Privacy Policy

We at Northern Lights Expedition (“we”, “us”, or “our”) respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website https://northernlightsx.com contact us, or book our tours and experiences in the Ruka and Kuusamo area.

We process your personal data in accordance with the EU General Data Protection Regulation (GDPR, EU 2016/679) and applicable Finnish data protection legislation.

1. Data Controller

Company Name:Northern Lights Expedition Oy

Business ID: 2922982-9

Address:Reposuontie 19 A 1, 93830 Rukatunturi

Email: varaukset@kuusamonmatkailu.com

Phone: +358 44 985 7098

If you have any questions regarding this Privacy Policy or how we handle your personal data, please contact us using the details above.

2. What Personal Data We Collect and Why

We only collect personal data that is necessary for providing our services, communicating with you, and operating our website securely and efficiently.

A. Tour Bookings & Reservations (via Bokun)

When you book an experience on our website (such as Northern Lights expeditions, ice fishing trips, or private group tours), the booking process is handled through an embedded booking widget provided by Bokun (a TripAdvisor company).

• Data collected: Name, email address, phone number, billing/payment information, accommodation/pick-up location in Ruka/Kuusamo, group details (number of adults/children), and any special requests or safety-related information you provide (e.g., dietary requirements for campfire snacks/meals or mobility considerations).
• Purpose: To process and confirm your booking, arrange transport/pick-ups, ensure participant safety during outdoor activities, process payments, and send booking confirmations or updates.
• Legal basis (GDPR Art. 6(1)): Performance of a contract (Art. 6(1)(b)), compliance with legal obligations such as the Finnish Accounting Act (Art. 6(1)(c)), and protecting vital interests/safety during tours (Art. 6(1)(d)).

B. Contact Form & Direct Enquiries

When you send us a message via our website’s “Get In Touch” / “Enquire Now” form, email, phone, or WhatsApp:

• Data collected: Name, email address, phone number (if provided), message content, and your explicit acceptance to process the enquiry.
• Purpose: To respond to your enquiry, prepare custom quotes for families, friends, or company groups, and provide customer service.
• Legal basis: Your consent (Art. 6(1)(a)), taking steps at your request prior to entering into a contract (Art. 6(1)(b)), and our legitimate interest in providing customer service (Art. 6(1)(f)).

C. Website Usage, Technical Data & Cookies (Borlabs Cookie)

When you visit our website, certain technical data is collected automatically or based on your cookie preferences managed via Borlabs Cookie.

• Data collected: IP address (anonymized where applicable), browser type and version, operating system, pages visited, time and date of visit, and your cookie consent status (consent ID, timestamp, and selected cookie categories).
• Purpose: To ensure the technical functionality and security of our website, enable the embedded booking system, remember your cookie preferences, and (if consented to) analyze website traffic.
• Legal basis: Legitimate interest for strictly necessary technical cookies and security (Art. 6(1)(f)), compliance with legal obligations regarding consent documentation (Art. 6(1)(c)), and your explicit consent for non-essential cookies (Art. 6(1)(a)).

3. Cookies and Consent Management (Borlabs Cookie)

Our website uses Borlabs Cookie, a consent management technology provided by Borlabs GmbH (Hamburg, Germany), to obtain and document your valid consent for storing certain cookies in your browser and for using specific external services.

When you enter our website, a Borlabs Cookie banner appears, allowing you to choose which categories of cookies you wish to accept. Borlabs Cookie sets a technically necessary cookie (borlabs-cookie) in your browser to remember your choices. This cookie does not process any personal data that identifies you directly, and the data is not shared with Borlabs GmbH.

We categorize cookies as follows:

• Essential / Strictly Necessary Cookies: Required for the basic operation of the website, security, and recording your cookie consent preferences (e.g., Borlabs Cookie).
• External Media / Functional Cookies (e.g., Bokun Booking Widget): Required to load and operate our online booking calendar and checkout system embedded via Bokun.

Managing or Withdrawing Your Consent:

You can review, change, or withdraw your cookie consent at any time by clicking the “Cookie Settings” link, or by deleting the cookies directly in your browser settings.

4. Third-Party Service Providers & Data Recipients

We do not sell or rent your personal data to third parties. However, we share necessary data with trusted service providers (“data processors”) who assist us in operating our business:

• Bokun (Bokun ehf. / TripAdvisor LLC): We use Bokun’s booking management system and embedded widgets to handle online reservations. When you make a booking, your data is processed via Bokun’s secure platform. You can view Bokun’s privacy practices in their official privacy policy.
• Payment Service Providers: Online payments made during booking are processed securely via PCI-DSS compliant third-party payment gateways. We do not store your credit card numbers on our servers.
• Website Hosting & Technical Maintenance: Our website is hosted and maintained by trusted IT partners (including server infrastructure located within the EU/EEA).
• Accounting & Authorities: Financial transaction records are shared with our accounting service provider and, where required by law, Finnish tax or regulatory authorities.

5. International Data Transfers

We primarily store and process your personal data within the European Union (EU) and the European Economic Area (EEA).

However, some of our third-party service providers (such as Bokun / TripAdvisor or certain cloud/email providers) may process or transfer data outside the EU/EEA (for example, to the United States). Whenever personal data is transferred outside the EU/EEA, we ensure that an adequate level of data protection is guaranteed in accordance with Chapter V of the GDPR, such as through:

• An adequacy decision by the European Commission (e.g., the EU-U.S. Data Privacy Framework), or
• Standard Contractual Clauses (SCCs) approved by the European Commission.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Contact Form Enquiries: Retained for as long as necessary to answer your enquiry and handle any follow-up communication, and typically deleted within 12–24 months if no booking is made.
• Booking & Customer Records: Retained for the duration of the customer relationship and after the tour to handle potential feedback, safety/insurance matters, or legal claims.
• Accounting & Financial Data: Under the Finnish Accounting Act (Kirjanpitolaki), invoices, receipts, and booking transaction records must be retained for six (6) years from the end of the calendar year in which the financial year ended.
• Cookie Consent Logs (Borlabs): Stored in your browser for the lifetime of the Borlabs cookie (typically up to 12 months) or until you clear your browser cookies.

7. Your Rights Under the GDPR

As a data subject, you have the following rights regarding your personal data:

• Right of Access (Art. 15): You have the right to request confirmation of whether we process your personal data and to receive a copy of that data.
• Right to Rectification (Art. 16): You have the right to request that we correct any inaccurate or incomplete personal data.
• Right to Erasure / “Right to be Forgotten” (Art. 17): You have the right to request the deletion of your personal data when it is no longer needed for the purposes it was collected (subject to statutory retention requirements such as accounting laws).
• Right to Restriction of Processing (Art. 18): You have the right to request that we restrict the processing of your data under certain conditions.
• Right to Data Portability (Art. 20): You have the right to receive the data you provided to us in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): You have the right to object to the processing of your personal data when the processing is based on our legitimate interests.
• Right to Withdraw Consent (Art. 7): Where processing is based on your consent (such as contact form consent or cookie consent), you may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us by email at varaukset@kuusamonmatkailu.com

8. Data Security

We take appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our website uses SSL/TLS encryption (HTTPS) to secure data transmitted between your browser and our server, and access to customer data is restricted strictly to authorized personnel who need the information to organize and guide your tours or manage customer enquiries.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, website functionality, or legal requirements. The latest version will always be available on our website, with the “Last updated” date shown at the top of the page.