Book an introduction

Privacy notice

Data protection and privacy

Disclaimer: This notice is written by Karma Accounts and has not been reviewed by a qualified data protection lawyer.

Last updated: 17 September 2026

1. Controller

The data controller is:

  • Legal name: Karma Accounts Oy
  • Business ID: 3651800-4
  • Registered office: Helsinki, Finland
  • Contact email: [email protected]

2. Website visitors

Our pages load no analytics, set no cookies of their own, use no local storage and make no requests to third parties: fonts, styles and images are served from the site itself. Cloudflare, our host, may set a strictly necessary security cookie (such as cf_clearance) if it has to check a request to protect the site.

The website is hosted by Cloudflare, Inc. (Cloudflare Pages). When you open a page, Cloudflare processes technical details of your request, such as your IP address, the page address and the time, to deliver and protect the website. It does this as our processor, but it also uses network traffic data for its own purposes, such as security and improving its services, as described in Cloudflare’s privacy policy. This data may be processed outside the EEA, including in the United States, for which Cloudflare relies on its EU–U.S. Data Privacy Framework certification (otherwise on the EU Standard Contractual Clauses). Cloudflare does not publish a fixed retention period for these logs on our plan; under its data processing terms it keeps them only as long as needed to provide its service to us. The request records we can see in our Cloudflare account go back at most 7 days, and we do not copy them elsewhere. The legal basis is our legitimate interest in delivering the website securely (GDPR Art. 6(1)(f)).

3. Enquiries by email

When you email us at [email protected], we process the email address and whatever information you provide to answer your enquiry. This is based on our legitimate interest in responding to you (GDPR Art. 6(1)(f)) or, where you are asking about becoming a client, on steps prior to entering a contract (GDPR Art. 6(1)(b)).

Emails are received in our Google Workspace (Gmail) account, provided by Google Cloud EMEA Limited (Dublin, Ireland), which processes them on our behalf as our processor. Our Google Workspace edition does not support choosing a data region, so Google may store and process emails wherever Google or its subprocessors have facilities, including the United States. For transfers to the United States Google relies on the EU–U.S. Data Privacy Framework (Google LLC is certified) and, where required for other transfers outside the EEA, on the EU Standard Contractual Clauses.

Enquiries that do not become clients are kept for a limited time before deletion.

4. Applications through the client portal

Applications submitted at https://books.karmaaccounts.com/signup collect your name, email, optional phone number, type of work, optional Business ID and business name, preferred language, an optional message, and the time consent was given. We store a keyed hash of your IP address, not the IP itself.

Submitting this form does not create an account. The application is reviewed by a person, your identity is verified, and a customer agreement is signed before an account is opened. The lawful basis for collecting this is steps prior to entering a contract (GDPR Art. 6(1)(b)).

The ERP system is hosted by UpCloud in Helsinki, Finland (an EU/EEA data centre).

5. Client accounting data

Important: Client accounting data is governed by a separate client privacy notice issued with your engagement. This website notice does not cover it.

As an accounting firm, we are subject to customer due diligence and record-keeping duties under the Finnish Act on Preventing Money Laundering and Terrorist Financing (444/2017). This is a legal obligation (GDPR Art. 6(1)(c)) to collect and retain customer due diligence data, including identity data, when a client relationship is established. These records are kept for five years from the end of the permanent client relationship, or five years from an occasional transaction (Act 444/2017, chapter 3, section 3).

Accounting records themselves are retained according to the Finnish Accounting Act for at least 10 years from the end of the financial year for the financial statements, annual report, ledgers, chart of accounts and list of accounting records, and at least 6 years from the end of the calendar year in which the financial year ended for vouchers, business correspondence and other accounting material (Accounting Act 1336/1997, chapter 2, section 10).

6. Your rights

You have the right to request access to your data, rectification of errors, erasure of your data, restriction of processing, objection to processing, and data portability. To exercise any of these rights, please email us at [email protected].

7. Complaints

If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority in Finland:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Website: tietosuoja.fi