Privacy Policy
Privacy Notice
Last updated: October 2026
1. Data Controller
2. Purpose and Legal Basis
Personal data is collected and processed for the following purposes:
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, phone | Booking confirmation, guest communication | Contract (GDPR Art. 6.1b) |
| Date of birth, nationality, home address, passport/ID number | Statutory guest register (Act 308/2006) | Legal obligation (GDPR Art. 6.1c) |
| Number of guests, stay dates | Booking management | Contract (GDPR Art. 6.1b) |
| Payment data | Payment processing via Stripe | Contract (GDPR Art. 6.1b) |
3. Retention Period
Personal data is retained for 12 months from the end of your stay, as required by the Finnish Act on Accommodation and Catering Operations (308/2006). After this period, data is automatically deleted. Payment records held by Stripe are subject to Stripe's own retention policy.
4. Data Recipients
Your data is shared only with the following processors, solely to provide the service:
- Stripe, Inc. — Payment processing. stripe.com/privacy
- Resend, Inc. — Transactional email delivery. resend.com/privacy
- Railway Corp. — Cloud hosting (EU region). railway.app/legal/privacy
Data is not sold, rented, or shared with any other third parties. Data is processed within the EU/EEA.
5. Your Rights
Under GDPR you have the right to:
- Access — Request a copy of the personal data we hold about you.
- Rectification — Request correction of inaccurate data.
- Erasure — Request deletion of your data, subject to legal retention obligations.
- Restriction — Request that we limit processing of your data.
- Portability — Receive your data in a structured, machine-readable format.
- Objection — Object to processing based on legitimate interests.
To exercise any of these rights, contact: kivikatuapartment@gmail.com. We will respond within 30 days.
6. Right to Lodge a Complaint
If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman:
Tietosuojavaltuutetun toimisto
PO Box 800, 00531 Helsinki
tietosuoja.fi
7. Cookies and Tracking
This website does not use tracking cookies or analytics. The only cookies set are strictly necessary session cookies required for the booking process (Stripe payment).
8. Security
All data is transmitted over HTTPS. Payment data is processed directly by Stripe and never stored on our servers. Access to guest records is restricted to the property manager via authenticated admin interface.