Privacy

Controller

The controller is:

Qimmit Wild North Oy
Tolvantie 48, 93900 Kuusamo, Finland
Business ID (Y-tunnus): 3630372-4
Email: [email protected]

Data and purposes

Kennel visit booking

• Data: name, email, optional phone number, language, date, time slot and participants.
• Purpose: manage and confirm the booking, and allow it to be cancelled.
• Legal basis: performance of a contract.
• Retention: anonymised 12 months after the visit, unless a legal obligation or a dispute requires otherwise.

Stay enquiry

• Data: season, dates, participants, name, email, optional phone number, language and message.
• Purpose: answer the enquiry and prepare an offer.
• Legal basis: pre-contractual measures.
• Retention: 24 months after the last exchange, unless a contract is concluded.

Emails

• Data: email address and message content.
• Purpose: send confirmations, cancellations and replies.
• Legal basis: contract or pre-contractual measures.
• Retention: temporary technical content; delivery record for up to 30 days.

Abuse prevention

• Data: IP address and timestamp.
• Purpose: limit automated submissions.
• Legal basis: legitimate interest in securing the service.
• Retention: in memory only, 24 hours at most.

Cloudflare Turnstile

• Data: IP address and technical signals.
• Purpose: tell a human user apart from an automated submission.
• Legal basis: legitimate interest in protecting the forms.
• Retention: according to Cloudflare’s configuration and terms.

Administration

• Data: email, login token and session.
• Purpose: authenticate users of the administration area and keep it secure.
• Legal basis: legitimate interest.
• Retention: link: 15 minutes; session: 30 days, 90 days at most.

Technical logs

• Data: IP address, date, requested resource, browser and security events.
• Purpose: security, diagnostics and attack detection.
• Legal basis: legitimate interest.
• Retention: 90 days at most.

Backups

• Data: encrypted copy of the database.
• Purpose: business continuity and recovery after an incident.
• Legal basis: legitimate interest.
• Retention: rolling 14 days.

Contracts and accounting

• Data: identity, booking, payment and invoicing data.
• Purpose: legal obligations, evidence and accounting.
• Legal basis: legal obligation and performance of the contract.
• Retention: period required by applicable Finnish law.

Free-text fields must not be used to submit medical information or other sensitive data. Information needed for the safety of an activity will be requested separately when necessary.

Recipients

Data is accessible only to those who need it:

• Qimmit Wild North Oy;
• Makeset, for hosting, maintenance and support;
• Hostinger, provider of the server (VPS) used by Makeset;
• one.com, for sending emails;
• Cloudflare, for security, CDN and Turnstile;
• Stripe, once online payments are activated;
• public authorities and professional advisers where required by law.

GitHub and Pages CMS host the website’s code, texts and public media. They contain neither bookings nor stay enquiries.

Processing on our behalf

Makeset processes booking data on behalf of Qimmit Wild North and on its instructions. This processing is governed by an agreement that complies with Article 28 of the GDPR.

Transfers outside the EEA

Some providers may process data, or make it accessible, from a country outside the European Economic Area.

Depending on the provider, Qimmit Wild North and Makeset rely on:

• an adequacy decision of the European Commission;
• the EU–US Data Privacy Framework, where the recipient is validly certified;
• or the European Commission’s Standard Contractual Clauses, supplemented where necessary by a transfer assessment and additional measures.

Information about the applicable safeguards can be requested from Qimmit Wild North.

Your rights

Under the conditions set by the GDPR, anyone may request:

• access to their data;
• rectification of their data;
• erasure of their data;
• restriction of processing;
• portability of the data they have provided;
• objection to processing based on legitimate interest.

Requests may be sent to [email protected]. Proportionate proof of identity may be requested in case of reasonable doubt.

Anyone who considers that the processing of their data infringes the GDPR may lodge a complaint with:

Office of the Data Protection Ombudsman (Finnish data protection authority)
PO Box 800, 00531 Helsinki, Finland
Email: [email protected]
Website: tietosuoja.fi

Cookies and local storage

No cookies are placed on visitors’ devices, either by the public pages of the website or by its API. The website uses no audience-measurement or advertising tools.

Two strictly necessary mechanisms are used:

• Cloudflare Turnstile, only when a form is displayed: it stores a cf.turnstile.u entry in the browser’s local storage, for the third-party domain challenges.cloudflare.com (partitioned storage, specific to this website). It is used solely to protect against automated submissions.
• Administration area, reserved for the website owner: a __Host-session session cookie, valid for 30 days, extended with each use, 90 days at most.

As these mechanisms are strictly necessary, no consent is requested. This section will be updated before any other tracker is added.

Automated decisions

No decision producing legal effects is taken solely by automated means. No commercial profiling is carried out.