Privacy Policy

Effective and last updated: 24 July 2026


Privacy at a glance

Northwild Oy collects only the personal information reasonably necessary to answer enquiries, manage bookings, take payments, operate activities safely, deliver photographs and meet legal obligations.


We do not sell personal information. We do not use customer information for profiling or personalised pricing, and we do not currently send newsletters or direct marketing messages.


Routine information that is no longer needed is deleted after the relevant winter season. Certain information must be retained longer for contractual, accounting, safety, insurance or legal reasons. Tour photographs are normally deleted within 90 days unless separate permission has been given for selected photographs to be used in Northwild’s marketing.


Privacy questions and requests may be sent to info@northwild.eu.


1. Who is responsible for your information?

The controller responsible for processing your personal information is:


Northwild Oy
Business ID: 3633737-7
Address: Sylvenvaarantie 1, 99800 Ivalo, Finland
Email: info@northwild.eu
Telephone: +358 41 483 7556
Website: www.northwild.eu


Privacy requests are handled by the owners of Northwild Oy.

Northwild Oy has not appointed a Data Protection Officer.


2. Who does this Privacy Policy apply to?

This Privacy Policy applies to personal information processed in connection with:

  • Visits to the Northwild website;
  • Enquiries submitted by email, telephone, contact form, SMS or WhatsApp;
  • Bookings made through the Northwild website, Bókun, email or telephone;
  • Bookings received through resellers and other booking partners;
  • Participation in Northwild activities;
  • Payments, cancellations and refunds;
  • Tour photographs;
  • Complaints, incidents and insurance matters; and
  • Optional marketing consent.

Where a customer books on behalf of other participants, the person making the booking is responsible for providing the other participants with relevant information about the booking and this Privacy Policy.


3. What information do we collect?

Depending on how you interact with Northwild, we may process the following information:


Contact and enquiry information
  • Name;
  • Email address;
  • Telephone number;
  • The content of your enquiry or message; and
  • Relevant communications through email, telephone, SMS or WhatsApp.


The Northwild website contact form requires your name, telephone number, email address and message. Contact-form submissions are delivered to Northwild’s business email account.


Booking and activity information
  • Name of the person making the booking;
  • Email address and telephone number;
  • Country, if voluntarily provided;
  • Booking number and booking history;
  • Selected activity, date and number of participants;
  • Pickup and drop-off location;
  • Requested language;
  • Activity-specific requests;
  • Cancellations, rescheduling and refund information;
  • Payment status and amount;
  • Confirmation that participants satisfy applicable age or other participation requirements; and
  • Necessary communications concerning the booking.


Northwild normally receives the details of the person making the booking and the number of participants. Northwild does not normally collect the names of every group member.


Payment information

Payments are processed by the payment provider displayed during checkout. Depending on the available checkout options, these providers may include Stripe, PayPal, Paytrail or Nets.


Northwild does not receive or store complete payment-card details. We normally receive information such as the amount paid, currency, payment status, transaction reference, cancellation and refund status.


Payment providers may conduct security and fraud-prevention checks in accordance with their own privacy policies.


Health, accessibility and safety information

Customers may voluntarily inform Northwild of a medical condition, injury, pregnancy, disability, mobility limitation, medication or another circumstance that could affect safe participation.

This information may be provided through Bókun, email, WhatsApp or directly to the guide. Information given only verbally is normally used during the activity and is not recorded.


Northwild does not request unnecessary medical details. Customers should provide only the information needed to assess whether safe participation or a reasonable adjustment is possible.


Dietary and allergy information

Northwild does not routinely collect dietary information. If a customer voluntarily informs us of an allergy or dietary requirement, we may use that information to check the ingredients of refreshments ourselves. We do not normally share dietary or allergy information with the supplier of the refreshments.


Driving-licence checks

Snowmobile drivers must present an acceptable original driving license. Northwild visually checks the license but does not normally photograph, copy or record the license number, expiry date or other license details.


Drivers are required to sign a declaration confirming that they hold a valid driving license, accept the applicable Terms and Conditions and understand the snowmobile damage liability.


Photographs

Where photographs are included in an activity, Northwild may take photographs using a company camera or business device.


Photographs may initially be stored on Northwild’s camera, business phone, password-protected and encrypted laptop, secure cloud storage or encrypted external drive. Photographs are normally delivered electronically to the main booking contact through WeTransfer or another secure file-transfer service.


Each customer receives access only to the photographs intended for their booking or group.


Complaints, accidents and legal matters

If a complaint, accident, damage event or other incident occurs, we may collect:

  • The customer’s identity and contact information;
  • Booking and payment information;
  • Communications and complaint details;
  • Witness information;
  • A description of the incident;
  • Photographs or video of the location, vehicle or damage;
  • Relevant health or injury information;
  • Signed declarations;
  • Refund and compensation records; and
  • Information required by insurers, authorities, medical services or legal advisers.


4. Why do we process personal information?

We process personal information for the following purposes and legal bases:



Enquiries: To answer questions and take requested steps before a booking is made. The legal basis is taking steps before entering into a contract.

Bookings: To process, confirm and manage bookings. The legal basis is the performance of a contract.


Activities and pickups: To organise activities, pickups and necessary customer communication. The legal basis is the performance of a contract.

Payments, cancellations and refunds: To process payments, cancellations and refunds. The legal bases are the performance of a contract and compliance with legal obligations.


Participation requirements: To confirm that customers meet applicable age, driving-licence and other participation requirements. The legal bases are the performance of a contract and Northwild’s legitimate interest in operating activities safely.


Safety: To protect customers, guides and other persons during activities. The legal bases are the performance of a contract, Northwild’s legitimate safety interests and, in an emergency, the protection of vital interests.


Health and accessibility information: To assess whether safe participation or a reasonable adjustment is possible. The legal basis is normally the customer’s explicit consent. In an emergency, information may also be processed to protect a person’s vital interests.


Tour photographs: To take and deliver photographs included in an activity. The legal basis is the performance of a contract.


Marketing photographs: To use selected photographs on the Northwild website, social media, printed material or other marketing channels. The legal basis is separate and optional consent.


Accounting and taxation: To maintain invoices, payment records and other statutory accounting information. The legal basis is compliance with legal obligations.


Complaints, accidents and legal matters: To handle complaints, accidents, vehicle damage, insurance matters and legal claims. The legal bases are compliance with legal obligations and Northwild’s legitimate interest in establishing, exercising or defending legal claims.


Security: To protect Northwild’s customers, staff, property, services and information systems. The legal bases are Northwild’s legitimate interests and applicable legal obligations.


Website analytics and advertising measurement: To understand website use and measure advertising effectiveness. Where non-essential cookies or similar technologies are involved, the legal basis is the visitor’s consent.


Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect processing that occurred lawfully before consent was withdrawn.


5. Health and other sensitive information

Health information is a special category of personal information and receives additional protection.


Northwild processes such information only where it is reasonably necessary to:

  • Assess whether participation is safely possible;
  • Consider an accessibility request or reasonable adjustment;
  • Respond to an accident or medical emergency;
  • Establish or handle an insurance or legal claim; or
  • Comply with a legal obligation.


Providing health or accessibility information is voluntary. However, if Northwild does not receive information that is necessary for safety, it may not be possible to confirm or permit participation.

Access is restricted to the owners of Northwild Oy and, in an emergency, to persons who reasonably need the information, such as medical services or authorities.


6. Tour photographs and marketing consent

Photographs included in a tour are taken and delivered as part of the booked activity. Northwild normally deletes ordinary customer photographs from its camera, phone, laptop, external storage and cloud storage within 90 days after the activity.

Photography cannot be guaranteed where photographs are unavailable because of unsafe conditions, equipment failure, data corruption or another circumstance beyond Northwild’s reasonable control.

Northwild will not rely solely on acceptance of the booking Terms and Conditions to use identifiable customer photographs for advertising or promotional purposes.


Instead, we will request separate optional written consent for selected photographs to be used on the Northwild website, social-media accounts, printed material or other marketing channels. Refusing consent has no effect on the customer’s booking or participation.


Each identifiable adult provides their own consent. Consent for a participant under 18 must be provided by their parent or legal guardian, and the wishes of the young person will also be respected.


Selected marketing photographs may be retained for up to five years unless:

  • Consent is withdrawn earlier;
  • The photograph is no longer required; or
  • Northwild renews the consent for continued use.


Consent can be withdrawn at any time by contacting info@northwild.eu. After withdrawal, Northwild will stop using the photograph and remove it from channels under its control as soon as reasonably possible. Withdrawal cannot always reverse use in physical material that has already been printed or information legitimately published or shared before withdrawal.


7. Refund Protection

Customers may be offered optional enhanced refund protection during checkout. This service is administered by Protect Group through Refundable.me and is separate from Northwild’s standard cancellation policy.


If a customer selects the service, booking, contact, transaction and other necessary information may be made available to the refund service so that the protection can be administered.


Customers submitting a refund application may be asked to provide Refundable.me directly with supporting information such as medical certificates, proof of travel disruption, official documents or payment details. Refundable.me processes this information according to its own terms and Privacy Policy.


Northwild does not normally receive all supporting documents submitted directly to Refundable.me.

More information is available in the Refundable.me Privacy Policy and the applicable Refundable Terms.


8. Bókun and the Northwild website

The Northwild website and booking system are provided through Bókun. When a booking is made, Bókun processes booking and customer information on Northwild’s behalf.


For these booking activities, Northwild is the controller and Bókun acts as a processor. Bókun may also process certain information for its own legal, security and service-administration purposes as described in its own policies.


Northwild applies the retention periods in this Privacy Policy to the information under its control and will delete information or request its deletion from Bókun where technically and legally possible. Bókun may retain limited information where it has an independent legal obligation or legitimate requirement to do so.


Further information is available in the Bókun Privacy Policy.


9. Resellers and booking partners

Northwild activities may also be sold through resellers and destination partners, including:

  • GetYourGuide;
  • Viator; and
  • Lapland North.


When a booking is made through a reseller, the reseller may provide Northwild with the contact, booking, participant, pickup and order information needed to operate the activity.


Northwild may communicate directly with reseller customers where necessary to arrange the activity, confirm pickup information, handle a change or respond to a safety or customer-service matter.


Northwild may return necessary information to the reseller, such as cancellation, no-show, incident, complaint or refund information. Tour photographs may be delivered through a reseller only where appropriate for the booked service and supported by the relevant platform. The reseller separately processes information according to its own Privacy Policy and booking terms.


10. Who may receive personal information?

Where necessary for the purposes described in this Privacy Policy, information may be processed by or disclosed to:

  • Bókun, as website and booking-system provider;
  • Google Workspace, as business email provider;
  • Veebimajutus.ee, as domain-service provider;
  • Payment providers displayed during checkout;
  • Refundable.me and Protect Group, where enhanced refund protection is selected;
  • GetYourGuide, Viator, Lapland North and other relevant resellers;
  • Talenom, as accounting and accounting-system provider;
  • WeTransfer or another secure file-transfer provider;
  • Apple iCloud and other approved cloud-storage providers;
  • Website analytics, mapping, social-media or advertising providers where activated with the required consent;
  • Insurers, insurance advisers and claims handlers;
  • Police, rescue services, medical services and other authorities;
  • Professional legal, accounting, IT and technical advisers; and
  • Other recipients where disclosure is required by law or necessary to protect a person’s vital interests.


These recipients receive only the information reasonably necessary for their role.
Northwild does not sell customer information.


11. International data transfers

Some service providers, resellers, payment providers and technology companies may process information outside Finland or the European Economic Area.


Where personal information is transferred outside the European Economic Area, Northwild relies on an appropriate legal mechanism where required, such as:

  • A European Commission adequacy decision;
  • Standard Contractual Clauses approved by the European Commission; or
  • Another transfer mechanism permitted under applicable data-protection law.


Providers may also process information under their own responsibility and transfer arrangements. Further details can be found in the relevant provider’s Privacy Policy.


12. How long do we retain information?

Northwild retains personal information only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, contractual, accounting, safety or insurance requirements.


Our normal retention periods are:

  • Health, accessibility or safety information communicated only verbally is normally used during the activity and is not recorded.
  • Written health, accessibility and similar participation information is normally deleted within 30 days after the activity, unless it is connected with an accident, complaint, insurance matter or legal claim.
  • Ordinary customer photographs are normally deleted within 90 days after the activity.
  • Unsuccessful enquiries, routine customer emails, WhatsApp and SMS conversations, pickup lists and other routine operational information that is no longer needed are normally deleted by 30 April following the relevant winter season.
  • Website analytics information is normally retained for up to 14 months where analytics are activated and this retention setting is available.
  • Booking confirmations, contractual records and relevant customer communications that are not subject to longer accounting requirements are normally retained for three years after the activity.
  • Signed snowmobile driver and damage-liability declarations are normally retained for three years after the activity. They may be retained longer if they are connected with an accident, damage event, insurance matter or legal claim.
  • Complaints, disputes, cancellations and refund records that are not subject to longer accounting requirements are normally retained for three years after the matter has been finally resolved.
  • Selected marketing photographs may be retained and used for up to five years, unless consent is withdrawn or the photograph is no longer needed. Consent may be renewed for continued use.
  • Marketing consent records are retained while the relevant photograph is being used and generally for three years afterward, where necessary to demonstrate how consent was obtained and handled.
  • Records needed to demonstrate website cookie choices and consent may generally be retained for up to five years, depending on the cookie-consent system used.
  • Invoices, accounting records and supporting documents are retained for the periods required under Finnish accounting and tax law. Depending on the type of record, this will generally be six or ten years.
  • Accident, injury, vehicle-damage, insurance and legal-claim records are retained until the matter has been resolved and the applicable legal or insurance retention period has expired.


If more than one retention period applies, the longer legally necessary period may be used. Information may also be retained for longer where:

  • A complaint, accident, investigation or claim is ongoing;
  • An insurer, authority or court requires it;
  • A legal obligation applies; or
  • The customer has separately consented to a longer period, such as for a selected marketing photograph.


After the applicable period, information will be deleted, anonymised or securely destroyed where reasonably possible. A service provider may retain limited information for its own legal obligations.


13. Website cookies and external content

The Northwild website may use cookies and similar technologies that are necessary for basic website, security and booking functions.


Non-essential technologies, such as analytics, advertising tracking or certain embedded third-party content, will be used only where the required consent has been obtained. Visitors must be able to reject non-essential cookies as easily as they accept them.


External services may include:

  • Google Analytics;
  • Google Ads conversion measurement;
  • Google Maps;
  • Instagram content; and
  • YouTube content.


A normal link to an external website does not itself load that website’s content on the Northwild website. Embedded maps, social-media posts or videos may transfer information such as the visitor’s IP address and device information to the provider.


Detailed information about the cookies and technologies currently used, their purposes, providers and durations is provided in Northwild’s separate Cookie Policy and cookie-preference tool.


14. WhatsApp and the Northwild WhatsApp channel

Northwild uses a WhatsApp Business account exclusively for business communication.


Customers may use WhatsApp for booking-related questions, pickup communication, cancellation or rescheduling requests and other customer-service matters. Routine conversations are normally deleted after the relevant winter season unless they must be retained for a complaint, refund, incident or legal reason.


Northwild may invite customers to voluntarily join its WhatsApp channel. Joining is optional, and channel followers may leave at any time. Joining or following the channel is separate from receiving direct marketing messages.


Northwild does not currently send promotional WhatsApp or SMS messages directly to previous customers. WhatsApp separately processes information according to its own Privacy Policy.


15. Children’s information

An adult may book an eligible activity for a participant aged 10–17 without providing the child’s name. Northwild normally records only that the participant meets the applicable minimum-age requirement.

Booking and activity communications are directed to the adult who made the booking rather than directly to the child.


Where an identifiable photograph of a person under 18 is selected for marketing, written consent must be obtained from a parent or legal guardian, and the wishes of the young person will also be respected.


16. Automated decision-making

Northwild does not use personal information to create customer scores, personalise prices or make decisions based solely on automated processing that produce legal or similarly significant effects.


Availability checks and booking confirmations may be automated. Payment providers may separately conduct automated fraud and security checks under their own policies.


17. Security

Northwild uses reasonable technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, alteration, disclosure or destruction.


These measures include, where appropriate:

  • Password-protected devices and accounts;
  • Device encryption;
  • Two-factor authentication;
  • Restricted access;
  • Separation of business and personal files;
  • Encrypted external storage;
  • Secure cloud and file-transfer services; and
  • Limiting access to the owners of Northwild Oy


No electronic storage or transmission method can be guaranteed to be completely secure. If a personal-data breach occurs, Northwild will assess it and notify the relevant authority and affected persons where required by law.


18. Your data-protection rights

Depending on the circumstances, you may have the right to:

  • Request confirmation of whether Northwild processes your personal information;
  • Request access to your personal information;
  • Request correction of inaccurate or incomplete information;
  • Request deletion of information;
  • Request restriction of processing;
  • Object to processing based on legitimate interests;
  • Receive information you provided in a structured, commonly used and machine-readable format where the right to data portability applies;
  • Withdraw consent at any time;
  • Object to direct marketing; and
  • Lodge a complaint with a data-protection supervisory authority.


These rights are not absolute. For example, Northwild may need to retain certain information to meet a legal obligation or establish, exercise or defend a legal claim.


19. How to submit a privacy request

Privacy requests should be sent to: info@northwild.eu


Please provide your full name, booking number where applicable, and enough information for us to identify the relevant records and understand your request.


Northwild may request additional information where reasonably necessary to verify the requester’s identity. We will not request more verification information than necessary.


Requests may be submitted in English, German, Estonian or Russian. English is preferred where possible.

Northwild normally responds within one month. This period may be extended where permitted by law because of the complexity or number of requests, in which case we will inform you.


20. Complaints to the supervisory authority

If you believe that Northwild has processed your information unlawfully, we encourage you to contact us first so that we can try to resolve the matter.


You also have the right to lodge a complaint with:

Office of the Data Protection Ombudsman, Finland
Website: tietosuoja.fi


If you live in another EU or EEA country, you may also contact the data-protection authority in your country of residence.


21. Changes to this Privacy Policy

Northwild may update this Privacy Policy when its activities, systems, providers or legal obligations change.


The current version will be published on the Northwild website. Material changes will be communicated where appropriate. The effective and last-updated date appears at the top of the policy.


22. Contact

For questions about this Privacy Policy or Northwild’s handling of personal information, please contact:


Northwild Oy
Sylvenvaarantie 1, 99800 Ivalo, Finland

Email: info@northwild.eu
Telephone: +358 41 483 7556