Privacy Policy

1. Who we are

The controller of personal data described in this policy is:

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy enquiries are handled directly by the partners at the address above.

2. What we collect and why

2.1 Enquiries and consultation requests

When you use a form on this site we collect the company name, contact name, email address, optional telephone number, the service you selected, the turnover band you selected, and the message you wrote. We use this solely to answer your enquiry and, where relevant, to prepare a written scope of work.

Legal basis: your consent (Article 6(1)(a)) and steps taken at your request prior to entering into a contract (Article 6(1)(b)).

2.2 Client engagements

Where you become a client, we process the personal data contained in the accounting records, payroll data and tax filings we handle for you. For that data you are generally the controller and we act as processor under a written engagement and, where required, a data processing agreement.

Legal basis: performance of a contract (Article 6(1)(b)) and compliance with our legal obligations under Finnish accounting and tax law (Article 6(1)(c)).

2.3 Technical data

Our web server records the IP address, timestamp, requested page and user agent of each request in its access log. This is used only to keep the service running and to detect abuse.

Legal basis: our legitimate interest in the security and availability of the service (Article 6(1)(f)).

2.4 The statutory scope estimator

The estimator on this site runs in your browser. The figures you enter are not transmitted to us or stored anywhere unless you choose to submit them as part of a consultation request.

3. Cookies and measurement

Strictly necessary cookies are set so the site functions and so your consent choice can be remembered. Analytics and Microsoft Advertising measurement cookies are set only if you consent, and no such cookie or tag is loaded before you make that choice. See the Cookie Policy for the detail and to change your choice.

4. Who we share data with

We do not sell personal data, ever. We share it only with:

• our hosting and email providers, acting as processors under contract, with servers located in the EU/EEA;
• the Finnish Tax Administration, the Finnish Patent and Registration Office, the Incomes Register and comparable authorities, where a filing obligation requires it;
• your independent auditor, where you have engaged one and asked us to liaise;
• Microsoft Advertising, in the form of aggregated conversion measurement, and only where you have consented to advertising cookies.

5. International transfers

Personal data collected through this site is stored on servers within the EU/EEA. We do not transfer it to a third country. If that ever changes we will update this policy and rely on an appropriate Article 46 safeguard.

6. How long we keep it

• Enquiries that do not become engagements: 24 months from your last contact with us, then deleted.
• Client accounting records: as required by the Finnish Accounting Act — generally six years from the end of the financial year, and ten years for certain records.
• Server access logs: 12 months.
• Your consent record: stored in your own browser until you clear it.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased, where no legal retention obligation applies;
• restrict or object to processing;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing already carried out.

To exercise any of these, email info@elegian.net. We respond within one month. If you are not satisfied, you may complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi) or to the supervisory authority in your own EU country.

8. Security

The site is served over HTTPS. Form submissions are rate-limited and validated server-side. Access to enquiry data is limited to the partners and staff who need it. We do not ask for, and you should not send, payment card details or credentials through this site.

9. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

10. Changes to this policy

If we change how we handle personal data we will update this page and the date at the top. Material changes affecting existing enquiries or clients will be communicated directly.