Request a free introduction

Privacy notice

Data protection and privacy

Disclaimer: This notice is written by Karma Accounts and has not been reviewed by a qualified data protection lawyer.

Last updated: 7 October 2026

1. Controller

The data controller is:

  • Legal name: Karma Accounts Oy
  • Business ID: 3651800-4
  • Registered office: Helsinki, Finland
  • Contact email: contact@karmaaccounts.fi

2. Website visitors

Our pages load no analytics, set no cookies of their own and request nothing from another domain: fonts, styles and images are served from the site itself. Ordinary browsing stores nothing in your browser's local storage. The one exception is the free invoice template, and only when you ask: if you tick “Remember my business details in this browser”, it keeps the details you entered under “Your business” (name, address, business ID, VAT number, IBAN, BIC, email, phone, and whether you are in the VAT register) in this browser's local storage, so they are filled in next time. It does not keep your customers' details or your invoices, and it sends nothing to us: the page's security settings do not let it make network connections. Unticking the box deletes the saved details, and so does clearing the site's data in your browser. Two things come from Cloudflare, our host, rather than from the pages. It may set a strictly necessary security cookie (such as cf_clearance) if it has to check a request to protect the site. And it asks browsers to report failed connections to Cloudflare (Network Error Logging). A browser that supports this — Chrome, Edge and other Chromium-based browsers do, Firefox and Safari do not — may, for up to seven days after a visit, send Cloudflare a report when it cannot reach the site: the address it tried, the page you came from, the kind of error and when it happened. The report reaches Cloudflare from your browser, with your IP address; Cloudflare says it keeps that address only while handling the report and does not log it.

The website is hosted by Cloudflare, Inc. (Cloudflare Pages). When you open a page, Cloudflare processes technical details of your request, such as your IP address, the page address and the time, to deliver and protect the website. It does this as our processor, but it also uses network traffic data for its own purposes, such as security and improving its services, as described in Cloudflare’s privacy policy. This data may be processed outside the EEA, including in the United States, for which Cloudflare relies on its EU–U.S. Data Privacy Framework certification (otherwise on the EU Standard Contractual Clauses). Cloudflare does not publish a fixed retention period for these logs on our plan; under its data processing terms it keeps them only as long as needed to provide its service to us. The request records we can see in our Cloudflare account go back at most 7 days, and we do not copy them elsewhere. The legal basis is our legitimate interest in delivering the website securely (GDPR Art. 6(1)(f)).

3. Enquiries by email

When you email us at contact@karmaaccounts.fi, we process the email address and whatever information you provide to answer your enquiry. This is based on our legitimate interest in responding to you (GDPR Art. 6(1)(f)) or, where you are asking about becoming a client, on steps prior to entering a contract (GDPR Art. 6(1)(b)).

Emails are received in our Google Workspace (Gmail) account, provided by Google Cloud EMEA Limited (Dublin, Ireland), which processes them on our behalf as our processor. Our Google Workspace edition does not support choosing a data region, so Google may store and process emails wherever Google or its subprocessors have facilities, including the United States. For transfers to the United States Google relies on the EU–U.S. Data Privacy Framework (Google LLC is certified) and, where required for other transfers outside the EEA, on the EU Standard Contractual Clauses.

Enquiries that do not become clients are deleted 12 months after the last message.

4. Quote requests through the website form

When you send the quote request form at karmaaccounts.fi/request-a-quote, we collect your name, email address, business form, expected turnover, whether the business pays salaries, the language you want to be served in and, if you give them, your Business ID or VAT number and a message. The request also records that you confirmed reading this notice, the language of the page you sent it from and the time it arrived. Like any web server, the ERP server also records technical data about the request, such as your IP address, to limit how many requests one connection can send and to keep the service secure.

We use this information only to answer your request and to prepare an offer. The legal basis is steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)). We do not add you to a newsletter or any mailing list, and we do not pass the information on to third parties.

The request is stored in our ERP system at https://books.karmaaccounts.com. The ERP system is hosted by UpCloud in Helsinki, Finland (an EU/EEA data centre). A request that does not lead to a client relationship is deleted automatically six months after it arrives, or six months after we last handle it if that is later, within a day of the six months ending. If you become a client, the request is kept for 12 months from that decision and then deleted; your client records are kept as described in section 7. We reply by email, and that correspondence is handled as described in section 3.

5. Offers to businesses

We sometimes email a limited company that may need accounting services, to offer ours. The company's name, business ID and registration details come from the public Trade Register (open data of the Finnish Patent and Registration Office), and the email address from the company's own website, where the company has published it. Where that address names a person, we process it on the basis of our legitimate interest in offering our services to businesses (GDPR Art. 6(1)(f)), and we write only about services that concern the company's accounts. We do not send these emails to sole traders.

Every such email says how to stop further messages. If you reply that you do not want them, or object at contact@karmaaccounts.fi, we put the address on a do-not-contact list and send it nothing more. Contact details of companies that do not become clients are deleted 12 months after the last message; the do-not-contact entry is kept so that we can respect it.

6. Applications through the client portal

Applications submitted at https://books.karmaaccounts.com/signup collect your name, email, optional phone number, type of work, optional Business ID and business name, preferred language, an optional message, and the time consent was given. The application record keeps a keyed hash of your IP address, not the address itself. Like any web server, the server also records the IP address of each request in its access logs, and in its application log when a signup is refused for too many attempts; both are used only for security and troubleshooting.

Submitting this form does not create an account. The application is reviewed by a person, your identity is verified, and a customer agreement is signed before an account is opened. An application that does not lead to an account is kept for six months and then deleted automatically, within a day of the six months ending. The lawful basis for collecting this is steps prior to entering a contract (GDPR Art. 6(1)(b)).

The ERP system is hosted by UpCloud in Helsinki, Finland (an EU/EEA data centre).

7. Client accounting data

Important: Client accounting data is governed by a separate client privacy notice issued with your engagement. This website notice does not cover it.

As an accounting firm, we are subject to customer due diligence and record-keeping duties under the Finnish Act on Preventing Money Laundering and Terrorist Financing (444/2017). This is a legal obligation (GDPR Art. 6(1)(c)) to collect and retain customer due diligence data, including identity data, when a client relationship is established. These records are kept for five years from the end of the permanent client relationship, or five years from an occasional transaction (Act 444/2017, chapter 3, section 3).

Accounting records themselves are retained according to the Finnish Accounting Act for at least 10 years from the end of the financial year for the financial statements, annual report, ledgers, chart of accounts and list of accounting records, and at least 6 years from the end of the calendar year in which the financial year ended for vouchers, business correspondence and other accounting material (Accounting Act 1336/1997, chapter 2, section 10).

8. Your rights

You have the right to request access to your data, rectification of errors, erasure of your data, restriction of processing, objection to processing, and data portability. To exercise any of these rights, please email us at contact@karmaaccounts.fi.

9. Complaints

If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority in Finland:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Website: tietosuoja.fi