Privacy and terms
Two documents on one page: the privacy policy, and the terms of use for this website. The bookkeeping service itself is governed by your assignment agreement and TAL2023.
Updated 18 September 2026.
Privacy policy
Who is responsible for your data
tiliguru.fi is a registered trade name of HR-tilipalvelu Oy, and HR-tilipalvelu Oy is the controller.
HR-tilipalvelu Oy, Business ID 2513128-5, Bulevardi 19 A, 00120 Helsinki, Finland. kirjanpito@tiliguru.fi, +358 9 231 216 18.
What we collect, why, and on what legal basis
| Data | Purpose | Basis |
|---|---|---|
| Name, email, phone, company name and Business ID | Answering enquiries and providing the service | Contract, Art. 6(1)(b) |
| Identity documents and personal identity code | Verifying identity, as an accounting firm is required to | Legal obligation, Art. 6(1)(c) |
| Anti-money-laundering KYC data | Meeting obligations under the AML Act | Legal obligation, Art. 6(1)(c) |
| Bookkeeping and payroll material | Providing the bookkeeping service | Contract and legal obligation: see the section on two roles |
| Invoicing and payment history | Invoicing and debt recovery | Contract, Art. 6(1)(b) |
| Site usage and cookies | Site operation and visitor statistics | Consent for non-essential cookies (Art. 6(1)(a)), legitimate interest for essential operation (Art. 6(1)(f)) |
| Marketing to existing clients | Telling you about our services | Legitimate interest, Art. 6(1)(f). You may object at any time |
Special categories of personal data are not processed as a matter of routine. Where payroll requires information on sick leave or trade union membership, the processing is based on Article 9(2)(b), which concerns employment law obligations.
Two different roles, and why it matters
We process personal data in two distinct roles, and your rights differ between them.
- As controller, we process data about you as a visitor, a prospective client and a client: contact details, the client relationship, our own invoicing, identity verification, anti-money-laundering obligations and marketing.
- As processor, we process the personal data contained in your bookkeeping material, in which case your business is the controller and we act on your instructions: your customers’ details, your employees’ payroll data, and the contents of the receipts and invoices you send us.
The terms of the processor role are set out in the assignment agreement and its data processing terms.
Where the data comes from
Mostly from you. We also receive data:
- from the Finnish Patent and Registration Office (PRH) and the Business Information System, when we verify a Business ID
- from your bank, through the machine-readable statement feed you authorise
- from the Tax Administration and the incomes register, during the service
Who we share it with
We do not sell personal data. We disclose it only where the service or the law requires:
- Fennoa: the bookkeeping system the service runs on
- The Finnish Tax Administration: tax returns, VAT and own-initiative taxes
- The incomes register: reporting payroll data
- Perintäritari Oy: debt collection, when a client invoice goes unpaid
- Insurance companies: when insurance is arranged or declarations are filed
- Banks: for payment traffic
- Google Workspace: email and document handling
- Google Ireland Ltd: Google Analytics, visitor statistics, with consent only
- Google Ireland Ltd: Google Maps, the map on the contact page. It loads only after you ask for it, and then Google sees your IP address. You can open the address in Google Maps yourself instead, in which case nothing loads on this page.
- Microsoft Ireland Operations Ltd: Microsoft Clarity, session recording, with consent only
- Cloudflare: site delivery, spam protection on the contact form, and the technical platform for the chat service
- Google: chat conversations into our Google Chat workspace, and AI assistant messages to the Gemini model; see the chat service section
- Authorities where we are legally obliged to disclose, including money laundering reports
Where we are obliged to report a suspicion to the Financial Intelligence Unit, we are not permitted to tell you that we have. That is a statutory prohibition, not a choice.
Transfers outside the EU and EEA
The core of our service operates inside the EU and EEA. Where a service provider processes data outside the EU and EEA, the transfer relies on the European Commission’s standard contractual clauses or on an adequacy decision.
Security
Data is held in systems with access control and encryption in transit. Access is limited to those who need it for their work, and everyone handling client data is bound by a duty of confidentiality.
How long we keep it
| Material | Retention |
|---|---|
| Vouchers and running bookkeeping material | 6 years from the end of the calendar year in which the financial year ended |
| Accounting books, financial statements, chart of accounts and method descriptions | 10 years from the end of the financial year |
| Anti-money-laundering KYC data | 5 years from the end of the client relationship |
| Client relationship and agreements | For the duration of the relationship, then within the statutory retention periods |
| Enquiries that did not become a client relationship | 12 months |
| Site logs and cookies | See the cookies section |
Retention periods follow the law rather than a choice. We cannot delete bookkeeping material on request where the law obliges us to keep it.
Your rights
Under the GDPR you have the right to:
- access your personal data: the first copy is free
- have inaccurate data corrected and incomplete data completed
- have data erased where we are not obliged to retain it
- restrict or object to processing in certain situations
- data portability in certain situations
- withdraw consent at any time where processing is based on consent
To exercise these, write to kirjanpito@tiliguru.fi. We respond within one month. We may have to verify your identity first.
If you are not satisfied with how we have handled your data, you can lodge a complaint with the Finnish Data Protection Ombudsman:
Office of the Data Protection Ombudsman, Lintulahdenkuja 4, 00530 Helsinki (PO Box 800, 00531 Helsinki). tietosuoja.fi, +358 29 566 6700.
Cookies
This site sets no tracking cookies of its own and shows no advertising.
Necessary cookies are required for the site to work and cannot be switched off: spam protection on the contact form (Cloudflare Turnstile) and storing your cookie choice in your browser. Turnstile sets the cookies cf_clearance and __cf_bm; the second expires after 30 minutes of inactivity.
Statistics run only with your consent: Google Analytics and Microsoft Clarity. They tell us which pages get read, where visitors come from and how the page is used. Clarity also records an anonymised replay of mouse movement, scrolling and clicks; it masks the contents of form fields automatically and that cannot be switched off. Microsoft retains recordings for 30 days, and heatmaps and aggregated data for 9 months, after which they are deleted including from backups.
The map on the contact page is embedded from Google Maps and is not loaded until you press Show the map, or until you have allowed embedded content. Until then nothing is requested from Google and it learns nothing about your visit.
You give or withhold consent on your first visit, and you can change it at any time from the Cookie settings link in the footer. You can also block or delete cookies in your browser settings, in which case parts of the site may stop working.
Changes to this policy
We update this policy when our processing changes. The version in force is always on this page, and the date it was last updated is at the top. We tell clients directly about material changes.
Website chat service
What we process
Opening the chat window stores nothing. Processing begins only when you send your first message.
- the content of your messages and the times of the conversation
- your name and email address, requested only when you ask to speak to a colleague; a phone number is optional
- any files you attach, which is possible only after that handover
- your browser type and a salted hash of your IP address. We do not store the address itself, and the hash is used only to prevent abuse
Please do not send personal identity codes, banking credentials or other particularly sensitive information through the chat. Use the portal or another agreed channel for those.
AI assistant
Your questions are answered first by an AI assistant, not a person. You can ask to speak to a colleague at any time and we will hand the conversation over. The assistant uses Google’s Gemini model, and your messages are sent to Google in order to generate a reply.
The assistant does not make decisions about you, and its answers are not a binding offer.
Purpose and lawful basis
We process this data on the basis of our legitimate interest in responding to your enquiry, and where you ask about purchasing a service, on the basis of steps taken prior to entering into a contract.
Who we share it with
- Google: conversations are delivered into our Google Chat workspace, where our colleagues read and answer them. Google also processes the messages handled by the AI assistant.
- Cloudflare: the technical platform for the service; conversations and attachments are stored in Cloudflare’s services.
Some processing may take place outside the EU. Such transfers rely on the European Commission’s standard contractual clauses.
Retention
Conversations and their attachments are deleted automatically once 12 months have passed without a new message.
If a conversation leads to a client relationship, related information may be retained longer as required by accounting and anti-money-laundering law.
Browser storage
The chat stores a token in your browser’s localStorage so you can return to your own conversation. It lasts 7 days, contains no personal data, and is strictly necessary for the service to work, which is why it sits in the Necessary row of the cookie banner rather than behind a toggle.
Your rights
You have the right to access your data, correct it, request its deletion and object to processing. Requests: kirjanpito@tiliguru.fi. You may also lodge a complaint with the Finnish Data Protection Ombudsman.
Contact for the chat service
kirjanpito@tiliguru.fi · +358 9 231 216 18 · Bulevardi 19 A, 00120 Helsinki, Finland
Terms of use
These terms, and the ones that actually govern the service
These terms cover the use of this website. The bookkeeping service itself is governed by three documents:
- the assignment agreement you sign
- TAL2023, the general contractual terms of the Finnish financial administration industry
- the price list in force at the time
If this website and those documents conflict, those documents prevail. Nothing on this site is a binding offer.
Who provides the service
tiliguru.fi is a registered trade name of HR-tilipalvelu Oy. HR-tilipalvelu Oy is an authorised accounting firm, Business ID 2513128-5, domiciled in Helsinki.
When charging begins
Using this website or contacting us incurs no charge. Charging begins once you have accepted the general terms and signed the assignment agreement.
The information on this site
We keep this site up to date, but:
- Prices are indicative until confirmed in your assignment agreement. All prices are shown VAT 0 %; Finnish VAT is added as the law in force requires.
- Nothing here is accounting, tax or legal advice. General information on a web page cannot take your situation into account. Advice you receive as a client during the service is a different matter.
- Prices are reviewed once a year with at least a month’s notice. The next planned review is 1 January 2027.
Changing your plan
You can change plan free of charge each quarter by telling us by email before the new period begins.
Ending the agreement
Notice on the assignment agreement is three months, counted from the end of the month in which notice is given, in accordance with TAL2023.
Liability
Our liability is limited in accordance with the TAL2023 general contractual terms. We are not liable for interruptions to this website, to Fennoa or to other third-party systems beyond what the assignment agreement and TAL2023 require.
Your obligations as a client
These are set out in full in the assignment agreement. In summary, the service requires:
- a business bank account at a Finnish bank that provides a machine-readable statement
- receipts delivered within one month of the month they concern
- purchase invoices paid through the system with the documents attached
- every receipt entered into the system, including cash and card purchases
- the material you provide to be accurate and complete
We are not liable for consequences arising from late, incomplete or inaccurate material.
Intellectual property
The content of this site belongs to HR-tilipalvelu Oy unless stated otherwise, and may not be copied commercially without permission.
Governing law and disputes
Finnish law applies. Disputes are settled in the District Court of Helsinki, unless mandatory legislation provides otherwise.