Legal
Privacy policy
How Alavuden Kiinteistö- ja Tilitoimisto Oy handles personal data under Regulation (EU) 2016/679 (GDPR) and the Finnish Data Protection Act (1050/2018).
Last reviewed 26 August 2026. This document is maintained by Alavuden Kiinteistö- ja Tilitoimisto Oy and applies to alavudenkiinteistojatilitoimisto.com.
1Who is responsible
The data controller is Alavuden Kiinteistö- ja Tilitoimisto Oy, a Finnish limited company registered at Torikatu 1, 63300 Alavus, Finland, Business ID 0226379-5, EU VAT number FI02263795. The company was entered in the Finnish Trade Register on 21 July 1978.
All privacy matters, including requests to exercise your rights, go to help@alavudenkiinteistojatilitoimisto.com or by post to the address above. You can also telephone +358 46 804 3840.
This firm has not appointed a Data Protection Officer. It is not required to: it is not a public authority, its core activities do not consist of large-scale regular monitoring, and it does not process special categories of data on a large scale (Article 37). Enquiries reach the people who run the company directly.
2What this policy covers
This policy covers personal data collected through the website alavudenkiinteistojatilitoimisto.com — the enquiry form, the contact form and the technical records the site cannot function without.
It does not cover the personal data we process inside a client engagement: employee data in a payroll run, names on purchase invoices, and so on. In that work we normally act as a processor on the client’s instructions, and the terms are set out in the engagement agreement and its data processing annex rather than here.
3What we collect, why, and for how long
Each purpose below stands on its own legal basis and has its own retention period. We collect nothing “in case it is useful”.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering a service enquiry | Company name, Business ID if given, your name, email, telephone if given, service category, turnover range, and the message you write. | Article 6(1)(b) — steps taken at your request before entering into a contract. | 12 months if no engagement follows. If we work together it becomes part of the client file. |
| Answering a general message | Your name, email, telephone if given, subject and message. | Article 6(1)(f) — our legitimate interest in replying to people who write to us. | 12 months. |
| Optional updates about filing deadlines | Your name and email, and the fact that you ticked the box. | Article 6(1)(a) — your consent, which you may withdraw at any time. | Until you withdraw, or after two years of no engagement with the messages. |
| Preventing abuse of the forms | A truncated IP address (the final octet is discarded before storage), a hash of the browser user-agent, and submission timestamps. | Article 6(1)(f) — our legitimate interest in keeping the forms usable and the mailbox clean. | Rate-limit records: 24 hours. Truncated IP stored with an enquiry: with the enquiry. |
| Keeping the service running and secure | Server logs: request path, response status, timestamp, truncated IP. | Article 6(1)(f) — legitimate interest in the security and availability of the service. | Up to 30 days, then deleted. |
| Statutory records once you are a client | Engagement records, invoices and accounting material. | Article 6(1)(c) — legal obligation under Finnish accounting and tax law. | For the retention period the Accounting Act and tax legislation require. |
Nothing on this site is used for profiling and no automated decision producing legal effects is made about you within the meaning of Article 22.
4What we deliberately do not do
- We do not sell, rent or trade personal data. There is no circumstance in which we would.
- We do not share your details with advertising networks or data brokers.
- We do not load third-party scripts, fonts, maps, embedded video or social widgets on this website.
- We do not set advertising or analytics cookies. Today this site sets no cookie at all.
- We do not track you across other websites.
- We do not ask for personal identity codes (henkilötunnus) or bank credentials through a web form, and we ask you not to type them into one.
5Who else sees your data
Inside the firm, only the people who need it to answer you. Outside it, only the service providers that host the website and carry our email, each acting as a processor under a written agreement, and only to the extent the service requires.
Being honest about a gap: hosting and email providers for this domain have not been contracted yet, so this policy does not name any. A named list — provider, service, and the country the servers are actually in — will appear here before the site handles a single live enquiry. We would rather publish a gap than a guess.
We would also disclose data where a Finnish authority or a court requires it by law. If that ever happened we would tell you, unless we were legally prohibited from doing so.
6Transfers outside the EU and EEA
The intention is to keep all processing within the EU or EEA. Until hosting and email are contracted this cannot be stated as a fact, so it is stated as an intention. If any processor turns out to be outside the EEA, this section will name it and state the Article 46 safeguard relied on — normally the European Commission’s standard contractual clauses — before the arrangement begins.
7Cookies and browser storage
This site sets no cookies. It uses one entry in your browser’s local storage, and only after you have answered the consent banner: it records what you answered, so that you are not asked again on every page.
Every item is listed individually, with its name, purpose and lifetime, in the cookie and browser storage policy.
8Your rights, and how to use them
Under the GDPR you have the right to:
- ask what personal data we hold about you and receive a copy of it (Article 15);
- have inaccurate data corrected (Article 16);
- have data erased where the conditions are met (Article 17);
- restrict processing while a dispute is resolved (Article 18);
- receive data you gave us in a portable, machine-readable form (Article 20);
- object to processing based on our legitimate interest, including at any time and for any reason where the processing is for direct marketing (Article 21);
- withdraw consent at any time, without affecting processing that already happened (Article 7(3)).
Write to help@alavudenkiinteistojatilitoimisto.com with “GDPR request” in the subject line. There is no form and no portal. We reply within one month, as Article 12(3) requires; if a request is genuinely complex we will tell you inside that month and explain why more time is needed. Exercising a right costs nothing.
We may need to confirm you are who you say you are before releasing data — not as an obstacle, but because handing your data to somebody else would be the worse failure.
9Complaints
If you are unhappy with how we have handled your data, tell us first — it is usually the fastest route to a fix. You also have the right to complain to the supervisory authority at any time, without going through us:
Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman), Lintulahdenkuja 4, 00530 Helsinki, Finland · tietosuoja.fi
10Security
The site is served over HTTPS. Form submissions are validated on the server as well as in the browser, are protected against cross-site submission by a single-use token, and are rate limited. Data submitted through the forms is stored in a database that is not reachable from the public internet, and access to it is limited to the people who need it.
No system is perfect. If we ever suffer a breach likely to result in a risk to your rights and freedoms, we will notify the Data Protection Ombudsman within 72 hours as Article 33 requires, and notify you directly where Article 34 requires it.
11Changes to this policy
When this policy changes, the review date at the top changes with it. Where a change materially affects how your data is handled, we will say so prominently rather than relying on you to notice a date. This version was last reviewed on 26 August 2026.