Privacy Policy

Controller: Sipoonjoen Perinnesauna / Havuhattu Oy (business ID 3018112-1), Hindsbyntie 124, 04130 Sipoo, Finland, tel. 010 299 2866, savusauna@saunotus.fi. Contact person for data protection matters: Joonas Vaarala, savusauna@saunotus.fi.

This policy explains how we process the personal data of our customers and website users (EU General Data Protection Regulation 2016/679, Article 13).

1. What data we process and why

We receive the data from you when you make a booking, buy something or contact us.

Bookings and orders: name, email, phone number, language, the service booked, the time and number of people, any additional message, and the status of the order and booking. We use this data to deliver your booking, to send confirmations, to handle changes and cancellations, and for customer service.

Business customers and invoicing: company name, business ID, VAT number, billing address, e-invoice address and operator ID, reference, and the contact person's name, email and phone. We use this data for invoicing. The same applies to quote requests from companies (contact person, preferred date, number of people and message).

Payments, receipts and invoices: payment amount, payment method, payment status, the payment provider's transaction ID, and receipt and invoice details. We do not see or store card details, as card and MobilePay payments are made in the payment provider's service.

Gift cards: the buyer's name and email, the recipient's name and email (if the gift card is sent to the recipient), the greeting text, delivery date, gift card code, balance and usage history. If you pay with a partner's gift card (e.g. Elämyslahjat), we verify the code with the partner. Only the gift card code is passed on to the partner.

Annual passes: the pass holder's name, email and phone, the pass code, its validity and its use in bookings.

Waiting list: name, email, phone number (optional), the preferred session and number of people. We use this data to let you know when a place becomes available.

Customer messages: we send emails related to your booking, such as confirmations, receipts, gift cards, payment links and arrival instructions. We also keep records of customer service by email or phone insofar as they relate to your booking.

Email marketing: if you give your consent, we send newsletters and offers to your email. We record when and where you gave your consent. You can withdraw your consent at any time using the unsubscribe link in the message or by contacting us.

Abuse prevention and information security: we process your IP address and email address for a short time so that we can limit repeated requests (e.g. guessing gift card codes). We also keep a log of changes made by our staff.

Cookie-free visitor analytics is described in section 7.

Providing your data is a requirement for making a booking or purchase. Without your contact details we cannot confirm your booking or deliver a gift card. We do not make decisions about you based solely on automated processing, and we do not profile you.

2. Legal bases for processing

Bookings, orders, payments, gift cards, annual passes, the waiting list, booking-related messages and customer service: contract or pre-contractual measures (Article 6(1)(b)).

Receipts, invoices and bookkeeping: legal obligation, namely the Finnish Accounting Act (Article 6(1)(c)).

Business customers' contact person details and quote requests, cookie-free visitor analytics, and abuse prevention, information security and backups: legitimate interest, namely managing the customer relationship, developing the website and services, and protecting the service and data (Article 6(1)(f)). We have assessed that the processing is minor and does not override your interests.

Email marketing: consent (Article 6(1)(a)). You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

3. Recipients and processors

We do not sell your data or disclose it to others for their marketing. The following service providers process data on our behalf:

– Supabase: database and server side. The data is located in the EU (Paris).

– Hetzner Online GmbH: website hosting and storage of encrypted backups. The server is located in Helsinki. The website's server technically processes your IP address when you browse the site.

– Google (Gmail / Google Workspace, Google Drive): sending emails and storing encrypted backups.

– Resend: email delivery.

– Montonio (Montonio Finance / Montonio Payments): online payments. Online bank, card, Apple Pay, Google Pay and MobilePay are paid through Montonio.

– Procountor: bookkeeping and invoicing.

– Johku (Aptual Commerce Oy): our previous online store and booking system. Data on orders made through Johku is transferred to the new system during the transition period. New bookings and purchases are made in our own online store.

– Gift card partners (e.g. Elämyslahjat): receive only the gift card code in order to verify it.

The website does not load third-party tracking scripts, advertising cookies, embedded social media feeds or external fonts. The only exception is the MobilePay payment button, which the page loads from the MobilePay service at the payment stage. Links to social media and map services are ordinary links. Those services process your data only when you open the link.

We may disclose data to authorities when required by law.

4. Transfers outside the EU and EEA

The database, website and backups are located in the EU. Some of our service providers (Google, Resend and Supabase) are US companies, so data may be processed in or accessed from the United States. In these cases the transfer is based on the EU–US Data Privacy Framework, where the provider has committed to it, or on the European Commission's standard contractual clauses.

5. Retention periods

Customer, booking, gift card, annual pass and waiting list data, and quote requests: 3 years from the end of the customer relationship, meaning your last booking, purchase, contact, gift card use or the gift card's expiry, whichever is latest. The retention period is based on the limitation period for possible claims (Finnish Limitation Act 728/2003, section 4).

When the retention period ends, customer data is anonymised: the records remain, but any data that could identify you is removed. Booking, order and payment records are not deleted. If you have a valid marketing consent, your data is kept for as long as the consent is valid; the 3 years are also counted from the withdrawal of consent. A business customer's name and business ID are kept, but the contact person's details are anonymised. Your login account is deleted when your customer data is anonymised.

Accounting records (vouchers, receipts, invoices and payment data): vouchers for 6 years from the end of the year in which the financial period ended, and the financial statements and books of account for 10 years from the end of the financial period (Finnish Accounting Act, chapter 2, section 10). Receipt and invoice PDFs are kept for 6 years, counted the same way, and deleted after that. Any other data linked to you is deleted at the same time. An anonymous entry of the payment remains (amount, date, product and payment method) from which you cannot be identified.

Gift card PDF files: 3 years from the gift card's last use or expiry, after which they are deleted.

Sent emails: sent messages are not deleted from the message log. The personal data in a message (recipient and personal content) is erased 3 years after it was sent.

Marketing consent: until you withdraw it. The record of the withdrawal is kept so that we do not send you messages again.

Visitor analytics: see section 7, Cookie-free visitor analytics.

IP and email data for abuse prevention: 2 days.

Backups: daily backups for 30 days and monthly backups for 12 months. Data is removed from the backups within these periods.

6. Your rights

You have the right to know whether we process your data and to get a copy of it; to request correction of inaccurate data; to request erasure of your data if we have no legal obligation or other grounds to keep it; to request restriction of processing; to object to processing based on legitimate interest; to receive the data you have provided in a machine-readable format and transfer it to another controller when the processing is based on a contract or consent; and to withdraw your consent at any time.

Send your request to savusauna@saunotus.fi or call 010 299 2866. We will respond within one month. We may ask you to verify your identity.

If you believe that we process your data unlawfully, you can lodge a complaint with the Data Protection Ombudsman: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), www.tietosuoja.fi, PL 800, 00531 Helsinki, Finland.

7. Cookie-free visitor analytics

When the website's visitor analytics is enabled, it works without cookies. Nothing is stored in your browser: we use no cookies or other identifiers that are stored in the browser or persist.

We record: the address of the page opened without URL parameters (unknown addresses as "other"), views of product and checkout pages and the related product, the domain of the referring website (not the full address), campaign tags (utm source, medium and campaign), the device type (phone, tablet or computer, based on screen width), the page language, the time of the event, and a random session identifier. The session identifier is valid for a single page load only and is not stored in the browser.

When an order has been paid, the visit is linked to the order (the order, its product and total). For this reason the analytics data is pseudonymous rather than anonymous.

We do not store your IP address, browser identification data or any free text. Browser identification data is used only momentarily to filter out search engines and other bots. The IP address is used momentarily to limit abuse (number of requests). For this purpose, a daily hash, not the address itself, is kept for at most 2 days.

Purpose and legal basis: developing the website and services, and tracking marketing. The legal basis is legitimate interest (Article 6(1)(f)), see section 2.

Retention: individual analytics events are kept for 13 months. After that they are automatically combined into monthly summaries and deleted. The summaries contain only counts and totals by page, language, device type, traffic source (for example search engine, social media or campaign) and product. They contain no session identifiers, orders, referring website domains or campaign tags, and groups of fewer than 5 events are merged into larger ones. The summaries are kept indefinitely.

The data is stored in the booking system in the EU (processor Supabase) and is not disclosed to anyone else.

You can object to the analytics. Your browser's Do Not Track or Global Privacy Control setting blocks the analytics completely.

Updated 24.10.2026.