Privacy Policy

1. Data Controller Identity & Contact Details

The data controller responsible for the processing of personal data on this website and in connection with our professional accounting services is:

2. Categories of Personal Data Collected

We adhere strictly to the data minimization principle under Article 5(1)(c) of the GDPR. We collect only data strictly necessary for our business functions:

• Inquiry & Communication Data: When submitting an inquiry via our contact form or email, we collect your full name, business email address, optional telephone number, subject matter, and message content.
• Client Engagement & Financial Records: For formally engaged corporate clients, we process representative contact names, official business authorizations (Suomi.fi mandates), billing identifiers, bank details, and accounting records necessary to deliver statutory accounting and tax filings.
• Technical & Consent Preferences: We record your cookie consent choice in your browser's local storage (stored for 12 months).
• Advertising Measurement Data (Consent Required): If and only if you explicitly choose "Accept all" or enable "Advertising & Measurement" in our cookie preferences, Microsoft Advertising Universal Event Tracking (UET) cookies (_uetsid, _uetvid, MUID) and pseudonymous interaction signals are processed to gauge advertising efficiency.

3. Purposes & Legal Bases for Data Processing

All processing of personal data is grounded in a valid legal basis set forth in Article 6(1) of the GDPR:

• Responding to Inquiries (Art. 6(1)(b) GDPR): Processing contact requests is conducted to take pre-contractual steps at your request or to communicate with you regarding requested accounting services.
• Statutory Accounting & Legal Compliance (Art. 6(1)(c) GDPR): Retaining financial ledgers, invoice verifications, tax return records (Form 6B), and corporate correspondence in compliance with the Finnish Accounting Act (Kirjanpitolaki) and Finnish Tax Administration mandates.
• Legitimate Interests (Art. 6(1)(f) GDPR): Maintaining network security, preventing spam bot abuse (such as through honeypot field verification), and defending potential legal claims.
• Consent for Advertising & Measurement (Art. 6(1)(a) GDPR): Processing Microsoft Advertising UET cookies and measurement data is strictly predicated upon your prior, explicit, and freely given consent. You may withdraw this consent at any time via the "Cookie settings" link.

4. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered:

• General Inquiries: Communications that do not lead to an engagement are archived and securely deleted within 12 months.
• Statutory Accounting Documents: In accordance with Chapter 2, Section 10 of the Finnish Accounting Act (Kirjanpitolaki 1336/1997), accounting ledgers, financial statements, and supporting vouchers must be retained for at least six (6) to ten (10) years following the end of the financial year.
• Cookie Consent State: Stored locally in your browser for 12 months, after which you will be prompted again.

5. Recipients & Processors of Personal Data

We do not sell, rent, or trade personal data. Data is disclosed only to trusted service providers acting under binding data processing agreements (DPAs) compliant with Article 28 GDPR:

• IT & Web Hosting Providers: Secure hosting and database infrastructure located within the European Economic Area (EEA).
• Email & Communication Providers: Encrypted enterprise mail servers handling business correspondence.
• Public Regulatory Authorities: Where legally mandated by Finnish law, data is transmitted to the Finnish Tax Administration (Verohallinto), the Finnish Patent and Registration Office (PRH), or the Incomes Register (Tulorekisteri) pursuant to authorized mandates.
• Microsoft Corporation (Advertising Partner): If you grant consent to advertising cookies, pseudonymous interaction data is received by Microsoft Ireland Operations Limited and Microsoft Corporation to measure campaign conversions through the Microsoft Advertising UET tag. Microsoft collects or receives personal data through this tag; see the Microsoft Privacy Statement. Microsoft acts as an independent controller for certain processing activities under its own privacy policies.

6. International Data Transfers

Our core accounting operations and website databases are hosted within the European Union. In instances where service providers (such as Microsoft Corporation) process data in countries outside the European Economic Area (specifically the United States), such transfers are governed by:

• The EU-US Data Privacy Framework (DPF), under which Microsoft is certified; and/or
• European Commission Standard Contractual Clauses (SCCs) ensuring an adequate level of data protection consistent with European standards.

7. Your Rights Under GDPR

As a data subject within the European Union, you possess extensive statutory rights under Articles 15 through 22 of the GDPR:

• Right of Access (Art. 15): You have the right to obtain confirmation as to whether your personal data is being processed, and a copy of such data.
• Right to Rectification (Art. 16): You may request the immediate correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): You may request the erasure of your personal data where retention is no longer necessary, subject to statutory retention duties under Finnish accounting legislation.
• Right to Restriction of Processing (Art. 18): You may request restriction of processing while accuracy or objections are verified.
• Right to Data Portability (Art. 20): You may receive your data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): You have the right to object at any time to processing grounded in legitimate interests.
• Right to Withdraw Consent (Art. 7(3)): Where processing relies on consent (such as advertising measurement cookies), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. Use the "Cookie settings" link in our footer.

To exercise any of these rights, please contact our data protection representative at info@bilanssi.com or via post at Mannerheimintie 15a B, 00250 Helsinki, Finland.

8. National Supervisory Authority

If you consider that the processing of your personal data infringes the GDPR, you have the statutory right to lodge a complaint with the competent supervisory authority in Finland: