Privacy Notice

Last updated: 16 September 2026

This Privacy Notice explains how Ruka Nordic Oy processes the personal data of website visitors, customers, partners, volunteers and other contacts.

1. Data Controller

Ruka Nordic Oy
Business ID: 3523300-7
Torangintaival 4
93600 Kuusamo
Finland

For enquiries concerning data protection:

Marko Hiltunen
marko.hiltunen@rukanordic.com
+358 50 431 0221

2. What Personal Data Do We Process?

We may process the following personal data:

• name and contact details, such as an email address, telephone number and postal address
• the name of a company, association or other organisation and the person’s position within that organisation
• the contents of enquiries, messages and other communications
• information related to VIP services, corporate partnerships and event arrangements
• information required for volunteer applications and event organisation, such as skills, preferred duties, availability and possible accommodation or special arrangements
• technical information concerning the use of the website, such as the IP address, device and browser information, time of visit, pages viewed and cookie preferences
• other information voluntarily provided to us by the individual.

We only request special categories of personal data, such as health information, when this is necessary for event arrangements or the individual’s safety.

3. For What Purposes Do We Use Personal Data?

We process personal data for the following purposes:

• responding to enquiries and other communications
• managing customer and partner relationships
• providing VIP services and other event-related services
• processing and selecting volunteer applicants and managing communications, orientation and event arrangements
• ensuring event safety and practical arrangements
• maintaining the operation, security and usability of the website
• analysing and improving the use of the website
• marketing and communications where an appropriate legal basis exists
• complying with statutory obligations and establishing, exercising or defending legal claims.

4. Legal Bases for Processing Personal Data

Depending on the circumstances, the processing of personal data is based on:

• the performance of a contract or measures taken before entering into a contract
• the legitimate interests of the data controller, such as responding to enquiries, organising the event, managing customer relationships and developing our services
• compliance with a legal obligation
• consent given by the individual, for example for optional marketing or the use of non-essential cookies.

Consent may be withdrawn at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Where Do We Obtain Personal Data?

Personal data is primarily obtained:

• directly from the individual through enquiries, emails, applications and other submissions
• from a company or organisation represented by the individual
• from services and systems used to organise the event
• through cookies and similar technologies when the website is used
• from publicly available sources when necessary for managing a customer or partner relationship.

6. Recipients and Service Providers

We may use external service providers when processing personal data, including:

• website maintenance, hosting and security service providers
• email and communications service providers
• event, registration and volunteer management systems
• analytics, cookie management and marketing services
• partners involved in organising the event, where disclosure is necessary for performing their duties
• public authorities where disclosure is required by law.

The GateHQ service is used for volunteer registration. Information entered into the service is processed for the purposes of volunteer management and organising the event.

Ticket sales are handled through the external Ticketmaster service. Ticketmaster processes personal data submitted through its service in accordance with its own privacy practices. Payment information for ticket purchases is not processed on the Ruka Nordic website.

We do not sell personal data to third parties.

7. Transfers of Personal Data Outside the EU or EEA

Some of our service providers may process personal data outside the European Union or the European Economic Area.

In such cases, we ensure an appropriate level of protection in accordance with applicable data protection legislation. A transfer may be based, for example, on an adequacy decision adopted by the European Commission or the European Commission’s Standard Contractual Clauses.

8. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Notice.

The applicable retention period is affected by factors including:

• the duration of an enquiry or customer or partner relationship
• the time required for organising the event and completing related follow-up activities
• statutory retention periods applying to contractual and accounting records
• limitation periods for possible legal claims
• the validity of the individual’s consent.

Personal data that is no longer necessary or is outdated will be appropriately deleted or anonymised.

9. Cookies and Website Use

The website uses cookies and similar technologies to ensure its proper operation, remember user preferences and, with the user’s consent, provide analytics and marketing functions.

Essential cookies may be used without separate consent. Other cookies are set according to the preferences selected by the user.

Further information about the purposes of cookies, the cookies in use and managing consent is available in our Cookie Policy.

10. External Services and Links

The website may contain content or links provided by external services, including Ticketmaster, GateHQ, Google Maps and social media platforms.

When a user accesses an external service or accepts the loading of content provided by such a service, the service provider may process personal data in accordance with its own privacy practices. We recommend reviewing the service provider’s privacy notice before using the service.

11. Protection of Personal Data

Personal data is protected using appropriate technical and organisational measures. Access to personal data is limited to individuals whose duties require them to process it.

Access rights are restricted, systems are appropriately protected and service providers processing personal data are required to protect the information in accordance with applicable legislation.

12. Rights of the Data Subject

In accordance with applicable data protection legislation, you have the right to:

• receive information about the processing of your personal data
• access the personal data concerning you
• request the correction of inaccurate or incomplete information
• request the deletion of your personal data
• request the restriction of processing
• object to processing based on legitimate interests
• receive data based on consent or a contract in a portable format where applicable
• withdraw your consent at any time
• object to the use of your personal data for direct marketing.

These rights are not absolute in every situation. The legal basis for processing and applicable statutory retention obligations may affect whether a request can be fulfilled.

Requests concerning these rights should be sent to the email address specified in Section 1. We may request additional information to verify the identity of the person making the request.

13. Right to Lodge a Complaint

If you believe that your personal data has been processed in violation of data protection legislation, you may contact Ruka Nordic Oy.

You also have the right to lodge a complaint with the supervisory authority:

Office of the Data Protection Ombudsman
https://tietosuoja.fi/en/home

14. Automated Decision-Making

Ruka Nordic Oy does not make decisions based solely on automated processing that produce legal effects concerning an individual or otherwise significantly affect them.

15. Changes to This Privacy Notice

We may update this Privacy Notice if our operations, services or applicable legislation change. The current version will be published on this page, and the date of the latest update will be shown at the beginning of the notice.