Privacy Policy

Last updated: October 2026

1. Website administrator

This website, finnlinec.world, is operated by the Finnlinec Baltic Maritime Heritage administrator, 10 Long Barn Lane, Reading, RG2 7SZ, United Kingdom. Email: [email protected]. Telephone: 0118 910 1010. Finnlinec is independent and is not connected with Finnlines or any ferry operator.

2. Personal information we collect

We collect only what is needed to run the site and answer messages:

• Contact form: your name, email address, subject and message, and the date and time of submission.
• Technical data: our web server records standard log data (IP address, browser type, requested page, time). Your IP address is also used in hashed form for short-term rate limiting of the contact form.
• Consent record: your cookie choice is stored in your own browser (local storage), not on our server.

We do not collect payment details, passport information or booking data, and we do not sell tickets.

3. Contact form processing

When you submit the form, your message is transmitted securely to our server and forwarded by email to [email protected] through a transactional email provider. We use it only to read and reply to your enquiry.

4. Purposes and legal bases

• Responding to your enquiry — your consent (UK GDPR / EU GDPR Art. 6(1)(a)) and our legitimate interest in replying to correspondence (Art. 6(1)(f)).
• Security, abuse prevention and server operation — legitimate interests (Art. 6(1)(f)).
• Storing your cookie preference — legal obligation to obtain and record consent (Art. 6(1)(c)) and legitimate interests.

5. Data retention

Contact messages are kept for up to 12 months after our last correspondence, unless longer retention is needed to resolve a dispute. Rate-limiting records are discarded after one hour. Server logs are retained for up to 30 days.

6. Security measures

The site is served over HTTPS. The contact form uses server-side validation, input sanitisation, header-injection protection, spam filtering and rate limiting. Email provider credentials are held only on the server and never exposed to browsers.

7. Third-party email services

Contact form messages are delivered through Resend, a transactional email service, which processes the message content on our behalf as a data processor.

8. International data transfers

Our email provider may process data outside the United Kingdom or European Economic Area, including in the United States. Where this happens, transfers rely on appropriate safeguards such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses.

9. Your rights

You may request access to, correction or erasure of your personal data, restriction of or objection to processing, and data portability, and you may withdraw consent at any time. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

10. Privacy contact

For any privacy question, email [email protected] or write to the address above.