Privacy Policy

Tmi: Teemu Riita / Ulvilan koirametsä

Business ID: 3192408-9

Töykäntie 11, 28450 Vanha-Ulvila, Finland

Phone: 0400 722022

Email: info@ulvilankoirametsa.fi

We may process data such as your name, email address, phone number, booking date and time, booking identifiers, payment status and transaction identifiers, information required to generate and deliver an access code for the booking, customer service and booking communications, email and SMS delivery information, technical data such as IP address, browser/device data and server logs, and your analytics consent choice.

Our booking system does not need to store your full payment card number or security code. Payment information is processed through Stripe.

We process personal data to receive and manage bookings, process and confirm payments, generate and deliver access codes related to bookings, send booking confirmations, reminders, instructions and other necessary customer communications by email and, where applicable, SMS, provide customer service, meet accounting and other legal obligations, maintain security and technical operation, and measure website usage where permitted by the user's consent settings.

Depending on the situation, processing is based on performance of a contract or pre-contractual steps, legal obligations, legitimate interests related to security, operation, customer service and legal claims, or consent for Google Analytics and other optional analytics.

Online payments are processed using Stripe. Stripe may process transaction data such as your name, contact information, payment method, amount, transaction time, device and IP information and information required for payment security and fraud prevention.

Depending on the processing activity, Stripe may act as a processor and/or an independent controller. Payment card details are entered into Stripe services and the full card number is not stored in the Ulvilan Koirametsä booking system.

Stripe privacy information

We use Google Analytics 4 for statistical measurement of website usage.

The website uses the basic implementation of Google Consent Mode v2. The Google Analytics tag is not loaded and analytics measurements are not sent before the user grants consent. Once accepted, Google Analytics may set analytics cookies and collect information about website usage. Consent can be withdrawn in cookie settings.

We do not intentionally send the name, email address or phone number entered in the booking form to Google Analytics.

Google Privacy Policy

With your consent, we also use our own first-party analytics system. It measures page views, permitted interface events and active usage time, and processes random visitor and session identifiers and technical browser, device and error information.

Data is stored in our own database. We do not intentionally collect customer names, email addresses, phone numbers or payment card details in analytics. Consent can be withdrawn in cookie settings.

Session and event data is retained for up to 90 days, daily aggregates for 13 months and JavaScript error statistics for 30 days.

Personal data may be processed with the help of service providers necessary to operate the service. These may include the website and database hosting provider, Stripe for payment processing, the email service provider, Tavoittaja for SMS delivery, Igloohome for generating access codes related to bookings, and Google Analytics in accordance with the user's consent settings.

Only information necessary to provide the relevant service is shared with service providers. We do not sell personal data. Data may be disclosed to authorities where required by law.

Some service providers may process data outside the EU or EEA. Where this occurs, transfers must rely on an appropriate legal transfer mechanism and safeguards, such as European Commission standard contractual clauses or an applicable adequacy decision.

Personal data is retained only as long as necessary for the purposes described in this policy. Booking/customer-service data is kept as needed to complete the booking, provide customer service and address possible claims; accounting data for the statutory period; security/server logs for a limited operational period; Analytics data according to the current Analytics property settings; and the consent choice until it is changed, browser storage is cleared or the consent solution version changes.

An account may be deleted at the customer's request, by an administrative decision, or automatically after 13 months of inactivity, subject to the system's notification and eligibility checks.

To demonstrate that deletion was completed and resolve questions about it, we retain a minimal deletion record. It contains the deletion date and time, deletion method, the category of any administrative reason, a random event identifier and a lookup identifier derived from the account email using a secret key (HMAC). It does not contain a name, phone number, plain-text email address or full customer profile. The lookup identifier is pseudonymised personal data, not anonymous data.

Processing is based on our legitimate interest in demonstrating account deletion and resolving related questions (Article 6(1)(f) GDPR). Access is restricted, and only the principal administrator handles personal data requests.

The deletion record is retained for six calendar months from deletion. After expiry it is excluded from access-request searches immediately and removed by daily cleanup, normally within 24 hours. These records are excluded from routine database backup data. Creating another account does not restart the retention period.

Account deletion notification email: When an administrator deletes a customer account, a notification is sent to the customer by email. For delivery processing, we store the deletion request identifier, recipient email address, delivery status and timestamps, and the record retention deadline. After a successful or uncertain delivery attempt, the recipient email address is removed from the delivery queue. The target retention period for a queue record is 30 days from creation. Pending records eligible for delivery may be kept longer to avoid losing the notification. These records are processed to communicate account deletion and investigate delivery outcomes.

Deleting an account does not automatically erase all other data. Accounting records and necessary booking-ban information may remain under their own legal bases and retention rules. Such data remains within the scope of an access request where it can be linked to you. You may also request access to the deletion record and object to processing based on legitimate interests. Evidence necessary for a pending data request or a concrete legal matter is assessed and preserved separately; this does not extend retention for all customers.

We use appropriate technical and organisational measures to protect personal data. The website uses HTTPS encryption. Access to booking administration and other administrative functions is restricted by access controls. Payment card processing is handled by the payment service provider.

Subject to applicable data protection law, you may have the right to receive information about processing, request access and correction, request deletion or restriction where legally applicable, object to processing in applicable situations, receive portable data where the requirements are met, and withdraw consent at any time where processing is based on consent.

Requests can be sent to info@ulvilankoirametsa.fi. We may need to verify your identity before fulfilling a request.

If you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

We may update this privacy policy when the service, systems we use or applicable legislation changes. The current version will be published on this page.