Welcome to Afra Arctic. At Afra Arctic Oy, we respect your privacy and are committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, make an accommodation reservation, book additional activities or communicate with us.
This policy applies to our website, including the booking functionality provided through Hostaway, and to personal data processed in connection with our accommodation and tourism services.
We process personal data in accordance with the European Union General Data Protection Regulation (GDPR) and applicable Finnish data protection legislation.
2. Data Controller
The controller responsible for processing your personal data is: Afra Arctic Oy, Sodankylä, Finland
Website: afra-arctic.com
Email: info@afra-arctic.com
Registered business address: Isojängäntie 71, 99560 Orakylä / Sodankylä
Finnish Business ID: 3603984-7
For questions regarding privacy or the processing of your personal data, please contact us using the email address provided above.
3. Personal Data We Collect
Depending on your interaction with our services, we may collect the following information:
Personal identification and contact information: Full name, email address, telephone number, postal address and country of residence.
Reservation information: Arrival and departure dates, number of guests, accommodation preferences, additional services and activities booked, special requests and reservation history.
Payment information: Payment amounts, transaction references, payment status, billing information and refund information.
Payment card information is handled through our payment service providers, including Stripe, according to the applicable payment processing arrangements.
Technical information: When you visit our website, certain technical information may be collected, including IP address, browser type, device information, operating system, website usage information, cookies and similar technologies.
4. Purposes and Legal Basis for Processing
We process personal data for the following purposes:
Accommodation reservations: To manage reservations, provide accommodation, process booking requests and communicate with guests. Legal basis: Article 6(1)(b) GDPR – performance of a contract or steps taken before entering into a contract.
Payments and accounting: To process payments, issue invoices, manage refunds and comply with financial and accounting obligations. Legal basis: Article 6(1)(b) and Article 6(1)(c) GDPR.
Guest communication: To send reservation confirmations, arrival instructions, check-in information and other communications related to your stay. Legal basis: Article 6(1)(b) GDPR.
Customer service: To respond to questions, requests and complaints. Legal basis: Article 6(1)(b) or Article 6(1)(f) GDPR, depending on the nature of the request.
Legal obligations: To comply with applicable Finnish legislation, including accounting, taxation and legally required guest registration obligations. Legal basis: Article 6(1)(c) GDPR.
Website security and operation: To maintain the security, stability and functionality of our website and booking services. Legal basis: Article 6(1)(f) GDPR, based on our legitimate interest in operating secure and reliable services.
Marketing communications: Where required by law, we send promotional emails or newsletters only with your consent. Legal basis: Article 6(1)(a) GDPR. You may withdraw your consent at any time.
5. Booking Management Through Hostaway
We use Hostaway as our property management and booking platform. Hostaway helps us manage accommodation availability, reservations, guest information, automated guest communications, booking calendars, payment-related information and connections to booking platforms. Our website may include an integrated Hostaway booking engine that allows guests to check availability, select accommodation and complete reservations. When using these functions, relevant personal information is processed through Hostaway and its authorised service providers. The processing is necessary to provide our accommodation services. For more information about Hostaway’s own processing activities, please refer to Hostaway’s Privacy Policy.
6. Payments Through Stripe
We use Stripe to process online payments for accommodation reservations and additional services. When you make a payment, information necessary to complete the transaction may be transmitted to Stripe. This may include your name, email address, billing information, payment amount, payment method details and transaction information. Stripe processes payment information in accordance with its applicable privacy and security policies.
We use payment information to complete reservations, process refunds, manage deposits where applicable and fulfil accounting obligations.
7. Reservations Through Third-Party Platforms
Our accommodation may also be available through external booking platforms, including Airbnb, Booking.com and Vrbo / FeWo-direkt. When you make a reservation through one of these platforms, the platform may share relevant booking and guest information with Afra Arctic Oy. We use this information to manage your reservation and provide the accommodation and services requested. These booking platforms also process personal data under their own privacy policies.
8. Additional Activities and Services
Afra Arctic may offer additional tourism services, including snowmobile rentals, guided tours and other outdoor activities.
When you request or book such services, we may process information necessary to arrange and deliver them. Where activities are provided in cooperation with external partners, relevant reservation information may be shared with those partners when necessary to provide the requested service.
9. Cookies and Website Technologies
Our website and integrated booking services may use cookies and similar technologies. These technologies may be used to ensure essential website functionality, maintain booking sessions, support secure payment processes, remember user preferences and analyse website performance where enabled.
Strictly necessary cookies may be used to provide requested services and ensure website security. Non-essential cookies, including analytics and marketing cookies, will be used only where legally permitted and, where required, after obtaining your consent. You can manage your cookie preferences through the available cookie settings.
10. Sharing of Personal Data
We may share personal data with trusted service providers where necessary to operate our business. These may include property management and booking software providers, payment processing providers, website hosting and technical service providers, booking platforms, accounting and professional service providers, tourism activity partners and public authorities where legally required. We share only the information necessary for the relevant purpose. We do not sell your personal data.
11. International Data Transfers
Some service providers may process personal data outside the European Economic Area. Where such transfers occur, we ensure that appropriate safeguards are applied as required by the GDPR. These safeguards may include European Commission adequacy decisions, Standard Contractual Clauses or other legally recognised transfer mechanisms. Information about applicable safeguards can be requested using our contact details.
12. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy. Reservation and customer information is retained for the period necessary to provide our services, handle potential claims and comply with applicable legal obligations.
Accounting and transaction records are retained in accordance with Finnish accounting and tax legislation. Other personal data is deleted or anonymised when it is no longer required, unless a longer retention period is legally necessary.
13. Data Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration and disclosure. These measures may include access restrictions, secure communication technologies, password-protected systems, use of professional payment processing providers and appropriate organisational security procedures.
While we take reasonable precautions, no internet-based system can guarantee absolute security.
14. Your Rights Under the GDPR
Under applicable data protection legislation, you may have the following rights:
The right to access your personal data.
The right to request correction of inaccurate information.
The right to request deletion of personal data.
The right to restrict certain processing activities.
The right to object to processing based on legitimate interests.
The right to data portability.
The right to withdraw consent at any time.
These rights are subject to the conditions and limitations established by applicable law.
To exercise your rights, please contact us using the contact information provided above.
15. Complaints
If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent data protection supervisory authority.
In Finland, the competent authority is the Office of the Data Protection Ombudsman. You may also contact a supervisory authority in another EU or EEA country where you reside, work or where an alleged infringement occurred.
16. Automated Decision-Making
Afra Arctic Oy does not currently use personal data for automated decision-making that produces legal or similarly significant effects within the meaning of Article 22 GDPR. Automated reservation confirmations, booking notifications and guest communications may be used to support our services.
17. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our services, legal requirements or data processing activities. The latest version will be published on our website.
18. Contact
For questions regarding this Privacy Policy or the processing of your personal data, please contact: