Privacy Policy

1. Who is responsible for your data?

GXA Oy (Nordcation), business ID 2873319-3, Linkkitorninkatu 1, 20540 Turku, Finland. For questions about privacy or to exercise your rights, email nordcation@gmail.com.

2. What information do we collect?

If you send a request, we receive your email address and any details you choose to provide: name, phone number, country of residence, dates, number of travellers, children's ages, destination and experience preferences, budget, contact preference and the text of your message. We also receive the time and page of submission. Email and consent to process the inquiry are required; the other travel details are optional.

Please avoid putting health information, identity documents, payment card details or other sensitive information in the free-text fields. If special assistance or dietary details become necessary later, we will discuss them with you directly.

3. How do we use it, and on what basis?

We use your inquiry to read your request, reply to you and discuss a possible tailored journey. The form asks for your consent to process and store the information for this purpose. You can withdraw that consent by emailing us; withdrawal does not affect processing already carried out. If discussions progress toward a service you request, we may also need to process information to take steps at your request before entering into a contract.

We may process limited technical information to keep the website working and secure, based on our legitimate interests in operating it. We do not add you to a marketing mailing list when you submit a travel request.

4. Who receives the information?

Requests are sent from your browser to our HubSpot CRM account, where authorised people handling Nordcation inquiries can access them. Hosting and other technical providers may process limited data needed to operate the site. We do not automatically send a new inquiry to travel suppliers. If you decide to continue planning, relevant details may need to be shared with selected accommodation or experience partners so they can respond to your request; we will explain that step to you.

Some service providers may process data outside the European Economic Area. Where this occurs, we use the safeguards required by applicable data protection law, such as an adequacy decision or standard contractual clauses, as appropriate.

5. How long do we keep it?

We keep a travel inquiry while it is needed to respond and, if you continue planning with us, to manage that discussion. We then delete or anonymise information that is no longer needed. Some correspondence may be kept longer when necessary to handle a dispute or comply with a legal obligation. We review inquiry records periodically rather than keeping them indefinitely.

6. Website technology

The short form on the homepage temporarily keeps its answers in your browser's session storage so they can be carried to the full request page. Those answers are removed from session storage when the request page loads; nothing is sent to HubSpot until you submit the full form. The website loads fonts from Google Fonts, which may receive technical information such as your IP address. The website currently does not include advertising pixels or an analytics tracker. If those tools are introduced later, this policy and any required consent controls will be updated.

7. Your rights

Depending on the circumstances, you can request access to your data, correction or deletion, restriction of processing, or a copy in a portable format. You can object to processing based on legitimate interests and withdraw consent where processing is based on consent. Contact nordcation@gmail.com to make a request. We may need to confirm your identity before acting on it. You can also complain to the Finnish Data Protection Ombudsman's Office or another competent supervisory authority.

8. Changes

We may update this policy if the website, services or data practices change. The current version and its update date will be shown on this page.