Privacy Policy

The data controller for the processing described in this notice is Harriniva Oy (Business ID 0511442-9), Harrinivantie 35, 99300 Muonio, Finland. General contact: sales@harriniva.fi.

For questions about privacy or exercising your data protection rights, Harriniva's currently published privacy contact is Hanna-Mari Talvensaari, CEO, +358 40 570 0268, pyry@harriniva.fi.

Depending on how you interact with Arcora, we may process identification and contact details such as your name, email address, telephone number, postal address, date of birth and nationality; reservation and stay information; payment and invoicing information; information about services purchased or used; preferences and requests relating to your stay; customer feedback or complaints; and marketing consent or opt-out information.

Website enquiry forms may also include preferred travel dates, number of guests, enquiry topic, message content, language and the page from which the enquiry was submitted. Travel Trade enquiries may include company, country, website, business type, markets served and other information you choose to provide. Media Bank Access requests may include your name, email address, company, role or title, country, requester type, reason for requesting access and professional-use acknowledgement. Newsletter subscriptions include your email address, consent record, language and source page.

If you voluntarily provide dietary, accessibility, allergy or health-related information that is necessary to arrange a requested service, we process that information only for the purpose of providing the relevant service and, where required, on the basis of your explicit consent.

We process personal data to handle and manage reservations; provide accommodation, dining, experiences, wellness and other requested services; respond to enquiries; manage Travel Trade, media access and other professional relationships; process payments, invoicing and related obligations; communicate with customers before, during and after a stay; handle feedback and complaints; develop our services and customer experience; maintain website security and functionality; and send marketing communications where permitted.

Depending on the situation, processing is based on one or more of the following legal grounds: performance of a contract or steps taken at your request before entering into a contract; Harriniva Oy's legitimate interests in managing customer and business relationships, responding to enquiries, developing services and protecting its operations; compliance with legal obligations such as accounting requirements; and consent, particularly for electronic direct marketing and where consent is otherwise required by law.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

We primarily receive personal data directly from you when you contact us, subscribe to the newsletter, visit Arcora, or make a reservation. We may also receive reservation or customer information from booking services, travel agents, tour operators, employers, associations or other parties acting on your behalf.

When you follow a booking link from arcora.fi, the booking process may take place in a separate booking service. Information entered there is processed according to the booking process and may be received by Harriniva Oy for the purpose of fulfilling the reservation.

Personal data is accessible only to personnel and service providers who need it for the purposes described in this notice. We may use service providers for website hosting and technical operation, email delivery, reservations, digital guest services, payments, analytics and other business systems. Such providers process data only to the extent necessary for the service they provide and subject to applicable data protection requirements.

Information may also be disclosed to authorities where required by law, or to third parties where this is necessary to arrange a service requested by you, such as transportation or another partner service.

Arcora uses Speeron NEXT, provided by Speeron AB, to support digital guest services during the guest journey, including online check-in and check-out, guest communication, service requests and purchases. When you use these services, information necessary to provide the requested service may be processed through Speeron, including reservation identifiers, name and contact details, stay information, selected services and transaction-related information.

Payments made through these digital guest services are processed using Nets Easy. Payment and transaction information necessary to complete, verify and administer a payment may be processed by Nets and its payment partners in accordance with the applicable payment-service terms and privacy notices. Harriniva Oy receives the information necessary to manage the reservation, purchased services and payment status.

Further information about Speeron and Nets and their processing of personal data is available in their respective privacy notices linked below.

Speeron Privacy Policy ↗ · Nets Privacy Notice ↗

The Arcora website may use Google Analytics when analytics is enabled. The service can process technical usage information such as page views, browser and device information, referring page and approximate location derived from network information. The current website implementation uses IP anonymisation in Google Analytics.

Analytics is used to understand how the website is used and to improve the digital guest experience. Where applicable law requires consent for analytics or similar technologies, the processing is based on that consent. Technical information may also be processed where necessary to operate, secure and troubleshoot the website.

We aim to process personal data within the European Economic Area whenever practical. Some technology or service providers may process data in other countries. Where personal data is transferred outside the European Economic Area and an adequacy decision does not apply, appropriate safeguards required by data protection law are used, such as the European Commission's standard contractual clauses.

Personal data is kept only for as long as necessary for the purposes for which it was collected and for any applicable legal obligations. Harriniva Oy's published customer-register policy considers a customer relationship to have ended when the customer has not used its services for three years; unnecessary customer data is then deleted within six months unless there is another lawful reason to retain it, for example accounting requirements, complaints or legal claims.

Enquiry data is retained only as long as reasonably necessary to handle the enquiry and any resulting customer or business relationship. Newsletter data is retained until you unsubscribe or withdraw your marketing consent, unless retention is required to demonstrate compliance with your request.

The Arcora newsletter is sent only where the required marketing consent has been recorded or another lawful basis applies. You can withdraw your consent or unsubscribe from electronic marketing at any time. Withdrawing from marketing does not affect service-related communications that are necessary for an existing reservation or customer relationship.

Subject to the conditions of applicable data protection law, you may have the right to access your personal data; request correction of inaccurate data; request deletion of data; request restriction of processing; object to processing based on legitimate interests; object at any time to direct marketing; receive data you have provided in a structured, commonly used and machine-readable format where the right to data portability applies; and withdraw consent where processing is based on consent.

We may ask you to provide information necessary to verify your identity before fulfilling a request. Some rights may be limited where continued processing is required by law or is necessary for the establishment, exercise or defence of legal claims.

If you believe that your personal data has been processed in breach of applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

We use appropriate organisational and technical measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Access to customer, enquiry and administration systems is limited to authorised users and service providers who need the information for their work.

We may update this Privacy Policy when our services, systems or legal requirements change. The current version is published on this page and the 'Last updated' date above indicates when this notice was most recently revised.