Privacy Policy

1. Who we are

The controller of personal data described in this policy is:

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy enquiries are handled at the address above.

2. What we collect and why

2.1 Enquiries and consultation requests

When you use a form on this site we collect the company name, contact name, email address, optional telephone number, the service you selected, the turnover band you selected, and the message you wrote. We use this solely to answer your enquiry and, where relevant, to prepare a written scope of work.

Legal basis: steps taken at your request before a contract (GDPR Article 6(1)(b)).

2.2 Client engagements

Where you become a client, we process the personal data contained in the accounting records, payroll data and tax filings we handle for you. For that data you are generally the controller and we act as processor under a written engagement and, where required, a data processing agreement.

Legal basis: performance of a contract (Article 6(1)(b)) and compliance with our legal obligations under Finnish accounting and tax law (Article 6(1)(c)).

2.3 Technical data

Our web server records the IP address, timestamp, requested page and user agent of each request in its access log. This is used only to keep the service running and to detect abuse.

Legal basis: our legitimate interest in the security and availability of the service (Article 6(1)(f)).

2.4 The statutory scope estimator

The estimator on this site runs in your browser. The figures you enter are not transmitted to us or stored anywhere unless you choose to submit them as part of a consultation request.

3. Cookies and measurement

This site sets no cookies. Your choice on the banner is stored in this browser under the local-storage key elegian.consent.v1. No analytics product is installed. No Microsoft Advertising tag is installed, and enquiry data is not sent to Microsoft. See the Cookie Policy.

4. Who we share data with

We do not sell personal data, ever. We share it only with:

• Namecheap, Inc., United States, which hosts this website and provides the mailbox for info@elegian.net. Form submissions and server access logs are processed there;
• the Finnish Tax Administration, the Finnish Patent and Registration Office, the Incomes Register and comparable authorities, where a filing obligation requires it;
• your independent auditor, where you have engaged one and asked us to liaise.

5. International transfers

The website and the form API run on servers operated by Namecheap, Inc. in the United States. A form submission, and the IP address, time, requested page and user agent in the server access log, are processed in the United States.

6. How long we keep it

• Enquiries that do not become engagements: 24 months from your last contact with us, then deleted.
• Client accounting records: as required by the Finnish Accounting Act — generally six years from the end of the financial year, and ten years for certain records.
• Server access logs: 12 months.
• Your banner choice: stored in your own browser until you clear it.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased, where no legal retention obligation applies;
• restrict or object to processing;
• receive your data in a portable, machine-readable format.

To exercise any of these, email info@elegian.net. We respond within one month. If you are not satisfied, you may complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi) or to the supervisory authority in your own EU country.

8. Security

The site is served over HTTPS. Form submissions are rate-limited and validated server-side. Access to enquiry data is limited to the people at Elegian Oy who need it. We do not ask for, and you should not send, payment card details or credentials through this site.

9. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

10. Changes to this policy

If we change how we handle personal data we will update this page and the date at the top. Material changes affecting existing enquiries or clients will be communicated directly.