Privacy policy

PRIVACY NOTICE 

PRIVACY NOTICE — GUEST AND CUSTOMER DATA

This notice explains how Basecamp and Adventure Oy processes your personal data in accordance with the EU General Data Protection Regulation (EU) 2016/679 and the Finnish Data Protection Act (1050/2018). Statutory traveller information is also processed in accordance with Sections 6–9 of the Act on Accommodation and Catering Operations (308/2006).

Date of drafting: October 7th 2026

Data Controller 

Basecamp and Adventure Oy

Business ID: 2953180-9

Address: Revontulentie 4, Kilpisjärvi 99490, Finland

Privacy enquiries and requests: margit@cahkalhotel.fi

Legal Basis for Processing Personal Data 

We process personal data on the following legal bases:

  • Contract: To handle bookings, provide accommodation, restaurant and activity services, and arrange payments where you are a party to the contract, or to take steps at your request before entering into a contract.
  • Legal obligation: To collect, retain and disclose statutory traveller information under the Act on Accommodation and Catering Operations (308/2006), and to fulfil applicable accounting and tax obligations.
  • Legitimate interests: To manage relationships with corporate customers through their contact persons, handle customer feedback, pursue outstanding payments and maintain necessary customer information to provide personalised service to returning guests, where these interests are not overridden by your rights and interests.
  • Consent: To send electronic direct marketing where consent is required.
  • Explicit consent for health information: Where dietary or accommodation requests contain health information, we process that information with your explicit consent to arrange and provide the services you request.

You may withdraw your consent at any time by contacting reception or emailing margit@cahkalhotel.fi. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Processed Personal Data 

The following personal data is processed where required by law or necessary for the services used.

Statutory traveller information

  • Full name and nationality.
  • Finnish personal identity code or, if unavailable, date of birth.
  • Travel document number, except for Nordic citizens and guests resident in Finland.
  • Address.
  • Country from which you arrive in Finland, unless you reside in Finland.
  • Arrival and departure dates.
  • Full names and Finnish personal identity codes or, if unavailable, dates of birth of accompanying spouses and minor children recorded on the same traveller notification.
  • Signature confirming the traveller information.

Booking and customer information

  • Contact information: name, telephone number, email address and address where needed for the booking or billing.
  • Booking details, equipment requirements and information about services used or purchased.
  • Payment method, billing details and information about overdue payments.
  • Accommodation preferences and other service requests.
  • Dietary requirements and health information needed to fulfil dietary or accommodation requests, with explicit consent where the information concerns health.
  • Customer feedback.
  • Marketing consents and objections to direct marketing.

Corporate customer contact information

  • Contact person’s name, email address and telephone number.
  • Marketing preferences and objections.
  • Feedback provided by the contact person.

Providing statutory traveller information is required by law. Without it, we cannot complete the required traveller registration. Information necessary to arrange a booking and provide the requested services must also be supplied; otherwise, we may be unable to fulfil the booking or service request. Other preferences and marketing consent are optional.

We collect personal data directly from you and, where applicable, from booking platforms, travel agents, your employer or another person making a booking on your behalf.

Purposes of Personal Data Processing 

We process personal data for the following purposes:

  • Handling and managing accommodation, restaurant and activity bookings.
  • Arranging and providing the services you request, including equipment and accommodation preferences.
  • Processing payments, invoicing, monitoring outstanding payments and collecting overdue amounts.
  • Communicating with customers about bookings, services and enquiries.
  • Managing customer relationships and using feedback to improve our services.
  • Marketing our services, subject to applicable consent requirements and your marketing preferences.
  • Arranging suitable meals and fulfilling dietary or accommodation requests. Related health information is used only to fulfil those requests, with your explicit consent.
  • Fulfilling statutory traveller-registration obligations, including collecting and retaining required traveller information and providing it to the authorities as required by law.
  • Fulfilling accounting and tax obligations.

Recipients or Categories of Recipients of Personal Data 

Personal data may be shared, where necessary for the purposes described in this notice, with:

  • Providers of booking and hotel-management systems, IT support, data hosting and customer communication services.
  • Payment service providers, accounting service providers and debt collection agencies.
  • Activity providers and other partners delivering services you have booked.

Service providers processing personal data on our behalf act under our instructions and appropriate data-processing agreements. We share only the information necessary for their tasks.

Statutory traveller information concerning foreign nationals is provided without delay to the local police as required by the Act on Accommodation and Catering Operations (308/2006). Traveller information is also provided to the police and other competent authorities upon request where required by law.

Transfer of Data Outside the EU or EEA 

We use Mews to manage bookings and hotel services. In providing these services, Mews and its service providers may process personal data outside the EU or EEA, including in the United States.

Where such transfers take place, they are based on an applicable European Commission adequacy decision or protected by appropriate safeguards, including the European Commission’s standard contractual clauses and additional measures where necessary.

You may obtain further information about these transfers and a copy of the applicable safeguards by contacting margit@cahkalhotel.fi.

Protection of Personal Data

We protect personal data through appropriate technical and organisational measures against unauthorised access, loss, alteration and disclosure.

Access is limited to authorised staff and service providers who need the information to perform their duties. Persons handling personal data are subject to confidentiality obligations.

Electronic records are protected through access controls and other appropriate security measures. Any paper records are stored securely with access restricted to authorised persons.

Retention Period of Personal Data 

Statutory traveller notifications are retained for one year from signing, and statutory traveller-register entries for one year from entry, after which they are destroyed. Customer information used to manage bookings and serve returning guests is retained for five years after the guest’s last stay or last substantive contact concerning our services.

Accounting records are retained for the periods required by law. Health information provided for a specific service request is deleted when no longer needed for that request.

Other personal data is deleted or irreversibly anonymised when its justified retention period ends.

Rights of the Data Subject 

You may request access to or correction of your personal data and, where applicable, its deletion, restriction of processing or transfer to another controller. You may also object to processing based on legitimate interests on grounds relating to your situation.

You may object to direct marketing or withdraw your consent at any time. Withdrawal does not affect processing already lawfully carried out. Some information must still be retained to meet legal obligations.

To exercise your rights, contact reception or email margit@cahkalhotel.fi. We may need to verify your identity. We normally respond within one month and will notify you if additional time is needed.

You may also lodge a complaint with the Finnish Office of the Data Protection Ombudsman.

Privacy notice