Privacy Policy
Last updated: May 2025
1. Data controller
NordNest ("we", "us", "our") is the data controller for personal data collected through this website and booking platform.
This policy applies to all personal data processed in connection with your use of nordnest.fi and the services offered therein, in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.
2. What data we collect
Account & booking information
When you register or make a booking we collect your full name, email address, phone number, and booking details (property, dates, number of guests, special requests).
Payment information
Payments are processed by Stripe, Inc. We do not receive or store your full card number, CVV, or other sensitive payment data. We receive only a payment confirmation token and basic metadata (amount, currency, date).
Technical data
We collect your IP address, browser type, operating system, and pages visited for security, fraud prevention, and basic platform analytics. No third-party analytics scripts (e.g. Google Analytics) are currently active on this site.
Communications
If you contact us by email, we retain those communications to handle your enquiry and for our records.
3. Legal basis for processing
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your booking | Performance of a contract (Art. 6(1)(b)) |
| Processing payment | Performance of a contract (Art. 6(1)(b)) |
| Fraud prevention & security | Legitimate interest (Art. 6(1)(f)) |
| Compliance with Finnish bookkeeping law | Legal obligation (Art. 6(1)(c)) |
| Marketing emails (if opted in) | Consent (Art. 6(1)(a)) |
4. Data retention
Booking records (including payment records) are retained for 7 years from the date of the booking in accordance with the Finnish Accounting Act (Kirjanpitolaki 1336/1997) and Finnish Accommodation Act 308/2016.
Account data is retained until you request deletion. You may request deletion at any time by emailing info@nordnest.fi.
Technical logs are retained for up to 90 days for security purposes.
5. Third-party processors
We share your data only with trusted processors necessary to provide the service. We do not sell or rent your personal data to any third party.
- Stripe, Inc. — payment processing. Data may be transferred to the United States under Stripe's Privacy Shield / Standard Contractual Clauses.
- Supabase / hosting provider — database and file storage, hosted in the EU (EU-West region).
- Email delivery provider — transactional emails (booking confirmations). No marketing profiling.
All processors are bound by data processing agreements compliant with GDPR Chapter V requirements.
6. Your rights
Under GDPR you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right of rectification — request correction of inaccurate or incomplete data.
- Right of erasure — request deletion of your data, subject to legal retention obligations.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interest, including direct marketing.
- Right to withdraw consent — where processing is based on consent, withdraw it at any time.
To exercise any of these rights, contact us at info@nordnest.fi. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) at tietosuoja.fi.
7. Cookies
We use only essential cookies (authentication session, CSRF protection). We do not use advertising or tracking cookies. See our Cookie Policy for full details.
8. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email to registered users or by a prominent notice on the website. The "last updated" date at the top of this page reflects the most recent revision.