Privacy policy
1. Data controller
Arctic Ventures Oy (Business ID 3385580-6)
Privacy enquiries: info@arcticglowminigolf.com
2. What we collect and why
We only collect personal data where it's necessary to deliver our service or meet our contractual obligations. Depending on the use case, we collect:
Gift card purchase
Buyer's name and email, optional recipient name and email, the amount paid, and the gift card code. Legal basis: contract performance (GDPR Art. 6(1)(b)). Retained for six years per Finnish accounting law. Card data flows directly through the payment provider — we never store card numbers.
Private event quote requests
Contact details from the form (name, phone, email), preferred date, headcount and free-text message. Legal basis: pre-contractual measures (GDPR Art. 6(1)(b)). Retained two years from the last contact, then anonymised or deleted.
Newsletter sign-up
Email address and subscription timestamp. Legal basis: consent (GDPR Art. 6(1)(a)). You can unsubscribe at any time via the link at the bottom of every email — your address is removed from the list.
Leaderboard
After playing you can optionally save your round to the public leaderboard. We collect your display name (which may be a nickname), email address, per-hole stroke counts and venue. Legal basis: explicit consent (GDPR Art. 6(1)(a)). Display name and total stroke count are shown publicly on the leaderboard; the email stays private and is used only to send your round summary and deliver any prizes. Data is retained for at most 24 months from the last round, after which it is anonymised or deleted.
Website usage
We use Plausible Analytics, which collects aggregate visitor statistics (visit counts, page popularity, referrers). Plausible sets no cookies and collects no identifying information, so no separate cookie consent is required. Hosting is provided by Vercel, which keeps request IP addresses for technical purposes for at most 30 days.
3. Data sharing and processors
We don't sell or rent your data. We use the following processors under data-processing agreements:
- Stripe Payments Europe — card payments (Ireland, EU)
- ePassi Payments Oy — sport benefit payments (Finland)
- Smartum Oy — sport benefit payments (Finland)
- Edenred Finland Oy — sport benefit payments (Finland)
- Resend, Inc. — transactional and newsletter email (USA, with EU Data Processing Addendum)
- Vercel Inc. — website hosting (EU region, Frankfurt)
- Plausible Insights OÜ — anonymous visitor analytics (Estonia, EU)
- Google LLC (Apps Script + Sheets) — private events form and leaderboard database (EU/USA, Standard Contractual Clauses)
- Google LLC — Google Maps embeds (handles your IP when a map loads)
Data may be shared with authorities where required by law — for example, accounting records to the tax administration or evidence to police in a criminal investigation.
4. Where data lives
Most data is processed within the EU. Resend and Stripe transfer data to the United States under the EU-US Data Privacy Framework and Standard Contractual Clauses.
5. Your rights
Under GDPR you have the right to:
- access the data we hold about you
- request correction of inaccurate data
- request erasure when the processing basis ends
- object to or restrict processing
- export your data to another provider (electronic format)
- withdraw consent (e.g. unsubscribe from the newsletter) at any time
- file a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi)
Send requests to info@arcticglowminigolf.com. We respond in writing within one month.
6. Security
Data is protected with technical and organisational measures: encrypted connections (HTTPS), restricted database access, and payment data flowing directly to the payment provider without being stored by us.
7. Changes to this notice
We update this notice as needed. We'll announce material changes on the site and to newsletter subscribers by email. The date at the top of this page reflects the most recent change.