How Lapeso Oy (LaplandActivities) processes personal data: newsletter signups, analytics and affiliate cookies. GDPR and ePrivacy compliant.
We collect anonymous analytics data via Google Analytics 4. If you subscribe to our newsletter, we store your email address securely. We do not collect any other personally identifiable information unless you contact us directly.
2a. Legal Basis for Processing (GDPR Art. 6)
We rely on the following legal bases for each processing activity:
for analytics cookies (Google Analytics 4) and any non-essential cookies. You give consent via the cookie banner and can withdraw it at any time.
for newsletter subscription. You give consent by submitting the signup form; you can withdraw at any time via the unsubscribe link.
for essential cookies (storing your consent preference) and for fraud-prevention / security logs. Our interest is operating a functioning website; this is balanced against your reasonable expectations.
for affiliate-link click attribution. Our interest is being paid the commission we have earned editorially; the data collected is minimal (referral source) and you can decline by not clicking affiliate links.
Our website uses cookies to improve your browsing experience and to collect anonymous analytics data. These include:
Required for the website to function properly (consent preferences, session data).
Used by Google Analytics 4 to understand how visitors interact with our site. Collected anonymously.
Placed when you click affiliate links (e.g. Adtraction, Daisycon or Travelpayouts tracking). These help us attribute referral commissions.
We use Google Analytics 4 with Consent Mode v2. If you decline cookies, no analytics data is collected. If you accept, anonymous usage data (pages viewed, time on site, general location by country) is sent to Google. No personal data is included.
Analytics data is retained for 14 months in Google Analytics. Newsletter emails are retained until you unsubscribe.
We do not sell or share your personal data with third parties. However, the following third-party services process data as part of our operations:
We participate in affiliate programmes through the Adtraction, Daisycon and Travelpayouts networks and in the Trip.com partner programme; partners include Sembo, Lomarengas, Trip.com and EconomyBookings. When you click an affiliate link and make a purchase or booking, we may receive a commission at no additional cost to you.
Several of the third-party services we use are based in or transfer data to countries outside the European Economic Area (EEA), most commonly the United States:
(Google LLC, USA): covered by the EU–US Data Privacy Framework (DPF).
(Cloudflare Inc., USA): covered by the EU–US Data Privacy Framework and Standard Contractual Clauses (SCCs).
(Resend Inc., USA): covered by Standard Contractual Clauses.
(Supabase Inc., USA, with EU region hosting available): covered by Standard Contractual Clauses.
Adtraction / Daisycon / Travelpayouts / Trip.com
(Adtraction AB, Sweden, EU; Daisycon B.V., the Netherlands, EU; Travelpayouts and Trip.com, international): transfers outside the EU/EEA are covered by Standard Contractual Clauses.
(GetYourGuide GmbH, Germany): within the EEA.
In each case the transfer is protected by an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses approved by the European Commission. You can request a copy of the relevant safeguards by contacting us.
As we operate from Finland and serve visitors from the European Union, the GDPR applies in full. You have the following rights:
request a copy of the personal data we hold about you.
ask us to correct inaccurate or incomplete data.
Right to erasure / "right to be forgotten" (Art. 17)
ask us to delete your data when there is no overriding reason to keep it.
Right to restriction of processing (Art. 18)
ask us to pause processing while a question is being resolved.
receive your data in a structured, machine-readable format.
object to processing based on legitimate interest, including for direct marketing.
at any time, with effect from the moment of withdrawal.
with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) at tietosuoja.fi, or with the supervisory authority of your habitual residence within the EU.
We do not perform automated decision-making, profiling, or any process that produces legal or similarly significant effects about you within the meaning of GDPR Article 22.
This site and our newsletter are intended for adults. We do not knowingly collect data from children under 13 (the digital-services age threshold under Finnish law and the GDPR). If you believe a child has provided us with personal data, contact us and we will delete it.