CAR RENTAL ROVANIEMI AURORA & BEYOND
Legal · Rovaniemi · 66°N

Privacy & cookies

This notice explains which personal data Car Rental Rovaniemi processes when you use this website or rent a vehicle from us, why we process it, who receives it and what rights you have. It covers www.carrentalrovaniemi.fi and bookings made through it.

01

Data controller

The controller of your personal data is Car Rental Rovaniemi (Business ID 0186307-8), Rekkatie 1, 96300 Rovaniemi, Finland. We have not appointed a data protection officer. Questions about this notice and requests concerning your data go to the contact details below and are answered by the owner personally.

02

What data we process

We process only the data needed to run a car rental. Depending on how you deal with us, this covers the following.

Booking data
Name, email address, phone number, country, pick-up and return dates and places, chosen vehicle and extras, price and booking reference. Collected through the VikRentCar booking system on this site when you make a reservation.
Driver details at pick-up
Driving-licence number, issue and expiry dates, date of birth and the ID document presented, for every driver named on the rental agreement. Recorded on the agreement at pick-up, not through the website.
Driving licence and handover record
Photos of the front and back of the main driver’s driving licence, and the electronic handover acknowledgement with the customer’s signature. Collected through our own check-in tool before pick-up, so that the vehicle can be handed over without meeting in person.
Contact details in the handover tool
Name, email address and phone number, transferred from the booking system to our own handover tool so that the check-in link, the deposit request and the rental documents reach the right person.
Return inspection photos
Photos of the vehicle and its instrument cluster taken when the vehicle is returned, documenting the fuel level, the mileage and the condition of the vehicle.
Payment data
Payments are processed by Stripe on its hosted checkout page. Your card number never reaches our website or servers. We receive the payment status, the amount, the card type and the last four digits. The security deposit is handled the same way or on our card terminal.
Correspondence
Emails, phone calls and messages you send us before, during or after a rental, including damage reports and photos.
Technical data
Our hosting provider keeps standard server logs (IP address, browser type, requested pages and time) for security and troubleshooting. The web fonts used on the site are loaded from Google Fonts, so your browser also sends its IP address to Google when it fetches them; this sets no cookies. Analytics and marketing data are collected only with your consent, as described in the cookies section.
03

Purposes and legal bases

Each purpose rests on one of the legal bases in Article 6 of the GDPR. You are not obliged to provide your data, but without the booking data we cannot rent you a vehicle.

PurposeLegal basis
Handling your booking, the rental agreement, the security deposit and customer servicePerformance of a contract
Preparing the handover record (driving licence photos and electronic acknowledgement) and pre-authorising and releasing the security depositPerformance of a contract
Resolving disputes about the condition of the vehicle, using the handover record and the return inspection photosLegitimate interest
Bookkeeping, invoicing and tax recordsLegal obligation (Finnish Accounting Act)
Verifying drivers, preventing fraud, handling damage, traffic fines and disputes, and keeping the website secureLegitimate interest
Displaying the website, including web fonts loaded from Google FontsLegitimate interest
Analytics and marketing cookiesConsent, withdrawable at any time
Newsletters and marketing emailsConsent, with an unsubscribe link in every message
04

Recipients and processors

We do not sell personal data. It is shared only with the service providers below, who process it on our behalf under data processing agreements, and with authorities and insurers where the law or a claim requires it.

ProviderRole
Stripe Payments Europe Ltd (Ireland)Online payments and security deposits
Zoner Oy (Finland)Web hosting, server logs and backups
Hostinger (Lithuania)Hosting of our own handover tool (check-in, deposit requests and return inspection) on a server in the EU
Google Ireland LtdGoogle Analytics 4, Google Ads, Google Maps, Business Profile reviews and Google Fonts
Meta Platforms Ireland LtdMeta Pixel for advertising measurement, only with marketing consent
Google Workspace (Google Ireland Ltd)Email and calendar
Authorities and insurersPolice, insurance companies and parking or toll operators in the event of an accident, damage, fine or legal claim
05

Transfers outside the EU

Google, Meta and Stripe may transfer data to the United States. Such transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses. Booking and accounting data are stored in Finland and the EU.

06

Retention

We keep personal data only as long as its purpose requires, then delete or anonymise it.

DataRetention period
Booking records and rental agreements6 years from the end of the financial year, as required by the Finnish Accounting Act
Driver details recorded at pick-upWith the rental agreement, 6 years
Driving licence photos and electronic signatureDeleted 30 days after the vehicle is returned
Contact details in the handover toolDeleted 30 days after the vehicle is returned
Return inspection photos180 days after the vehicle is returned, for possible disputes
Payment records6 years, as required by the Finnish Accounting Act
CorrespondenceUntil the matter is closed, and as long as needed for possible claims
Consent log12 months
Analytics data (Google Analytics 4)14 months
Server logsAs set by the hosting provider, typically a few weeks
07

Cookies and consent

When you first visit the site, a banner lets you accept all cookies, allow only the necessary ones, or choose by category. Analytics and marketing cookies are not set until you accept them, and Google tags run in consent mode without setting cookies or storing identifiers until then. Your choice is stored in the crr_consent cookie for 180 days and can be changed at any time under Cookie settings, also found in the footer of every page. We keep a record of each consent choice (time, choice, an anonymised browser and IP fingerprint) for 12 months to demonstrate compliance.

Necessary cookies keep the site and the booking process working and need no consent. Analytics cookies (Google Analytics 4) tell us which pages are visited and how bookings progress; no advertising profiles are built from them. Marketing cookies (Google Ads, Meta Pixel) measure whether an advertisement led to a booking and may be used to show you relevant ads on those platforms.

If you have accepted marketing cookies and complete a booking, a SHA-256 hash of the email address used for the booking is passed to Google Ads so that the booking can be matched to an advertisement click (Enhanced Conversions). Google cannot recover the address from the hash; it can only compare it with addresses it already holds in the same hashed form. Without marketing consent nothing is sent.

CookiePurposeDurationCategory
crr_consentStores your cookie choices so the banner is not shown again180 daysNecessary
crr_bc_*Set on the order page while a booking is awaiting payment; stops the checkout-start event from being counted twice if the page is reloaded. Contains no identifier.1 dayNecessary
WordPress and VikRentCar session cookiesKeep the booking form, cart and login session workingSessionNecessary
_ga, _ga_*Google Analytics 4: distinguishes visitors and sessions to measure how the site is used2 years (browsers may shorten this to 400 days)Analytics
_gcl_auGoogle Ads: attributes bookings to advertisement clicks90 daysMarketing
_gcl_aw, _gcl_gb, _gcl_gsGoogle Ads: stores the click identifier from a Google advertisement (gclid, gbraid or wbraid) so that a later booking can be attributed to it. Set only when you arrive from such an advertisement.90 daysMarketing
_fbpMeta Pixel: distinguishes browsers for advertising measurement90 daysMarketing
_fbcMeta Pixel: stores the click identifier from a Meta advertisement (fbclid) so that a later booking can be attributed to it. Set only when you arrive from such an advertisement.90 daysMarketing
08

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you and receive a copy
  • have inaccurate data corrected
  • have your data erased, where we are not obliged to keep it
  • restrict processing while a request is being handled
  • object to processing based on legitimate interest
  • receive the data you gave us in a machine-readable format
  • withdraw consent to cookies at any time under Cookie settings, without affecting the lawfulness of processing before withdrawal

To exercise these rights, email us from the address used for your booking, or write to the postal address below. We answer within one month. If you believe we process your data unlawfully, you can lodge a complaint with the Finnish Data Protection Ombudsman at tietosuoja.fi.

09

Changes to this notice

We update this notice when our tools or practices change. The date of the latest version is shown at the bottom of this page. Material changes to how we use your data are announced here before they take effect.

10

Contact

Requests concerning your personal data are handled by the owner of Car Rental Rovaniemi. Please write from the email address used for your booking so we can verify your identity.

Company
Car Rental Rovaniemi
Business ID 0186307-8
Rekkatie 1
96300 Rovaniemi, Finland

Last updated · 19 September 2026