1. Scope and responsible contact
This Privacy Policy applies to information processed through hokankokan.com and to guest enquiries submitted to Hokankokan in connection with its planned Turku opening. It describes our approach to personal data when you browse this website, contact us, request information about future accommodation or events, or communicate with our guest care team. For privacy matters, write to concierge@hokankokan.com or use the postal address Satamakatu 19, 20100 Turku, Finland.
2. Personal data we may collect
Depending on your interactions, we may process your name, email address, telephone number, preferred language, dates of interest, group size, accessibility or service requests that you voluntarily share, correspondence history, and other content contained in an enquiry. Basic technical information may include IP address, browser type, device characteristics, referral page, visit time and security-related diagnostics when these are collected by a hosting provider. We ask that you do not send identification documents, financial account credentials, card numbers or health details through the general contact form.
3. Sources and purposes
Information is usually obtained directly from you. It may also be provided by a person making an enquiry on your behalf or through technical logs generated when this site is delivered to your browser. We use appropriate data to reply to enquiries, assess requested services, plan guest experiences, maintain correspondence, protect systems, prevent misuse, comply with legal duties, and respond to legal or privacy requests. We do not use contact-form details to enroll you in marketing messages without a separate lawful basis.
4. Lawful grounds under the GDPR
Where the EU or UK GDPR applies, our potential lawful grounds include taking steps at your request before entering a contract, performing a contract if one exists, complying with legal obligations, and legitimate interests in responding to correspondence, securing the website and administering operations. Where the law requires consent, including for non-essential tracking or optional electronic marketing, we seek it separately and allow withdrawal. Any legitimate-interest assessment must consider your rights and reasonable expectations.
5. Recipients and processors
Authorised guest care personnel may access only information needed for their work. Service providers such as email, hosting, cybersecurity and IT-support partners may process information under contractual controls and confidentiality obligations. We may disclose data to competent public authorities where lawfully required, or to professional advisers where necessary to establish, exercise or defend legal claims. We do not sell personal information as a data brokerage activity.
6. International transfers
If personal data is transferred outside the European Economic Area or another protected jurisdiction, we will assess the destination and rely on an applicable legal mechanism such as an adequacy decision, approved standard contractual clauses, or another authorised safeguard, together with supplementary measures where appropriate. Details of relevant transfers and safeguards may be requested using the privacy contact above.
7. Retention and deletion
We seek to retain personal information only for a period justified by its purpose. General pre-opening enquiries are normally reviewed for deletion or anonymisation within 24 months after the last substantive interaction, unless a booking, dispute, legal duty or ongoing request requires longer retention. Routine security and technical logs, where generated, are generally retained for shorter operational periods, often up to 90 days unless investigation or law requires otherwise. Contractual, accounting and tax records may be kept for applicable statutory periods, which may extend to seven years or longer where required. We periodically review these timeframes and securely delete or de-identify data when no longer necessary.
8. Security practices
We use reasonable organisational and technical measures proportionate to risk, including access restrictions, appropriate supplier review, data minimisation, protected communications, employee confidentiality and incident response processes. No online transmission or storage system is entirely risk-free. If a personal data breach requires notification under applicable law, affected individuals and relevant authorities will be informed within legally required timeframes.
9. Your rights
Subject to law and applicable exceptions, you may request access, correction, deletion, restriction, portability, or an objection to certain processing. You may withdraw consent at any time without affecting the lawfulness of earlier processing. We may need to verify identity before fulfilling a request and may ask for information necessary to locate the relevant records. We aim to answer valid GDPR requests within one month, subject to permitted extensions. You may complain to the Office of the Data Protection Ombudsman in Finland or another competent supervisory authority.
10. Children and sensitive information
This website is not intended to solicit data from children and any age-restricted on-property facilities are for eligible adults only. We do not intentionally seek sensitive personal data through ordinary forms. If special assistance is needed, please initially describe practical requirements without supplying medical records or diagnoses. We will discuss an appropriate and more private method of communication where required.
11. Cookies, external links and communications
Information about browser storage and consent options is provided in the GDPR, CCPA & Cookies Policy. External links take you to third-party websites that operate under their own terms and privacy notices. If you email us, your email provider will process the message in accordance with its practices. Service correspondence is separate from optional marketing communications.
12. Updates and contact
We may update this policy to reflect service, technological or legal changes. Material changes will be indicated by revising the date at the top and, where required, by additional notice. For requests or questions, email concierge@hokankokan.com or write to Hokankokan, Satamakatu 19, 20100 Turku, Finland.