Privacy notice

1. Data controller

The data controller is Riverside Arctic Experience Oy, operating Ivalo River Camping and developing the Ivalo River Village customer experience.

Contact details

2. Personal data we process

Depending on how you interact with us, we may process:

• name, email address, phone number and country
• preferred language and other communication preferences
• messages and enquiries you send to us
• booking and service information received from accommodation or activity booking systems
• website source, page path, referrer and campaign parameters used to understand customer acquisition
• marketing-consent status and evidence when you explicitly choose to receive marketing
• limited technical data needed for website security and abuse prevention

3. Why we process personal data

• to answer enquiries and provide customer service
• to take steps requested by you before a booking or purchase
• to manage customer and booking information received from operational booking systems
• to maintain IVRC-owned customer and commercial records
• to understand how customers find our services and improve the customer journey
• to send marketing only where a valid permission or other lawful basis applies
• to protect the website and services from misuse

4. Legal basis

Depending on the situation, processing is based on steps requested before entering into a contract, performance of a contract, our legitimate interests in customer service and operating our business, compliance with legal obligations, or your consent. Marketing consent can be withdrawn at any time.

5. Systems and service providers

Website enquiries are sent through a secure server-side interface to our Supabase customer-data environment. Accommodation and activity bookings may be processed by the relevant booking, distribution and payment providers. Hosting, security and content-delivery providers may process technical connection data needed to deliver the service. We use processors only for defined business purposes and seek appropriate data-protection safeguards.

6. Sharing and international processing

We do not sell personal data. Data may be shared with service providers where necessary to provide the requested service, operate the website, process a booking or payment, meet legal obligations or protect our rights. If a provider processes data outside the European Economic Area, appropriate safeguards are used where required by applicable law.

7. Retention

We keep personal data only for as long as it is needed for the purpose for which it was collected and for applicable legal, accounting, contractual and dispute-handling obligations. Contact enquiries are not intended to be kept indefinitely. Consent records may be retained as evidence of the permission given or withdrawn.

8. Marketing consent

A booking or contact enquiry does not automatically create marketing permission. Marketing consent is recorded separately when you explicitly choose to receive marketing, and you may withdraw that consent at any time.

9. Your rights

Subject to applicable law, you may have the right to:

• access your personal data
• ask us to correct inaccurate data
• request deletion or restriction of processing
• object to processing based on legitimate interests
• receive data in a portable format where applicable
• withdraw consent at any time
• lodge a complaint with the competent data-protection authority

To exercise your rights, contact us using the details below. We may need to verify your identity before completing a request.

10. Third-party booking services

When you continue from our website to an external accommodation or activity booking service, that provider may also process personal data under its own privacy terms. Those operational services remain separate from this website privacy notice.

11. Changes to this notice

We may update this notice as the digital services, booking integrations or legal requirements change. The current version and update date are shown on this page.