1. Data Controller: Ruka-Kuusamo Tourist Association, Rukatunturintie 9, 93830 Rukatunturi.
2. Person Responsible for Register Matters: Ruka-Kuusamo Tourist Association, Rukatunturintie 9, 93830 Rukatunturi, Sari Kumpuniemi, firstname.lastname@example.org.
3. Name of the Register: Customer register for services sold on the Ruka.fi website.
4. Legal Basis for Personal Data Processing: The processing of customer information is based on the data controller's legitimate interest or a contract between the data controller and the data subject.
5. Purpose of Personal Data Processing: Management and development of the customer relationship, such as the sale and purchase of services, confirmation of online purchases, and identification of online reservations. Marketing and communication by the company and its partners. Development of partners’ business and customer service.
6. Content of the Register: The data controller processes the following personal data of customers:
- Customer's first and last name, date of birth, phone number, address, email address
- Information related to activity bookings (value of booking, booked service, special diets)
- Customer payment information
- Information on the use or purchase of services
- Information related to customer behavior, choices, and preferences
- Possible customer feedback and complaint information
7. Profiling: As part of the processing activities of personal data stored in the customer register, Ruka-Kuusamo Tourist Association may use the information for profiling purposes. Profiling is done by creating a customer identifier for the registered individual, allowing various data arising from the use of the service to be combined. Profiles created in this way can then be compared to profiles created for other registered individuals. The purpose of profiling is to determine the demand for services and customer behavior.
8. Regular Data Sources: Data is collected from customers at the time of booking, from the registered person themselves. Additionally, data is collected on the use of services, from information on purchases, or possibly from third parties. By accepting Ruka-Kuusamo Tourist Association's communication and marketing, you give permission for your personal data to be stored and processed so that you can be sent the content you subscribed to via email.
9. Recipients of Personal Data: The data controller uses subcontractors or subcontractors to implement its services, which require personal data to implement their own service.
10. Data Transfer Outside the EU: According to data protection legislation, personal data may be transferred outside EU member states or the EEA to the extent that the European Commission has found that the country in question ensures an adequate level of data protection. Ruka-Kuusamo Tourist Association uses partners located outside the EU or EEA for customer management, customer service, marketing support, technical support, and analytics. When transferring user personal data outside the EU or EEA, we use data transfer mechanisms approved by the European Commission, such as standard contractual clauses. Ruka-Kuusamo Tourist Association is responsible for third-party data processing in accordance with data protection legislation.
11. Retention Period for Personal Data: Customer personal data stored in the customer register is processed for the duration of the customer relationship. The data controller considers the customer relationship to have ended if the customer has not used the company's services for twenty (20) years. The time is calculated from the end of the calendar year when the customer last used the company's services. The data is deleted within six (6) months after the customer relationship has ended unless there is another reason for retaining the data.
After the end of the customer relationship, data can still be stored and processed if it is necessary for handling complaints. The retention period for data in the customer register also follows legally mandated retention periods, such as accounting laws. Data required by accounting laws are kept for as long as the accounting law requires.
When data is processed based on a contract between the data controller and the registered individual, the data is kept for as long as needed to fulfill the contract. Once the contract is executed, the data is kept for as long as the customer relationship exists or there is another basis for processing (e.g., complaint cases or accounting laws).