Privacy Policy of Beyond Arctic Ltd

Last updated: 26 August 2026

Beyond Arctic Ltd (“Beyond Arctic”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how Beyond Arctic collects, uses, stores, discloses and protects personal data when you visit our website, make a booking, purchase or participate in our services, contact us, or otherwise interact with us.
We process personal data in accordance with the EU General Data Protection Regulation (GDPR), applicable Finnish data protection legislation and other applicable laws.

1. Data Controller and Contact Information

Data Controller
Beyond Arctic Ltd
Business ID: 2763270-2
Valtakatu 21
96200 Rovaniemi
Finland
Phone: +358 50 323 1090
Email: contact@beyondarctic.com

Contact person for data protection matters
Juho Uutela
Email: juho@beyondarctic.com
Phone: +358 50 323 1090
If you have any questions about this Privacy Policy, our processing of personal data or your rights, please contact us using the contact details above.

2. Personal Data We Collect

The personal data we collect depends on how you interact with Beyond Arctic and which services you use.

Customer and contact information
We may collect:
• name
• email address
• telephone number
• postal or billing address
• country of residence or origin
• language preferences
• booking and customer reference information
• information about products and services purchased or booked
• information necessary for invoicing and payment administration
• other information you provide to us in connection with your booking or customer relationship

Booking and service information
We may process information necessary to organise and provide the services you have booked, including:
• booking details
• dates and times of activities
• number of participants
• special requests
• equipment or other arrangements related to the booking
• information concerning cancellations, changes and refunds
• communications relating to your booking
• information received through booking or distribution channels

Health information and special requirements

Some of our programmes and activities may require us to process information relating to a participant’s health or special requirements in order to assess whether the participant can safely participate in an activity and to organise and provide the service appropriately.

This may include information such as:
• allergies and dietary requirements;
• physical disabilities or mobility limitations;
• illnesses or medical conditions;
• injuries or other physical limitations;
• medication information where relevant to safe participation;
• pregnancy where relevant to the safety or suitability of the activity; and
• other health-related information that may affect the participant’s ability to safely participate.

Some of this information may constitute special categories of personal data under the GDPR.
We only ask participants to provide health or other sensitive information that is relevant to the safe organisation and provision of the booked service.
Providing such information is generally voluntary. However, if information that is necessary to assess the safety or suitability of an activity is not provided, we may be unable to provide the service or may need to refuse or discontinue participation if the activity cannot be safely carried out.

Communication information
When you contact us by email, telephone, WhatsApp, social media, contact forms or other communication channels, we may process:

• your name and contact details;
• the content of your communications;
• information relating to your booking;
• information you choose to provide to us; and
• information necessary to handle and respond to your enquiry.
Website and technical information

When you visit or use our website, we may collect technical and usage information, including:
• IP address;
• browser type and version;
• operating system;
• device information;
• online identifiers;
• pages visited;
• interactions with our website; and
• information about how you access and use our digital services.

Some of this information may be collected through cookies and similar technologies. Further information is provided in Section 9.

3. How We Collect Personal Data

We may collect personal data directly from you or from other sources, including:
• when you make a booking or purchase;
• when you contact us by email, telephone, WhatsApp, social media or other messaging services;
• when you use our website or contact forms;
• when you communicate with us regarding an existing booking;
• through booking, reservation and distribution platforms used to sell our services;
• through local service providers or business partners where necessary to provide a booked service;
• through marketing, analytics and advertising technologies, where permitted by law and, where required, with your consent; and
• when you otherwise provide information to us voluntarily.
Where we receive personal data from another organisation, we process the information in accordance with applicable data protection legislation.

4. Purposes and Legal Bases for Processing

We process personal data only for specified, legitimate and necessary purposes.
Providing and managing our services
We process personal data where necessary to:

• process and manage bookings;
• provide and organise purchased services;
• communicate with customers about bookings;
• arrange activities, transportation, equipment or other services;
• handle special requests;
• assess whether an activity can be safely provided;
• provide customer support;
• process payments and related transactions; and
• manage cancellations, changes and refunds.
The legal basis for this processing is generally the performance of a contract or taking steps at your request before entering into a contract.

Legal and accounting obligations
We may process personal data where necessary to:

• comply with legal and regulatory obligations;
• maintain accounting and financial records;
• issue invoices;
• fulfil tax and reporting obligations;
• respond to lawful requests from authorities; and
• establish, exercise or defend legal claims.
The legal basis is generally compliance with a legal obligation or, where applicable, our legitimate interest in establishing, exercising or defending legal claims.

Customer relationship and business administration
We may process personal data to:

• communicate with customers;
• manage customer relationships;
• maintain booking and service records;
• handle enquiries, feedback and complaints;
• improve our internal processes and services;
• develop and improve the quality of our services; and
• protect our business, systems and customers.
Where applicable, the legal basis is our legitimate interest in operating, managing and developing our business, provided that such interests are not overridden by your rights and freedoms.

Marketing and advertising
We may process personal data for direct marketing and advertising where permitted by applicable law.
Depending on the circumstances, the legal basis may be your consent or our legitimate interest where permitted by law.
You have the right to object to direct marketing at any time. You can unsubscribe from marketing communications by using the unsubscribe option included in the communication or by contacting us.
Where cookies or similar technologies are used for advertising, analytics or other non-essential purposes, we will obtain consent where required by applicable law.

Website analytics and advertising
We may use analytics and advertising technologies to understand how our website is used, measure the effectiveness of our advertising and improve our online services.
These technologies may also be used to create audiences or measure interactions with our advertisements.
Where consent is required, these technologies will not be activated until you have given the required consent through our cookie consent mechanism.

5. Processing of Health and Other Sensitive Information

Some of our activities may require information concerning health, allergies, dietary requirements, disabilities, injuries or other special needs.
We use this information only where necessary to:
• assess whether a participant can safely participate in a programme;
• identify relevant safety risks before the programme;
• determine whether an activity is suitable for the participant;
• prepare food appropriately, including taking allergies and dietary requirements into account;
• make appropriate operational arrangements;
• provide appropriate assistance or adaptations where reasonably possible; and
• ensure that the service can be delivered safely and appropriately.
Health information may be accessed by authorised Beyond Arctic personnel who need the information for legitimate operational purposes. This may include members of our sales, operations and guiding teams.

Where necessary for the provision of a booked service, relevant information may also be shared with a local service provider or business partner involved in providing that service.
For example, information about allergies or dietary requirements may need to be shared with a service provider preparing food. Information concerning a disability, mobility limitation or other relevant physical limitation may need to be shared where this is necessary to ensure that the service can be provided safely and appropriately.

We only share information that is relevant and necessary for the specific purpose.
Health information and other special categories of personal data are processed only where an applicable legal basis and a relevant condition under Article 9 of the GDPR exist.
Where explicit consent is relied upon, consent will be requested separately and will be freely given, specific, informed and explicit. Where another lawful condition applies, processing will be carried out on that basis.

We limit access to health information to persons who need the information for the relevant purpose and apply appropriate technical and organisational measures to protect such information.

6. Disclosure of Personal Data

Beyond Arctic may disclose or make personal data available to carefully selected service providers and business partners where this is necessary to operate our business or provide a service booked by you.
These recipients may include:

• booking and reservation service providers;
• payment service providers;
• customer relationship and business management systems;
• local activity and service providers;
• transportation or accommodation providers where relevant to the booked service;
• communication and messaging service providers;
• website hosting and technical service providers;
• analytics and advertising service providers;
• accounting, legal and other professional advisers; and
• public authorities where disclosure is required by law.

We only disclose personal data where there is a lawful basis for doing so and only to the extent necessary for the relevant purpose.

Where a service provider processes personal data on our behalf, we require appropriate contractual and organisational safeguards in accordance with applicable data protection legislation.

Beyond Arctic does not sell customers’ personal data to third parties for their own independent marketing purposes.

7. International Transfers of Personal Data

Some of our service providers may process personal data outside the European Economic Area (EEA).
Where personal data is transferred outside the EEA, we ensure that the transfer is carried out in accordance with applicable data protection legislation.
Depending on the circumstances, this may include relying on:
• an adequacy decision of the European Commission;
• Standard Contractual Clauses approved by the European Commission; or
• another lawful transfer mechanism recognised under applicable data protection legislation.

Where appropriate, we may also implement additional safeguards to protect personal data during international transfers.

You may contact us if you would like further information about applicable safeguards relating to international transfers.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Different categories of information may therefore be retained for different periods.
In general:
• booking and customer information is retained for as long as necessary to provide and administer the service and manage the customer relationship;
• financial and accounting information is retained for the period required by applicable accounting and tax legislation;
• information necessary to establish, exercise or defend legal claims may be retained for as long as necessary for those purposes;
• health and other sensitive information is retained only for as long as necessary for the purpose for which it was collected, unless a longer period is required or permitted by law;
• marketing information is retained until you unsubscribe or object, or until it is no longer necessary for the relevant marketing purpose; and
• information collected through cookies and similar technologies is retained according to the relevant technology, purpose and cookie settings.

When personal data is no longer necessary, it will be securely deleted or anonymised.

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies to ensure that the website functions properly, improve the user experience, analyse website usage and support marketing and advertising.

Cookies and similar technologies may include:
• Necessary cookies, which are required for the operation, security or basic functionality of the website.
• Analytics cookies, which help us understand how visitors use our website and improve our services.
• Advertising and marketing cookies, which may be used to measure advertising effectiveness, create advertising audiences, personalise advertising or support remarketing and similar activities.

Where required by applicable law, non-essential cookies and similar technologies are only activated after you have provided the required consent.

When you visit our website, you may be asked to accept or reject non-essential cookies through our cookie consent mechanism.

You can change or withdraw your cookie consent at any time through the available cookie settings.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Some website functionality may be affected if certain cookies are rejected.

10. Data Security

Beyond Arctic takes appropriate technical and organisational measures to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction or damage.
Access to personal data is restricted to persons who need access for legitimate business purposes.
Where third-party service providers process personal data on our behalf, we use appropriate contractual and organisational safeguards to protect the information.
Despite appropriate security measures, no electronic transmission or storage system can be guaranteed to be completely secure.



11. Your Rights

Subject to the conditions and limitations provided by applicable law, you have the right to:
• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• request restriction of processing;
• object to certain processing of your personal data, including direct marketing;
• request data portability where the right applies; and
• withdraw your consent where processing is based on consent.

You may also have the right to object to processing based on our legitimate interests, depending on the circumstances.
These rights are not absolute and certain legal exceptions may apply. For example, we may need to retain certain information to comply with legal obligations or to establish, exercise or defend legal claims.

12. How to Exercise Your Rights

You can exercise your rights by contacting us:
Email: contact@beyondarctic.com
We may need to verify your identity before processing your request in order to protect your personal data.

We will respond to requests without undue delay and, in principle, within one month of receiving the request.

Where permitted by the GDPR, this period may be extended if the request is particularly complex or numerous. We will inform you if an extension is necessary.
Exercising your data protection rights is generally free of charge unless applicable law permits us to charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive.

13. Right to Lodge a Complaint

If you believe that Beyond Arctic processes your personal data in violation of applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

In Finland, the supervisory authority is:
Office of the Data Protection Ombudsman
Tietosuojavaltuutetun toimisto
Finland
You may also contact Beyond Arctic first so that we have an opportunity to address your concerns.

14. Automated Decision-Making and Profiling

Beyond Arctic does not make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals.
We may use limited profiling, audience segmentation or similar technologies for marketing and advertising purposes, where permitted by applicable law and, where required, with your consent.

15. Personal Data of Children

Our services may be used by families and participants under the age of 18.
Where personal data concerning a child is provided to us, it should normally be provided by or with the involvement of the child’s parent or legal guardian where required by applicable law.
We do not knowingly collect personal data from children for purposes unrelated to providing our services.

16. Changes to This Privacy Policy

Beyond Arctic may update this Privacy Policy from time to time to reflect changes in our services, processing activities or applicable legislation.
The latest version will always be published on our website together with the date of the latest update.

Last updated: 26 August 2026