Privacy Policy

Contact person for data protection matters: Julia, info@kaihosauna.fi.

• Name, email address and phone number
• Booking details: session or requested date, number of people, selected add-ons and your message
• Payment and invoicing details
• Emails and messages we exchange with you
• Notes about your booking, for example your wishes or arrangements we have agreed on
• Photos in which you appear, if you have given permission to be photographed

We receive the data from you when you make a booking or contact us. We receive confirmation of a successful payment from Vipps MobilePay.

Your name, email address and phone number are needed to make a booking. Without them, we cannot accept the booking.

• Handling bookings and providing the service. Legal basis: contract and steps taken before entering into a contract (Article 6(1)(b) GDPR).
• Replying to enquiries. Legal basis: our legitimate interest in answering questions sent to us (Article 6(1)(f)).
• Accounting and invoicing. Legal basis: legal obligation (Article 6(1)(c)).
• Running the website securely, for example technical log data. Legal basis: our legitimate interest in keeping the service running and secure (Article 6(1)(f)).
• Publishing photos on our website and social media. Legal basis: your consent (Article 6(1)(a)). You can withdraw your consent at any time; this does not affect the lawfulness of earlier processing.

We do not send newsletters or direct marketing, and we do not make automated decisions.

Booking and enquiry data is kept for 2 years after the booking or enquiry and then deleted. Accounting records are kept for the period required by the Finnish Accounting Act (vouchers 6 years and financial statements 10 years from the end of the financial year).

We use photos in which you appear for as long as your consent is valid. When you withdraw consent, we stop using the photos and remove them from our posts.

We do not sell your data or disclose it for marketing. We use service providers that process data on our behalf:

• Supabase: booking database (US company, data stored in the EU)
• Netlify: website and form hosting (US company)
• Google Workspace: email (US company)
• Uploadcare: website images (US company)
• Kitsas and our accountant: accounting (Finland)

Vipps MobilePay processes payment data as an independent controller under its own terms and privacy policy.

As some service providers are US companies, data may also be processed in the United States. Transfers are based on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

The website does not use tracking or marketing cookies or visitor analytics. The server may store technical log data, such as IP addresses, to keep the service running and secure.

You have the right to access your data and to request its correction or deletion. You can also request restriction of processing, object to processing and request data portability. Send your request to info@kaihosauna.fi.

If you believe your data is processed unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman (www.tietosuoja.fi).

Only the people handling bookings can access the data, by logging in. The connection to the website is encrypted.

We update this policy when our operations or the law change. The current version is always on this page, and the date of the latest update is shown at the bottom of the page.