Skip to content

Privacy policy

Élvania Oy is a Finnish limited company registered in Helsinki. This policy explains what we collect when you enquire about a journey, why we hold it, and how to have it removed.

Last updated 11 August 2026

1. Who is responsible

Élvania Oy, Helsinki, Finland, is the data controller. For anything in this policy, write to info@elvania.travel.

2. What we collect

When you send an enquiry we store your name, email address, and — if you provide them — your phone number, the country you are travelling from, the number of travellers, your intended travel month, and whatever you write in the message field.

We also record the browser user-agent string with the enquiry. That is used to diagnose submission problems and to identify automated abuse, nothing else.

We do not collect payment details on this site. There is no checkout.

3. Why we hold it

To reply to your enquiry and to prepare an itinerary and quote. That is the sole purpose. The legal basis is your consent, which you give with the checkbox on the enquiry form, and our legitimate interest in responding to a direct commercial approach.

We do not sell your details, and we do not pass them to advertisers.

4. How long we keep it

Enquiries that do not become bookings are deleted after 24 months. Enquiries that become bookings are retained for the period Finnish accounting law requires.

5. Who else sees it

Our database and file storage are operated by Supabase on infrastructure inside the EU. The site is hosted by Vercel. Where a journey is delivered by a partner operator, we pass on only what that operator needs in order to deliver it.

6. Your rights

You may ask for a copy of what we hold, ask us to correct it, or ask us to delete it. Write to info@elvania.travel and we will act within 30 days.

If you are not satisfied with how we have handled a request, you may complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).

7. Cookies

This site sets no advertising or tracking cookies, and there is no consent banner because there is nothing to consent to. A session cookie is set only inside the private admin area, for staff who sign in.