Privacy Policy
Updated 1 October 2026
Luolaseikkailu processes personal data so you can make a booking and so the site works. We only process what is necessary: analytics and marketing are used only if you consent to them. This policy explains what data we process, why, and what your rights are.
Data controller
The data controller is responsible for the processing of your personal data on this site. For any privacy-related questions, use the contact details below.
- Data controller
- Irti Maasta Oy
- Business ID
- 2659037-9
- Data protection officer
- Aleksi Mattila
- Address
- c/o Kummelipolku 5a, 02330 Espoo
- Phone
- +358 40 356 6276
What data we process and why
We only process the data we need to handle your booking, answer your questions and, with your consent, improve the site.
| Data | How we use it | Legal basis |
|---|---|---|
| Booking details: name, email, phone number and booking details | Making, confirming and handling the booking, and booking-related communication. | Performance of a contract (booking). |
| Payment details | Processing and confirming the payment. We do not store your card number. It is handled by the payment provider. | Performance of a contract and a legal obligation (accounting). |
| Enquiries: contact form, email or phone | Answering your questions (e.g. allergies, age recommendations, cancellations). | Legitimate interest: customer service. |
| Analytics data: cookies and site usage | Understanding how the site is used so we can improve it. | Consent. |
| Marketing data: cookies | Ad targeting and measuring its effectiveness. | Consent. |
Who we share data with
We do not sell your personal data. Booking data is processed in our own, self-hosted booking system (Sessiq) and is not disclosed to an external booking platform. The other providers below process data on our behalf only for the purpose it was given:
- Booking-system hosting: Hetzner hosts the server for our own booking system in Finland (Helsinki).
- Payment processing: Stripe and Paytrail handle card and online bank payments securely. For Paytrail payments, Irti Maasta Oy is the controller and Paytrail Oyj acts as processor under a separate agreement. Paytrail collects e.g. the payment method, date and time, and IP address (plus the bank account number for direct bank payments, and your name for email refunds and strong-authentication methods). See the Paytrail privacy notice.
- Analytics: Google Analytics (visitor measurement) and Microsoft Clarity (usability analytics, including session recordings), only with your analytics consent.
- Marketing: Google Ads, Meta (Facebook and Instagram) and TikTok, for ad targeting and measuring its effectiveness, only with your marketing consent.
- Server-side event forwarding: some measurement events are sent from your browser through an operator-controlled server-side tagging endpoint to the analytics and marketing partners named above. Consent follows the same analytics and marketing choices you make.
- Contact-form email: Brevo delivers your contact-form message to our inbox (name, email, message and IP address); Brevo does not store the message.
- Gift cards: gift cards are sold in the Active Entertainment online shop, which processes purchase details under its own terms and privacy policy.
- Website infrastructure: Cloudflare provides the site’s delivery and security.
Some providers may process data outside the EU or EEA. Transfer basis by recipient:
- Google, Stripe, Cloudflare, Brevo, Meta and Microsoft (Clarity): the EU–US Data Privacy Framework (DPF).
- TikTok: the European Commission’s Standard Contractual Clauses (SCCs).
- Paytrail: transfers outside the EU/EEA may take place on the basis of an adequacy decision or the European Commission’s Standard Contractual Clauses (Paytrail privacy notice, section 9).
- Hetzner: booking-system data is processed in Finland and is not transferred outside the EEA.
We also disclose data to authorities where the law requires it.
How long we keep data
- Booking and payment details: for as long as needed to handle the booking, and after that for six (6) years from the end of the booking year, as required by the Accounting Act.
- Payment details processed by Paytrail: Paytrail keeps payment details for five (5) years under its statutory obligation as a payment institution, after which they are deleted or anonymised. This is separate from the accounting retention period above.
- Enquiries: contact messages are kept in our inbox for twelve (12) months and then deleted.
- Cookie consent: stored in your browser for about 12 months. You can change your choice at any time.
- Analytics and marketing cookies: for the period set by each provider.
Your rights
You have rights over your own data under data protection law. You can:
- check what data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete your data;
- ask us to restrict processing, or object to it;
- receive the data you have given us in a portable format;
- withdraw your consent at any time (for example cookie consent via the button above).
To use your rights, contact info.tampere@luolaseikkailu.fi. If you believe your data is being processed unlawfully, you can lodge a complaint with the supervisory authority (Office of the Data Protection Ombudsman).
Data security
We protect personal data with appropriate technical and organisational measures. Payments are encrypted and go through the payment provider, and we never handle card details ourselves.
Changes to this policy
We may update this policy, for example when our services change. The current version is always on this page, and the date at the top shows when it was last changed.
Contact
For privacy questions, contact info.tampere@luolaseikkailu.fi or +358 40 356 6276.