Legal
Privacy Policy
How Account Officer Oy processes personal data on this website and in the course of answering your enquiries. Last reviewed 12 September 2026.
1. Who is the controller
Account Officer Oy, Kalliotie 1, 04400 Järvenpää, Finland, Business ID 0106777-6, is the controller for the processing described here. Contact info@accountofficeroy.com for any matter relating to your personal data.
We have not appointed a Data Protection Officer. Our processing does not meet the criteria in Article 37(1) GDPR that would require one, and saying so is more useful than leaving the question open.
2. What this website collects, and what it does not
Visiting a page collects nothing beyond what the web server necessarily records to serve it. There is no analytics provider on this site, no advertising pixel unless you switch one on, no social media embed, no third-party font, and no content loaded from another company’s server. The Content-Security-Policy on this site enforces that rather than merely promising it.
Personal data reaches us in exactly two ways:
- You send a proposal request or a message. We receive the fields you filled in: company name, contact name, email address, optionally a telephone number and Business ID, your approximate volumes, and anything you write in the message box.
- You become a client. The accounting engagement itself is described in section 6 and is a separate matter from this website.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Kept for |
|---|---|---|
| Answering a proposal request or enquiry | Art. 6(1)(b), steps at your request before a contract; Art. 6(1)(f), our legitimate interest in responding to business enquiries | 24 months from last contact |
| Keeping the forms secure and rate limited | Art. 6(1)(f), our legitimate interest in operating a secure website | Request logs 30 days; the rate-limit record holds a hashed address only |
| Occasional guidance emails, if you ticked the box | Art. 6(1)(a), your consent | Until you withdraw it |
| Advertising measurement, if you allowed it | Art. 6(1)(a), your consent | Per the cookie lifetimes on the cookie policy |
| Client engagement records and accounting files | Art. 6(1)(b), performance of the engagement; Art. 6(1)(c), our own statutory obligations | As required by the Accounting Act and anti-money-laundering legislation |
4. Who else sees it
Nobody, unless you ask us to or the law requires it. Enquiry data is not sold, is not shared with advertising networks, and is not used to build a profile. The site is hosted on a server in the European Union and enquiry data is not transferred outside the EU or EEA.
The one exception you control: if you allow advertising measurement, Microsoft Corporation receives the measurement events described in the cookie policy, which may involve a transfer to the United States under the EU-US Data Privacy Framework. Declining leaves that script unloaded entirely, so no transfer occurs.
5. Your rights
You may request access to your personal data, its rectification or erasure, restriction of processing, or portability, and you may object to processing based on legitimate interests. Where processing rests on consent you may withdraw it at any time, and withdrawal does not affect what was done before.
Write to info@accountofficeroy.com. We answer within one month. If you are not satisfied you may complain to the Finnish Data Protection Ombudsman, tietosuoja.fi, or to the supervisory authority where you live or work.
6. Personal data we process for clients
When we act as your accountant we process personal data on your behalf, usually about your employees and your counterparties. In that relationship you are the controller and we are the processor, and the processing is governed by a written data processing agreement forming part of the engagement, not by this website policy.
7. Security
The site is served over HTTPS with a strict Content-Security-Policy. Form submissions carry a cross-site request forgery token and are rate limited. Enquiry data is stored in a database that is not reachable from the internet, on a server in the European Union. Access is limited to the people who need it to answer you.
8. Changes
If this policy changes materially we will say so on this page with the date. It was last reviewed on 12 September 2026.