Protecting your data matters to us. This page explains which personal data we process when you visit our website or contact us, what we use it for and which rights you have.
1. Controller
Villa Lapland Holidays Oy
Rihmakuja 2
FI-99340 Raattama, Finland
Business ID (Y-tunnus): 3577721-5
Phone: +358 40 5200942 (also WhatsApp)
You can also reach us through the contact form on the page "Contact / Imprint". For all questions about data protection and to exercise your rights, please use one of these ways.
2. Server log files
Each time you open our website, the web server automatically processes technical data: IP address, date and time, the page requested, the amount of data transferred, browser and operating system details and the page you came from. We need this data to deliver the site, to find errors and to defend against attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). The data is deleted as soon as it is no longer needed for that purpose.
The website runs on a server of a hosting provider that processes the data on our behalf (processing under Art. 28 GDPR).
3. Cookies and your consent
On your first visit, a banner asks which cookies and external services you allow. We set necessary cookies without consent and all others only if you agree.
- Essential: a session cookie that the website and the booking system need technically, and cookies that store your choice in the banner (reDimCookieConsent, reDimCookieHint, reDimCookieConsentId). Legal basis: Art. 6(1)(f) GDPR.
- Functional: Google reCAPTCHA in the contact form (section 7) and the weather display (section 8).
- Statistics: Google Analytics (section 6).
- Marketing and Other: we do not use them.
Your consent is voluntary. You can change or withdraw it at any time with effect for the future, using the round cookie button at the bottom left of every page ("Cookie settings"). The legal basis for all non-necessary services is Art. 6(1)(a) GDPR.
The banner is provided by the Joomla plugin "CookieHint and Consent" by reDim GmbH. To prove your decision we store a log entry per decision: time (UTC), action, selected categories, a consent ID, the truncated IP address and the browser identifier (user agent). Entries are deleted after three years. The legal basis is our legitimate interest in being able to prove consent under Art. 7(1) GDPR (Art. 6(1)(f) GDPR). The plugin also counts anonymously how often the banner is shown, accepted or declined, without IP address and without personal reference.
4. Contacting us
If you write to us through the contact form, we process your name, email address, subject and message to answer your request. If you ask for a copy of your message, we send it to the address you give. The legal basis is Art. 6(1)(b) GDPR where the request concerns a stay with us, otherwise Art. 6(1)(f) GDPR. We usually delete requests once they are dealt with, unless legal retention duties apply.
If you call us or write via WhatsApp, we process your phone number and the content of your message to reply. For WhatsApp, the provider's own privacy terms apply in addition.
5. Booking enquiries and bookings
If you send an enquiry or book through our booking system, we process the details you enter there, for example name, contact details, travel dates, number of guests and your message. We need them to check your enquiry, confirm your stay and handle it. The legal basis is Art. 6(1)(b) GDPR. Beyond handling the stay, we keep data only as long as legal retention duties require, for example under Finnish accounting law (Art. 6(1)(c) GDPR).
6. Google Analytics 4 (only with your consent)
With your consent, we use Google Analytics 4 to measure reach. It shows us which pages are visited so that we can improve the website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Cookies are set (_ga and _ga_BXV5X43467) and usage data is sent to Google, for example pages viewed, approximate location, device, browser and time on page. Google may transfer this data to Google LLC in the USA. The transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework. We delete event-level data after the retention period set in our account, after 14 months at the latest.
Without your consent, Google Analytics is not loaded and no data is sent to Google. The legal basis is Art. 6(1)(a) GDPR.
7. Google reCAPTCHA (only with your consent)
Our contact form is protected against misuse and spam by reCAPTCHA v3. The provider is Google Ireland Limited (address in section 6). reCAPTCHA evaluates how you behave on the page, for example time on page, mouse movements, browser details and IP address, and sends this data to Google, possibly to the USA (Data Privacy Framework, see section 6).
The legal basis is your consent under Art. 6(1)(a) GDPR. Without your consent to the category "Functional", reCAPTCHA is not loaded and the form cannot be sent. A note on the page points this out. You can then reach us by phone or via WhatsApp.
8. Weather display
In the lower part of the page we show the current weather at the villa. For this, your browser retrieves weather data from Open-Meteo (open-meteo.com). Your IP address is transmitted to the provider in the process. No cookies are set for this. The legal basis is your consent under Art. 6(1)(a) GDPR.
9. Fonts, images and videos
We deliver all fonts, images and videos of this website from our own server. There is no connection to Google Fonts or to video platforms.
10. Recipients of data
We pass data on only where necessary: to our hosting provider as processor, to Google and Open-Meteo as far as you have consented, and to authorities or advisers where we are obliged or entitled to do so.
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data based on legitimate interests, you can object to the processing (Art. 21). You can withdraw a consent you have given at any time with effect for the future (Art. 7(3)). Processing carried out until the withdrawal remains lawful.
You can lodge a complaint with a data protection supervisory authority, in particular in the EU country of your habitual residence. The authority responsible for us is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), P.O. Box 800, FI-00531 Helsinki, Finland, www.tietosuoja.fi.
We do not use solely automated decision-making, including profiling.
12. Changes
We update this notice when our services or the law change. Status: October 2026.
