This is the privacy notice of Herranterttu Holiday Apartments under the EU General Data Protection Regulation (GDPR). Drawn up on 8 September 2026. Last updated on 8 September 2026.
Herranterttu Holiday Apartments 99830 Saariselkä, Inari +358 40 5880 785 info@herranterttu.fi Business ID 3187172-2
Herranterttu Holiday Apartments’ customer register, marketing register and online service user register.
The legal basis for the processing of personal data under the EU General Data Protection Regulation is:
The purpose of processing personal data is to communicate with customers, maintain customer relationships and provide information about our services. The data is not used for automated decision-making or profiling.
The data stored in the register includes: the individual’s name, position, company or organisation, contact details (telephone number, email address, postal address), website addresses, IP address of the internet connection, usernames and profiles on social media services, details of services subscribed to and any changes thereto, billing details, and other information relating to the customer relationship and the services subscribed to.
The IP addresses of website visitors and the cookies necessary for the service to function are processed on the basis of legitimate interest, to ensure data security and to collect visitor statistics, in cases where they can be considered personal data. Where necessary, separate consent is requested for third-party cookies.
The data stored in the register is obtained from the customer via messages sent through online forms, by email, by telephone, via social media services, contracts, customer meetings and other situations in which the customer provides their data. Information on contact persons at companies and other organisations may also be collected from public sources such as websites, directory services and other companies.
Data is not routinely disclosed to third parties. Data may be published to the extent agreed with the customer. The data may also be transferred by the data controller outside the EU or the EEA. Data will not be transferred to the United States without the explicit consent of the data subjects.
The register is managed with due care, and data processed using information systems is protected appropriately. When register data is stored on internet servers, appropriate measures are taken to ensure the physical and digital security of the hardware. The data controller ensures that stored data, as well as server access rights and other information critical to the security of personal data, is treated confidentially and only by those employees whose job description includes such duties.
Every person listed in the register has the right to check the data stored about them in the register and to request that any incorrect data be corrected or that any incomplete data be supplemented. If a person wishes to check the data held about them or request that it be corrected, the request must be sent in writing to the data controller. The data controller may, if necessary, ask the person making the request to prove their identity. The data controller will respond to the customer within the timeframe set out in the EU General Data Protection Regulation, generally within one month.
A data subject has the right to request the erasure of their personal data from the register, i.e. the right to be forgotten. Data subjects also have other rights under the EU General Data Protection Regulation, such as the right to restrict the processing of personal data in certain circumstances. Requests must be submitted in writing to the data controller. If necessary, the data controller may ask the person making the request to prove their identity. The data controller will respond to the customer within the timeframe set out in the EU General Data Protection Regulation, usually within one month.
The cookies used on our website are listed below. You can manage your cookie settings via the ‘Cookie settings’ link.