Privacy Policy

Last updated: 15.10.2026

Company: Karu Lodge Oy
Business ID: 3171496-2
Address: Yli-Luostontie 358, 99555 Luosto
Website: www.karulodge.fi
Email: kaija@karulodge.fi
Phone: +358 40 745 3766

This Privacy Policy explains how Karu Lodge Oy collects, uses, stores and protects personal data in connection with bookings, customer enquiries and the delivery of our services.

Karu Lodge Oy processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection legislation.

Karu Lodge Oy acts as the data controller for personal data processed in connection with its own services.

Depending on the service and booking method, we may collect:

• full name
• email address
• phone number
• billing information
• booking date and activity details
• number and ages of participants
• transportation and pickup information
• messages and other information provided in connection with the booking
• dietary requirements and allergy information
• health or mobility information voluntarily provided by the customer when necessary for safe participation in an activity
• information required for accounting, payment processing and legal obligations.

We only request information that is reasonably necessary for managing the booking and providing the service.

Personal data may be used for:

• processing and confirming bookings
• communicating with customers before, during and after the service
• organising and delivering activities
• arranging included or separately agreed transportation
• accommodating dietary requirements and relevant safety needs
• processing payments and refunds
• invoicing and accounting
• handling complaints and customer service matters
• complying with legal and regulatory obligations
• protecting the rights and legitimate interests of Karu Lodge Oy
• marketing communications where the customer has provided consent or where otherwise permitted by law.

The legal basis for processing depends on the situation and may include performance of a contract, compliance with a legal obligation, legitimate interests and, where required, consent.

Customers may voluntarily provide information relating to allergies, dietary requirements, medical conditions, mobility or other matters relevant to safe participation.

Such information is processed only when necessary for providing the requested service and, where required by applicable data protection law, on the basis of explicit consent.

Please do not provide health information that is not relevant to the booked service.

Bookings may be made directly with Karu Lodge Oy or through third-party booking and sales platforms such as Bókun, GetYourGuide or other authorised travel partners.

When a booking is made through a third party, that provider may process personal data under its own privacy policy in addition to providing booking information to Karu Lodge Oy.

Karu Lodge Oy uses Bókun as a booking management system. Personal data necessary for managing reservations may therefore be processed through Bókun.

Online payments may be processed by Stripe or another payment service provider.

Karu Lodge Oy does not store full payment card details. Payment information is processed by the payment service provider in accordance with its own privacy practices.

We do not sell personal data.

Personal data may be disclosed or made available only where reasonably necessary, including to:

• booking platform providers
• payment processors
• accounting and financial administration providers
• IT and hosting providers
• guides or activity partners involved in delivering the booked service
• licensed transportation providers where transportation is arranged for the customer
• authorities where disclosure is required by law.

Only information necessary for the relevant purpose is shared.

For example, a transportation provider will only receive information required to complete the agreed transfer.

Some service providers may process data outside the European Union or European Economic Area.

Where personal data is transferred internationally, appropriate safeguards required by applicable data protection legislation are used.

Personal data is retained only for as long as necessary for the purpose for which it was collected or as required by law.

Booking and accounting information may be retained for the periods required under Finnish accounting and tax legislation.

Customer correspondence may be retained for a reasonable period where necessary to manage bookings, complaints or possible legal claims.

Allergy, health-related and other special-category personal data will not be retained longer than necessary for providing the service unless continued retention is legally justified.

Karu Lodge Oy uses appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Access to customer information is limited to persons who need the information for their work or for delivering the booked service.

Subject to applicable law, you may have the right to:

• request access to your personal data
• request correction of inaccurate information
• request deletion of personal data where there is no lawful reason to retain it
• request restriction of processing
• object to certain processing
• request data portability in applicable situations
• withdraw consent where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Requests concerning personal data can be sent to:

kaija@karulodge.fi

We may request reasonable information to verify your identity before processing a request.

If you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

Our website may use cookies and similar technologies for website functionality, analytics and other purposes.

Where required, visitors are given the opportunity to manage their cookie preferences.

Further information may be provided through the website’s cookie settings or cookie notice.

This Privacy Policy may be updated when our services, systems or legal obligations change.

The current version will be made available through our website and/or booking system.