Privacy Notice

Updated 29 September 2026

This notice explains how Natura Viva Oy processes the personal data of its customers, website visitors and business partners, in line with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

1. Controller

Natura Viva Oy, Business ID 0649766-0
Postal address: Harbonkatu 13, 00980 Helsinki, Finland
Phone: +358 10 292 4030
Email: info@naturaviva.fi

2. Privacy contact

Send all privacy questions and requests to info@naturaviva.fi (subject "Privacy"). We reply within one month.

3. Purposes and legal bases

  • Handling bookings, orders, gift cards and season passes; delivering services; customer service – contract (Art. 6(1)(b))

  • Payments, including sport and culture benefits (Epassi, Edenred) – contract (Art. 6(1)(b))

  • Accounting and other statutory obligations – legal obligation (Art. 6(1)(c))

  • Managing the customer relationship, service development, statistics – legitimate interest (Art. 6(1)(f))

  • Email marketing of similar services to existing customers – legitimate interest; you can opt out at any time

  • Newsletter for non-customers – consent (Art. 6(1)(a))

  • Contact persons of corporate and group customers, quotes and sales – legitimate interest (Art. 6(1)(f))

  • Website analytics, marketing measurement and targeted advertising (cookies) – consent (Art. 6(1)(a))

  • Strictly necessary cookies, security and fraud prevention – legitimate interest (Art. 6(1)(f))

We do not use automated decision-making that has legal effects.

4. Data we process

Contact details (name, email, phone, and address for products that require it); order and booking details; payment details (method, amount, transaction ID; we never see or store card details); customer correspondence; marketing consents and opt-outs; corporate contact details; and technical data (IP address, browser and device details, cookie identifiers).

5. Sources

Mainly from you. Also from payment providers, Epassi and Edenred, a group organiser or gift card buyer who gives us others' details, public sources for business contacts, and website cookies.

6. Recipients and processors

We do not sell personal data. Processors acting on our behalf under data processing agreements: Aptual Commerce Oy (Johku, booking and web shop platform, Finland), Pipedrive OÜ (CRM), Brevo (newsletters), Google Ireland Ltd (Workspace/Drive, Analytics, Ads, Tag Manager), Meta Platforms Ireland Ltd (advertising), Anthropic Ireland, Limited (Claude Team, AI assistant for internal work such as drafting customer messages and handling booking, order and customer data; data is not used to train AI models), Vallonic B.V. (Consent Studio, cookie consent, the Netherlands), our marketing agency and our accounting firm Administer Oyj (Finland) and Visma Solutions Oy (Netvisor accounting software, Finland). Visma Payments Oy (Visma Pay), Vipps MobilePay AS, Epassi Finland Oy and Edenred Finland Oy are independent controllers for payments. We disclose data to authorities where the law requires it.

7. Transfers outside the EU/EEA

Google, Meta, Anthropic and some of Pipedrive's subprocessors may process data in the United States. These transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses, with supplementary safeguards where needed.

8. Retention

  • Customer, order and booking data: 5 years from last purchase, booking or contact

  • Gift cards and season passes: validity period + 5 years

  • Accounting records: 6 years (vouchers) and 10 years (financial statements) from the end of the financial year, per the Finnish Accounting Act

  • Corporate contacts (CRM): 5 years from last contact

  • Newsletter and marketing consents: until withdrawn; opt-outs are kept so we can respect them

  • Analytics data: up to 14 months

  • Cookies: as shown in cookie settings; analytics and marketing cookies up to 13 months

9. Cookies

We use strictly necessary cookies and, with your consent, analytics and marketing cookies (Google Analytics, Google Ads, Meta), managed with Consent Studio. You can change or withdraw consent at any time via "Cookie settings" at the bottom of the page.

10. Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing (including direct marketing at any time), to data portability, and to withdraw consent at any time. You can view, correct and download your data yourself in Oma Johku at johku.com/customer. Send other requests to info@naturaviva.fi. You may also lodge a complaint with the Office of the Data Protection Ombudsman, Lintulahdenkuja 4, 00530 Helsinki, Finland, tietosuoja@om.fi, tietosuoja.fi/en.

11. Security

Only people who need personal data for their work can access it, using personal accounts and two-factor authentication where available. Website traffic is encrypted (HTTPS). Processors are bound by data processing agreements and confidentiality. More on data protection in the Johku service: johku.fi/fi/tietosuoja.

12. Changes

We update this notice when our operations or the law change. The current version and its date are always on this page.