Source: http://hettahuskies.com/en/about-us/GDPR
Timestamp: 2019-04-21 08:07:42+00:00

Document:
These terms refer to the definition of terms given in Art. 4 of the Basic Data Protection Ordinance (DSGVO).
'PII' stands for Personally Identifiable Information and this refers to any information that relates to an indentifiable person, whether that information is either directly or indirectly related. In other words, it includes, but is not limited to, data such as names, an id number, location data, an online identifier (e.g cookies) or to one or more special features that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that) person.
'Processing' means any operation carried out with or without the aid of automated procedures or any such series of operations in connection with personal data. The term goes a long way and covers practically every aspect of handling data.
In our case, for instance, assuming that we can show a legally legitimate reason for needing to collect information for a business purpose (e.g. when using agents, web hosts etc., or when sending automated follow-up emails through sites like Tripadvisor, requesting that clients share photos or leave feedback on third party feedback sites like Tripadvisor or Facebook), we still need to gain legal permission (consent) to collate the email contacts of our multiday clients for these purposes. The same also applies to the sharing of client information with companies like payment service providers (banks, paypal etc., in accordance with Art. 6, Para. 1 lit. b DSGVO) in order to fulfil the contract between both parties.
'Responsible' means the natural or legal person, authority, institution or other body that alone, or together with others, decides on the purposes and means of processing personal data. In this case, this is CAPE Lapland Oy / Hetta Huskies and any third parties we cooperate with.
'Data Subjects' (aka the people identifiable through their PII), according to Art. 15 DSGVO, have the right to request information about what data we hold and how their data is being processed. They also have the right to request access to (which links to the right to data portability) or to correct data, to restrict its future processing (Art. 18 & 21 DSGVO) or even immediately delete it, even if this revokes previously granted consents (Art. 7 para. 3 DSGVO). They can also object to the future processing of the data concerning them in accordance with Art. 21 DSGVO at any time. This object may be lodged, in particular, against processing for direct marketing purposes.
At Hetta Huskies we have always honoured our users’ right to data privacy and protection and, as a small business, we generally do not collect and process personal information beyond that which is required for the functioning of our products.
We carried out a mini data protection impact assessment (DPIA) around the Personally Identifiable Information (PII) that both we and our third-party partners collect for our products in accordance with GDPR guidelines. As part of this, we considered how it is processed - in other words the purpose for which it is collected, used and stored - and when and how it is disposed of.
Our data protection declaration explains to you the type, scope and purpose of the processing of personal data within our physical company and our 'online offer'. Our online offer includes our associated websites, functions and contents as well as external online presences, e.g. our social media profile.
What PII do we currently process?
We understand that providing information online involves a great deal of trust on your part. We take this trust very seriously, and make it a high priority to ensure the security and confidentiality of the personal information you provide to us when you visit our Website or use our services. Before submitting your personal information to us, please read this Policy carefully to learn about our privacy practices. By visiting Hetta Huskies' website, www.hettahuskies.com, or using any of our linked sites or services, you are accepting the practices described herein.
. a) You supply your basic contact details and standard inventory data (for instance your first and last name, telephone number, postal and email addresses) when you contact us about our products and we respond, as solicited, to your questions and comments in order to facilitate your booking reservations to the point of sale (as per Art. 6 Para. 1 lit. b) DSGVO.
. j) to resolve disputes or troubleshoot problems; to prevent potentially prohibited or illegal activities; . k) to drive best practices in animal welfare within the industry.
Aspects of this request cover topics included within special category data, as determined by Category 9. This includes race; ethnic origin and health since these are considered the type of data that could create more significant risks to a person’s fundamental rights and freedoms. For example, by putting them at risk of unlawful discrimination because of sexual preferences or ethnic origin.
We also explain that internal access to the digital forms requested in advance and maintained in our internal databases (or to the physical forms completed in situ by those who failed to send them in advance) is restricted to specifically designated members of staff.
Of course, you can choose not to provide information to us, but some information about you is required in order for you to participate in our products. For example, only registered members of our social media pagges may be able to post travel reviews or photos in them, access members-only newsletters, enter surveys or contests. Similarly, we have the right to refuse access to products if we know that you are choosing to withhold information about your medical history. However, we may not know that you have withheld data until after an incident has occured. Therefore, withholding requested data has to always be at your own risk.
. Third-party vendors who provide services or functions on our behalf, including business analytics, payment processing, distribution of surveys or sweepstakes programs, and fraud prevention.
. Business partners with whom we may offer products or services in conjunction. You can tell when a third party is involved in a product or service you have requested because their name will appear either with ours or separately. If you choose to access these optional services, we may share information about you, including your personal information, with those partners. Please note that we do not control the privacy practices of these third-party business partners.
. Referring Websites. If you were referred to TripAdvisor from another website, we may share your registration information, such as your name, email address, mailing address, telephone number and travel preferences, about you with that referring website. We have not placed limitations on the referring websites’ use of personal information and we encourage you to review the privacy policies of any website that referred you to Hetta Huskies.
. Social Media Services. You can choose to access certain third party social media websites and services through our site (such as Facebook). When you do so, you are sharing information with those sites, and the information you share will be governed by their privacy policies. You may also be able to modify your privacy settings with these third party social media websites.
. We also may share your information if we believe, in our sole discretion, that such disclosure is necessary to either comply with legitimate and enforceable subpoenas, court orders, or other legal process; to establish or exercise our legal rights; to defend against legal claims; or as otherwise required by law. In such cases we reserve the right to raise or waive any legal objection or right available to us.
. Finally, we also may share your information if we believe, in our sole discretion, that such disclosure is necessary in connection with a corporate transaction, such as a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.
We want you to feel confident when interacting with us, and we are committed to protecting the information we collect. While no website can guarantee security, we have implemented appropriate administrative, technical, and physical security procedures to help protect the personal information you provide to us. For example, only authorized employees are permitted to access personal information, and they only may do so for permitted business functions. We also employ firewalls and intrusion detection systems to help prevent unauthorized persons from gaining access to your information.
Unless expressly stated in this data protection declaration, the data stored by us in our CRM systems will be deleted as soon as it is no longer required for its intended purpose and so long as the deletion does not either conflict with any statutory storage obligations or its storage is necessitated for other legally permissable purposes (e.g. data that must be retained for commercial or tax reasons). If there is a statutory storage requirement beyond the time when it is required for its intended purpose, its processing will be restricted in accordance with Articles 17 and 18 DSGVO.
GDPR gives end users the right to not only access, modify or delete personal information but also to request that the controller be able to transfer it to another controller (depending on technical feasibility). To that end, an active and continuous GDPR implementation and privacy program needs to be in place for employees, in addition to a data breach notification protocol.
The hosting services we use serve to provide the following services: Infrastructure and platform services, computing capacity, storage space and database services, security services and technical maintenance services.
Our hosting provider collects, on our behalf, data on each access to the server on which this service is located (so-called server log files) on the basis of our legitimate interests within the meaning of Art. 6 para. 1 lit. f. DSGVO.
Access data includes the name of the accessed website, file, date and time of access, transferred data volume and notification of successful access. Meta / communication data includes device and browser type and version, the user's operating system, referrer URL (the previously visited page) and the requesting provider (i.e., IP address). Usage data (e.g. interest in content, access times) is also available to us for analysis by default.
Log file information is stored, as standard, for a maximum of 7 days for security reasons (e.g. to investigate misuse or fraud) and then deleted. Data whose further storage is required for evidentiary purposes are excluded from deletion until the respective incident has been finally clarified.
A cookie is a small piece of data that a website asks your browser to store on your computer or mobile device (if your Web browser permits). The cookie may be either permanent or temporary and allows the website to "remember" your actions or preferences over time. Most browsers support cookies, but users can set their browsers to decline them and can delete them whenever they like.
The cookies are stored on the user's devices for a number of purposes, including but not limited to security, the presentation of the website, to identify the user and save their user decisions and preferences (so that, for instance, they can complete tasks without having to re‑enter information when browsing from one page to another or when visiting the site later), to measure reach and for marketing purposes. Cookies can also be used for online behavioural target advertising and to show adverts relevant to something that the user searched for in the past.
Within our online offer, we make no representations or warranties of any kind based on our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offer within the meaning of Art. 6 para. 1 lit. f. DSGVO) content or service offerings of third parties to incorporate their content and services, such as videos or fonts (hereinafter uniformly referred to as "content"). This always presupposes that the third party providers of this content perceive the IP address of the users, since without the IP address they could not send the content to their browser. The IP address is therefore required for the display of this content. We make every effort to use only those contents whose respective providers use the IP address only for the delivery of the contents.
In addition to using cookies to collect data about visitors visiting our pages on their sites, third-party providers like YouTube, Facebook, Tripadvisor etc., may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. Pixel tags" can be used to evaluate information such as visitor traffic on and between the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may include technical information about the browser and operating system, referring websites, visiting time and other information about the use of our online offer, as well as may be linked to such information from other sources.
According to GDPR, any organisation which uses Google Analytics, however infrequently (and this is something we would only look at very sporadically), is considered a Data Controller - since it controls which data is sent to Google Analytics - and Google Analytics, in turn, is considered to be one of that organisation's Data Processors.
Google, as a Data Processor, has obligations to conform to the EU GDPR. According to Google’s own Privacy Compliance website, they are “working hard to prepare for the EU’s General Data Protection Regulation.” You can see more details on this site and it is almost certain that Google Analytics will be fully compliant by May 25, 2018. As part of being a Data Processor, Google must provide a data processing agreement that you’ll need to accept.
Within our online offer we use the marketing functions (so-called "LinkedIn Insight Tag") of the network LinkedIn. The provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. Every time you visit one of our pages that contains functions of LinkedIn, a connection to LinkedIn's servers is established. LinkedIn is informed that you have visited our website with your IP address. With the help of the LinkedIn Insight Tag we can analyse the success of our campaigns within LinkedIn or determine target groups for them based on the interaction of the users with our online offer. If you are registered with LinkedIn, it is possible for LinkedIn to associate your interaction with our online service with your user account. Even if you click on the "Recommend-Button" of LinkedIn and are logged into your LinkedIn account, LinkedIn is able to assign your visit to our website to you and your user account. LinkedIn is certified under the Privacy Shield Agreement and thus offers a guarantee to comply with ()European data protection law.
Functions of the service or the Twitter platform (hereinafter referred to as "Twitter") can be integrated within our online offer. Twitter is an offer of Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. The functions include the presentation of our contributions within Twitter within our online offer, the link to our profile on Twitter as well as the possibility to interact with the contributions and the functions of Twitter and to measure whether users reach our online offer via the advertisements we place on Twitter (so-called conversion measurement).
Tripadvisor's policy statement on privacy settings can be found here.
Tripadvisor automatically collects some information from client computers or devices when people visit TripAdvisor. For example, they collect session data, including IP addresses, Web browser software, and referring website. They may also collect information about their client's online activity, such as content viewed, pages visited, and searches and/or reservations facilitated or made. One of their goals in collecting this automatic information was to help us understand the interests and preferences of their users and to customize their user experience.
When you use an Application on a Device, they collect and use information about you in generally similar ways and for similar purposes as when you use the TripAdvisor website. In addition, they may collect information about your location if you have instructed your Device to send such information to the Application via the privacy settings on that Device, or if you have uploaded photos tagged with location information. They may use the location information collected from your Device or photos to enhance your use of the Application by providing you with relevant content and contextual advertising. For example, they may use your location to show you reviews of hotels or restaurants near you when you are traveling. You can change the privacy settings of your Device at any time, in order to turn off the functionality to share location information with the Application and/or the functionality to tag your photos with location information. Please note that turning off location sharing may affect certain features of their App. If you have any queries about the privacy settings of your Device, we suggest you contact the manufacturer of your Device or your mobile service provider for help.
The ways in which TripAdvisor utilises cookies is also explained in this page. The Help portion of the toolbar on most browsers should tell you how to prevent your browser from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable most types of cookies. Please note that if you refuse to accept cookies, you may not be able to access many of the travel tools offered on their sites.
Facebook is certified under the Privacy Shield Agreement and thus offers a guarantee to comply with European data protection law.
The purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as the relevant rights and setting options for the protection of users' privacy, can be found in Facebook's data protection information: .
If a user is a Facebook member and does not want Facebook to collect data about them via this online offer and link it to their membership data stored on Facebook, they must log out of Facebook before using our online offer and delete their cookies. Further settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US page http://www.aboutads.info/choices/ or the EU page http://www.youronlinechoices.com/. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.
The copyright and all other rights to content, images, photos or other files portrayed on the website belong exclusively to Hetta Huskies / CAPE Lapland Oy or the specifically named owners. The written consent of the copyright holders must be obtained in advance for the reproduction of any elements.
Without limiting the generality of the foregoing, if FareHarbor is collecting or furnishing Personal Data of individuals in the European Economic Area (“EEA”) to Provider or if FareHarbor is Processing, storing or transferring such Personal Data on behalf of Provider, then FareHarbor and Provider and/or their Affiliate(s), as applicable, will agree to be bound by the Data Processing Addendum (Addendum 1), and any applicable data transfer mechanisms (collectively, the “Privacy and Security Terms”). For the avoidance of doubt, no such Personal Data should be Processed or transferred without Privacy and Security Terms necessary for compliance with applicable law.
This Data Processing Addendum (this “Addendum”), is part of the [FareHarbor Terms of Service] (“Agreement”) between FareHarbor and Controller and governs FareHarbor’s Processing of Personal Data to the extent such Personal Data relates to natural persons in the European Economic Area or Switzerland in connection with FareHarbor’s provision of the services described in the Agreement (“Services”). Except as expressly stated otherwise, in the event of a conflict between the terms of the Agreement and the terms of this Addendum, the terms of this Addendum will take precedence. This Addendum applies to each agreement between Controller and FareHarbor under which FareHarbor Processes Personal Data as part of performing under that agreement. The Addendum will be effective on May 25, 2018. All capitalized terms used but not defined in this Addendum have the meanings given to them in the Agreement.
1. Instructions from the Controller. Notwithstanding anything in the Agreement to the contrary, FareHarbor will only Process Personal Data on documented instructions from Controller, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by European Union or Member State law to which FareHarbor is subject. FareHarbor will promptly inform Controller if following Controller instructions would result in a violation of applicable data protection law or where FareHarbor must disclose Personal Data in response to a legal obligation (unless the legal obligation prohibits FareHarbor from making such disclosure).
2. Confidentiality. FareHarbor will restrict access to Personal Data to those authorized persons who need such information to provide the Services. FareHarbor will ensure such authorized persons are obligated to maintain the confidentiality of any Personal Data.
3. Security. FareHarbor will implement appropriate technical and organizational measures to ensure a level of security appropriate to the Personal Data provided by Controller and Processed by FareHarbor. Such security measures will be at least as protective as the security requirements set forth in the Agreement.
4. Sub-processors. Controller agrees that FareHarbor may engage other processors (“Sub-processors”) to assist in providing the Services consistent with the Agreement. FareHarbor will make a list of such Sub-processors available to Controller prior to transferring any Personal Data to such Sub-processors. FareHarbor will notify Controller of any changes to the list of Sub-processors in order to give Controller an opportunity to object to such changes. The list of Sub-processors can be found here.
5. Sub-processor Obligations. Where FareHarbor engages another processor for carrying out specific Processing activities on behalf of Controller, the same data protection obligations as set out in this Addendum will be imposed on that other processor by way of a contract or other legal act under EU or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the Processing will meet the requirements of the EU data protection law. Where that other processor fails to fulfil its data protection obligations, FareHarbor will remain fully liable to the Controller for the performance of that other processor’s obligations.
6. Access Requests. FareHarbor has implemented and will maintain appropriate technical and organizational measures needed to enable Controller to respond to requests from data subjects to access, correct, transmit, limit processing of, or delete any relevant Personal Data held by FareHarbor.
7. Recordkeeping. Upon a request issued by a supervisory authority for records regarding Personal Data, FareHarbor will cooperate to provide the supervisory authority with records related to Processing activities performed on Controller’s behalf, including information on the categories of Personal Data Processed and the purposes of the Processing, the use of service providers with respect to such Processing, any data disclosures or transfers to third parties and a general description of technical and organizational measures to protect the security of such data.
8. Cooperation. FareHarbor will cooperate to the extent reasonably necessary in connection with Controller’s requests related to data protection impact assessments and consultation with supervisory authorities and for the fulfillment of Controller’s obligation to respond to requests for exercising a data subject’s rights in Chapter III of Regulation (EU) 2016/679. FareHarbor reserves the right to charge Controller for its reasonable costs in collecting and preparing Personal Data for transfer and for any special arrangements for making the transfer.
9. Third Party Requests. If FareHarbor receives a request from a third party in connection with any government investigation or court proceeding that FareHarbor believes would require it to produce any Personal Data, FareHarbor will inform Controller in writing of such request and cooperate with Controller if Controller wishes to limit, challenge or protect against such disclosure, to the extent permitted by applicable law.
10. Transfer of Personal Data; Appointment. Controller authorizes FareHarbor to transfer, store or Process Personal Data in the United States or any other country in which FareHarbor or its Sub-processors maintain facilities. Controller appoints FareHarbor to perform any such transfer of Personal Data to any such country and to store and Process Personal Data in order to provide the Services. FareHarbor will conduct all such activity in compliance with the Agreement, this Addendum, applicable law and Controller instructions.
11. Retention. Personal Data received from Controller will be retained only for so long as may be reasonably required in connection with FareHarbor’s performance of the Agreement or as otherwise required under applicable law.
12. Deletion or Return. At the choice of the Controller, FareHarbor will delete or return all the Personal Data to the Controller after the end of the provision of services related to Processing, and delete existing copies unless European Union or Member State law requires storage of the Personal Data. FareHarbor will relay Controller’s instructions to all Sub-processors.
13. Breach Notification. After becoming aware of a Personal Data Breach, FareHarbor will notify Controller without undue delay of: (a) the nature of the data breach; (b) the number and categories of data subjects and data records affected; and (c) the name and contact details for the relevant contact person at FareHarbor.
14. Audits. Upon request, FareHarbor will make available to Controller all information necessary, and allow for and contribute to audits, including inspections, conducted by Controller or another auditor mandated by Controller, to demonstrate compliance with Article 28 of Regulation (EU) 2016/679. For clarity, such audits or inspections are limited to FareHarbor’s Processing of Personal Data only, not any other aspect of FareHarbor’s business or information systems. If Controller requires FareHarbor to contribute to audits or inspections that are necessary to demonstrate compliance, Controller will provide FareHarbor with written notice at least 60 days in advance of such audit or inspection. Such written notice will specify the things, people, places or documents to be made available. Such written notice, and anything produced in response to it (including any derivative work product such as notes of interviews), will be considered Confidential Information and, notwithstanding anything to the contrary in the Agreement, will remain Confidential Information in perpetuity or the longest time allowable by applicable law after termination of the Agreement. Such materials and derivative work product produced in response to Controller’s request will not be disclosed to anyone without the prior written permission of FareHarbor unless such disclosure is required by applicable law. If disclosure is required by applicable law, Controller will give FareHarbor prompt written notice of that requirement and an opportunity to obtain a protective order to prohibit or restrict such disclosure except to the extent such notice is prohibited by applicable law or order of a court or governmental agency. Controller will make every effort to cooperate with FareHarbor to schedule audits or inspections at times that are convenient to FareHarbor. If, after reviewing FareHarbor’s response to Controller’s audit or inspection request, Controller requires additional audits or inspections, Controller acknowledges and agrees that it will be solely responsible for all costs incurred in relation to such additional audits or inspections.
Payment processing services for Providers on FareHarbor are provided by Stripe and are subject to the Stripe Connected Account Agreement, which includes the Stripe Terms of Service (collectively, the “Stripe Services Agreement”). By agreeing to these terms or continuing to operate as a Provider on FareHarbor, you agree to be bound by the Stripe Services Agreement, as the same may be modified by Stripe from time to time. As a condition of FareHarbor enabling payment processing services through Stripe, you agree to provide FareHarbor accurate and complete information about you and your business, and you authorize FareHarbor to share it and transaction information related to your use of the payment processing services provided by Stripe.

References: Art. 4
 Art. 6
 Art. 15
 Art. 21
 Art. 6
 Art. 6
 Art. 6