Lomarengas Oy's privacy policy. We process our customers' personal data in accordance with the EU General Data Protection Regulation and Finnish national data protection law.
Download the privacy policy as a PDF
Controller, name of the data file and contact information
Lomarengas Oy and the subsidiaries of Lomarengas Oy (hereinafter referred to as the "Controller" or the "Group").
Contact information
Lomarengas Oy
Siltasaarenkatu 8–10, FI-00530 Helsinki
Business ID: 09801728
Contact person
Heli Viljanen
Siltasaarenkatu 8–10, FI-00530 Helsinki
Tel. +358 (0) 306 502 502
Purpose of processing the personal data (purpose of use of the data file)
The Controller processes the personal data of customers for the following purposes:
- offering the Controller's services to customers
- constant management and development of the customer relationship and bookings
- payment of booking fees, monitoring and collection of payments
- development of the Controller's operations and the related development of the service
- monitoring and analysing data on the interests of customers and their accommodation preferences and wishes, including the related development of the service
- taking the wishes of customers into account, developing the service and targeting the services.
The Controller does not disclose customers' personal data to third parties for marketing purposes or opinion or market surveys.
The Controller may send direct marketing to the customers electronically (e.g. by e-mail or SMS; the Lomarengas Group newsletter, confirmation at the start of a booking, feedback query etc.) and target specific customer groups (segmentation) with marketing online, on advertising platforms, and on social media (e.g. Google, Meta, YouTube, Sanoma Media, Alma Media).
Data content of the file
The following information is collected and stored about the data subjects:
- customer number, first name, last name, address, postal code, city, country, telephone number and e-mail address
- customer feedback data: customer satisfaction, comments on the Controller's services and other information obtained with the customer's consent; online feedback form, online feedback, feedback via e-mail or mail and complaints; results of customer satisfaction surveys (e-mail, mail, telephone)
- booking information (e.g. information on previous bookings and future bookings)
- information related to the use of services: for example, service use, purchase and cancellation data
- information on the customer's payment method and past payments (including delays in payment)
- statutory information on direct advertising, distance selling and other direct marketing bans (removal from the newsletter mailing list)
- membership in customer benefit systems of the Controller and its partner companies and the information needed for receiving benefits under the systems
- hobbies and interests
- other information that is collected with the customer's consent (e.g. physical impairments, injuries or illnesses that are relevant when providing the requested services).
Personal data is not used for automated decision-making by the system which would have legal or similar consequences for the customer/data subjects.
Regular sources of data
Information about the customer is collected with the customer's consent from the customer and the events related to the booking and purchase of services (during the booking and purchase process). Personal data may also be collected, stored and updated using the registers of the Population Information Centre or another Controller that provides address, updating or other such services.
Credit information is checked from a service provider with the customer's consent. Information on customer satisfaction is collected using customer satisfaction surveys with the customer's consent.
Regular disclosure and transfer of data outside of the EU or the EEA
Customers' personal data is disclosed for the purposes of direct marketing and opinion and marketing surveys within the limits set out in the Personal Data Act (e.g. as permitted by the consent or required by the assignment). Data is not disclosed outside the EU or the EEA.
When a customer has consented to receiving marketing content via SMS, e-mail, online, and on social media, Lomarengas Group has the right to disclose personal data processed for this purpose to third parties, who may target the customer with commercial communication/marketing. Lomarengas Group may also disclose personal data to social media and marketing platforms to target its marketing (segmentation).
The disclosed personal data is anonymized by the systems used by the marketing and social media platforms, and as a result, individual users cannot be identified based on the data. The anonymization of personal data cannot be reversed, and all anonymized personal data on marketing and social media platforms is carefully encrypted.
Data file security principles
Only Lomarengas Group's employees who need the information at work have access to the data filing system. Local booking centres, cottage owners, maintenance and cleaning personnel and the persons to hand over the keys have access to the customer information that is relevant to their work.
The system can only be accessed using a personal user ID and password provided by the system administrator to a company employee or service provider. Offices are monitored with an access control system. The information stored in the filing system is located in the closed network of Lomarengas Group. The network is secured with a firewall.
Persons who process the data are covered by the obligation to secrecy and penalty provisions set out in the Personal Data Act.
Public access to the filing system
The privacy policy (description) of the customer register of Lomarengas Group is available on the premises of Lomarengas Oy, at Sörnäisten rantatie 29, Helsinki, and on the Controller's website at https://www.lomarengas.fi/en.
Collection of data
Personal data is collected when a customer makes a cottage reservation and directly from the data subjects, from customer surveys, raffles and competitions, updates to customer information, invoicing and payment monitoring.
Right of review and the rectification of inaccurate data
Customer's right to review their personal data (right of access)
The customer has the right to review the data concerning them stored in the filing system. The review request must be sent to the Controller's contact person. The right to review may be denied on statutory grounds. As a general rule, exercising the right of access is free of charge.
The review request must specify the customer's name, contact details and phone number. The review request must specify clearly the service in question. The customer can also make the request personally by visiting the Controller's premises.
Customer's right to request the rectification or erasure of data or the restriction of processing
If there are errors in a customer's information, the customer may request that Lomarengas rectify the error. The Controller will rectify, erase or update any data that is inaccurate, unnecessary, incomplete or outdated from the point of view of the purpose of processing, either at its own initiative or upon the request of the data subject.
Insofar as they are able and with no unnecessary delay upon being made aware of or observing the error, the customer must rectify, remove, or update any irrelevant, erroneous, unnecessary, or outdated information stored in the register. The rectification request can be sent in writing to the filing system contact person.
Right to prohibit
The customer has the right to prohibit the Controller from processing their data for the purposes of direct advertising, distance selling and other direct marketing. A registered customer can issue the prohibition by contacting Lomarengas in writing, using the address specified hereinabove.
Customer's right to lodge a complaint with a supervisory authority
Customers have the right to lodge a complaint with a competent supervisory authority if they consider that the Controller has not acted in accordance with the EU General Data Protection Regulation and Finnish national data protection law.
