Privacy notice

Draft. This privacy notice is being finalised and will be reviewed before the site goes live.

Who we are

The controller of your personal data is Tanja Invest Oy (Business ID 2953707-1), Sivulankuja 10, 99130 Sirkka, Finland. Hush Lapland is a trade name of Tanja Invest Oy. For privacy matters, email info@hushlapland.com.

What we collect and why

Bookings

When you book a stay, we process your name, contact details, the number of guests, your dates of stay, your booking messages and payment information. We need these to provide the stay, to send you arrival instructions and to keep accounts as required by law. Legal basis: performance of a contract and our legal obligations.

If you book through Airbnb or Booking.com, that platform is also a controller of your data under its own privacy policy. We receive the booking details we need to host you.

The chat assistant

Our website chat is an AI assistant. When you use it, we process your messages, the time of the conversation, the page or home you asked about and the language you used. If you ask us to pass your question to the host, we also process the contact detail you give us so that we can reply. We use conversations to answer you and to improve our answers. Legal basis: our legitimate interest in answering guests and improving our service, or the performance of a contract if you are staying with us.

Please do not share payment card details, passwords or other sensitive information in the chat.

Using the website

Our hosting provider processes technical data, such as your IP address and browser type, to deliver the site and keep it secure. Legal basis: our legitimate interest in running a secure website.

Cookies

We only use cookies that are necessary for the site to work. We do not currently use analytics or marketing cookies. If we start to use them, we will ask for your consent first.

Who processes your data for us

• Smoobu (Smoobu GmbH, Germany): booking and channel management.
• Stripe (Stripe Payments Europe Ltd, Ireland): card and online payments. We do not receive or store card details.
• Supabase: database for bookings and chat conversations. Data region: [to confirm].
• Anthropic (United States): the language model behind the chat assistant.
• Website hosting: [Netlify or Vercel, to confirm].

Where data is transferred outside the EU or EEA, we rely on the European Commission's standard contractual clauses or an adequacy decision, such as the EU–US Data Privacy Framework.

How long we keep it

• Booking and accounting records: six years from the end of the financial year, as required by the Finnish Accounting Act.
• Chat conversations: [for example 12 months, to confirm], after which they are deleted.
• Guest contact details: no longer than needed for the stay, any follow-up and our legal obligations.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing and, where applicable, to data portability. To use your rights, email info@hushlapland.com. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).