This is the register and privacy statement of Isabel Videla in accordance with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018). Prepared on 27.10.2026.

 

1. Data controller

Isabel Videla, Tanino Productions (toiminimi)

Business ID: 2901236-3

 

2. Contact person responsible for the register

Isabel Videla

 

3. Name of the register

Isabel Videla customer register.

 

4. Legal basis and purpose of processing personal data

Personal data is processed on the following legal bases under the GDPR:

– a contract to which the data subject is a party, or steps taken at their request before entering into one (enquiries, proposals, bookings of private experiences and Limited-Seat Editions, and gift cards);

– the person’s consent (documented, voluntary, specific, informed and unambiguous), for example for the newsletter and analytics cookies;

– explicit consent for information on special diets and allergies;

– the controller’s legitimate interest in maintaining customer relationships and communicating with business clients;

– legal obligations, such as bookkeeping under the Finnish Accounting Act.

 

The purpose of processing personal data is to contact customers, prepare proposals, manage bookings and gift cards, maintain customer relationships, and carry out marketing. The data is not used for automated decision-making or profiling.

 

5. Data content of the register

The data stored in the register are:

– person’s name

– email address and phone number

– company name and billing details

– website addresses

– IP address of the network connection

– usernames/profiles in social media services

– information about ordered services and their changes (experience, date, number of guests, payments)

– gift card details, including the recipient’s name and email address if provided

– special diets, allergies and other information related to the customer relationship and ordered services. Information about diets is used only for food preparation and serving.

 

Customer data is stored with the following service providers:

– Hostinger (website hosting, WordPress)

– WooCommerce (bookings and gift cards)

– Paytrail (payments; card and bank details are processed directly by Paytrail)

– Creamailer (newsletter service)

 

6. Regular data sources

The information stored in the register is obtained from the customer, for example through messages sent via web forms, by email, by telephone, through social media services, from contracts, customer meetings and other situations in which the customer provides their information, as well as from competitions and customer benefits in which the customer participates. Information may also be provided by the person or company organising a booking on behalf of a group.

 

7. Cookies on this site

A cookie is a small text file that is stored on a user’s computer when they visit a site. Cookies cannot be used to run programs or store viruses on a user’s computer. We use cookies on this site for purposes related to the functionality of the site, analysis and marketing.

 

Essential cookies keep the website, booking cart and checkout working. Analytics and marketing cookies are used only with the user’s consent, given through the cookie banner. You can change your choice at any time.

 

We use Google Analytics to track the website. The purpose of tracking is to collect statistical information, for example about the number of visitors and the most popular content. You can read more in the Google Cookie Policy. Cookie information helps us improve the functionality and usability of our website.

 

Blocking cookies in your browser

If you wish to block cookies, please change your browser’s cookie settings. Blocking cookies may prevent you from using some of the site’s features.

 

8. Regular disclosure of data and transfer of data outside the EU or EEA

Personal data may be disclosed within the limits permitted and required by applicable legislation. Data is shared only with service providers and partners involved in delivering the service, such as hosting, payment and newsletter providers, and the venues where experiences take place (for example, the number of guests and dietary requirements). Personal data is never sold.

 

The Paytrail and Creamailer servers are located in Finland. Some service providers, such as Google, may process data outside the EU or EEA. In these cases, the transfer is protected by the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

 

9. Retention of personal data

Personal data is kept only as long as necessary for the purposes described above:

– information on special diets and allergies is deleted within 30 days after the experience;

– enquiries that do not lead to a booking are kept for 12 months after the last contact;

– customer and booking data is kept for the duration of the customer relationship and 12 months after the last experience;

– accounting records are kept for 6 years from the end of the financial year, as required by the Finnish Accounting Act;

– newsletter data is kept until the person unsubscribes.

 

10. Principles of register protection

The register is handled with care, and the data processed by information systems is protected appropriately. The register data is stored on Internet servers, and the physical and digital security of their equipment is appropriately ensured. The website uses encrypted connections (HTTPS). The controller ensures that the stored data, as well as the access rights to the servers and other information critical to the security of personal data, are handled confidentially and only by persons whose work requires it.

 

11. Right of inspection and right to demand correction of information

Every person in the register has the right to check their information stored in the register and demand correction of any incorrect information or completion of incomplete information. If a person wishes to check the information stored about them or demand correction, the request must be sent in writing to the controller. The controller may, if necessary, ask the person to prove their identity. The controller will respond within one month, as specified in the EU General Data Protection Regulation.

 

12. Other rights related to the processing of personal data

A person in the register has the right to request that personal data concerning them be deleted from the register (“right to be forgotten”). Data subjects also have other rights under the GDPR, such as the right to restrict or object to processing, the right to data portability, and the right to withdraw consent at any time. Requests must be sent in writing to the controller. If necessary, the controller may ask the requester to prove their identity. The controller will respond within one month. Personal data will be deleted at the person’s request, unless legislation, outstanding invoices or debt collection measures prevent the deletion.

 

Every person also has the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).