Forest Tales & TrailsForest Tales and Trails Oy - Privacy Policy
Version: 2026-10-08 | This policy explains how Forest Tales and Trails Oy ("FTT", "we", "us") processes personal data in connection with foresttalesandtrails.com, our enquiry forms and our tours.
1. DATA CONTROLLER
1.1 Forest Tales and Trails Oy (business ID 3640719-5), a company incorporated in Finland, is the data controller for the personal data described in this policy. You can reach us at privacy@foresttalesandtrails.com or +358 400 139 643.
2. ENQUIRY FORMS
2.1 Our website has three enquiry forms: one for asking about a specific adventure or a larger group, one for general questions, and one for asking about prints of our photographs. When you send one, we receive your name, your email address and whatever else you fill in: depending on the form, your message, phone number, the adventure you are interested in, the number of people and the dates that would suit you, or the photograph and print size you have in mind. Section 2.5 explains which of these we need. When you ask about an adventure, you can also tell us about health matters in a separate field, as described in section 7.
2.2 We use these details only to answer your enquiry and, where a booking follows, to plan and deliver your tour. The legal basis is our legitimate interest in answering the people who contact us and, where you ask about a tour, taking the steps you request before entering into a contract with you (Article 6(1)(f) and 6(1)(b) GDPR).
2.3 To protect the forms from spam and abuse, the service that receives them also records the time it took to fill in the form, your browser's user agent, and a keyed hash of your network (IP) address. Your IP address itself is never stored. The legal basis is our legitimate interest in keeping our forms secure and free of spam and abuse (Article 6(1)(f) GDPR).
2.4 Ticking "I've read the privacy policy" records which version of this policy you saw. It is not consent to marketing. We do not use the forms to send you marketing, and we do not sell or rent your personal data to anyone.
2.5 We need your name and email address to answer any enquiry. When you ask about an adventure, we also need the number of people and when you would like to come. When you ask a general question, we need your message. When you ask about prints, we need your message and the photograph you have in mind. Without these we cannot answer your enquiry. Everything else is optional.
3. DRAFTS SAVED IN YOUR BROWSER
3.1 While you fill in an enquiry form, your answers are saved in your own browser's local storage, so that closing the form by accident loses nothing. Anything you write in the health field described in section 7 is not saved. This draft stays on your device. It is not sent to us until you press send.
3.2 A draft is deleted when your enquiry is sent, when you choose "Start again", or after 14 days, whichever comes first. You can also delete it at any time by clearing this site's data in your browser.
4. EMAIL, PHONE AND MESSAGES
4.1 If you email, call or text us, we use your contact details and whatever you tell us for the same purposes and on the same legal basis as in section 2.
4.2 If you message us on Instagram or WhatsApp, we receive your message and your username or phone number, and use them in the same way. These services are run by Meta Platforms Ireland Limited and WhatsApp Ireland Limited, which process your messages as separate controllers under their own privacy policies and may transfer data outside the EU. If you would rather avoid this, email us instead.
5. BOOKINGS, PAYMENT AND ACCOUNTING
5.1 When you book a tour, we process your name, contact details, the tour you booked, the date and the number of people in your group, in order to deliver the tour under our contract with you (Article 6(1)(b) GDPR).
5.2 Card payments, whether online or at the meet-up, are handled by the payment provider Mollie B.V., Amsterdam, the Netherlands, as described in clause 3 of our Terms & Conditions. Mollie processes your payment as a separate controller under its own privacy statement, including to prevent fraud and to meet its anti-money-laundering obligations as a payment institution. We do not see or store your card details.
5.3 We keep invoices, receipts and other accounting records because Finnish accounting law requires us to (Article 6(1)(c) GDPR).
5.4 We need these details to confirm and deliver your booking. Without them, we cannot accept the booking.
5.5 If you book by phone, we may ask you to fill in these details, and those described in sections 7 and 8, on a paper form when we meet. Paper forms are kept securely and destroyed at the end of the periods set out in section 11.
5.6 If you book for a group, please share this policy with the people you book for. We process their names and any details you give us about them, including those described in section 7.
6. BOOKINGS THROUGH ONLINE TRAVEL PLATFORMS
6.1 If you book through an online travel platform we work with (currently GetYourGuide), the platform passes us the details we need to deliver your tour. These are usually your name, phone number, the tour, the date and the number of participants. We do not collect these details from you directly.
6.2 We use these details only to deliver your tour, on the same legal basis as a direct booking (Article 6(1)(b) GDPR), and keep them as described in section 11.
6.3 GetYourGuide (GetYourGuide Deutschland GmbH, Berlin, Germany) and we each act as separate controllers of your personal data. GetYourGuide's own privacy policy applies to the data it processes.
7. HEALTH AND DIETARY INFORMATION
7.1 When you ask about an adventure, our enquiry form has a separate, optional field for the health matters described in clause 7.1 of our Terms & Conditions, such as allergies, medical conditions and mobility limitations. If you book by phone or through an online travel platform, we ask about them on a separate form before your tour. Information about your health is a special category of personal data under the GDPR.
7.2 Giving this information is voluntary. We process it only with your explicit consent (Article 9(2)(a) GDPR), which you give by ticking the box next to that field or by signing the form, and only to plan your tour and to protect the safety of you, your group and the guide.
7.3 In an emergency during the tour, we may share it with emergency services to protect your life or health (Article 9(2)(c) GDPR).
7.4 You can withdraw your consent at any time by emailing privacy@foresttalesandtrails.com. If you do not give us this information, or withdraw your consent, we plan the tour without it, as set out in clauses 7.1 and 8.2 of our Terms & Conditions. If you withdraw your consent after your tour, we keep only the record described in 11.6, for that purpose.
7.5 If you tell us about the health of other people in your group, please make sure they agree. At the start of the tour, we ask each adult to confirm their own information and give their own consent, and a parent or guardian to do so for a child. If someone does not, we delete what we were told about them.
8. PHOTOGRAPHS AND VIDEO
8.1 We take photographs and video during tours as described in clause 10 of our Terms & Conditions.
8.2 The legal basis for using images in which you can be recognised is your written consent (Article 6(1)(a) GDPR), which you give on a separate consent form. For a child, a parent or guardian gives this consent.
8.3 You can withdraw your consent at any time by emailing privacy@foresttalesandtrails.com. We will then remove the recognisable images from our website and social media accounts and will not use them in new material. Withdrawal does not affect use before it, and printed material that has already been distributed cannot be recalled.
8.4 Images we publish on social media, currently Instagram and YouTube, are also processed by those services under their own privacy policies, and may be transferred outside the EU. Instagram is run by Meta Platforms Ireland Limited and YouTube by Google Ireland Limited.
9. WEBSITE ANALYTICS
9.1 We count visits to this website with Plausible Analytics, which we run on our own servers in Helsinki, Finland. It sets no cookies, stores nothing on your device, and does not store your IP address or build a profile of you. We only see totals, such as how many people visited a page or pressed an enquiry button.
10. WHO PROCESSES YOUR DATA
10.1 Enquiries sent through our forms are received, stored encrypted and passed on to us by email by speir, an enquiry service run by Infinite Device Labs Oy (trading as Leal Software, business ID 3524893-8), Helsinki, Finland, acting as our processor under a data processing agreement. speir uses the following sub-processors, all of which process data in the EU:
- UpCloud Oy, Helsinki, Finland, which hosts the service and its database;
- Heinlein Hosting GmbH (mailbox.org), Berlin, Germany, which relays the enquiry emails to us and keeps no copy of them;
- Hetzner Online GmbH, which stores encrypted backups in its Helsinki data centre.
10.2 The emails themselves, and any email you send us directly, are held in our mailboxes at mailbox.org (Heinlein Hosting GmbH, Berlin, Germany).
10.3 This website is hosted by statichost.eu, within the EU.
10.4 Our bookkeeping is done through Holvi (Holvi Payment Services Oy, Helsinki, Finland), which processes invoices, receipts and other accounting records on our behalf, only to keep our accounts and to meet our obligations under Finnish accounting law.
10.5 None of our processors may use your data for their own purposes.
10.6 Some services involved are not our processors but separate controllers, which process your data for their own purposes under their own privacy policies: the payment provider Mollie (section 5), online travel platforms we work with, currently GetYourGuide (section 6), and Instagram, WhatsApp and YouTube (sections 4 and 8).
11. HOW LONG WE KEEP IT
11.1 Enquiries about tours are deleted from the enquiry service six months after the last date you asked about or, if you gave no dates, six months after you sent them. Print enquiries are deleted six months after you sent them.
11.2 The browser and IP-address information described in 2.3 is deleted after 30 days. Enquiries identified as spam are deleted after 90 days. Encrypted backups of the enquiry service are kept for up to six months.
11.3 The emails and messages we receive are kept for as long as we need them to answer you. If you book, they are kept for three years after your tour, so that we can deal with any questions or claims about it.
11.4 Booking details, including those we receive from online travel platforms, are kept for three years after your tour.
11.5 Accounting records are kept as Finnish accounting law requires: invoices, receipts and other vouchers for six years, and our accounts and financial statements for ten years, from the end of the financial year.
11.6 Health information is used only to plan and deliver your tour. After it, we keep a record of the health information you gave us for three years, like other booking details, so that we can establish, exercise or defend legal claims about the tour (Article 9(2)(f) GDPR). The record is kept securely, apart from other booking details, and used for nothing else.
11.7 We use images in which you can be recognised for as long as your consent is valid. Signed consent forms are kept for as long as we use the images, and for three years afterwards, so that we can show that consent was given.
12. YOUR RIGHTS
12.1 Under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and applicable Finnish data protection legislation, you have the right to request access to, correction of, or erasure of your personal data, to object to or restrict our processing of it, and to receive a copy of it in a portable format, subject to the conditions set out in the GDPR.
12.2 Where we process your data based on your consent (sections 7 and 8), you can withdraw your consent at any time by emailing privacy@foresttalesandtrails.com. Withdrawing consent does not affect the lawfulness of processing carried out before it.
12.3 To exercise any of these rights, contact us at privacy@foresttalesandtrails.com. We will respond within the timeframes required by applicable law.
12.4 You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) if you believe your data has been processed unlawfully.
13. SECURITY
13.1 We apply reasonable technical and organisational measures to protect your personal data, including encryption of stored enquiries, access restrictions and data minimisation. We only ask for the information needed to answer your enquiry.
14. CHANGES TO THIS POLICY
14.1 We may update this policy from time to time. Each version is identified by the date in its first line, and each enquiry records the version in force when it was sent. Material changes will be published on this page.