This policy describes how LG Business House Oy processes personal data in its operations, on its website, and in customer relationships. When processing accounting, payroll, or other financial management materials on behalf of a client, the client is generally the data controller, and LG Business House Oy acts as a data processor according to the client’s instructions.

2.1 LG Business House Oy as Data Controller

We are the data controller when we independently decide on the purposes and means of processing personal data. This applies, for example, to contact persons of our current and prospective clients, contract and invoicing information, website contact forms, newsletter recipients, and statutory Know Your Customer (KYC) data.

2.2 LG Business House Oy as Date Processor

In financial management services, we process personal data on behalf of our clients, including data of clients' employees, clients' own customers, suppliers, and other business partners. In these situations, the client determines the purposes of processing and acts as the data controller. The processing is based on an assignment agreement, documented instructions from the client, and a data processing agreement pursuant to Article 28 of the GDPR. Data subjects should generally address requests regarding this data to the relevant client.

Information is obtained directly from the data subject, the client company and its representatives, materials provided in connection with the assignment, the Trade Register, business and beneficial ownership registers, credit information services, and other public sources permitted by law. Data processed on behalf of the client is primarily obtained from the client or through the systems utilized by the client.

• Tax Administration, Incomes Register, Trade Register, and other competent official authorities;

• Pension and insurance companies, banks, auditors, and other parties involved in carrying out the assignment;

• Debt collection services, such as Intrum, if a claim is transferred for collection;

• Financial management and document processing services, such as Procountor or Procountor Solo and eTasku;

• Electronic signature service Finago Sign; and

• Providers of email, website, IT, backup, and information security services.

Service providers process data in accordance with agreements, confidentiality obligations, and data protection requirements. Sub-processors used on behalf of the client are subject to the data processing agreement concluded with the client.

We strive to use services where data is processed within the EU or EEA. However, some providers of email, cloud, information security, or support services may process data outside the EU or EEA. In such cases, the transfer is based on an adequacy decision by the European Commission, approved standard contractual clauses (SCCs), or another legal transfer mechanism pursuant to Chapter V of the GDPR. Further details regarding the applicable transfer mechanisms can be requested from our contact person.

• Contact Form Messages: A maximum of two years from the conclusion of processing the request, unless the message leads to a customer relationship or longer retention is necessary due to a legal claim.

• Newsletter and Marketing Data: Until consent is withdrawn or for a maximum of 24 months from the last recorded activity. Unsubscribe information may be retained to ensure that messages are not re-sent.

• LG Business House Oy’s Own Customer, Contract, Invoicing, and Accounting Records: For the duration of the customer relationship and thereafter for as long as statutory obligations, receivables, liabilities, or legal claims require. Vouchers and other accounting records for the company’s own accounting are retained for at least six years, and financial statements, accounting books, and chart of accounts for at least ten years from the date defined in the Accounting Act.

• Accounting and Payroll Materials Processed on Behalf of the Client: Materials are returned or delivered to the client upon termination of the assignment. Thereafter, the materials and their copies are deleted from LG Business House Oy’s systems and possession within the timeframe specified in the client’s documented instructions and the data processing agreement, unless LG Business House Oy has a separate statutory obligation to retain certain materials. The client is responsible for the statutory retention of their own accounting materials. Any separate archiving service must be agreed upon in writing.

• Know Your Customer (KYC) Data: Pursuant to anti-money laundering legislation, generally five years from the termination of a permanent customer relationship or the execution of an occasional transaction.

Data will not be erased at the request of a data subject if its continued retention remains necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims.

Personal data is protected using role-based access controls, strong passwords, multi-factor authentication where applicable, up-to-date hardware and software, regular backups, encrypted data transmission, as well as contractual and confidentiality obligations. Physical paper documents are stored in monitored or locked premises. Access rights are granted only to personnel who require access to the data to perform their duties.

Depending on the applicable legal basis and situation, the data subject has the right to obtain information about processing, access their data, request the rectification of inaccurate data, request the erasure of data or restriction of processing, object to processing based on legitimate interest, transfer data processed automatically on the basis of consent or contract to another system, and withdraw consent. Direct marketing can be objected to at any time.

Requests should be sent to info@accounting-businesshouse.fi. Identity may be verified if necessary. We respond without undue delay and generally within one month. When acting as a data processor on behalf of a client, we forward the request to the client acting as the data controller or assist them in processing the request.

The data subject has the right to lodge a complaint with the Office of the Data Protection Ombudsman if they consider that the processing of their personal data is unlawful. Further details and electronic forms are available at tietosuoja.fi.

LG Business House Oy does not make decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them. Personal data is not used for such profiling.

The website may use only technical cookies or similar technologies that are strictly necessary for its operation and security without separate consent. If analytics, user tracking, or marketing cookies are added to the site in the future, they will only be deployed with the user’s consent, and this policy along with any applicable cookie banner will be updated prior to implementation.

This policy is updated whenever there are material changes to the processing of personal data, the services utilized, or relevant legislation. The current version is always available at www.accounting-businesshouse.fi. Where appropriate, data subjects will also be notified directly of any significant changes.