Legal
Privacy policy
This policy explains what personal data Abacus Accounting Oy processes, why, on what legal basis and for how long — and what you can require of us.
Last updated 23 August 2026. Version 1.0.
1. Who is the controller
The controller of the personal data described in this policy is:
Abacus Accounting Oy
Business ID 0115454-6 · VAT FI01154546
Harjukatu 30
05900 Hyvinkää, Finland
admin@abacusaccountingoy.com ·
+44 7440 319979
We have not appointed a data protection officer: our processing does not meet the criteria in Art. 37(1) GDPR. Privacy matters are handled by the company’s management at the address above.
Where we keep books, run payroll or file returns for a client company, that client is the controller of the personal data in its own records and we act as its processor under a written agreement required by Art. 28 GDPR. This policy covers the data we control ourselves: enquiries, correspondence, client-relationship administration and this website.
2. What we process, why, and on what basis
| Whose data | What | Purpose | Legal basis | Kept for |
|---|---|---|---|---|
| People who send an enquiry | Name, company, business ID, email, telephone, the message itself | Answering the enquiry and preparing a proposal | Art. 6(1)(b) — steps at your request before a contract; Art. 6(1)(f) — our legitimate interest in responding to business contact | 24 months from the last contact |
| Client contact persons | Name, role, business contact details, correspondence | Performing the engagement and administering the client relationship | Art. 6(1)(b) and Art. 6(1)(f) | Duration of the engagement, then as required below |
| Clients and their beneficial owners | Identification data and copies of identity documents | Customer due diligence required of accounting firms | Art. 6(1)(c) — legal obligation (Act on Preventing Money Laundering and Terrorist Financing 444/2017) | 5 years from the end of the client relationship (statutory) |
| Anyone appearing in accounting records | Data contained in vouchers, invoices and payroll records we handle | Bookkeeping, statutory reporting and archiving | Art. 6(1)(c) — Accounting Act 1336/1997; usually as processor for the client | Statutory retention periods (6 or 10 years depending on the record) |
| Marketing recipients | Name, email, company | Occasional updates on deadlines and rule changes | Art. 6(1)(a) — consent, given by ticking the optional box on the contact form | Until you withdraw consent |
| Website visitors | IP address, request time, URL, status code, user agent (web-server log) | Operating the site securely and diagnosing faults | Art. 6(1)(f) — legitimate interest in the security and availability of our service | Up to 90 days |
We do not ask you to consent to being answered. Replying to a business enquiry and preparing a proposal rests on Art. 6(1)(b) and 6(1)(f), not on consent, so the contact form has no “I agree” box gating the send button. The only consent we ask for is the separate, optional marketing box — you can send an enquiry without ticking it, and withdrawing it later does not affect anything else.
3. Where the data comes from
From you — the contact form, email, telephone and the material you provide during an engagement. For customer due diligence we also use public registers: the Finnish Business Information System (YTJ/PRH), the Trade Register and, where relevant, international sanctions lists.
4. Who else sees it
We do not sell personal data and we do not disclose it for anyone else’s marketing. Data is disclosed only to:
- Authorities, where a filing or a request is required by law — principally the Finnish Tax Administration, the Incomes Register and the Trade Register, on the client’s behalf.
- The client’s own auditor, where the client has appointed one and asks us to provide material.
- Service providers acting as our processors, listed below, each under a written Art. 28 agreement and bound to confidentiality.
| Role | Provider | Country of processing | Purpose |
|---|---|---|---|
| Website hosting | To be confirmed before launch | Named here once the server location has been established | Serving this website and storing web-server logs and enquiry messages. |
| To be confirmed before launch | Named here once the server location has been established | Receiving and storing correspondence sent to the address below. |
5. Transfers outside the EU/EEA
We do not transfer personal data outside the EU/EEA for our own purposes. The precise processing location of our hosting and email providers is stated in the table above once each provider’s server location has been established; where a provider processes data in a third country, the transfer is made under a Chapter V GDPR mechanism (an adequacy decision, or the European Commission’s standard contractual clauses together with a transfer impact assessment), and we will name the mechanism here rather than assert that no transfer occurs.
6. Cookies and similar technologies
This website loads no third-party scripts, fonts, maps, embedded videos or advertising pixels. There is no analytics tool, no tag manager and no social plug-in, so there is nothing to consent to and no consent banner is shown. What the site does store is:
| Name | Type | Purpose | Expires |
|---|---|---|---|
| abacus_session | Cookie (first party, HttpOnly, SameSite=Lax) | Carries the security token that protects the contact form against cross-site request forgery, and remembers that your message was sent. Set only when you open the contact page. | End of the browser session |
| abacus-notice-dismissed | localStorage entry (not a cookie, never sent to the server) | Remembers that you closed the notice at the foot of the page. | Until you clear your browser storage |
Both are strictly necessary for a service you have requested and are therefore exempt from the consent requirement in section 205 of the Act on Electronic Communications Services (917/2014), which implements Article 5(3) of the ePrivacy Directive. If we ever add anything that is not exempt, we will ask for consent before it is set.
7. Security
The site is served over HTTPS only, with HTTP Strict Transport Security, a restrictive Content Security Policy and standard hardening headers. The contact form is protected by a CSRF token, rate limiting and spam controls; the rate limiter stores a salted hash of your IP address rather than the address itself. Access to correspondence and client records is limited to the people who need it, and our staff are bound by professional confidentiality.
8. Your rights
Under the GDPR you may ask us to:
- Access the personal data we hold about you and receive a copy (Art. 15).
- Rectify data that is inaccurate or incomplete (Art. 16).
- Erase data, where we have no overriding legal obligation to keep it (Art. 17).
- Restrict processing while a dispute about accuracy or lawfulness is resolved (Art. 18).
- Receive data you gave us in a machine-readable format, or have it transmitted to another controller (Art. 20).
- Object to processing based on legitimate interests, including any direct marketing (Art. 21).
- Withdraw consent at any time where processing is based on it, without affecting the lawfulness of what was done before (Art. 7(3)).
Write to admin@abacusaccountingoy.com or to the postal address in section 1. We answer within one month and may ask you to identify yourself where we cannot otherwise tell that the request is yours. Requests are free of charge.
Note that statutory retention obligations — the Accounting Act and the anti-money-laundering rules above — can prevent us from erasing certain records before their period expires. If that applies to your request we will say so and tell you when the data will be deleted.
9. Complaints
If you believe we have processed your data unlawfully, please raise it with us first — it is usually the fastest fix. You also have the right to lodge a complaint with the Finnish supervisory authority:
Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman)
Lintulahdenkuja 4, 00530 Helsinki · PO Box 800, 00531 Helsinki, Finland
+358 29 566 6700 · tietosuoja.fi/en
10. Changes to this policy
We update this policy when our processing changes. The version number and the date at the top of the page tell you which version you are reading; material changes affecting existing clients are notified by email.