Privacy Policy

1. Who is responsible for your data

The controller is Auran Tili ja Kiinteistö Oy, Business ID 0576717-1, EU VAT FI05767171, registered office Vareliuksenkatu 2 A, 32200 Loimaa, Finland. Contact for all data-protection matters: contact@aurantilijakiinteisto.com, telephone +358 40 331 6751.

We have not appointed a Data Protection Officer. Not required under GDPR Art. 37 for an organisation of this size and processing profile; the controller answers data-protection enquiries at the address above. Enquiries go to the address above and are answered by the controller.

2. What we collect, why, and on what legal basis

2.1 Consultation and contact enquiries

When you submit a form on this site we collect the name, email address and — if you give them — company name, telephone number and Business ID, plus the service you selected and the message you wrote.

• Purpose: to assess your enquiry, prepare a scope of work, and reply.
• Legal basis: Article 6(1)(b) GDPR — steps taken at your request before entering into a contract. Where you write on behalf of an organisation, Article 6(1)(f) — our legitimate interest in responding to business enquiries — also applies. We have weighed that interest against your rights and consider a reply to an enquiry you initiated to be within your reasonable expectations.
• Retention: 24 months from your last contact, then deletion. If an engagement follows, the data moves to the client relationship and is kept for the periods required by the Accounting Act and tax legislation.

2.2 Optional marketing consent

If — and only if — you tick the separate optional box, we will send occasional notes on Finnish accounting and tax deadlines. Legal basis: Article 6(1)(a) GDPR, consent. It is never a condition of submitting a form, and you can withdraw it from any message or by emailing us. Withdrawal does not affect processing carried out before it.

2.3 Technical data

Our web server keeps standard access logs — IP address, timestamp, requested URL, HTTP status, user agent — for security, abuse prevention and diagnosing faults. Legal basis: Article 6(1)(f), our legitimate interest in operating a secure service. Logs are kept for a maximum of 30 days.

We also keep short-lived rate-limiting counters and a security token for the forms. These are described in the Cookie Policy.

2.4 Client engagement data

Once you become a client, we process personal data contained in the accounting material you provide — including payroll data about your employees. In that processing you are the controller and we act as your processor under Article 28 GDPR, governed by a written data processing agreement forming part of the engagement. We do not use that data for any purpose of our own.

3. What we never do

• We do not sell personal data, and we do not share it for anyone else’s marketing.
• We carry out no automated decision-making and no profiling.
• We do not use enquiry data for advertising unless you gave the separate optional consent.
• We set no analytics or advertising cookie before you have allowed it. Today this site loads no analytics or advertising provider at all.

4. Who else sees your data

Access inside the firm is limited to people who need it to answer you. Outside the firm, personal data is disclosed only to processors acting on our documented instructions:

• Hosting provider — the company operating the server this website runs on.
• Email provider — the company carrying our correspondence.
• We are finalising the written processor terms for both and will name each provider and the country its servers are in here as soon as that is complete. We would rather leave this incomplete and say so than publish names we have not confirmed. Ask us at contact@aurantilijakiinteisto.com and we will tell you what is in place today.

We may also disclose data where the law requires it — for example to a tax or supervisory authority, or a court.

5. Transfers outside the EU/EEA

Personal data collected through this website is processed inside the EU/EEA. We do not transfer it to a third country. Should that ever change, we will rely on an adequacy decision or on Standard Contractual Clauses under Article 46 GDPR, update this policy before the transfer begins, and say so here.

6. How we protect it

• The whole site is served over TLS; form submissions are encrypted in transit.
• Forms are protected by a cross-site request forgery token and by rate limiting, and the application stores data through parameterised queries only.
• A strict Content Security Policy is applied, and the site loads no third-party script.
• Access to stored enquiries is restricted to named individuals.

No system is perfectly secure. If a breach were to put your rights at risk we would notify the Office of the Data Protection Ombudsman within 72 hours and inform you where Article 34 requires it.

7. Your rights

Under the GDPR you may:

• ask whether we hold data about you and obtain a copy (Article 15);
• have inaccurate data corrected (Article 16);
• have data erased, where we have no overriding legal obligation to keep it (Article 17);
• ask us to restrict processing (Article 18);
• receive your data in a portable, machine-readable form (Article 20);
• object to processing based on legitimate interests, including at any time to direct marketing (Article 21);
• withdraw consent at any time, where consent is the basis (Article 7(3)).

Write to contact@aurantilijakiinteisto.com. We reply within one month, and will tell you if we need the extension Article 12(3) allows. Exercising these rights is free; we charge only for manifestly unfounded or excessive repeat requests, as Article 12(5) permits.

8. Complaints

If you think we have handled your data wrongly, please tell us first — we would like the chance to fix it. You also have the right to complain to the supervisory authority:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Lintulahdenkuja 4, 00530 Helsinki, Finland
PO Box 800, 00531 Helsinki, Finland
+358 29 566 6700 · tietosuoja.fi

9. Is providing data required?

No. Using this site does not require you to give any personal data. If you want a reply to an enquiry we need a name and an email address — without them we cannot answer. There is no statutory or contractual obligation on you to submit a form.

10. Children

This is a business-to-business service. It is not directed at children and we do not knowingly collect data from anyone under 16.

11. Changes to this policy

If we change how we handle personal data we will update this page and change the version and date at the top. Material changes affecting people who have already contacted us will be notified by email where we have an address.