Privacy and Cookie Policy

This Privacy and Cookie Policy explains how Töölön Osakeyhtiötoimisto Oy processes personal data on its website, in customer communications and in processes relating to the sale and purchase of Finnish limited companies and related services. We process personal data in accordance with the EU General Data Protection Regulation, the Finnish Data Protection Act, anti-money laundering legislation and other applicable laws.

1. Controller and contact details

Controller: Töölön Osakeyhtiötoimisto Oy

Business ID: 3435876-4

Address: Mannerheiminaukio 1, 00100 Helsinki, Finland

Email: toolo@osakeyhtiotoimisto.fi

Telephone: +35844 248 8709

Questions and requests concerning data protection may be sent to the email address above.

2. Whose data do we process?

We process personal data relating to:

• website visitors
• people who contact us, leads and newsletter subscribers
• customers, prospective customers and their representatives
• buyers and sellers of Finnish limited companies and their representatives
• shareholders, beneficial owners, board members, managing directors, procurists and other responsible persons
• contact persons of contractual and cooperation partners
• other individuals whose data must be processed to complete a company transaction, registration change, banking matter or legal obligation.

3. What personal data do we process?

The data depends on the customer relationship, service and our legal obligations. It may include:

• name, address, email, telephone number, language and other contact details
• date of birth, personal identity code, nationality and tax residence where necessary
• identity document details and copies, and remote-identification information
• company role, ownership interest, beneficial ownership and signatory rights
• customer due diligence information, including the purpose and nature of the business relationship, necessary source-of-funds information and results of politically exposed person and sanctions checks
• quotation, order, contract, signature, payment, invoicing and assignment data
• documents and information relating to company transactions, company background, registrations, banking services and authority filings
• messages, form responses, attachments, meeting and call notes, and customer service history
• marketing permissions and objections, newsletter data and campaign data
• IP address, browser, device, operating system, language, page views, clicks, session duration, traffic source, UTM data, cookie identifiers, consent choices and other log, analytics and security data.

We do not request special-category personal data unless processing is necessary and lawful in a specific case. Do not submit unnecessary sensitive information through a website form.

4. Where do we obtain data?

We obtain data:

• from you or the organisation you represent
• from our website, forms and the communication, analytics and consent tools we use
• from contracting parties, banks, accountants, lawyers and others involved in an assignment
• from public registers and authority sources, including PRH and YTJ services
• from credit and business information services, sanctions and PEP sources, and identity verification services
• from other legally permitted sources when needed to assess a company’s background, a person’s identity or a transaction.

5. Purposes and legal bases

Contract and pre-contractual steps: responding to enquiries, preparing company recommendations and quotations, managing assignments, completing company transactions and registration changes, assisting with banking matters, signing, invoicing and customer service.

Legal obligation: customer identification and due diligence, identification of beneficial owners and politically exposed persons, sanctions and money-laundering risk assessments, accounting and authority filings.

Legitimate interests: business administration, service development, lawful B2B communications and direct marketing, fraud prevention, information security, debt collection, and establishing, exercising or defending legal claims. We assess necessity and the effects on individuals before relying on legitimate interests.

Consent: non-essential cookies, analytics, advertising targeting, electronic direct marketing to consumers and other situations where we specifically request consent. Consent may be withdrawn at any time.

6. Customer due diligence and anti-money laundering

We comply with the Finnish Act on Preventing Money Laundering and Terrorist Financing. We may be entitled or required to request information and documents needed to identify the customer, representative and beneficial owner and to assess the purpose of a transaction, source of funds, ownership and control, and sanctions risks.

We may suspend a matter or refuse an assignment or transaction if sufficient information is not provided, identification cannot be completed reliably, or legislation, official guidance, sanctions obligations or our risk-based assessment so require. We may be prohibited by law from disclosing information about a suspicious transaction report or related review.

7. Recipients of personal data

To the extent required for the relevant purpose, we may disclose data or provide access to:

• authorities such as the Finnish Patent and Registration Office, the Finnish Tax Administration, the Financial Intelligence Unit and other competent authorities
• banks, payment service providers and insurance or financial-sector operators
• providers of electronic signatures, identity verification, accounting, invoicing, debt collection, customer relationship management, email, cloud storage and information security
• lawyers, auditors, accountants and other professional advisers
• parties to a company transaction or other assignment where disclosure is necessary
• website, analytics, consent-management and advertising providers described below.

Service providers process data under contracts and our instructions or in their own role as independent controllers. We do not sell personal data.

8. Website, analytics and advertising services

Our website is built on Webflow. We use CookieYes to manage cookie consent and Google Tag Manager to manage tags. Subject to your consent, we may use Google Analytics 4 for visitor analytics and Google Ads for measurement, targeting and remarketing.

We may later implement Meta Pixel and Meta Ads, LinkedIn Insight Tag and LinkedIn Ads, X Pixel and X Ads, and similar analytics or advertising technologies. They are used only after technical implementation, addition to the current cookie list and collection of the required consent before any tag fires.

The current list of cookies, service providers, purposes and expiry periods is available in CookieYes cookie settings. If this general description conflicts with the technical cookie list, the current technical list indicates which cookies are actually in use.

9. Transfers outside the EU and EEA

Some service providers may process data outside the EU or EEA, particularly in the United States. Where applicable, transfers rely on a European Commission adequacy decision, the EU–US Data Privacy Framework for certified recipients, European Commission Standard Contractual Clauses or another transfer mechanism permitted by the GDPR. We use supplementary technical, contractual and organisational safeguards where necessary.

10. Retention

We retain personal data only for as long as necessary for the purposes described in this policy or required by law. Typical periods include:

• customer due diligence data and related documents: five years after the end of a permanent customer relationship or completion of an occasional transaction, as required by Finnish anti-money laundering legislation, unless longer retention is required by law
• contracts, assignments, transactions and complaint materials: for the contractual period and generally up to ten years afterwards for the establishment and resolution of liabilities and legal claims
• accounting records: for the period required by Finnish accounting legislation, generally six or ten years depending on the material
• enquiries and leads that do not become customers: generally up to 24 months after the last interaction
• marketing data: until consent is withdrawn or marketing is objected to; suppression data may be retained afterwards to respect the objection
• analytics data: according to the settings of the service in use, typically up to 14 months at event level
• cookie-consent logs: for as long as reasonably necessary to demonstrate consent
• security and server logs: generally up to 12 months unless a security incident or legal claim requires longer retention.

When there is no longer a legal basis for retention, data is deleted or anonymised.

11. Security

We use technical and organisational safeguards appropriate to the risk, including encrypted connections, access restrictions, strong authentication where supported, logging, backups, data minimisation, confidentiality obligations, staff instructions and contractual controls over service providers.

No electronic system is entirely risk-free. If a personal data breach occurs, we act in accordance with applicable law and notify the competent authority and affected individuals where the notification thresholds are met.

12. Your rights

Subject to applicable legal restrictions, you may have the right to:

• obtain confirmation of processing and access your personal data
• request correction of inaccurate or incomplete data
• request erasure
• request restriction of processing
• object to processing based on legitimate interests and to direct marketing
• withdraw consent at any time
• receive personal data you provided in a machine-readable format and transmit it to another controller where the right applies.

These rights are not absolute. Anti-money laundering legislation may require us to retain data and may restrict access in certain situations. We verify the requester’s identity before fulfilling a request. We respond without undue delay and normally within one month.

13. Automated decision-making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects. We may use analytics, segmentation and risk signals to support our work, but significant customer and company-transaction decisions are assessed by a person.

14. Complaints

If you believe your personal data has been processed unlawfully, please contact us first so that we can investigate. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland or another competent supervisory authority in the EU or EEA.

15. Children

Our services are intended for people planning or carrying on business and are not directed to children under 16. We do not knowingly collect children’s personal data through the website.

16. Changes to this policy

We may update this policy when our operations, service providers or applicable laws change. The current version is published on this page and the date of the latest update appears at the top.

17. Cookies and similar technologies

We use cookies and similar technologies to operate the website, remember choices and, with your consent, conduct analytics and advertising.

Strictly necessary cookies support the website, security and consent choices. They may be used without separate consent.

Functional cookies remember preferences or enable added features. They are used with consent unless strictly necessary for a function you specifically request.

Analytics cookies help us understand website use and improve the service. GA4 and other non-essential analytics tools fire only after consent.

Advertising and social media cookies support conversion measurement, audiences, remarketing and advertising performance on services such as Google, Meta, LinkedIn and X. They are used only with consent and only after the relevant service has been implemented.

You can accept or reject non-essential cookies by category in the CookieYes banner. You can change or withdraw your choices at any time through the “Cookie settings” link in the footer. Withdrawal prevents future use of the relevant tags but does not affect the lawfulness of processing before withdrawal.

The current cookie list, provider, purpose and expiry period for each cookie are available in cookie settings.