Last updated: 10 September 2026
1. Data Controller
We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018).
2. What Data We Collect
2.1. Booking and contact data
When you make a booking or contact us, we collect: Name, Email address, Phone number, Pickup location and tour/service details (date, time, number of passengers) Any additional information you provide in the booking form.
Purpose: To provide, manage, and communicate about your booking. Legal basis: Performance of a contract (GDPR Art. 6(1)(b)).
2.2. Payment data
Payments are processed by Stripe, Inc. Your payment card details are entered directly into Stripe’s secure payment form. We never see, store, or have access to your full card number. We receive from Stripe only a payment confirmation, the amount, and limited transaction details (e.g., last four digits of the card, payment status).
Purpose: To process your payment and handle refunds.
Legal basis: Performance of a contract (Art. 6(1)(b)); legal obligations regarding accounting (Art. 6(1)(c)). Stripe’s privacy policy: https://stripe.com/privacy
2.3. Technical and usage data
When you visit our website, certain data is processed automatically; Cookie consent choices. Technical data needed for the site to function and load efficiently with your consent; website usage statistics via Google Analytics, such as pages visited, approximate location, device and browser type. IP anonymization is used where available.
Purpose: Website functionality and security (essential); improvement of our website and services (analytics, consent-based).
Legal basis: Legitimate interest for essential operations (Art. 6(1)(f)); your consent for analytics (Art. 6(1)(a)).
2.4. Communication data
If you email or call us, we process the content of your communication to respond to your inquiry.
Legal basis: Legitimate interest / performance of a contract.
3. Cookies
We use cookies as described earlier. Non-essential cookies (analytics, marketing) are placed only after your explicit consent through our cookie banner.
4. Who We Share Data With
We share personal data only with the service providers needed to operate our business: Stripe, Inc. (Payment processing), Google LLC (Website statistics; only with your consent), Hosting provider (Website hosting), Booking plugin provider (Booking management). We do not sell your personal data to anyone.
5. Data Retention Booking
Data retained for the duration of the customer relationship and thereafter as required by Finnish accounting law (up to 6-10 years for accounting records). Contact inquiries (up to 24 months). Analytics data (according to the retention settings of Google Analytics). Cookie consent records (12 months). When data is no longer needed, it is deleted or anonymized.
6. Your Rights Under the GDPR
6.1 You have the right to: Access your personal data and receive a copy.
6.2 Rectify inaccurate or incomplete data.
6.3 Erase your data (“right to be forgotten”), where no legal obligation requires us to keep it.
6.4 Restrict or object to processing.
6.6 Withdraw consent at any time (e.g., for analytics cookies) withdrawal does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us at support@aurorapursuit.com. We respond within one month.
7. Data Security
We use appropriate technical and organizational measures to protect your data, including HTTPS encryption on our website, access controls, and PCI DSS-certified payment processing through Stripe.
8. International Transfers
Some of our service providers (Stripe, Google) process data outside the EU/EEA, including in the United States. Such transfers are protected by EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as applicable.
9. Changes to This Policy
We may update this Privacy Policy from time to time.
10. Contact
For any questions about this Privacy Policy or your personal data: Email: support@aurorapursuit.com
