Privacy notice

• Contact and customer details, such as your name, email address and telephone number.
• Booking details, such as the rental date and time, duration, booking identifier, messages and rental-related events.
• Payment information, such as payment status, amount, Stripe customer and payment identifiers, and deposit processing. We do not store your full payment-card number.
• Access-control data, such as the name created for lock access, PIN identifier and the times at which PIN messages are sent.
• The boat’s GPS location data during the rental for safety, protection of property and investigation of damage.
• Website technical data, such as IP address, browser and device information, cookie and analytics identifiers, usage events, and error and performance data.
• Information you provide to customer service and information relating to damage or complaints.

• Entering into and performing a contract: arranging the booking, payment, deposit, customer communications and access to the boat (Article 6(1)(b) GDPR).
• Compliance with legal obligations: particularly accounting, tax and consumer-protection obligations (Article 6(1)(c) GDPR).
• Legitimate interests: service security and reliability, prevention of misuse, customer support, protection of property, GPS tracking, and the establishment, exercise and defence of legal claims (Article 6(1)(f) GDPR). We balance our interests against the customer’s rights and reasonable expectations.
• Consent: optional website analytics and advertising measurement (Article 6(1)(a) GDPR). You may withdraw consent at any time in the cookie settings.

• From you when you use the website, make a booking, pay or contact us.
• From Stripe in connection with payment and basic customer details.
• From your browser and device if you accept optional analytics and advertising measurement.
• From the boat’s location and access-control systems in connection with a rental.

We do not sell personal data. We use the following categories of service providers. They process data under our instructions or in their own role under the terms of their service:

• Stripe: payments, customer identification and deposit processing.
• Amazon Web Services: booking database and email delivery.
• Igloohome: temporary lock PINs and access control.
• Vercel: website hosting, technical analytics and performance monitoring.
• Sentry: error and technical-incident monitoring.
• Google Analytics, Microsoft Clarity and Meta Pixel: usage analytics and advertising measurement only with your consent.
• Authorities and other parties when disclosure is required by law or necessary for a legal claim.

Some service providers may process data outside the European Economic Area. In these cases, the transfer is based on a European Commission adequacy decision, approved standard contractual clauses or another transfer mechanism permitted by the GDPR. You may contact us for more information about the safeguards used.

• Booking, payment and accounting records are kept for the statutory period, typically six years after the end of the calendar year in which the financial year ended.
• Customer-service, damage and complaint information is kept for as long as necessary to handle the matter and any applicable claim or liability periods.
• GPS and access-control data is kept only for as long as required for rental safety, protection of property or investigation of damage, and in accordance with the applicable provider settings.
• Technical log and error data is kept for as long as needed to secure the service and investigate incidents.
• Your consent choice remains in your browser’s local storage until you change it or clear your browser data. Analytics data is retained according to the provider settings or until you withdraw consent, if earlier.
• Data is deleted or anonymised when it is no longer needed for the purposes described above.

Your name, email address, telephone number and payment information are required to enter into and perform the rental contract. Without them, we cannot confirm a booking. Consent to analytics and advertising measurement is voluntary and does not affect your ability to use the service.

Subject to applicable law, you have the right to:

• obtain confirmation of whether we process your data and access that data
• ask us to correct inaccurate or incomplete data
• ask us to erase data or restrict its processing
• object to processing based on legitimate interests and to direct marketing
• receive data you provided in a machine-readable format where processing is based on consent or a contract
• withdraw consent at any time without affecting the lawfulness of processing before withdrawal
• lodge a complaint with the Office of the Data Protection Ombudsman in Finland.

To exercise your rights, email moi@stadinbotski.fi. We may request additional information to verify your identity. Contact details for the Office of the Data Protection Ombudsman are available at tietosuoja.fi.

We do not make automated decisions based on personal data that produce legal or similarly significant effects concerning you.

We limit access to personal data to people who need it for their work and protect data with appropriate technical and organisational measures. Stripe processes payment-card details, and we do not store full card numbers in our own systems.

The website uses essential browser local storage to remember booking selections and your consent choice. Google Analytics, Microsoft Clarity, Meta Pixel, Vercel Analytics and Vercel Speed Insights are enabled only if you accept optional analytics and advertising measurement.

We may update this notice when our service or the law changes. The current version and its update date are always available on this page.