Skip to content
[email protected]
Flowpark logo
Benji

Privacy Notice

FLOWPARK OY PRIVACY NOTICE

Last updated 24 September 2026

This privacy notice explains how Flowpark Oy processes personal data in connection with its services, website, customer relationships, marketing and the other activities described in this notice.

1. DATA CONTROLLER

Flowpark Oy
Business ID 2292908-0
Skanssinkatu 10
20730 Turku
Finland
+358 400 315 181

2. CONTACT FOR DATA PROTECTION MATTERS

c/o Janne Kalhama
Email: [email protected]
Tel. +358 400 427 828

3. PURPOSES AND LEGAL BASES FOR PROCESSING

Flowpark Oy processes personal data to manage relationships with customers and other users of its services and to provide, develop and market its services.

  • processing reservations, purchases and other agreements and managing customer relationships
  • customer service and customer communications
  • billing, payment processing and compliance with legal obligations
  • developing, planning and monitoring Flowpark’s services, online services and business
  • sending newsletters and other electronic direct marketing where there is an appropriate legal basis
  • organising campaigns, competitions and events
  • maintaining the security and information security of Flowpark’s services

Depending on the circumstances, the legal basis for processing may be the performance of a contract or steps taken before entering into a contract, the data subject’s consent, compliance with a legal obligation, or Flowpark Oy’s legitimate interests, for example in appropriately managing and developing customer relationships, services and information security.

4. PERSONAL DATA PROCESSED

Customers making a reservation or reservation request:

  • name, address, telephone number, email address and information relating to the reservation and billing
  • for business and organisational customers, relevant company or organisation contact and billing information

Customers purchasing tickets from the online shop:

  • contact, order and payment-related information required to complete the purchase, such as name, address, telephone number and email address

Newsletter subscribers:

  • email address
  • the park or parks the subscriber is interested in, and the language of the form
  • consent information: time of consent, consent text and source of the subscription, as well as any withdrawal of consent
  • information relating to newsletter delivery, such as whether a message was delivered or opened and whether links were clicked, to the extent processed by the newsletter service

Group offer subscribers:

  • email address
  • type of group, if the subscription is made with a reservation request
  • consent information: time of consent, consent text and source of the subscription, as well as any withdrawal of consent
  • information relating to message delivery, such as whether a message was delivered or opened and whether links were clicked, to the extent processed by the newsletter service

Customers participating in Flowpark activities:

  • information required for safety and provision of the service, such as name, telephone number, email address, date of birth, nationality and any direct marketing consent
  • where necessary, the name and contact details of a parent or guardian of a minor

Technical information generated through use of the website:

  • for example IP address, browser and browser version, referring page, cookies and information relating to similar technologies where such information constitutes personal data

Marketing, campaign and event information:

  • information concerning participation in campaigns, competitions, events or other marketing activities and related contact details and consents

5. NEWSLETTER, GROUP OFFERS AND SENDER

Flowpark Oy sends newsletters and other electronic marketing communications to persons who have subscribed to the newsletter. The newsletter can be subscribed to with a separate, voluntary option on the safety form or with the newsletter form on the front page of the website.

When the newsletter is subscribed to on the safety form, only the email address, park, language of the form and the time, text and source of the consent are transferred to the newsletter service. Other information on the safety form, such as names, dates of birth, telephone numbers or information about minors, is not transferred to the newsletter service. When the newsletter is subscribed to on the front page form, the email address, the parks selected by the subscriber, the language of the website and the time, text and source of the consent are stored in the newsletter service.

Group offers. Flowpark Oy sends separate email communications about group offers and events to persons who have subscribed to them. The subscription can be made with a separate, voluntary option in a park’s reservation request form or on the front page newsletter form. The email address, the type of group when subscribing through a reservation request (for example a school group or a team day) and the time, text and source of the consent are stored in the newsletter service. Other information in the reservation request, such as name, telephone number, number of participants or additional details, is not transferred to the newsletter service. A subscription made through a reservation request covers group offers only, and the subscriber is not added to the general newsletter list.

The legal basis for processing related to the newsletter and group offer messages is the data subject’s consent under Article 6(1)(a) of the EU General Data Protection Regulation.

Flowpark uses the Sender service, provided by UAB Sender.lt (Vilnius, Lithuania), to manage and send newsletters and group offer messages. Sender acts as a data processor and processes personal data related to these communications on behalf of and according to the instructions of Flowpark Oy. Where the service provider or its subcontractors process data outside the European Economic Area, safeguards required by applicable data protection legislation are used.

Subscriptions are voluntary. Subscribers may withdraw their consent at any time by using the unsubscribe link included in a message or by contacting Flowpark Oy. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Subscriber data is retained while the subscription remains active. After unsubscribing, Flowpark Oy or its service provider may retain information necessary to record the unsubscribe request or marketing objection in order to ensure that electronic direct marketing is not sent contrary to the subscriber’s wishes.

An email address provided in connection with another Flowpark service will not be added to the newsletter or group offer mailing lists without a subscription or another legal basis applicable to electronic direct marketing.

6. SOURCES OF PERSONAL DATA

Personal data is primarily obtained directly from the data subject, for example when visiting a Flowpark park, purchasing from the online shop, making a reservation or reservation request, completing a safety form, subscribing to a newsletter or group offers, using an online service or participating in a campaign, competition or event.

Where permitted by law, information may also be obtained or updated from Flowpark Oy’s service providers and partners, public authorities and publicly available sources. For business customers, information may also be obtained from company registers and publicly available company websites.

7. RECIPIENTS AND INTERNATIONAL TRANSFERS

Flowpark Oy uses external service providers in providing its services. These providers may process personal data on Flowpark Oy’s behalf. They may include providers of website, online shop, reservation, payment, email, newsletter, analytics, database and other information technology services.

Service providers may process personal data only to the extent necessary to provide their services and in accordance with applicable contractual and data protection requirements.

Personal data may also be disclosed to competent authorities where required by law and, where necessary, in connection with a corporate transaction or reorganisation.

Where personal data is transferred outside the European Economic Area, Flowpark Oy ensures that there is a lawful basis for the transfer and that appropriate safeguards required by applicable data protection legislation are used.

8. RETENTION OF PERSONAL DATA

Flowpark Oy retains personal data only for as long as necessary for the purposes described in this notice or to comply with legal obligations.

  • customer, reservation and purchase information is retained for as long as necessary for the customer relationship and provision of the service and thereafter for any period required by applicable legislation
  • accounting and billing information is retained for the applicable statutory retention periods
  • newsletter and group offer subscriber information is generally retained while the subscription remains active; information concerning an unsubscribe request or marketing objection may be retained to the extent necessary to respect the request
  • campaign and competition information is retained for as long as necessary to conduct the activity and meet related obligations
  • safety form information is retained for 12 months from submission and then deleted automatically. The same retention period applies to copies of the forms delivered to the parks by email. If an accident occurs or the information is needed for the establishment, exercise or defence of legal claims, the relevant information may be retained for longer until the matter has been resolved. Other safety-related information is retained only for as long as required for its purpose and any applicable legal obligations

9. DATA SECURITY

Flowpark Oy protects personal data using appropriate technical and organisational measures. These may include access restrictions, user accounts and passwords, firewalls, system security and other appropriate information security measures.

Access to personal data is limited to Flowpark Oy employees and authorised service providers who require the information to perform their duties. Any personal data kept in paper form is stored in premises protected against unauthorised access.

10. RIGHTS OF THE DATA SUBJECT

Subject to the conditions of applicable data protection legislation, the data subject has the right to:

  • obtain access to personal data concerning them
  • request rectification of inaccurate or incomplete personal data
  • request erasure of personal data
  • request restriction of processing
  • object to processing where processing is based on legitimate interests
  • in certain circumstances, receive personal data they have provided in a structured, commonly used and machine-readable format and transmit that data to another controller
  • withdraw consent at any time where processing is based on consent

These rights may be restricted where applicable legislation permits or requires the continued retention or processing of personal data.

Requests concerning personal data may be sent to [email protected] or by post to:

Flowpark Oy
Skanssinkatu 10
20730 Turku
Finland

Flowpark Oy may request additional information where necessary to verify the identity of the person making a request.

If a data subject considers that their personal data has been processed in breach of applicable data protection legislation, they have the right to lodge a complaint with the competent data protection supervisory authority.

11. FLOWPARK NIGHT COURSES GAME AND LEADERBOARD

Flowpark Oy processes personal data in connection with the Flowpark Night Courses game available on its website and the game’s public leaderboard.

Data processed

A submitted game result may include the nickname selected by the player, the course played, score, number of carabiners collected, finishing time shown by the game clock, remaining lives and the duration of the game performance. The game does not collect email addresses or other contact details.

The game does not require the player to provide their real name, age or location. Players are advised not to use their full real name as their nickname. Normal technical server information, such as an IP address, may also be generated when the online service is used.

Purpose and legal basis

The nickname and game result information are processed to operate the game and its leaderboard and to develop the service. The legal basis is Flowpark Oy’s legitimate interest in providing and developing its online service and leaderboard under Article 6(1)(f) of the GDPR.

Retention period

Nicknames and game results are retained for as long as the game and leaderboard are available on the website. They will be deleted when the game is discontinued. Email addresses and prize park selections provided during the game’s earlier prize competition have been deleted after the prizes were delivered.

Service providers and recipients

The game leaderboard uses database and online services provided by Supabase Inc. Supabase processes information on behalf of Flowpark Oy. The project’s primary data is stored in the server region selected for the Supabase project. Supabase may use subprocessors in providing its services.

Where personal data is transferred outside the European Economic Area, safeguards required by applicable data protection legislation are used.

Public leaderboard

The nickname and game result are shown on the public leaderboard to all users of the website. Flowpark Oy may prevent or remove a nickname from the public leaderboard if it is offensive, impersonates another person or is otherwise inappropriate.

Information stored on the player’s device

The game stores the most recently used nickname, unlocked courses and best scores in the browser’s local storage so that the player can continue later. This local storage does not by itself transmit the information to Flowpark Oy. Local information can be removed by clearing the browser’s stored website data.

Player’s rights

A player may request deletion of personal data connected with a game result by contacting [email protected]. Because a result is stored under a nickname rather than the player’s real name, the request should include the nickname used and, where necessary, other information required to identify the result.

12. CHANGES TO THIS PRIVACY NOTICE

Flowpark Oy may update this privacy notice as its services, processing practices or applicable legislation change. The current version is available on the Flowpark website.