1. Data Controller
Uudet Urat Ky
0634348-5
Kummunkatu 14, 83500 Outokumpu, Finland
[email protected]
+358 50 524 5561
2. Scope of this Policy
This policy describes how Hotel Restaurant Kumpu processes personal data in connection with our website (hotellikumpu.fi), booking system, customer service, marketing, and camera surveillance.
3. Data Subject Categories
- Website visitors
- Accommodation and restaurant guests, as well as persons making bookings
- Marketing and newsletter subscribers
- Employees and job applicants (where applicable, in accordance with a separate personnel privacy policy)
- Individuals on the property and within its premises (camera surveillance)
4. Data Collected
- Booking and customer data: name, contact details, booking details, payment details (payments are processed through a payment service provider; full card details are not stored in our systems)
- Website usage data: IP address, browser and device information, visit data (via cookies, see section 8)
- Contact inquiries: information provided via the contact form
- Camera surveillance data: recordings from public areas of the premises (see section 9)
- Newsletter, customer communication, and marketing data: customer information, time of subscription or consent for those who have signed up for newsletter or marketing messages, and data regarding message opens and link clicks.
5. Sources of Data
Data is primarily collected directly from the data subject, for example, through online forms during booking or via cookies, as well as through the booking system or booking intermediary (e.g., Booking.com).
6. Purposes of Processing Personal Data
Personal data is processed for the following purposes:
- Processing accommodation and restaurant bookings, managing customer relationships — Legal basis: performance of a contract
- Invoicing and accounting — Legal basis: legal obligation
- Customer service and responding to inquiries — Legal basis: performance of a contract / legitimate interest
- Essential website functionality (e.g., session management) — Legal basis: legitimate interest
- Analytics cookies — Legal basis: consent
- Direct marketing to existing customers — Legal basis: legitimate interest
- Direct marketing to new leads / non-customers — Legal basis: consent
- Camera surveillance to ensure the safety of properties and property — Legal basis: legitimate interest, Section 16–24 of the Finnish Act on the Protection of Privacy in Working Life
- Business development (e.g., tracking visitor numbers at an aggregate level) — Legal basis: legitimate interest
For processing based on legitimate interest, the controller's interest has been established by balancing it against the rights and expectations of the data subject; the data subject has the right to obtain further information about this assessment upon request.
7. Voluntary Nature of Providing Data
Making a reservation and using accommodation or restaurant services require providing certain information (name, contact details, payment information where applicable) to conclude and fulfill the contract. If this information is not provided, the service cannot be offered. Browsing the website does not require providing personal data, and accepting analytics cookies is always voluntary.
8. Cookies and Website Tracking
The website uses both essential and optional cookies:
- Essential cookies: mandatory for the website to function (e.g., session management), do not require consent.
- Analytics cookies: used only if the user has given consent. Consent can be withdrawn at any time via cookie settings.
A detailed list of the cookies used, their purpose, and their validity period can be found in our Cookie Policy.
9. Camera Surveillance
The public areas of the property (e.g., entrances, lobby) are under camera surveillance, the purpose of which is to ensure the safety of property, staff, and customers, as well as to prevent and investigate misuse. Camera surveillance is indicated by clear signs in the monitored area.
Retention period: Recordings are stored for a maximum of 90 days, after which they are automatically deleted unless a recording is required for an ongoing investigation, legal claim, or authority request, in which case the relevant recording is stored for as long as necessary.
Recordings are processed only by specifically authorized personnel and are disclosed to third parties only for reasons based on law (e.g., upon police request in a criminal investigation).
10. Other Retention Periods
- Booking and customer data — retention period: 5 years from the last transaction
- Accounting records — retention period: 6 years (minimum period required by the Finnish Accounting Act)
- Employment certificates and employment relationship data — 10 years from the end of the employment relationship
- Newsletter subscriber data — retention period: until the subscription is canceled
- Analytics data — retention period: 12 months
- Camera surveillance recordings — retention period: see section 9
11. Recipients and Processors
Personal data is processed by the following service providers:
- Hostinger — website and backend hosting service
- Cloudflare — content delivery network (CDN) and cybersecurity
- PostHog — website usage analytics (subject to consent)
- Netvisor — financial management and accounting
- Sportum TravelNet — space and accommodation bookings, catering and dining services
- EmailOctopus (Three Hearts Digital Ltd, United Kingdom) — sending newsletters and marketing messages
12. Transfer of Data Outside the EU/EEA
Some of the service providers we use (Cloudflare, PostHog) are companies located outside the EU/EEA. The actual location of data processing is as follows:
- Cloudflare: operates as a global CDN/security service; data transfers outside the EU/EEA may occur as part of standard service routing. Transfers are based on Standard Contractual Clauses (SCCs) approved by the European Commission.
- PostHog: we use PostHog's EU instance (posthog.com EU Cloud), meaning analytics data is processed and stored within the EU/EEA, and no data transfers to third countries take place in this regard.
- EmailOctopus: we use the service to send newsletters, customer communications, and marketing messages. Data is stored in a data center located in Dublin, Ireland. The service provider is a UK-based company. Any transfer to the United Kingdom is based on an adequacy decision for data protection issued by the European Commission.
Data subjects have the right to request further information regarding the safeguards used by contacting the contact details provided in section 1.
13. Data Security
Personal data is protected using appropriate technical and organizational measures, such as access controls, encrypted connections, and regular backups, to prevent accidental or unlawful destruction, loss, alteration, or unauthorized access to data.
14. Rights of the Data Subject
In accordance with the GDPR, you have the right to:
- access your personal data
- request the correction of inaccurate data
- request the deletion of data
- request the restriction of processing
- transfer data from one system to another
- object to the processing of your personal data when it is based on legitimate interest
Right to object to direct marketing
You always have the unconditional right to forbid the use of your data for direct marketing purposes (Articles 21(2)–(3) of the GDPR). This right is separate from the general right to object mentioned above and applies to all direct marketing regardless of its legal basis. You can exercise this right by:
- clicking the "unsubscribe" link included in every marketing message, or
- contacting the contact details provided in section 1.
When you object to direct marketing, your data will no longer be processed for that purpose.
Right to lodge a complaint
If you feel that your data has been processed unlawfully, you have the right to lodge a complaint with a supervisory authority:
Office of the Data Protection Ombudsman
tietosuoja.fi
15. Changes to This Policy
This policy may be updated due to changes in legislation or the development of our services, for example. The up-to-date version is always available on our website.
