Privacy notice

1. Data controller

The data controller is Riverside Arctic Experience Oy, operating Ivalo River Camping and developing the Ivalo River Village customer experience.

Contact details

2. Personal data we process

Depending on how you interact with us, we may process:

• name, email address, phone number and country
• preferred language and other communication preferences
• messages and enquiries you send to us
• booking and service information received from accommodation or activity booking systems
• website source, page path, referrer and campaign parameters used to understand customer acquisition
• marketing-consent status and evidence when you explicitly choose to receive marketing
• limited technical data needed for website security and abuse prevention

3. Why we process personal data

• to answer enquiries and provide customer service
• to take steps requested by you before a booking or purchase
• to manage customer and booking information received from operational booking systems
• to maintain IVRC-owned customer and commercial records
• to understand how customers find our services and improve the customer journey
• to send marketing only where a valid permission or other lawful basis applies
• to protect the website and services from misuse

4. Legal basis

Depending on the situation, processing is based on steps requested before entering into a contract, performance of a contract, our legitimate interests in customer service and operating our business, compliance with legal obligations, or your consent. Marketing consent can be withdrawn at any time.

5. Systems and service providers

Website enquiries are sent through a secure server-side interface to our Supabase customer-data environment. Accommodation and activity bookings may be processed by the relevant booking, distribution and payment providers. Hosting, security and content-delivery providers may process technical connection data needed to deliver the service. We use processors only for defined business purposes and seek appropriate data-protection safeguards.

6. Sharing and international processing

We do not sell personal data. Data may be shared with service providers where necessary to provide the requested service, operate the website, process a booking or payment, meet legal obligations or protect our rights. If a provider processes data outside the European Economic Area, appropriate safeguards are used where required by applicable law.

7. Retention

We keep personal data only for as long as it is needed for the purpose for which it was collected and for applicable legal, accounting, contractual and dispute-handling obligations. Contact enquiries are not intended to be kept indefinitely. Consent records may be retained as evidence of the permission given or withdrawn.

8. Marketing consent

A booking or contact enquiry does not automatically create marketing permission. Marketing consent is recorded separately when you explicitly choose to receive marketing, and you may withdraw that consent at any time.

9. Your rights

Subject to applicable law, you may have the right to:

• access your personal data
• ask us to correct inaccurate data
• request deletion or restriction of processing
• object to processing based on legitimate interests
• receive data in a portable format where applicable
• withdraw consent at any time
• lodge a complaint with the competent data-protection authority

To exercise your rights, contact us using the details below. We may need to verify your identity before completing a request.

10. Third-party booking services

When you continue from our website to an external accommodation or activity booking service, that provider may also process personal data under its own privacy terms. Those operational services remain separate from this website privacy notice.

11. Cookies, analytics and marketing technologies

The website uses necessary first-party technology for security, forms and remembering privacy choices. Non-essential analytics and marketing technologies are disabled until you choose the relevant category. You can change or withdraw your choice at any time through Cookie settings in the footer.

Your choice is stored in the necessary ivrc_consent cookie for up to six months. With Analytics consent, IVRC records limited visit and booking-intent events in its Supabase environment; session storage remembers a random session ID and campaign codes until the tab closes. With Analytics consent, Google Tag Manager loads Google Analytics 4 to measure page views, experience views, booking-link clicks and successful enquiries. Google Analytics uses _ga and _ga_* cookies to distinguish browsers and sessions; these can remain for up to two years. Google Ads, remarketing, Google Signals and Meta Pixel are not enabled. Google may process analytics data outside the EU/EEA under its applicable data protection safeguards. Names, email addresses, phone numbers, enquiry text and feedback links are excluded from measurement. Campaign click identifiers are not retained by this foundation. You can withdraw consent through Cookie settings; consented session data is cleared and loaded tracking is stopped by reloading the page.

12. Changes to this notice

We may update this notice as the digital services, booking integrations or legal requirements change. The current version and update date are shown on this page.