Privacy policy and cookies

A separate bookkeeping customer register privacy notice (PDF, Finnish) covers personal data processed for accounting services. This notice concerns the website and incoming enquiries.

1. Data controller and contact details

Data controller:
Tilitoimisto Pesa Oy
Business ID: 3525969-6

Email: aspa@pesa.fi
Phone: 0300 472 286

Contact person for matters concerning the register:
Janne Lohilahti
janne.lohilahti@pesa.fi
0300 472 286

2. What personal data we collect

Tilitoimisto Pesa Oy processes the following personal data through the website:

Information provided via contact forms and other website forms, such as name, email address, phone number, company name, subject of the message, message content and other information given on the form.
Information related to phone calls, such as phone number, time of call, call duration, call content, call recording and notes related to the call.
Technical information generated automatically from website use, such as IP address, browser information, device information, operating system, timestamps, pages viewed, referral sources and other analytics and log data.
Information collected through cookies and other similar technologies.

Personal data is obtained primarily from the data subject directly, when they fill in a form, contact us by email or phone, or use the website.

3. Purposes of processing personal data

Personal data is processed for the following purposes:

Receiving, processing and responding to inquiries.
Providing quotes, service information and other requested information.
Preparing, managing and documenting the customer relationship.
Developing customer service, service quality and operations.
Quality assurance of phone calls, handling complaints, verifying service events and preparing for legal claims.
Monitoring and developing the functionality, usability, information security and performance of the website.
Producing visitor statistics and analyzing website use.
Preventing and investigating misuse, disruptions and information security incidents.

4. Legal bases for processing

The processing of personal data is based on one or more of the following legal bases:

Pre-contractual measures at the data subject's request, when the data subject requests contact, a quote, or another response related to the service.
The controller's legitimate interest, when processing is necessary for managing customer relationships, inquiries, phone calls, service quality, website information security and development of operations.
Consent, when processing is based on explicit consent, such as non-essential cookies or specifically requested marketing communications.
Legal obligation, if the processing or disclosure of personal data is necessary to fulfil a statutory obligation.

When processing is based on legitimate interest, the legitimate interest is managing customer communications, ensuring service quality, developing the business, maintaining information security, and handling any complaints and legal claims.

5. Mandatory and voluntary information

Some of the information requested on the website's forms may be mandatory so that an inquiry can be received and processed. Such information generally includes at least the name, email address or other contact detail, and the content or subject of the message.

If the data subject does not provide the mandatory information, the inquiry may not be sent or may not be answered properly.

Not providing voluntary information generally does not prevent the matter from being handled, but may affect how smoothly it can be processed.

6. Call recording

Calls to and from Tilitoimisto Pesa Oy's number 0300 472 286 may be recorded for quality assurance, developing customer service, verifying service events, handling complaints, and preparing for legal claims.

Notice of the recording is given before the recording begins.

If a data subject does not wish to conduct business on a recorded call, they can contact us by email at aspa@pesa.fi.

7. Cookies and analytics

The website uses cookies and other similar technologies to implement the site's technical operation, information security, usability and analytics.

The site uses necessary cookies that are required for the site to function.

Website analytics and live chat are provided through HubSpot tracking only if a visitor accepts optional cookies for these functions. The new Cloudflare Pages site does not separately load Google Analytics.

The site may also use HubSpot-related cookies and identifiers in connection with HubSpot's form and tracking functions. These can, for example, link a form submission to a previous website visit, manage sessions and track website use.

Non-essential cookies are used only with the consent required by applicable law. HubSpot analytics and live chat share one tracking script and require a combined opt-in. You can withdraw this consent via Cookie settings in the footer. Any marketing consent in contact forms is requested separately.

8. Recipients and disclosures of personal data

Personal data is not made available to parties other than those who have a right to it based on their work, service provision, or the law. Personal data may be processed by the following parties:

Tilitoimisto Pesa Oy's staff and other authorized personnel, according to their job duties.
HubSpot, which is used to receive form data, as a CRM system, for customer relationship management, and for processing call-related data.
Technical service providers related to HubSpot's calling features, such as Twilio, to the extent they participate in connecting and recording calls.
Microsoft 365, used for email, file handling and internal work.
AI assistants used by Tilitoimisto Pesa Oy in internal work and granted access to the Microsoft 365 environment, such as Anthropic (Claude) and OpenAI (ChatGPT). AI assistants are used for example to draft messages, retrieve information and prepare work tasks. They are granted only the access rights their tasks require, and those rights are limited and reviewed regularly.
Cloudflare, whose Pages service hosts and protects the website.
Other technical website maintenance providers.

Tilitoimisto Pesa Oy is responsible for the content of the website. Data may also be disclosed to authorities or other parties if there is a statutory obligation to do so.

9. Transfers of personal data outside the EU or EEA

Tilitoimisto Pesa Oy aims to process personal data within the European Union and the European Economic Area.

However, some of the service providers used, or their subcontractors, may also process personal data outside the EU or EEA. In such cases, transfers of personal data are carried out in accordance with applicable data protection legislation using appropriate safeguards, such as standard contractual clauses approved by the European Commission or other transfer mechanisms permitted by law.

Such services include for example HubSpot, Microsoft 365, Cloudflare and the AI assistants used, whose service providers are US-based.

The data subject may request further information about any international data transfers by contacting the controller.

10. Retention periods for personal data

Personal data is retained only for as long as necessary to fulfil the purposes described in this policy.

Data received through the website's contact forms and other forms is generally retained for a maximum of 12 months from when the inquiry has been fully processed, unless longer retention is necessary, for example, for preparing a customer relationship, a complaint, a legal claim, or another justified reason.
Call recordings are generally retained for a maximum of 6 months from the time of recording, unless longer retention is necessary due to a complaint, a legal claim, an ongoing matter, or another justified reason.
Retention of HubSpot analytics depends on the configured service and retention settings. Further details are available from the data controller.
The retention period of cookies varies by cookie. Some cookies are deleted when the browser session ends, while others remain until their defined validity period ends or the user deletes them from their browser.
Server and information-security logs are retained only for as long as necessary to ensure the security and functionality of the site and to investigate any misuse.

If an inquiry leads to a customer relationship, the data may be transferred to another register, in which case it is retained in accordance with the retention periods applicable to that register.

11. Data subject rights

Under applicable data protection legislation, the data subject has the right to:

obtain access to personal data concerning them
request correction of inaccurate or incomplete data
request erasure of data
request restriction of processing
object to the processing of personal data
have their personal data transferred from one system to another, to the extent the right applies
withdraw given consent at any time, if the processing is based on consent
lodge a complaint with a supervisory authority

Requests concerning these rights should be submitted by email to aspa@pesa.fi or to the contact person named at the beginning of this policy.

Requests are handled without undue delay and generally within one month of receipt. If necessary, the controller may request additional information to verify the data subject's identity.

12. Information security

Tilitoimisto Pesa Oy protects personal data with appropriate technical and organizational measures. These measures include, among others:

secured network connections
restriction of access rights
access control
maintenance and updates of systems
logging and monitoring
staff guidance
limiting data processing to only those persons whose job duties require it
limiting and regularly reviewing the access rights granted to AI assistants

13. Changes to this privacy policy

Tilitoimisto Pesa Oy may update this privacy policy if the operation of the website, the methods of processing personal data, service providers, or applicable legislation change. The current privacy policy is always published on the website.