PyhähippuPYHÄHIPPUPYHÄTUNTURI
Operated by
FI

PYHÄHIPPU

Privacy policy

Privacy policy for Valkea Homes Oy’s customer register

This is Valkea Homes Oy’s privacy policy document according to the EU General Data Protection Regulation (GDPR). The document includes information about the processing of personal data and about the rights of the data subject (the person whose data is being processed).

Data controller

Valkea Homes Oy
Finnish Business ID: 3103387-6
Registered company address: Kuusisaarenpolku 4 A 3, 00340 Helsinki, Finland
Pyhähippu – customer service: +358 16 882 820
info@pyhahippu.fi

The aim of processing personal data

Personal data is processed to share information, deliver products, provide access to internet services, carry out surveys and campaigns, and carry out marketing and advertising properly in all the channels used for these purposes.

In other words, the personal data is used for:

  • Starting and maintaining the customer relationship.
  • Communicating with the customer, for example the invoicing language, the booking confirmation and discussions with the customer by phone or email.
  • Designing and developing new services and products.
  • Targeting marketing.

The aim is to be a customer-oriented service provider.

Legal basis for processing personal data

  • GDPR Article 6(1), points b, c and f:
    • A contract to which the data subject is a party.
    • Processing is necessary for compliance with a legal obligation of the data controller.
    • Processing is necessary for the legitimate interests of the data controller or a third party.
  • Finnish law 308/2006 obliges the data controller to store guest registration cards.

The data subject has the right at any time, free of charge, to prohibit the processing of personal data for marketing or to withdraw consent previously given.

The data content of the register

The data content of the register varies depending on what the data subject does and what products or services the customer purchases. This section specifies the stored data from the perspective of the purchasing customer.

When you make a booking, the following contact information is stored:

  • First name and family name
  • Address
  • Country
  • Language
  • Phone number
  • Email
  • Customer number

In addition, in some cases:

  • Name of the company
  • Company ID

Additionally, some profiling data may be stored. Profiling data may be used to target marketing and improve customer service.

Profiling information:

  • Private / company
  • Season: winter / spring / summer / autumn

Information filled in on the guest registration card:

  • First name, family name, address and signature
  • Date of birth
  • Nationality
  • Passport number (except for Nordic citizens and persons who live in Finland)
  • Country of entry to Finland
  • Names and dates of birth of children and others staying in the same cabin
  • Arrival and departure dates
  • Name of the accommodation

Online traveller notification

Guests staying in a Pyhähippu cabin can fill in and sign the traveller notification online on the Manage Booking page before they arrive. The notification is required by Finnish law (Accommodation and Food Service Act 308/2006, sections 6–8), and the legal basis for processing it is the data controller’s legal obligation (GDPR Article 6(1)(c)).

  • The form asks only for the details the law lists. It never asks for or stores a Finnish personal identity code.
  • The details and the signature are stored encrypted. Only named Valkea Homes Oy administrators can open a full notification. Office staff see whether a notification has been made and mark the identity check as done. The details are not shown to the cabin owner or cleaners and are not used for marketing.
  • A signed notification is deleted automatically one year after it is signed. An unfinished, unsigned notification is deleted 30 days after the departure date. Encrypted backups no longer hold the details at most 120 days after deletion.
  • The details are disclosed to the police or another authority only as the law allows and when they ask.

Regular sources of information

Information is collected from the data subject in the following situations: when booking or using the website, and when booking services or products at the Valkea Homes Oy desk, by email or by phone.

Information about visitors and visits to the website is collected automatically. Such information includes IP address, device, internet browser, operating system, language, time (date and hour), pages displayed and information from clicks. The information is collected by an analytics program and is used to develop internet services and customer care.

Cookies and outside services

The Pyhähippu website does not set cookies itself. While you make a booking, your browser keeps an identifier in that tab’s own storage so the same booking is not paid twice. It is deleted when you close the tab.

The following services process data on our behalf and may set their own cookies only when they are used:

  • Stripe processes payments. Stripe’s payment form loads only when you go to payment. Stripe may set its own cookies to keep payments secure and prevent fraud.
  • Google Maps shows cabin locations on a map. The map loads from Google only when you open the map view. The small map images on cabin pages are passed through our own server, so showing them does not connect your browser to Google.
  • Videos load from YouTube (youtube-nocookie.com) only when you press a video’s play button.

For more about how these services process data, see Stripe’s and Google’s own privacy policies.

Data transfers required by law

Personal data is disclosed under a legal obligation to the public authorities for their official duties. We do not transfer the data in the register outside the EU or EEA ourselves. Stripe and Google may also process data outside the EU and EEA under their own privacy terms.

Social media

Our sites may contain links to social media or content served by social media providers. If you have an account with a social media provider, they may be able to identify you from this content or when you visit their site. Such content may also identify you even if you do not use social media. Please see the social media provider’s terms of service or privacy policy to learn more about their practices.

The principles for protecting the data

The principles of protecting the data in the register are the following: the data is used only by employees who need it in their work. The data is stored in a database. The database is protected by firewalls and passwords as well as other technical systems. The servers are located in high-security server rooms.

The data controller is not responsible for information collected and stored by third parties, for example travel agencies or internet booking platforms that offer Valkea Homes Oy’s services or products to their own customers. The data controller is responsible only for the data delivered directly to Valkea Homes Oy.

Right to rectification and erasure of the data (“right to be forgotten”)

The data subject has a right to review their data in the register and to have incorrect data corrected. The data subject also has a right to have their data erased from the register, also known as the “right to be forgotten”. The exception is Valkea Homes Oy’s legal obligations to store data, for example under the Accounting Act (1336/1997) and for guest registration cards (completed at check-in) under law 308/2006. Requests must be made in writing.

Guidance, supervision and more information

The Office of the Data Protection Ombudsman (tietosuojavaltuutettu) is the official data protection authority in Finland. It provides guidance and advice and supervises the processing of personal data. More information is on the Data Protection Ombudsman’s website.

Updated 31 October 2026