Legal
Privacy Policy
How Account Officer Oy processes personal data on this website and in the course of answering your enquiries. Last reviewed 12 September 2026.
1. Who is the controller
Account Officer Oy, Kalliotie 1, 04400 Järvenpää, Finland, Business ID 0106777-6, is the controller for the processing described here. Contact info@accountofficeroy.com for any matter relating to your personal data.
We have not appointed a Data Protection Officer. Our processing does not meet the criteria in Article 37(1) GDPR that would require one, and saying so is more useful than leaving the question open.
2. What this website collects, and what it does not
Visiting a page collects nothing beyond what the web server necessarily records to serve it. There is no analytics provider on this site, no advertising pixel unless you switch one on, no social media embed, and no third-party font. Pages and scripts are served from our hosting provider; until you allow advertising measurement, nothing else is loaded from Microsoft’s network. The Content-Security-Policy on this site enforces that rather than merely promising it.
Personal data reaches us in exactly two ways:
- You send a proposal request or a message. We receive the fields you filled in: company name, contact name, email address, optionally a telephone number and Business ID, your approximate volumes, and anything you write in the message box.
- You become a client. The accounting engagement itself is described in section 6 and is a separate matter from this website.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Kept for |
|---|---|---|
| Answering a proposal request or enquiry | Art. 6(1)(b), steps at your request before a contract; Art. 6(1)(f), our legitimate interest in responding to business enquiries | 24 months from last contact |
| Keeping the forms secure and rate limited | Art. 6(1)(f), our legitimate interest in operating a secure website | Request logs 30 days; the rate-limit record holds a hashed address only |
| Occasional guidance emails, if you ticked the box | Art. 6(1)(a), your consent | Until you withdraw it |
| Advertising measurement, if you allowed it | Art. 6(1)(a), your consent | Per the cookie lifetimes on the cookie policy |
| Client engagement records and accounting files | Art. 6(1)(b), performance of the engagement; Art. 6(1)(c), our own statutory obligations | As required by the Accounting Act and anti-money-laundering legislation |
4. Who else sees it
Enquiry data is not sold, is not shared with advertising networks for their own purposes, and is not used to build a profile. To run this website we use processors in the United States:
- Namecheap, Inc. hosts the public site and the database that stores proposal requests. Processing takes place in the United States.
- Namecheap Private Email (Namecheap, Inc.) receives email you send to info@accountofficeroy.com and any notification messages we send about your enquiry. Processing takes place in the United States.
Transfers outside the European Economic Area are made under Article 46 GDPR using the European Commission’s standard contractual clauses in our agreements with these providers, together with their published data-processing terms.
If you allow advertising measurement, Microsoft Corporation also receives the events described in the cookie policy, which may involve a separate transfer to the United States under the EU-US Data Privacy Framework. Declining leaves that script unloaded entirely, so that transfer does not occur.
5. Your rights
You may request access to your personal data, its rectification or erasure, restriction of processing, or portability, and you may object to processing based on legitimate interests. Where processing rests on consent you may withdraw it at any time, and withdrawal does not affect what was done before.
Write to info@accountofficeroy.com. We answer within one month. If you are not satisfied you may complain to the Finnish Data Protection Ombudsman, tietosuoja.fi, or to the supervisory authority where you live or work.
6. Personal data we process for clients
When we act as your accountant we process personal data on your behalf, usually about your employees and your counterparties. In that relationship you are the controller and we are the processor, and the processing is governed by a written data processing agreement forming part of the engagement, not by this website policy.
7. Security
The site is served over HTTPS with a strict Content-Security-Policy. Form submissions carry a cross-site request forgery token and are rate limited. Enquiry data is stored in a database that is not reachable from the internet, on the same Namecheap-hosted server described in section 4. Access is limited to the people who need it to answer you.
8. Changes
If this policy changes materially we will say so on this page with the date. Register particulars were last verified on 12 September 2026. This policy was updated on 6 October 2026 to name hosting and email processors and their locations.