--- title: "Privacy Notice" description: "Confidential handling of information is an essential part of our accounting services. This Privacy Notice explains how F.E.A. Nordic Oy processes personal data in managing client relationships, handling enquiries and operating its website, and describes your rights." --- # Privacy Notice **F.E.A. Nordic Oy — Clients, Contact Persons and Website Users** Last updated: 30 October 2026 Confidential handling of information is an essential part of our accounting services. This Privacy Notice explains how F.E.A. Nordic Oy processes personal data in managing client relationships, handling enquiries and operating its website, and describes your rights. ## 1. Data controller and contact details **F.E.A. Nordic Oy** Business ID: 2692128-9 Kansakoulukuja 3 A, 00100 Helsinki, Finland Email: [info@feanordic.fi](mailto:info@feanordic.fi) Telephone: +358 40 840 8888 You can send questions and requests concerning the processing of your personal data to the email address above with the subject line “Data Protection”. Please do not send personal identity numbers or confidential documents by ordinary email. Where necessary, we will arrange a secure way to provide the information. ## 2. When do we act as a controller or a processor? We act as a data controller when processing personal data to manage our own client relationships, invoicing, enquiries and website, and to fulfil our own statutory obligations. When providing accounting or payroll services on behalf of a client company and in accordance with its instructions, we generally act as a data processor. The client company acts as the controller, for example, for its employees’ personal data. This processing is governed by the client agreement and the applicable data processing terms. If your request concerns data we process on behalf of your employer or another client company, please contact that company first. Where necessary, we will help direct your request to the appropriate party. ## 3. What personal data do we process? We process only information necessary for the relevant purpose. This may include: - your name, job title and role within a company; - company name, Business ID and contact details; - email address, telephone number and preferred language; - information relating to requests for quotations, agreements, services and invoicing; - the content of enquiries and client communications; - information required to identify clients, their representatives and beneficial owners, including customer due diligence (KYC) information required by anti-money laundering law and politically exposed person (PEP) status when entering into a service agreement with F.E.A. Nordic; - technical website information, such as IP address, browser and device details, and access times; - messages you send to the chatbot and any contact details you voluntarily provide. Materials processed on behalf of our clients may also contain payroll, employment, payment and tax information. Such information is processed in accordance with the client’s instructions and the data processing agreement. ## 4. Why do we process personal data and what are the legal bases? ### Responding to enquiries and preparing quotations We process information to answer questions and prepare the services requested. This is based on our legitimate interest in handling business-related enquiries. If you are personally the prospective contracting party, processing may instead be necessary to take steps at your request before entering into a contract. ### Managing client relationships and services We use information to arrange services, communicate with clients and administer agreements. Processing is based on the performance of a contract where the individual is personally a party to that contract. Processing the information of corporate clients’ contact persons is based on our legitimate interest in managing client relationships and communicating with clients. ### Invoicing and statutory obligations We process necessary information for invoicing, our own accounting and compliance with statutory obligations. These obligations also include customer due diligence and the prevention of money laundering and terrorist financing. ### Website and service security Technical information is used to maintain service functionality, investigate faults and prevent misuse. This processing is based on our legitimate interest in protecting our services and their users. ### Processing based on consent Where a processing activity relies on your consent, we request it separately in connection with that activity. You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. When relying on legitimate interests, we also assess the effects on your privacy. You can contact us for further information about this assessment. ## 5. Where do we obtain personal data? We primarily obtain personal data from you, the company you represent, and communications during the client relationship or enquiry process. Where necessary, we obtain information about companies, their representatives and beneficial owners from public registers, such as the Finnish Trade Register and the Finnish Business Information System, and from services used for customer due diligence. Technical website information is generated when you use the website. Information processed on behalf of our clients is obtained from the client or from sources approved by the client. ## 6. Website chatbot Our website uses the Callvick AI assistant. Its purpose is to help visitors find information about our services, answer general questions and direct enquiries to a specialist where necessary. The chatbot uses Azure OpenAI, provided by Microsoft, to generate responses. The chatbot retrieves information from pre-approved public sources. It does not have a separate knowledge base built from client documents. The chatbot does not have access to our clients’ accounting, payroll, banking or tax-filing systems. Responses are grounded in retrieved information from approved public sources and include links to the pages used. If relevant information is unavailable or conflicting, the chatbot states the limitation and directs you to a member of staff. External search queries are limited to the general topic; names, contact details, confidential client information and full conversations are not intentionally sent to external search services or source websites. The chatbot may make mistakes. Its responses do not constitute personalised accounting, tax, legal or payroll advice. Questions concerning an individual client’s circumstances are referred to a member of our staff. A chat message does not establish an engagement, submit accounting documents or constitute an instruction to file a return or meet a statutory deadline. Please arrange such matters directly with our staff through the agreed channel. **Do not enter personal identity numbers, banking details, payslips, health information, tax documents or other confidential client information into the chat.** Submit such materials only through a separately agreed secure channel. When you use the chatbot, we process the content of your messages, any contact details you provide and the technical information necessary to operate the service. The information is processed to generate a response, handle your enquiry and maintain service security. Processing relies on the legitimate interests described in Section 4 or, where applicable, on steps taken before entering into a contract. Your data, including chatbot messages and responses, is not used to train AI models. Data processed through the chatbot is stored within the European Union. Chatbot logs are retained in active systems for 30 days from the creation of each entry and then deleted. Backup retention is described in Section 9. Using the chatbot is optional. You may also contact us by telephone or email. ## 7. Who may process or receive personal data? Personal data is accessible to authorised F.E.A. Nordic Oy employees only to the extent necessary for their duties. We also use service providers to operate and maintain our website and chatbot. The principal providers supporting the website and chatbot are: - **Abitech Oy (Business ID: 3273789-1)** — provides website maintenance, technical support and the Callvick chatbot service. Abitech acts as a data processor on behalf of F.E.A. Nordic Oy and processes website enquiries, chatbot conversations and associated technical data in accordance with our documented instructions. - **Google (Google Cloud) — provides cloud infrastructure and data storage on servers located in Finland.** - **Supabase (supabase.com)** — provides backend and database services used by the website and chatbot. - **Microsoft (Azure OpenAI)** — provides the AI model service used to generate chatbot responses. This involves processing the message content and context necessary to produce a response. User data is not used to train AI models. The providers listed here support the website and chatbot. Processing in our separate accounting and payroll services is governed by the relevant client arrangements. Service providers acting as processors or subprocessors are subject to contractual data protection and confidentiality obligations. Access to personal data is limited to what is necessary to provide, secure and support the relevant services. The chatbot is not connected to our clients’ accounting, payroll, banking or tax-filing systems. Using the chatbot does not give these providers access to those systems or their records. Personal data may also be disclosed to competent authorities where required by law and, where necessary, to auditors and legal advisers to the extent required for their duties. ## 8. Is personal data transferred outside the EU or EEA? Personal data relating to the website and chatbot is stored and processed using the following EU regions: Supabase — Germany; Microsoft Azure OpenAI — Sweden; Google Cloud — Finland. Personal data is not transferred outside the EU or EEA. ## 9. How long do we retain personal data? We retain personal data only for as long as necessary for the stated purpose or as required by law. - **Client and contract information:** for the duration of the client relationship and normally for five years after it ends, to the extent necessary for statutory obligations or the establishment, exercise or defence of legal claims. Records subject to specific statutory retention periods are retained under those requirements. - **Records forming part of our own accounting:** in accordance with applicable statutory retention periods. - **Customer due diligence information under anti-money laundering legislation:** generally for five years after the ongoing client relationship ends. Any longer retention requires a lawful basis. - **Chatbot conversations:** messages and responses are retained in active systems for 30 days from the date of each message or response, after which they are deleted. Backup retention is described below. - Contact details collected through website or chatbot enquiries: retained in Abitech’s active systems for 30 days after collection, after which they are deleted. Copies transferred to F.E.A. Nordic’s own email or client systems follow the separate retention periods applicable to those enquiries or client relationships. Backup retention is described below. - **Technical and security logs:** retained in active systems for 30 days from the date each log entry is created, after which they are deleted. Backup retention is described below. - **Backups of the website and chatbot service:** each backup is retained for no more than 90 days from its creation, after which it is deleted. Data deleted from active systems may remain in isolated backups until that period expires. Backups are used only for recovery; after recovery, previous deletions are reapplied. No new backups of data deleted from active systems are created. - **Materials processed on behalf of clients:** in accordance with the client’s instructions, the data processing agreement and applicable obligations. Information that is no longer needed is deleted or anonymised so that individuals can no longer be identified. When the website and chatbot service agreement with Abitech ends, personal data is returned or deleted as instructed by F.E.A. Nordic. Data remaining in Abitech’s active systems is deleted within 30 days after termination; shorter operational retention periods continue to apply and are not restarted or extended. Each backup is deleted no later than 90 days after its creation. Final deletion from backups may therefore occur up to 120 days after termination. Any retention required by law is limited to the necessary data and period. Returned copies held in F.E.A. Nordic’s own systems remain subject to its applicable retention periods. ## 10. How do we protect personal data? We protect personal data through appropriate technical and organizational measures. Access is restricted to people who need the information to perform their duties. Our staff are subject to confidentiality obligations. Confidential accounting documents are exchanged through secure services agreed with the client. ## 11. Personal data breach notifications If we become aware of a personal data breach, we promptly investigate, contain its effects and take necessary corrective action. We document the breach, its effects and the measures taken. When acting as controller, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a breach, unless it is unlikely to result in a risk to individuals’ rights and freedoms. If notification is delayed, we explain the reasons. Information may be provided in stages. If a breach is likely to result in a high risk to your rights and freedoms, we also inform you without undue delay as required by data protection law. We explain in clear language the nature of the breach, likely consequences and measures taken or planned, and provide a contact point and, where appropriate, advice on reducing harm. When processing data on behalf of a client company, we notify that controller without undue delay and assist it with its notification obligations. ## 12. Links to external websites Our website and chatbot responses may contain links to independent third-party websites. When you visit such a site, its own privacy notice applies to the processing on that site. We recommend reading it before providing personal data. This exclusion does not apply to the Callvick chatbot embedded in our website. Processing connected with its use remains covered by this Privacy Notice, even where external providers support its technical operation. ## 13. Cookies The main website does not use cookies. However, the chatbot uses cookies when you interact with it. The chatbot cookie stores a chat-session identifier to enable the requested chat function. The maximum session duration is 30 days. Where consent is required, the relevant cookies are used only after consent. You can also block or delete cookies through your browser settings; this may interrupt the chat session. You can also contact us by telephone or email without using the chatbot. ## 14. Your rights Subject to the conditions set out in applicable law, you have the right to: - receive information about the processing of your personal data and access your data; - request correction of inaccurate information; - request deletion of your data or restriction of processing; - object to processing based on legitimate interests on grounds relating to your particular situation; - receive the information you have provided in a portable format where processing is automated and based on consent or a contract; - withdraw your consent; - object to the use of your personal data for direct marketing. These rights do not apply without exception in every situation. For example, a statutory retention obligation may prevent us from deleting information. Please send your request to [info@feanordic.fi](mailto:info@feanordic.fi). Where necessary, we may request reasonable additional information to verify your identity. We normally respond within one month. If an extension permitted by law is necessary, we will inform you of the extension and the reasons within that month. You may lodge a complaint about the processing of your personal data with the Finnish Office of the Data Protection Ombudsman: [**tietosuoja.fi/en**](https://tietosuoja.fi/en/). ## 15. Is providing personal data mandatory? Contacting us and using the chatbot are voluntary. However, we need sufficient information to respond to your request and arrange the agreed services. If information necessary to enter into a contract or perform statutory customer due diligence is not provided, we may be unable to establish a client relationship or provide the service. Where necessary, we will explain which information is required and why. ## 16. Automated decision-making In the processing covered by this notice, we do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Responses generated by the chatbot are not such decisions. ## 17. Changes to this notice We update this notice when our services or personal data processing practices change. The current version is published on this page. Where appropriate, we will also notify you separately of significant changes.