Privacy policy
Last updated: 9 September 2026
This explains what we do with your photographs and your email address, and what you can ask us to do about it. It is written to be read, not to be skipped.
Who is responsible for your data
Lapland Today operates this site and is responsible for the personal data described here.
For anything in this policy, including the requests described below, write to info@laplandtoday.com.
Your photograph is personal data
A photograph of you taken on a tour identifies you, so it is personal data and this policy covers it in the same way as your email address.
We photograph guests on the tours and activities we cover in Lapland — snowmobile safaris, husky sledding, reindeer farms, aurora outings and guided walks — so that they can buy their own pictures afterwards. Our lawful basis is legitimate interest: it is the service the tour is offering, and it is what you would expect a tour photographer to be doing.
If you would rather not be photographed, tell your guide at the start of the tour. If you find a photograph of yourself after the fact and want it removed, use the Report button in the album, or write to us. We will delete it, including from any album it appears in, and if you left an email address we will tell you when it is done.
What we collect, and why
We never see or store your card number. It is entered on the payment provider’s own page and never reaches our systems. What the provider sends back, and what we keep with the order, is the amount, the payment method, the last digits of the card, whether the payment succeeded, and the reason it gives if a card is refused.
The address your browser connects from is also used, briefly and in memory only, to limit how many times an access code or a payment can be attempted in a row. It is not written down for that purpose.
| Data | Why we hold it | How long |
|---|---|---|
| Tour photographs | So the group can find and buy their pictures | Until the album expires, twelve hours after the tour by default |
| Your email address | To send your download link and to answer you about the order | With the order record, for as long as accounting law requires |
| Payment record | Confirming your payment, refunds, and our own accounts | As required by Finnish accounting law |
| Download link token | So only you can reach the photos you paid for | Until the album is deleted, twelve hours after the tour by default |
| The emails we send you | A copy of each message, so we can see what you received and send it again if it did not arrive | With the order record |
| A report you make about an album | Your message, the reason, the email address if you gave one, and the address your browser connected from, so we can handle the report and show afterwards how it was handled | As the record of how the complaint was dealt with |
Who else handles it
We keep the number of outside companies to a minimum. These are all of them:
- Resend is in the United States, so sending your email address there is a transfer outside the EU. It is covered by the European Commission’s standard contractual clauses.
- We do not use analytics, advertising or tracking of any kind, so nothing about your visit is shared with anyone else.
- We never sell personal data.
| Company | What they do | Where |
|---|---|---|
| Stripe | Processes the card payment | United States and the EU |
| Resend | Delivers our email to you: the download link, and replies to a report | United States |
| Contabo | Hosts the server holding the photos and the database | Germany (EU) |
Location data in photographs
Cameras often record GPS coordinates inside an image file. Every photograph on this site is re-encoded when it is uploaded, which removes that data along with the rest of the camera metadata. The file you download carries no location information.
How long we keep things
Albums expire automatically, twelve hours after the tour by default, and a scheduled job then deletes the photographs from storage and their records from the database. This applies to photographs that were purchased as well — buyers are told the exact date and time at purchase and in their email, and are asked to download their copies.
A photograph can also go earlier: when someone in it asks for it to be removed, we delete it as soon as the request has been looked at, even if it has already been sold.
The order record itself is kept after the photographs are gone: it is the accounting record, and Finnish law requires holding it. It contains your email address and the payment details, not the photographs.
Your rights
Under the GDPR you can ask us to do any of the following, free of charge. Write to info@laplandtoday.com and we will answer within one month.
- Get a copy of the personal data we hold about you, including your photographs.
- Correct anything that is wrong.
- Have your data deleted, including photographs you appear in.
- Object to us photographing you, or to a photograph staying published.
- Receive your data in a portable format.
- Complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) if you think we have handled this badly.
Security
Photographs are held in private storage that is not reachable from the internet, and are served only to someone holding the tour’s access code or a valid download link, and to our own staff: the guide who took them and the people who manage the site. Passwords are stored hashed, never in plain text. Traffic to the site is encrypted.
Actions taken by our staff in the site’s panels — uploading, deleting, changing settings, handling a report — are recorded with the account and the address it connected from, so that what happened to a photograph can always be traced afterwards.
The access code your guide gives you is a convenience for your group, not a secret: anyone who has it can see the tour’s watermarked previews. Do not share it more widely than the people who were on the tour.
Changes
If this policy changes in a way that affects you, we will say so on this page and update the date at the top.