1. Who is responsible for your data
The data controller is Bokföringsbyrå Lundström Ab, a Finnish limited company. Our full registration details are:
- Legal company name: Bokföringsbyrå Lundström Ab
- Company form: Aktiebolag / Osakeyhtiö (Finnish limited company)
- Business ID (Y-tunnus): 0519474-8
- EU VAT number: FI05194748
- Registered address: Nybrovägen 9, 04130 Sipoo, Finland
- Country: Finland (EU / EEA)
- Telephone: +358 40 301 7891
- E-mail: support@bokforingsbyralundstromab.com
For any question about this policy or about your personal data, write to support@bokforingsbyralundstromab.com or telephone +358 40 301 7891. We have not appointed a designated Data Protection Officer, as we are not required to under Article 37 GDPR; enquiries are handled by the company’s management.
2. What personal data we collect through this website
This website is a business-to-business site. We do not ask for, and do not want, special categories of personal data, personal identity codes, bank credentials or payment card details. Through this website we collect only:
- Consultation and contact form data — company name, Business ID if you choose to give it, contact person’s name, business e-mail address, telephone number if you give it, the service category selected, and the message you write.
- Consent record — the cookie choice you made, the version of the notice you were shown, and the time you made it, stored in the
lundstrom_consentcookie in your own browser. - Server log data — IP address, request time, URL requested, HTTP status, referrer and user-agent string, written by the web server for security and troubleshooting.
- Abuse-prevention signals — whether a hidden trap field in a form was filled in, and how long the form was open before submission. These distinguish automated submissions from real ones.
3. Why we process it, and on what legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Responding to a consultation or contact enquiry | Art. 6(1)(b) — steps at your request before entering a contract | 24 months |
| Keeping a record of the consent you gave | Art. 6(1)(c) — legal obligation to demonstrate consent | 24 months |
| Site security, abuse prevention and troubleshooting | Art. 6(1)(f) — our legitimate interest in a working, non-abused website | Server logs: 30 days |
| Statistics and advertising measurement | Art. 6(1)(a) — your consent, given in the cookie banner | Until consent is withdrawn |
| Performing an engagement once you become a client | Art. 6(1)(b) contract and Art. 6(1)(c) statutory bookkeeping obligations | As required by the Kirjanpitolaki 1336/1997 (Finnish Accounting Act) |
We do not carry out profiling or automated decision-making that produces legal effects concerning you. We do not sell personal data, and we do not pass it to data brokers, advertising networks or list resellers.
4. Where your data is stored and who can see it
Website enquiries are stored in a database on a server located in the European Union and are accessible only to our own staff who need them to answer you. We do not transfer personal data collected through this website outside the EU/EEA. If that ever became necessary, we would rely on an adequacy decision or on Standard Contractual Clauses under Article 46 GDPR, and would update this policy before doing so.
Processors we use in connection with this website:
- Hosting and e-mail delivery — the provider of the virtual server on which this site runs, under a written data processing agreement.
- Map display — the map on the Contact page is loaded from openstreetmap.org, which receives your IP address in order to serve the map tiles and does not set advertising cookies.
- Advertising measurement — only if you consent to marketing cookies, Microsoft Advertising receives a measurement signal indicating that a visit resulted in an enquiry. Consent Mode signals are set to denied by default and only change if you accept.
5. Your rights
Under the GDPR you have the right to:
- ask what personal data we hold about you and receive a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have data erased where we no longer have a basis to keep it (Art. 17);
- ask us to restrict processing while a dispute is resolved (Art. 18);
- receive the data you gave us in a portable format (Art. 20);
- object to processing based on legitimate interest (Art. 21), including the security logging described above;
- withdraw consent at any time, without affecting processing already carried out.
Write to support@bokforingsbyralundstromab.com and we will respond within one month, as Article 12(3) requires. If you are not satisfied with how we have handled your data you may complain to the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Finland, which is the competent supervisory authority in Finland.
6. Cookies
This website sets no cookies beyond the strictly necessary one recording your own consent choice until you tell it otherwise. Every cookie is named and explained in the Cookie Policy, and you can change your choice at any time using the “Cookie preferences” link in the footer.
7. Security
The site is served only over HTTPS with a valid certificate. Form submissions are validated and rate-limited on the server, database access uses parameterised statements, and administrative access to the server requires key-based authentication. No system is perfectly secure, but we will notify you and the supervisory authority as Articles 33 and 34 require if a breach affecting your data occurs.
8. Changes to this policy
If we change how we handle personal data we will update this page and the date at the top. Where a change is material and we hold your contact details in connection with a live enquiry or engagement, we will tell you directly rather than rely on you noticing.
Bokföringsbyrå Lundström Ab · Business ID 0519474-8 · EU VAT FI05194748 · Nybrovägen 9, 04130 Sipoo, Finland · support@bokforingsbyralundstromab.com · +358 40 301 7891