1. Controller
E. Sipolan Tili ja Isännöinti Oy, Business ID (Y-tunnus) 0545990-2, EU VAT FI05459902, Kaurastie 11, 90800 Oulu, Finland. Phone +358453032478. E-mail enquiries@esipolantilijaisannointioy.com. Privacy questions are handled through the same e-mail address; the company has not appointed a separate data protection officer.
2. What we process and why
| Situation | Data | Purpose & legal basis | Retention |
|---|---|---|---|
| Consultation request form | Company name, contact person, e-mail, phone (optional), service, revenue band, message, notice version and time of acknowledgement | Answering your request and preparing a proposal — steps before a contract (Art. 6(1)(b)); legitimate interest in answering business enquiries (Art. 6(1)(f)) | 12 months, then deleted automatically |
| Contact form | Name, e-mail, subject, message | Replying to you — legitimate interest (Art. 6(1)(f)) | 12 months |
| E-mail and phone | What you choose to send | Replying and, if an engagement follows, providing the service (Art. 6(1)(b)) | As long as needed for the matter; accounting records as required by the Accounting Act |
| Server logs | IP address, time, requested page, browser type | Security and fault-finding — legitimate interest (Art. 6(1)(f)) | Up to 14 days |
| Form abuse protection | A keyed, one-way hash of your IP address (not the address itself) | Rate-limiting automated submissions — legitimate interest (Art. 6(1)(f)) | Up to 24 hours |
| Advertising measurement (only with consent) | Microsoft Advertising UET cookies and identifiers | Measuring the results of our ads — consent (Art. 6(1)(a)), withdrawable at any time | See the Cookie Policy |
We do not use the estimator inputs: the tax & audit matrix runs entirely in your browser and sends nothing to us. We do not make decisions based solely on automated processing, and we do not sell personal data.
3. Recipients and transfers
- Namecheap, Inc. — website hosting and business e-mail. Its servers are located in the United States. The transfer is based on the EU Standard Contractual Clauses (GDPR Art. 46(2)(c)) in the provider’s data processing agreement.
- Microsoft Corporation — advertising measurement, only if you accept advertising cookies (see the Cookie Policy).
- Authorities, when the law requires it (for example the Finnish Tax Administration in connection with client accounting).
4. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Send requests to enquiries@esipolantilijaisannointioy.com; we answer within one month. You can also lodge a complaint with the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).
5. Security
The website is served only over HTTPS. Form data is stored in a database that is not reachable from the internet, and access is limited to the company’s staff. Please do not send personal identity codes (henkilötunnus) or bank details through the website forms.
6. Changes
This policy may be updated; the version date at the top shows the current version.