Last updated 9 September 2026
1. Data controller
Kultainen Hanhi / Guesthouse Golden Goose
Business ID: 2298231-6
Valtatie 42 B
99100 Kittilä
Finland
Email: info@goldengoose.fi
Telephone: +358 44 040 2080
2. Personal data we process
We may process the following personal data:
- name
- email address and telephone number
- dates of the requested stay
- number of guests
- the accommodation concerned
- additional information provided by the customer
- information concerning bookings, accommodation, invoicing and customer service
- communications between the customer and the controller
- technical website data, such as IP address, browser and device information, time of visit, pages viewed and referring address
- cookie choices and consent records.
Please do not provide unnecessary sensitive personal data, such as health information, through the accommodation enquiry form.
3. Purposes and legal bases for processing
Accommodation enquiries and bookings
We process contact details, accommodation preferences and other information provided by the customer in order to respond to enquiries, make bookings and provide accommodation services. Processing is necessary for steps taken before entering into a contract and for the performance of a contract.
Customer service and customer relationship management
We process data to communicate with customers, arrange services, handle feedback and establish, exercise or defend legal claims. Processing is based on a contract or our legitimate interest in managing customer relationships and protecting our rights.
Invoicing and legal obligations
Booking, payment and invoicing information is processed for accounting and other statutory obligations. Processing is based on our legal obligations.
Website security and operation
Server logs and other technical data may be processed to ensure that the website operates correctly, prevent misuse and investigate security incidents. Processing is based on our legitimate interest in maintaining a secure and functional website.
Website analytics
With your consent, we use Google Analytics to understand how the website is used and to improve it. Analytics is activated only if you give your consent through the cookie banner. You may withdraw your consent at any time through the Cookie Settings function on the website.
4. Sources of personal data
Data is primarily obtained directly from you when you make an accommodation enquiry, booking or other contact; during the accommodation and customer relationship; through your use of the website; and from booking services you use to make a reservation. Third-party booking services process data under their own privacy policies.
5. Recipients of personal data
In addition to Kultainen Hanhi, data may be processed by service providers we use to organise our operations. These may include website hosting and maintenance providers, email and IT service providers, providers of the WordPress form and booking systems, accounting and payment service providers, and Google in connection with Google Analytics and Google Tag Manager.
Service providers process data in accordance with agreements, our instructions and applicable data protection law. Data may be disclosed to public authorities when required by law. We do not sell personal data.
Links to Booking.com, Facebook and Google Maps lead to external services. When you visit an external service, that provider processes your data in accordance with its own privacy policy.
6. Transfers outside the European Economic Area
Some service providers, such as Google, may process data outside the European Economic Area. Transfers are carried out in accordance with applicable law, relying where appropriate on a European Commission adequacy decision, the EU–US Data Privacy Framework or European Commission standard contractual clauses.
7. Retention periods
- Accommodation enquiries that do not result in a booking are generally deleted within 12 months of the last contact.
- Data relating to a completed booking and customer relationship is retained for the duration of the relationship and generally for no longer than three years afterwards for the handling of possible legal claims.
- Accounting records are retained for the period required by law, normally for at least six years from the end of the calendar year in which the financial year ended.
- Security and server logs are retained only for as long as required for security and technical maintenance.
- Analytics data is retained according to the retention period configured in Google Analytics.
- Cookie consent records are retained for as long as necessary to demonstrate consent.
Data may be retained for longer where required by law or where necessary to establish, exercise or defend a legal claim.
8. Security
Personal data is accessible only to persons whose duties require its processing. We use appropriate technical and organisational safeguards, including access controls, passwords, encrypted connections, backups and system updates.
9. Your rights
Depending on the circumstances, you have the right to:
- obtain confirmation as to whether we process your personal data
- access your personal data
- request correction of inaccurate or incomplete data
- request erasure of your data
- request restriction of processing
- object to processing based on legitimate interests
- receive data you have provided in a portable format
- withdraw your consent at any time.
These rights may be subject to statutory limitations. We may need to verify your identity in order to protect your information. To exercise your rights, contact info@goldengoose.fi.
If you believe that your personal data has been processed unlawfully, you may lodge a complaint with the Office of the Data Protection Ombudsman in Finland: tietosuoja.fi/en.
10. Requirement to provide data
To respond to an accommodation enquiry, we need at least your name, contact details and sufficient information about the accommodation requested. Without this information, we may not be able to process the enquiry or make a booking.
11. Automated decision-making
We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.
12. Changes to this policy
We may update this Privacy Policy when our services, systems or applicable law change. The current version is published on this website.