Nature and the sea are an essential part of Santalahti. We are committed to developing tourism responsibly, with respect for the environment, local community and sustainable business practices.
Santalahti Resort is a Finnish family-owned business that has operated in Kotka since 1991.
We want to make recycling as easy as possible for our guests. Recycling points around Santalahti Resort are available for mixed waste, biowaste, metal, glass, plastic, cardboard and paper. We encourage all our guests to sort the waste generated during their stay.
Waste and recycling instructions
Other recyclable waste:
Santalahti Resort has been awarded the Green Key certificate. Green Key is an international environmental certification programme for the tourism industry. Its criteria cover areas such as energy and water conservation, waste reduction and recycling, responsible purchasing and sustainable operating practices.
Santalahti Resort has been awarded the Sustainable Travel Finland label by Visit Finland. The label recognises our long-term commitment to developing sustainable tourism and integrating responsible practices into our operations.
Santalahti Resort is a Finnish family-owned business founded in 1991. Our location surrounded by the archipelago nature of the Gulf of Finland makes protecting and respecting the environment especially important to us.
We take the surrounding nature into consideration from the earliest stages of planning new buildings and services. Our aim is to preserve the natural environment and minimise unnecessary changes to the landscape.
Financially sustainable business enables the long-term development of Santalahti. Profitable operations allow us to employ people, make new investments and achieve our environmental and social responsibility goals.
Our aim is to develop Santalahti as a year-round travel destination while supporting local employment and the vitality of the region.
For us, responsibility also means taking care of our employees, guests, business partners and local community. We want Santalahti to be a safe and welcoming place for everyone.
This privacy policy explains how Santalahti Resort Oy collects, processes, stores and protects its customers’ personal data.
Personal data is processed in accordance with the European Union General Data Protection Regulation (EU 2016/679, GDPR), the Finnish Data Protection Act (1050/2018) and other applicable legislation.
Santalahti Resort Oy’s customer and booking register.
This policy covers the processing of customer data in connection with Santalahti Resort’s accommodation, restaurant, sauna, meeting, event and other services, as well as customer communications, invoicing and electronic marketing.
This policy also covers the statutory guest register.
Santalahti Resort Oy
Santalahdentie 150, 48310 Kotka, Finland
Telephone: +358 5 260 5055
Email: info@santalahti.fi
Website: https://santalahti.fi
Santalahti Resort Oy collects and processes personal data to manage customer relationships, handle bookings, provide services and comply with statutory obligations.
Personal data processed may include:
Personal data is primarily obtained directly from customers, for example when they make an online booking, contact us by email or telephone, interact with customer service or check in for their stay.
Data may also be obtained from booking channels and partners used by customers, such as Booking.com and other booking services, in order to fulfil the customer’s booking.
The statutory traveller notification includes information required under the Finnish Act on Accommodation and Food Service Activities (308/2006). This may include the traveller’s name, Finnish personal identity code or date of birth, nationality, address, travel document details and dates of stay.
Personal data is collected and processed only to the extent necessary for the specified purposes.
Personal data is processed for the following purposes:
Handling bookings and providing services
Personal data is used to receive, confirm, modify and fulfil accommodation and other service bookings, and to provide customer service.
The legal basis for processing is generally the performance of a contract with the customer or taking steps prior to entering into a contract (GDPR Article 6(1)(b)).
Compliance with legal obligations
Personal data is processed, among other things, to comply with obligations relating to traveller notifications, accounting and other statutory requirements.
The legal basis for processing is compliance with a legal obligation (GDPR Article 6(1)(c)).
Customer communications and customer relationship management
Personal data is used for communications relating to the customer’s booking, service, arrival, invoicing, feedback and customer relationship management.
Depending on the circumstances, processing is based on the performance of a contract or Santalahti Resort Oy’s legitimate interests (GDPR Article 6(1)(b) or 6(1)(f)).
AI-assisted customer service and communication
Santalahti Resort Oy uses Microsoft 365 Copilot as an AI assistant to support customer service, customer communication, quotation requests and customer relationship management.
AI may be used, for example, to summarise customer messages, prepare draft replies and quotations, translate texts and compile information needed for customer service.
The processing may involve customer contact details, email correspondence, booking information and previous customer communications to the extent necessary for carrying out the relevant tasks.
Depending on the circumstances, the legal basis for processing personal data is the performance of a contract, taking steps prior to entering into a contract, or the legitimate interests of the controller (Article 6(1)(b) or 6(1)(f) GDPR).
Staff review AI-generated customer replies and quotations before they are sent. AI is not used to independently make significant decisions concerning customers.
Service security and prevention of misuse
Personal data may be processed to ensure service security, prevent misuse, investigate data security incidents and establish, exercise or defend legal claims.
Depending on the circumstances, processing is based on a legal obligation or the data controller’s legitimate interests (GDPR Article 6(1)(c) or 6(1)(f)).
Electronic marketing and newsletters
Santalahti Resort Oy sends electronic newsletters and marketing messages to customers to whom electronic direct marketing may lawfully be sent.
Newsletters are sent no more than 10 times per year.
Where marketing is based on the customer’s consent, that consent may be withdrawn at any time using the unsubscribe link at the end of the newsletter or by contacting Santalahti Resort.
Electronic direct marketing also complies with the Finnish Act on Electronic Communications Services.
Santalahti Resort Oy uses external system and service providers to deliver and manage its services.
Personal data is processed in these systems only to the extent necessary to provide services, manage customer relationships or comply with statutory obligations.
Personal data is not sold to third parties.
Personal data may also be processed outside the European Union and the European Economic Area. Any international transfers of personal data are carried out in accordance with the GDPR using applicable transfer mechanisms, such as the European Commission’s Standard Contractual Clauses (SCCs), and any necessary supplementary safeguards.
Hotellinx Cloud – booking and property management system
Santalahti Resort Oy uses the cloud-based Hotellinx Cloud booking and property management system supplied and maintained by Vitec Hotellinx.
The system is used to manage accommodation bookings, customer data, booking payment information and accommodation services.
The service provider is responsible for the technical maintenance of Hotellinx Cloud, its system environment and software security measures in accordance with its contractual responsibilities.
As the data controller, Santalahti Resort Oy is responsible for ensuring that personal data processing has an appropriate legal basis and that personal data processing arrangements with the service provider comply with applicable legislation.
Booking information is generally retained for three years from the date of accommodation, unless another statutory or justified reason requires longer retention.
Payment card information is processed using technical security measures implemented by the service provider. The processing and retention of payment card information are limited to purposes necessary for payment processing.
Microsoft 365 and Microsoft Copilot – email, customer communication and AI-assisted processing
Santalahti Resort Oy uses Microsoft 365 cloud services for email communication, document processing, file storage and internal collaboration.
The Microsoft 365 environment is used to process information such as customer contact details, email correspondence, quotation requests, booking-related information and customer service documents.
Microsoft 365 Copilot is used as an AI assistant to support customer communication and other work-related tasks. Copilot may process information accessible to the user based on their access permissions, for example, to summarise emails, prepare draft replies and process documents.
Microsoft acts as a data processor in accordance with the applicable service agreements and data processing agreements.
In the business use of Microsoft 365 Copilot, user prompts, Copilot responses and organisational data accessed through Microsoft Graph are not used to train the underlying AI models.
Data is processed and stored within Microsoft’s services in accordance with the applicable contractual terms, security practices and data retention policies.
Personal data may also be processed outside the European Union and the European Economic Area. Any international transfers of personal data are carried out in accordance with the GDPR, using applicable transfer mechanisms and safeguards.
Fennoa – invoicing and accounting
Santalahti Resort Oy uses the Fennoa system for invoicing, financial administration and accounting.
The system may process customers’ names, contact details, invoicing information and information relating to payments and accounting.
Data is retained in accordance with the retention periods required by the Finnish Accounting Act and other applicable legislation.
Guest register
Santalahti Resort Oy maintains a guest register in accordance with the Finnish Act on Accommodation and Food Service Activities.
Traveller notifications are completed upon check-in. Traveller notifications and the resulting manual register are stored in secure, locked premises.
Traveller notifications and the related information are retained for one year in accordance with the law, after which they are securely destroyed.
Guest information is disclosed to the police and other competent authorities where required by law.
Mailchimp – email newsletter communications
Santalahti Resort Oy uses Mailchimp to send electronic newsletters and marketing messages.
The service processes newsletter subscribers’ names, email addresses, marketing consent information and communication data generated by the service.
Mailchimp is a US-based service provider, so personal data may be transferred to and processed outside the European Union and the European Economic Area.
Transfers of personal data to the United States are based on the EU–US Data Privacy Framework approved by the European Commission. Mailchimp is covered by the valid Data Privacy Framework certification of the Intuit group.
Mailchimp’s Data Processing Addendum also includes the European Commission’s Standard Contractual Clauses (SCCs), which apply where necessary if a personal data transfer is not covered by the Data Privacy Framework.
Further information about data transfer mechanisms and safeguards:
Mailchimp Data Processing Addendum: https://mailchimp.com/legal/data-processing-addendum/
EU–US Data Privacy Framework certification: https://www.dataprivacyframework.gov/participant/7693
Mailchimp Privacy Policy: https://mailchimp.com/legal/privacy/
Newsletter subscriptions may be cancelled at any time using the unsubscribe link at the end of the newsletter.
Other booking channels and service providers
When a customer books accommodation through an external booking channel, such as Booking.com or Expedia, personal data is also processed in that service provider’s systems.
Booking channels may act as independent data controllers in accordance with their own privacy policies.
Santalahti Resort Oy processes personal data received through booking channels to fulfil bookings and manage customer relationships.
Retention of personal data
Personal data is retained only for as long as its processing is necessary for the specified purposes, contractual obligations or statutory retention requirements.
The retention period depends on the category of data and the purpose of processing.
Data is deleted or anonymised when there is no longer a valid reason to retain it.
Santalahti Resort Oy protects personal data through appropriate organisational and technical measures.
Access to personal data is restricted to employees and service providers whose duties or provision of services require it.
Electronic systems use access controls and user authentication. Access rights are intended to be limited according to job responsibilities.
Santalahti Resort Oy’s personnel are bound by confidentiality obligations concerning the processing of personal data.
The service providers of cloud-based systems are also responsible for technical maintenance and security measures in accordance with their contractual obligations.
Manually maintained traveller notifications are stored in locked premises accessible only to persons authorised on the basis of their duties.
Any data security incidents are investigated and handled in cooperation with the relevant service providers. Necessary notifications are made to the competent authorities and data subjects in accordance with applicable data protection legislation.
Security of AI-assisted processing
The use of Microsoft 365 Copilot is based on employees’ individual user accounts and access permissions appropriate to their work responsibilities.
Copilot processes organisational information within the limits of the access permissions granted to each user. Staff are instructed to use AI securely and to avoid unnecessary processing of personal data and information requiring special protection.
The accuracy of AI-generated information is verified before it is used in customer communication or decision-making.
As the data controller, Santalahti Resort Oy is responsible for the lawfulness of personal data processing and for ensuring appropriate access permissions and staff procedures.
Customers have rights under the European Union General Data Protection Regulation concerning the processing of their personal data.
These include, where applicable:
Right to information about the processing of personal data
Customers have the right to be informed about how and for what purposes their personal data is processed.
Right of access
Customers have the right to obtain confirmation as to whether their personal data is being processed and to access personal data concerning them.
Right to rectification
Customers have the right to request the correction of inaccurate or incomplete personal data.
Right to erasure
In certain circumstances, customers have the right to request the erasure of their personal data.
However, data cannot be erased where there is a statutory obligation or another lawful basis under the GDPR for retaining it.
Right to restriction of processing
In certain circumstances, customers have the right to request restriction of the processing of their personal data.
Right to object to processing
Customers have the right to object to processing based on legitimate interests where applicable.
Customers always have the right to object to the processing of their personal data for direct marketing purposes.
Right to data portability
Customers may have the right to receive personal data they have provided in a structured, machine-readable format and to transfer it to another data controller where the requirements of the GDPR are met.
Right to withdraw consent
Where processing is based on consent, customers have the right to withdraw their consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint with a supervisory authority
Customers have the right to lodge a complaint with the Office of the Data Protection Ombudsman if they consider that their personal data has been processed in breach of data protection legislation.
Office of the Data Protection Ombudsman: https://tietosuoja.fi
Exercising your rights
Requests concerning the processing of personal data and the exercise of data subject rights may be sent to:
Santalahti Resort Oy handles requests without undue delay and, as a general rule, within one month of receipt.
Where necessary, the customer’s identity may be verified before personal data is disclosed or amended.
Making bookings and providing services require certain personal data, such as a name and contact details.
If a customer does not provide information necessary to deliver a service, it may not be possible to complete the booking or provide the service.
During check-in, customers are also required to provide the information necessary for the statutory traveller notification.
Subscribing to electronic marketing is voluntary, and giving marketing consent is not a condition for using accommodation or other services.
Santalahti Resort Oy does not use personal data in its customer register for solely automated decision-making that produces legal effects concerning customers or similarly significantly affects them within the meaning of Article 22 of the GDPR.
Santalahti Resort Oy may update this privacy policy if its personal data processing activities, systems, service providers or applicable legislation change.
