office of the Data Protection Ombudsman at tietosuoja.fi, or to another competent supervisory authority.
The enquiry form uses validation and short-lived anti-spam controls. It does not decide whether you can join an activity or accept bookings. Booking and payment providers may use automated security and fraud checks. Contact us for human assistance if you have a booking or payment problem.
Updates
We update this notice when necessary to reflect our processing. A change to this notice does not itself authorise a new use of your information that requires a separate legal basis or consent.