Authentic Experiences is a trade name of Lumikuutio Oy (Business ID 3613055-2), Rovaniemi, Finland.
1. Who We Are
This privacy policy explains how Lumikuutio Oy (Business ID 3613055-2), operating as Authentic Experiences (“Authentic Experiences”, “we”, “us”), collects and uses personal data when you visit our website, book a tour or transfer, or contact us. We are the data controller for this processing.
Contact details. Lumikuutio Oy, Rovaniemi, Finland · info@authenticexperiences.fi · +358 45 254 6832. You can contact us about any privacy question using these details.
2. Our Approach
We are based in Rovaniemi, Finland, so we follow the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018). Our guests come from all over the world, so we apply the same GDPR level of protection to everyone, wherever you live. Section 14 explains additional rights that some countries and states give you.
3. What Personal Data We Collect
Booking details. Your name, email address, phone number, number of participants, ages of children where needed for pricing or safety, pick-up location or accommodation, chosen tour, date and any messages or special requests.
Payment details. Payments are processed by our booking and payment providers. We receive confirmation of the payment, the amount and limited card details (for example the last four digits). We never see or store your full card number.
Communication. Messages you send us by email, WhatsApp, phone, the contact form or social media.
Health or accessibility information. Only if you choose to tell us, for example about allergies, mobility needs or medical conditions relevant to your safety on a tour.
Photos. Our guides photograph guests during tours, including under the Northern Lights.
Website data. IP address, browser and device information, pages visited and similar technical data collected through cookies and similar technologies (see section 11).
Reviews and feedback. What you share with us or publish on review platforms such as Google, Tripadvisor or GetYourGuide.
4. Why We Use Your Data and Our Legal Basis
To provide the service you booked, which includes managing bookings and payments, confirming start times, pick-ups and drop-offs, running the tour and sending you your photos. The legal basis is performance of a contract (GDPR Art. 6(1)(b)).
To keep you safe by using health or accessibility information you give us so the tour can be adapted. The legal basis is your explicit consent (Art. 9(2)(a)) and, in emergencies, your vital interests.
To answer questions and give customer service. The legal basis is our legitimate interest in replying to you, or steps taken at your request before a contract.
To meet legal obligations such as accounting, tax and consumer law. The legal basis is legal obligation (Art. 6(1)(c)).
To improve our services and website, prevent fraud and protect our rights. The legal basis is our legitimate interests (Art. 6(1)(f)), which we balance against your rights.
Marketing, such as newsletters or using photos where you can be recognised on our website or social media. The legal basis is your consent, which you can withdraw at any time.
We do not use automated decision-making or profiling that has legal or similarly significant effects on you.
5. Photos Taken on Our Tours
Tour photos are part of the service and are sent to you free of charge by email, usually within 24–72 hours after the tour. Photos may include other guests in the same group.
We only publish photos where you can be recognised (for example on our website, Instagram or TikTok) with your permission. If you see a photo of yourself that you would like removed, contact us and we will remove it.
6. Who We Share Your Data With
We do not sell your personal data. We share it only when needed:
• Booking and payment providers such as Bókun and the payment service providers connected to it, which process bookings and payments on our behalf.
• IT and communication services such as website hosting, email, cloud storage and messaging (for example WhatsApp, operated by Meta).
• Partners who help deliver your tour, such as subcontracted drivers or guides, and attractions like Ranua Wildlife Park when your booking includes entry.
• Resellers you booked through, such as GetYourGuide, Viator or Tripadvisor. They are independent controllers, and their own privacy policies also apply.
• Accountants, lawyers and authorities when required by law or to establish, exercise or defend legal claims.
Our service providers process data only on our instructions and under data processing agreements that meet GDPR requirements.
7. International Transfers
Some of our service providers are located, or have support staff, outside the European Economic Area (EEA), for example in the United States. When data is transferred outside the EEA, we make sure it is protected, for example through an adequacy decision by the European Commission (including the EU-US Data Privacy Framework), the Commission's Standard Contractual Clauses, or other safeguards allowed by GDPR. You can ask us for more information about these safeguards.
8. How Long We Keep Your Data
• Booking and accounting records are kept for the period required by the Finnish Accounting Act, generally 6 years from the end of the financial year (accounting books 10 years).
• Customer messages are kept for up to 2 years after our last contact, unless we need them longer for a booking or a claim.
• Original tour photo files are kept for up to 12 months after the tour so we can resend them, unless you have agreed to longer use.
• Health or accessibility information is deleted after the tour unless we need it for a safety incident or a claim.
• Marketing data is kept until you withdraw consent or unsubscribe.
• Website and cookie data is kept as described in the cookie settings, usually from the end of the session up to 24 months.
After this, we delete or anonymise the data.
9. Your Rights
Under GDPR you have the right to:
• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted (“right to be forgotten”) where there is no longer a reason to keep it;
• restrict our processing in certain situations;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• receive data you gave us in a machine-readable format (data portability);
• withdraw your consent at any time, without affecting earlier processing.
To use your rights, email info@authenticexperiences.fi. We reply within one month. We may ask you to confirm your identity.
You also have the right to lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi). If you live elsewhere in the EU/EEA, you can contact your local authority.
10. Security
We use appropriate technical and organisational measures to protect your data, such as encrypted connections (HTTPS), access controls, strong passwords and two-factor authentication, and reputable service providers with their own security certifications. Only people who need the information for their work can access it. No online service can be completely secure, but we work to protect your data and will notify you and the authorities of a data breach when the law requires it.
11. Cookies and Similar Technologies
Our website uses cookies that are needed for it to work (for example security, load balancing and the booking calendar). With your consent we may also use analytics or marketing cookies, for example to understand how visitors use the site or to measure advertising.
You can choose which non-essential cookies to accept in the cookie settings and change your choice at any time. You can also block or delete cookies in your browser, although some parts of the site, such as the booking calendar, may then not work properly. The booking calendar is provided by Bókun and may set its own cookies needed for bookings.
12. Children
Children are welcome on our tours, but bookings must be made by an adult. We do not knowingly collect personal data directly from children under 13 (or the minimum age in your country) without the consent of a parent or guardian. If you think a child has given us personal data, please contact us and we will delete it.
13. Links to Other Websites
Our website links to other services, such as review platforms, social media and booking partners. We are not responsible for their privacy practices, so please read their privacy policies.
14. Additional Information for Guests Outside the EU
United Kingdom. We process your data in line with the UK GDPR and the Data Protection Act 2018, and you have the same rights as described above. You may complain to the Information Commissioner's Office (ICO).
United States (including California). We do not sell or “share” personal information for cross-context behavioural advertising as those terms are defined in the California Consumer Privacy Act (CCPA/CPRA), and we do not use sensitive personal information to infer characteristics about you. California residents and residents of other US states with privacy laws have the right to know, access, correct and delete their personal information and to not be discriminated against for using these rights. You can use these rights by emailing us.
Canada, Australia, Brazil, Switzerland and other countries. We apply the protections in this policy to everyone and will respect the rights given by your local law (for example PIPEDA, the Australian Privacy Act, Brazil's LGPD or the Swiss FADP). Contact us and we will help.
15. Changes to This Policy
We may update this privacy policy when our services or the law change. The latest version is always on this page, and the date at the top shows when it was last updated. If the changes are significant, we will tell you, for example by email if you have an upcoming booking.
16. Contact
Lumikuutio Oy (Authentic Experiences)
Business ID: 3613055-2
Rovaniemi, Finland
Email: info@authenticexperiences.fi
Phone / WhatsApp: +358 45 254 6832