Privacy Policy

Updated: 6 November 2026

This policy explains how Arctic Skylight Lodge handles personal information when you contact us, book or use our services, or visit our website.

1. Who is responsible for your information?

Arctic Skylight Lodge Oy is the data controller. Business ID: 2997134-5.
Company street address and lodge arrival address: Äkäslompolontie 2748, 95970 Äkäslompolo (Muonio), Finland.
Postal address: c/o Due North Safaris, Sivulantie 8, 95970 Äkäslompolo, Finland.
Telephone: +358 40 506 35 95.
Email, including data-protection requests: info@arcticskylightlodge.com.
Website: arcticskylightlodge.com.

2. Information we collect

We receive information from you, from the person arranging your booking and, where relevant, from booking or service partners. This may include your name and contact details; stay dates, party size and relevant children’s ages; accommodation, restaurant, sauna, activity or transfer requests; correspondence; and booking, invoice and payment-status information. Statutory guest-registration information is collected where required by Finnish law.

Website systems also process technical information such as IP addresses, browser details, security events and essential session information. Optional visit-attribution information is described in the cookie section below. Please do not send payment-card details, identity-document copies or unnecessary personal information through general enquiry forms or ordinary email.

3. Why we use information

• To answer enquiries, prepare bookings and provide agreed services: steps requested before a contract and performance of the contract (GDPR Article 6(1)(b)).
• To meet accounting, tax and statutory guest-registration duties: legal obligation (Article 6(1)(c)).
• To keep the website and our records secure, handle complaints and establish, exercise or defend legal claims: our legitimate interests, balanced against your rights (Article 6(1)(f)).
• For optional cookies and marketing where consent is required: your consent (Article 6(1)(a)). You can withdraw consent. Enquiries and bookings do not automatically subscribe you to marketing.

Required booking or statutory information may be necessary to provide the service or meet the law. Optional information is not a condition of browsing the website. We do not use personal information for solely automated decisions producing legal or similarly significant effects.

4. Allergies, dietary requirements and other sensitive information

The Restaurant form separates ordinary dietary preferences from optional allergy or health-related information. You can request a table without providing health information. Give only details necessary for the meal you request, not diagnoses, medical histories or unnecessary information about anyone else. Use the dedicated optional field for health-related details rather than the ordinary preferences box.

We use enquiry information to take steps at your request before a contract or to provide an agreed service (GDPR Article 6(1)(b)). If you voluntarily provide health-related details, we additionally rely on your explicit consent under Article 9(2)(a). The separate health-consent checkbox is unchecked by default and is required only when you choose to submit those details. A general Privacy Policy acknowledgement is not health-data consent.

Health details are used only to assess and arrange your requested meal, with access limited to authorised staff who need them. The request is delivered to our enquiry mailbox and can be stored in the website form database; necessary service instructions may also be recorded in the booking system. Only relevant meal instructions should reach the kitchen. Do not assume that all guides, partners or other staff may access the full enquiry. We do not send your health text to an automatic translation service or repeat it in public or guest-facing confirmations.

To withdraw health-data consent, email info@arcticskylightlodge.com and identify the relevant request. We will stop the use that depends on that consent; withdrawal does not affect earlier lawful processing. We may need to review which dietary arrangements remain possible without the information and discuss this with you. Withdrawal does not automatically cancel your table request. Details should be removed when the service and necessary follow-up no longer require them, unless a specific lawful obligation or legal claim justifies limited retention. The general 12-month enquiry limit is not a reason to retain health details longer than needed, for marketing or merely because an invoice must be kept.

5. Service providers and other recipients

• Hotellinx: accommodation reservations and the booking/customer-management system. Website accommodation bookings use the Hotellinx booking service.
• GoDaddy and Sucuri: website hosting, infrastructure, backups and website-security/firewall services. These services may process website content, form records and technical or security information relevant to their functions.
• Google Fonts and Font Awesome: font styles and icon assets requested by public pages. Loading these resources can disclose your IP address and browser/request information to those providers. They are distinct from optional visit-attribution cookies.
• Microsoft 365 and email services: incoming email is routed through Microsoft 365. Email delivery and mailbox providers support delivery and storage of enquiry correspondence and reservation communications. Contact and restaurant forms can also store entries in the website database. The Sauna form is configured to send enquiry emails without a separate submission-storage action.
• Accounting and payment-service providers: information necessary for invoices, payments and statutory accounting, when those services are used.
• Requested activity and taxi operators: only the details needed to arrange your service. Due North Safaris operates its tours; a local taxi partner may provide an arranged transfer. An operator may be an independent controller for its own service rather than our processor.
• Authorities and professional advisers: where disclosure is required by law or necessary for a legal matter.

WordPress, WooCommerce, Caldera Forms and Ninja Forms are software used on the website; their presence does not by itself mean every form submission is sent to their developers. Providers processing information on our behalf must act under appropriate data-processing arrangements. Providers acting as independent controllers apply their own privacy information.

Some infrastructure, support or service providers may process information outside the EU/EEA. Where this occurs, an applicable GDPR transfer mechanism is required, such as an adequacy decision or appropriate contractual safeguards. You may ask us for the recipients relevant to your information and details of applicable transfer safeguards. We do not claim that all website, email and support data remains in the EU/EEA.

6. How long information is kept

Retention depends on the category and purpose, not a blanket ten-year period:

• Enquiries and reservation requests that do not become bookings: we review these monthly and delete or irreversibly anonymise them earlier when no longer needed, and in any event within 12 months of the last substantive exchange. Information needed for a specific legal obligation, dispute or legal claim is retained only to the necessary extent, with a documented reason and review date. This does not extend the shorter retention of sensitive service details, override statutory retention, or limit your data-protection rights.
• Booking and customer records: while needed for the booking and related administration, then only for an identified accounting, statutory or legal-claims requirement. Unneeded details should be deleted or anonymised rather than retained as part of an entire customer history.
• Statutory traveller notifications and traveller-register information: one year from signing the notification or entering the information in the traveller register, as applicable under Finland’s Act on Accommodation and Catering Services, then destroyed. This category is separate from accounting records.
• Accounting records: financial statements, accounting books and other records specified in Chapter 2, Section 10 of the Finnish Accounting Act: at least ten years from the end of the financial year. Vouchers, transaction correspondence and other accounting material covered by the six-year rule: at least six years from the end of the calendar year in which the financial year ended, unless a longer legal period applies. This does not justify keeping unrelated enquiry or health information.
• Allergy and other service-specific sensitive details: only as described in section 4; they should not become a permanent guest profile.
• Consent and marketing records: while needed for the consented purpose; a minimal withdrawal or objection record may be kept to respect your choice and demonstrate compliance.
• Security logs and backups: for the security, investigation and recovery purposes they serve, subject to applicable provider settings and necessary legal holds. Backup copies may remain until the relevant rotation or expiry; they are not a reason to restore deleted information to active use.
• Cookie information: the periods and withdrawal controls stated below.

Deletion is not instantaneous or uniformly automatic across the website database, email, booking system and backups. Manual review may be needed. Contact us for the retention criteria applicable to a particular record. Where information is kept for a legal obligation or claim, its use must be limited to that purpose.

7. Protecting information

We use access controls and technical and organisational safeguards appropriate to the information and its purpose. Access should be limited to authorised staff and providers who need it. No website or email service can guarantee absolute security. Please contact us if you believe information has been disclosed incorrectly.

8. Your rights and how to contact us

You can make a GDPR rights request by email to info@arcticskylightlodge.com, or write to the postal address in section 1. A signed letter, in-person visit or identity-document copy is not routinely required. If we have reasonable doubts about your identity, we may request only the additional information necessary to verify it. Please do not send an identity-document copy unless we explain why it is necessary and how to provide it safely.

Subject to the applicable legal conditions, you may request access and a copy, correction, erasure, restriction and data portability; object to processing based on legitimate interests; and object at any time to direct marketing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Erasure is not absolute where specific legal retention duties or legal claims apply.

We respond without undue delay and normally within one month of receiving the request. If complexity or the number of requests makes an extension necessary, GDPR allows up to two additional months; we will explain the extension and reasons within the first month. Requests are normally free. If we cannot act on a request, we will explain why and the available complaint and judicial-remedy options.

You may lodge a complaint with Finland’s Data Protection Ombudsman at tietosuoja.fi/en, or another competent supervisory authority, and seek a judicial remedy.

Website cookies and your choices

Essential cookies support functions you request, such as sign-in, security and a shopping-cart session where used. The asl_cookie_preferences cookie remembers your cookie choice for six months. These cookies are not used for optional visit attribution.

With your permission, WooCommerce uses first-party sbjs_* cookies for optional visit attribution: referral sources, campaign information, pages visited and browser/session information. If a WooCommerce order is placed, that information can be associated with the order. Attribution is not required to browse the site or make an enquiry.

The attribution cookies are sbjs_current, sbjs_current_add, sbjs_first, sbjs_first_add, sbjs_migrations, sbjs_udata and sbjs_session. The visit-session cookie lasts 30 minutes; the other attribution cookies are limited to the browser session under the current configuration.

Optional attribution stays off until you accept it. Choose Accept optional cookies, Reject optional cookies or Cookie settings. Use the Cookie settings button at the bottom of any page to change or withdraw your choice. Rejecting or withdrawing clears these attribution cookies and stops collecting that attribution data. It does not erase information already lawfully stored with an order.

Links to the accommodation booking service, live aurora camera, app stores and other websites open separate services. Their privacy and cookie information applies when you choose to visit them. Cookie choices here do not enable advertising networks.