Privacy Policy

1. Data Controller

WildAccess, Hiukkamäentie 10, 32700 Huittinen, Finland
Email: info@wildaccess.fi

2. Data We Collect

We collect the following personal data:

• Account data: Full name, email address, phone number, postal address
• Transaction data: Purchases, bookings, permit codes, payment confirmations (payment card data is processed by Stripe and not stored by us)
• Usage data: Pages visited, search queries, geolocation data (only when you explicitly share it via the location search feature), and a randomly generated session identifier recorded server-side for visit counting (stored in browser session storage, not as a cookie, and cleared when you close the tab)
• Communication data: Emails sent to or from us, review content

3. How We Use Your Data

We use your personal data to:

• Provide and manage your account and purchases
• Deliver permit codes and booking confirmations by email
• Process membership applications and notify you of decisions
• Show area recommendations based on your location (only when requested)
• Send service-related communications (transactional emails only)
• Comply with legal obligations under Finnish and EU law

We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects.

4. Legal Basis (GDPR)

• Contract performance (Art. 6(1)(b)): processing needed to fulfil purchases and memberships
• Legitimate interests (Art. 6(1)(f)): platform security, fraud prevention, service improvement
• Legal obligation (Art. 6(1)(c)): financial record-keeping, tax compliance
• Consent (Art. 6(1)(a)): geolocation data and optional marketing emails

5. Data Sharing

We share data only with trusted processors necessary to run the platform:

• Supabase – database and authentication (production hosted in Frankfurt, development in Ireland — both within the EU)
• Stripe – payment processing (data processed under Stripe's privacy policy)
• Resend – transactional email delivery
• Vercel – web hosting and infrastructure
• Vercel Analytics – aggregated, privacy-friendly page analytics. Collects anonymised pageview events (URL path, referrer, device type and approximate country) without cookies, fingerprinting, or any personally identifying information
• Sentry – error monitoring and performance diagnostics (may capture request URLs, IP addresses, and stack traces when an error occurs)

We share booking-related personal data with the service provider you have booked, to the extent necessary for the provider to deliver the service. The provider receives your name, email address, phone number (if you provided one), participant count, and any free-form message you sent with the booking. The provider acts as an independent controller of this data for the purpose of delivering the service and for their own legal obligations (e.g. accounting). Providers are not granted the right to use your contact details for direct marketing without your separate consent.

6. Data Retention

Account data is retained for as long as your account is active. Transaction records are kept for 7 years to comply with Finnish accounting law. You may request deletion of your account at any time — we will delete personal data that is not required for legal compliance.

7. Your Rights

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (right to be forgotten)
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact info@wildaccess.fi. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

8. Cookies

We use only essential cookies required for authentication (session cookies managed by Supabase). We do not use tracking or advertising cookies.

9. Changes to This Policy

We may update this policy periodically. Material changes will be communicated by email. The current version is always available at /privacy.