Last Updated: July 3, 2026
At Arctic Panorama Resort, the privacy and trust of our guests are of utmost importance to us. This Privacy Policy explains how we collect, process, store, and protect your personal data when you visit our website (https://arcticpanoramaresort.com/), make accommodation or service bookings, or otherwise communicate with us.
1. Data Controller
Name: Arctic Panorama Resort
Business ID (Y-tunnus): 3456459-2
Address: Golfkentäntie 16, 96600 Rovaniemi, Finland
Email: sales@arcticpanoramaresort.com
Phone: +358 44 246 8642
Website: https://arcticpanoramaresort.com/
2. Contact Person for Data Protection Matters
For any questions regarding the processing of your personal data or this Privacy Policy, please contact:
Contact: Simon Biton, Resort Manager
Email: sales@arcticpanoramaresort.com
3. Name of the Register
Arctic Panorama Resort Customer, Booking, and Marketing Register.
4. Legal Basis and Purpose of Processing
We process your personal data based on the following legal grounds and for the following purposes:
Performance and Preparation of a Contract: Processing is necessary to execute, confirm, and invoice accommodation bookings (e.g., Panorama Suite, Panorama Chalet, Romance Chalet), spa and wellness services, and other supplemental resort services.
Legal Obligation: We process data to comply with our statutory obligations, such as completing passenger notifications in accordance with Finnish law (Act on Accommodation and Catering Operations 308/2006) and adhering to accounting and tax legislation.
Legitimate Interest: We process data for customer relationship management, analytics, service development, statistical purposes, and direct marketing (unless the customer has opted out).
Consent: If you subscribe to our newsletter or accept optional cookies on our website, the processing is based on your explicit consent. You can withdraw your consent at any time.
5. Data Content of the Register
The following types of data may be processed in our register:
Basic Information: Name, address, phone number, email address, language preference, and nationality.
Booking and Accommodation Details: Dates of the booking, type of accommodation, booked additional services (e.g., Access Lapland activities, spa treatments, restaurant reservations), room number, arrival/departure dates, and any special requests or preferences provided by the guest.
Passenger Notification Data: Information required by Finnish law for foreign and domestic guests (such as date of birth, passport or other travel document number, and country of arrival).
Payment Information: Invoicing details, chosen payment method, and transaction identifiers. (Note: Credit card details are processed directly and securely by our certified third-party payment service provider).
Marketing Data: Newsletter subscription status, direct marketing consents, and opt-outs.
Website Usage Data: IP address, cookie data (see Section 11), and website browsing behavior.
6. Regular Sources of Information
We collect personal data primarily:
Directly from you when you make a booking on our website, contact us via email or phone, or fill out a passenger card upon arrival.
From third-party booking channels (such as Booking.com, Agoda, Expedia, Trip.com, etc.) through which you reserve a stay at our resort.
From our trusted partners, such as our activity service partner (Access Lapland), if you book joint tours or excursions.
7. Regular Disclosures and Data Transfers Outside the EU/EEA
Your data may be shared with the following parties:
Authorities: To comply with statutory obligations (e.g., providing passenger data to the local police department as mandated by Finnish law).
Service Providers and Subcontractors: Third-party vendors providing IT support, property management/booking systems, payment processing services, or operational services (such as Access Lapland for arranging activities). These parties process data solely on our behalf and under strict Data Processing Agreements (DPAs).
As a rule, data is not transferred outside the EU or the EEA. If we utilize a service provider whose servers are located outside the EU/EEA (e.g., global IT cloud infrastructure), we ensure the legality of the transfer by using European Commission-approved Standard Contractual Clauses (SCCs) or other safeguards permitted by the GDPR.
8. Principles of Data Security
We take the security of your personal data very seriously:
Digital Material: All systems containing personal data are secured with firewalls, password protection, and other technical security measures. Access to the data is restricted exclusively to authorized Arctic Panorama Resort employees and partners who require it to perform their duties.
Manual Material: Physical documents (such as paper passenger cards) are kept in secure, locked premises accessible only to authorized personnel.
9. Data Retention Period
We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy or to comply with statutory retention periods:
Passenger Cards: By Finnish law, passenger notifications must be retained for exactly one (1) year from the end of the guest’s stay, after which they are permanently destroyed.
Accounting Records: Retained for at least six (6) years from the end of the financial year, in compliance with the Finnish Accounting Act.
Customer and Marketing Data: Retained for the duration of an active customer relationship. If a customer unsubscribes from the newsletter or requests data deletion, the data is removed promptly, provided no legal hold or statutory obligation prevents it.
10. Rights of the Data Subject
Under the GDPR, you have the following rights regarding your personal data:
Right of Access: You have the right to request a copy of the personal data we hold about you.
Right to Rectification: You have the right to request the correction of inaccurate or incomplete data.
Right to Erasure (“Right to be Forgotten”): You can request the deletion of your data if there is no longer a legal basis for its processing (excluding data we are legally obligated to retain).
Right to Restrict or Object to Processing: You can object to the use of your data for direct marketing or request restriction of processing under certain legal conditions.
Right to Data Portability: You have the right to receive the data you provided to us in a structured, commonly used format and transfer it to another controller, where processing is based on consent or a contract.
Right to Withdraw Consent: If processing is based on your consent (e.g., newsletter), you can withdraw it at any time.
To exercise your rights, please send a written request to sales@staging2.arcticpanoramaresort.com. For security reasons, we may request verification of your identity before processing your request.
You also have the right to lodge a complaint with a national supervisory authority if you believe your data has been handled in breach of data protection laws. In Finland, this is the Office of the Data Protection Ombudsman (www.tietosuoja.fi).
11. Cookies
We use cookies and similar technologies on our website to enhance your user experience, analyze traffic, and personalize marketing content.
Essential Cookies: Necessary for the technical operation of the website and the booking engine.
Functional and Analytical Cookies: Help us understand how visitors interact with our site so we can continuously improve our online services.
Marketing Cookies: Used to display targeted, relevant advertisements to you on other websites and platforms.
You can manage your cookie preferences or withdraw consent for non-essential cookies via the cookie consent banner that appears when you visit our site, or by adjusting your web browser settings.
12. Changes to this Privacy Policy
We reserve the right to amend and update this Privacy Policy to reflect changes in our legal obligations or operational practices. We recommend reviewing this page regularly to stay informed. This is the English version of the comprehensive Privacy Policy for Arctic Panorama Resort, fully compliant with the EU General Data Protection Regulation (GDPR) and Finnish legislation.