Privacy Policy

Last updated: January 2026

1. Introduction

Nexoraecho ("we", "our", or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your personal information when you interact with our website, submit inquiries, or engage with our concierge services. We comply with the European Union's General Data Protection Regulation (GDPR), the Finnish Data Protection Act, and other applicable privacy laws.

2. Information We Collect

We may collect the following categories of personal data:

• Identification details: Full name, date of birth, nationality, passport or ID details (when required for reservations).
• Contact information: Email address, phone number, postal address.
• Travel preferences: Resort selection, room preferences, dietary requirements, accessibility needs, wellness interests.
• Payment information: Processed securely through partner properties — Nexoraecho does not retain raw card data.
• Technical data: IP address, browser type, device information, pages visited, and referral source.
• Communications: Records of correspondence with our concierge team.

3. How We Use Your Information

Your personal data is processed for the following purposes:

• To respond to inquiries and provide tailored concierge recommendations.
• To coordinate reservations and communications with partner resorts.
• To enhance your travel experience through personalization.
• To send service updates, booking confirmations, and (with consent) promotional materials.
• To comply with legal, tax, and regulatory obligations.
• To improve our website performance, security, and user experience.

4. Legal Basis for Processing (GDPR)

We process your personal data on the following lawful bases:

• Contract: Processing necessary to fulfill your booking inquiry.
• Consent: Where you have explicitly opted in (e.g., marketing).
• Legitimate interests: To operate, improve, and secure our services.
• Legal obligation: Compliance with Finnish and EU regulations.

5. Data Sharing & Disclosure

We share necessary booking and preference details only with the relevant partner resort or service provider associated with your inquiry. We may also share data with:

• Trusted service providers (e.g., secure hosting, email infrastructure).
• Legal or regulatory authorities when required by law.
• Professional advisors (legal, accounting) under confidentiality obligations.

We do not sell, rent, or trade personal information to third parties for marketing purposes.

6. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure adequate safeguards are in place through Standard Contractual Clauses or equivalent legal mechanisms.

7. Data Retention

We retain personal information only as long as necessary for the purposes outlined in this policy, or as required by applicable law. Inquiry records are typically retained for up to 24 months unless an active booking relationship exists. Financial records are retained as required by tax law (typically 6 years in Finland).

8. Data Security

We implement industry-standard technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include encrypted data transmission (TLS), restricted internal access, regular security reviews, and secure data storage practices.

9. Cookies & Tracking

Our website uses cookies and similar technologies to enhance functionality and analyze traffic. For full details, please refer to our Cookies Policy.

10. Your Rights

Under GDPR and Finnish law, you have the following rights regarding your personal data:

• Right of access — to obtain a copy of your personal data.
• Right to rectification — to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — to request deletion.
• Right to restrict processing in certain circumstances.
• Right to data portability — to receive your data in a portable format.
• Right to object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent at any time where processing is based on consent.
• Right to lodge a complaint with the Finnish Data Protection Ombudsman.

11. Children's Privacy

Our services are not intended for individuals under 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal information, please contact us so we can promptly remove it.

12. Marketing Communications

Where you have provided consent, we may send curated updates about new resort offerings, seasonal experiences, and concierge services. You may opt out at any time via the unsubscribe link in any email or by contacting us directly.

13. Updates to This Policy

This Privacy Policy may be updated periodically to reflect changes in legal requirements or our business practices. The effective date will be revised accordingly. We encourage you to review this page regularly.

14. Contact & Data Protection Inquiries

For privacy-related questions or to exercise any of your rights, please reach out through our contact page. We respond to all legitimate requests within 30 days.