Legal
Privacy Policy
How Airiston Tili ja Kiinteistö Oy collects, uses, stores and deletes personal data, under Regulation (EU) 2016/679 (GDPR) and the Finnish Data Protection Act 1050/2018.
- Document
- Privacy Policy
- Last updated
- 1 September 2026
- Published by
- Airiston Tili ja Kiinteistö Oy, Risto Rytin katu 30, 32700 Huittinen, Finland
- Business ID
- 0533416-5
- EU VAT number
- FI05334165
- Contact
- info@airistontilijakiinteisto.com · +358 2 559 323
1. Who is the data controller
The controller for the personal data described in this policy is Airiston Tili ja Kiinteistö Oy, Business ID 0533416-5, Risto Rytin katu 30, 32700 Huittinen, Finland. You can reach us by email at info@airistontilijakiinteisto.com or by telephone on +358 2 559 323.
We have not appointed a Data Protection Officer, as we are not required to under GDPR Article 37. Data protection enquiries are handled by the company’s management at the address above.
2. What personal data we collect
Through this website we collect only what you choose to send us:
- Consultation and contact form data: company name, Business ID (optional), contact person’s name, business email address, telephone number (optional), the service you are interested in, an estimated turnover band, and the free text of your message.
- Technical data recorded by the web server: your IP address, the time of the request, the URL requested, the HTTP status and your browser’s user-agent string. These are written to standard web-server logs.
- Anti-abuse data: when you submit a form we store a one-way hash of your IP address (not the address itself) together with a timestamp, so that we can rate-limit automated submissions.
- Your cookie choice: stored in your own browser, as described in our Cookie Policy.
We do not use tracking pixels, session recording, heat-mapping, fingerprinting or third-party advertising cookies unless you have given consent for the advertising category. We never ask for and do not want special-category data (GDPR Art. 9), payment card numbers, or personal identity codes (henkilötunnus) through this website.
3. Why we process it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answering your enquiry and preparing a proposal | Form data | Consent, GDPR Art. 6(1)(a); and pre-contractual steps at your request, Art. 6(1)(b) |
| Keeping the site available and secure | Server logs | Legitimate interest in network and information security, Art. 6(1)(f) |
| Preventing automated abuse of our forms | Hashed IP + timestamp | Legitimate interest in protecting our systems, Art. 6(1)(f) |
| Recording and honouring your cookie choice | Consent record in your browser | Legal obligation under the ePrivacy rules, Art. 6(1)(c) |
| Measuring advertising effectiveness (only if you consent) | Microsoft Advertising UET identifiers | Consent, GDPR Art. 6(1)(a) |
We do not use your data for automated decision-making or profiling, and we do not sell, rent or trade personal data to anyone, ever.
4. How long we keep it
- Enquiries that do not become engagements: 24 months from your last contact with us, then permanently deleted.
- Enquiries that become engagements: retained as part of the client record for the periods required by the Finnish Accounting Act (Kirjanpitolaki 1336/1997) — generally six years from the end of the accounting period, and ten years for accounting books and the chart of accounts.
- Web-server logs: 30 days, then rotated and deleted.
- Hashed IP anti-abuse records: 7 days.
5. Who can see it
Access inside the firm is limited to the staff who need it to answer your enquiry. Outside the firm, personal data is disclosed only to:
- Our hosting provider, acting as a processor under a written data-processing agreement, for the sole purpose of running the server.
- Microsoft Ireland Operations Limited, if — and only if — you consent to advertising cookies, for conversion measurement of Microsoft Advertising campaigns.
- Public authorities, where we are legally obliged to disclose (for example a lawful request from the Finnish Tax Administration).
Where your data is stored: this website runs on a server operated by Namecheap, Inc. in Los Angeles, California, United States. Personal data you submit through the forms on this site is therefore transferred outside the EEA. That transfer is made under EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), and the data is limited to the enquiry details listed in section 2 — we do not send accounting records, payroll data or any client material through this website. Client accounting work itself is not processed on this server.
6. Your rights
Under the GDPR you have the right to:
- ask what personal data we hold about you and receive a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased where there is no overriding legal obligation to keep it (Art. 17);
- ask us to restrict processing while a dispute is resolved (Art. 18);
- receive the data you gave us in a portable, machine-readable form (Art. 20);
- object to processing based on legitimate interest (Art. 21); and
- withdraw consent at any time, without affecting processing already carried out (Art. 7(3)).
Write to info@airistontilijakiinteisto.com. We respond within one month. If you are not satisfied, you may complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi), Lintulahdenkuja 4, 00530 Helsinki.
7. Security
The site is served exclusively over HTTPS with a valid TLS certificate. Form submissions are transmitted encrypted, validated server-side, rate-limited, and stored in a database that is not reachable from the public internet. Administrative access to the server is by SSH key only. We keep the operating system and application dependencies patched.
8. Changes to this policy
If this policy changes materially we will update the “last updated” date above and, where the change affects a consent you have given, ask for that consent again. This version is dated 1 September 2026.