Who is responsible
RUKA FORREST OY, trading as Ruka ForRest, is the controller for personal data used to operate this website, handle enquiries and provide bookings. Our Finnish Business ID is 3567608-6.
Contact us at info@rukaforrest.fi or +358 468 011 959. Our postal address is Ihtinginperäntie 25, 93830 Rukatunturi, Finland. Please use the same email address to ask about your data or exercise your rights.
What data we receive
Booking information includes the booker’s first name, surname, email address and required telephone number, together with the selected experience, date, time, group size, booking reference and transaction information needed to handle the purchase. Nationality is optional. Stripe processes payment details submitted through the payment checkout.
We receive information you provide in a booking or message. If someone books for you, relevant information may come from that person or the booking channel. Correspondence includes the contact details and message content you send us. Please provide only information needed to handle your request.
The website and hosting service process technical information such as IP addresses, requested pages, timestamps and browser or device information. Optional analytics may also use browser identifiers and information about website interactions. The cookies and analytics sections below explain this separately.
Why we use your data
We use the information needed to prepare and fulfil your booking, take payment and handle changes or cancellations on the basis of the contract or steps you request before entering into it (GDPR Article 6(1)(b)). Without the necessary identity, contact, booking and payment information, we cannot complete the booking.
We require the booker’s telephone number so we can contact them about arrival arrangements, changes to the session or urgent matters affecting the visit. The Bókun booking form cannot be completed without it. Providing a telephone number does not give consent to marketing.
We retain the necessary accounting and transaction records to comply with Finnish legal obligations (Article 6(1)(c)). We use relevant information to answer general enquiries, protect our services and establish, exercise or defend claims on the basis of our legitimate interests (Article 6(1)(f)). These interests are handling your request, keeping the service secure and protecting our legal position.
Optional Google Analytics operates on your consent (Article 6(1)(a)). Nationality statistics have a separate purpose described below. Providing information for a booking does not by itself give permission to use it for unrelated marketing.
Nationality and visitor statistics
We use nationality information to analyse the composition of our guest groups and assess progress against our internal targets, including growth in visitors from Poland and the United Arab Emirates. Nationality is different from country of residence, and these statistics do not establish where a guest lives.
The purpose is statistical analysis of the markets we serve, based on our legitimate interest in planning and evaluating the business (Article 6(1)(f)). You may object to this use by contacting us. We compile statistics annually and remove nationality from information linked to individual customers by 31 March of the year following the year in which it was collected. We then retain only anonymous totals by country. The separate accounting retention period does not extend this period for nationality.
Nationality is optional in the Bókun booking form. You can leave this field blank and still complete your booking and use the service.
Booking and accounting records
We retain booking and transaction records, including related transactional correspondence, for six years from the end of the calendar year in which the relevant financial year ended. We apply this period to the information needed to document and account for the transaction.
We keep the booker’s telephone number for as long as it is needed to arrange and complete the visit or resolve a related matter, then delete it unless a specific legal obligation or unresolved claim requires further retention.
Financial statements, accounting books and other records subject to the separate ten-year requirement are retained for ten years after the end of the financial year. These rules do not require us to keep every additional customer detail for ten years.
Bókun does not automatically remove completed bookings from our account. Expired records therefore require deletion or anonymisation under our retention procedure; the end of a retention period is not an automatic Bókun setting. Information needed for an unresolved claim or a separate legal obligation may be retained for that purpose until it is no longer required.
According to our confirmed booking setup, an abandoned purchase does not leave customer booking data. A temporary hold on availability during checkout is separate from technical logs, payment-provider records and backups, which follow their own purposes and retention periods.
Enquiries and correspondence
We keep ordinary enquiries that do not lead to a booking for twelve months after the matter is closed, then delete them. Messages that form part of booking or accounting documentation follow the transaction-record period above. Information needed for an ongoing complaint or claim is kept until that matter and the applicable retention obligation are resolved.
This is our retention rule for active correspondence. Zenbox’s backup cycle is separate and does not automatically delete messages from the active mailbox.
Who helps us handle your data
Bókun supplies the booking platform. Its standard contract identifies Tripadvisor LLC, doing business as Bókun, as the service provider. Stripe processes payments and may act as an independent controller for its own legal, security and fraud-prevention purposes as well as processing data for the payment service.
Zenbox, operated by cyber_Folks S.A., hosts the website and info@rukaforrest.fi mailbox. Hehkua Oy provides accounting services under our engagement and data-processing agreement. Our accounting agreement identifies Finland and other countries in the European Economic Area as processing locations.
Google provides optional website analytics. People authorised to handle bookings, enquiries and accounting may access the information needed for their work. Data may also be disclosed where required by law or to handle a relevant legal claim. Posti handles physical correspondence where postal delivery is used.
Our service providers may use the subprocessors covered by their contracts. You can contact us for further information about recipients and the applicable safeguards.
Transfers outside the EEA
Booking, payment and analytics services may involve processing outside the European Economic Area, including in the United States.
Google’s published terms describe use of the EU–US Data Privacy Framework for covered US transfers and standard contractual clauses where the applicable alternative transfer mechanism does not apply. Stripe’s terms describe transfers to Stripe, LLC in the US under the Data Privacy Framework, with standard contractual clauses where needed. These mechanisms apply only within their relevant scope.
Bókun’s contractual terms provide for transfers outside the EEA on the basis of an adequacy decision or the European Commission’s standard contractual clauses. You may contact us for further information about the safeguards applicable to the booking service.
Contact info@rukaforrest.fi for further information or a copy of the applicable transfer safeguards, subject to protection of confidential information.
Google Analytics and retention
Google Analytics 4 measures page views and interactions such as language selection and experience clicks after consent. The tag installed directly on this website does not load before consent. Our website configuration disables Google Signals and advertising personalisation and sends denied consent states for advertising storage, advertising user data and advertising personalisation.
Our confirmed GA4 settings retain user data for fourteen months and other event data for two months. Google’s documentation also applies the user-data period to key-event data. Reset on new user activity is enabled: new activity restarts the fourteen-month period for the user identifier. Expired data is deleted in Google’s monthly deletion cycle.
These settings do not control retention of standard aggregated reports. The validity of your cookie choice is a separate 180-day period and is not extended by Google’s user-data reset.
Hosting logs and backups
Zenbox creates backups of website files, databases and mailboxes four times a day, every six hours, and retains the most recent seven days. Removing data from an active service does not immediately remove it from all rotating backups. Backups serve restoration and continuity purposes; the seven-day backup cycle is not the retention period of active bookings or emails.
Zenbox’s published guidance states that archived web-server logs available through the customer panel are retained for up to fourteen days. This figure applies to those web logs, not automatically to every internal provider security log or a separately retained incident record.
Your rights
You may request access to your personal data, correction of inaccurate information, erasure or restriction of processing, and data portability where applicable. You may object to processing based on legitimate interests because of your particular situation. Where consent is the basis, you may withdraw it at any time.
These rights are subject to the conditions in the GDPR. For example, we may need to keep information required by accounting law or for a relevant legal claim. Contact info@rukaforrest.fi. We respond without undue delay and within one month; if a lawful extension is needed because of the complexity or number of requests, we explain this within that month.
You may complain to Finland’s Office of the Data Protection Ombudsman or to the supervisory authority in the EU/EEA country where you live or work, or where an alleged infringement occurred. You do not have to contact us first to exercise that right.
External links and changes to this notice
Instagram, YouTube where linked, and Google Maps are external services with their own privacy information. They are linked rather than embedded. Website fonts and photographs are served locally.
We update this notice when the way we handle data changes. The date above identifies this version. For questions about the notice, booking data or your rights, contact info@rukaforrest.fi.