Privacy policy

Art. 6(1)(b) — processing necessary in order to take steps at your request before entering into a contract. Art. 6(1)(f) — our legitimate interest, weighed against your rights and freedoms. Art. 5(2) — the accountability principle, which requires us to be able to demonstrate what we did and why. Art. 6(1)(a) — your consent, which you can withdraw at any time. Art. 7(1) — the duty to be able to show that consent was given.

The contact form never asks for a date of birth, an ID code or documents. The order form asks for a postal address. Only the questionnaire behind a personal link asks for a date of birth, ID numbers, citizenship, tax residency and documents, because the anti-money-laundering law requires it. No form on this site asks for a Ukrainian RNOKPP, an IBAN or card details. Minimisation is a legal requirement, and it is also the cheapest security control there is — data we do not hold cannot leak. The address and name are also shown in the internal “Contacts” view (owner and accountant) — so that nobody is mailed without a basis for it; no export.

The order form is the step you take to ask for our service. It runs on Art. 6(1)(b): we need these details to prepare the contract and the invoice. Its checkbox is evidence of what you were shown, exactly as on the contact form. You pay right after the order, on monobank’s page (see “Payments and subscriptions”), and the link to the questionnaire arrives as soon as the payment does.

The questionnaire has two parts: the company, and you personally. As an accounting firm we are an obliged entity under the Estonian Money Laundering and Terrorist Financing Prevention Act, which requires us to identify a client and the people behind it, and to assess the risk, before we start working together. That is Art. 6(1)(c), a legal obligation. If you do not give us this information, we cannot take you on.

One question needs a further basis: whether you, or someone close to you, is a politically exposed person. An answer can reveal political opinions, which the GDPR treats as a special category of data, so for that answer we also rely on Art. 9(2)(g) — substantial public interest, as laid down in the same Act.

Questionnaire answers and documents are used for two things only: our anti-money-laundering duties and the service contract with you. They are never copied into our list of enquiries, used for marketing or sent to website statistics; the order form and the questionnaire do not load Google Analytics at all.

Art. 6(1)(c) — processing necessary to comply with a legal obligation to which we are subject; here, the Estonian Money Laundering and Terrorist Financing Prevention Act. Art. 9(2)(g) — processing of a special category of data that is necessary for reasons of substantial public interest, on the basis of law. “(b), (c)” means both apply. Art. 6(1)(b), 6(1)(f) and 5(2) are explained in the contact form section above.

A client’s record never holds a copy of a passport, a document number or a personal identification code — those stay in the questionnaire, under its own rules. The company’s own details are kept until 7 years after the end of the year our work together ended; contact persons are deleted 12 months after the work ends. If you ask us to erase your data, your contact details are removed from the record at once; the company’s own details stay for their period, and we tell you so. The address and name are also shown in the internal “Contacts” view (owner and accountant) — so that nobody is mailed without a basis for it; no export.

A form open to the internet is a target. Left unprotected it fills with machine-generated submissions, and those submissions carry other people’s real names and email addresses — personal data we never had any reason to collect. Protecting the forms is therefore a data-protection measure first and an operational one second.

Your IP address is never written to our database. When a submission arrives, the address is combined with a secret and with the current date and put through SHA-256, and only that hash is stored. The date component means the salt changes every day: a hash recorded yesterday cannot be matched against one recorded today, and the stored values cannot be reversed by working through the address space. The same is done with your browser’s user-agent string.

Both hashes are erased 30 days after they are recorded, by a job that runs every night. The enquiry or order itself remains for as long as the retention table below says; the identifiers do not.

Cloudflare Turnstile runs on the contact form, the order form, the page where you ask for a new questionnaire link and the newsletter sign-up page. It checks whether a browser is behaving like a browser. It sets no advertising identifier and is not used to follow you between sites. Loading the widget does mean Cloudflare sees your IP address and some technical signals from your browser, in its own capacity as the provider of that service. Two further checks run silently on every one of them: a hidden field no human ever sees, and a signed timestamp that detects a form completed faster than a person could have read it. There are also limits on how many submissions arrive from one address in a minute and how many carry the same email address in a day. The questionnaire behind your personal link has limits of its own: on requests per minute, saves per day, and the number and total size of uploads; and a link is emailed again on request at most once every ten minutes. When you ask for a new link on the website, the address you type is used only to find your questionnaire; to count requests per address, we keep a keyed one-way hash of it for 48 hours, never the address itself. If we email a new link, or try to, our action log records the request against that questionnaire, with a salted hash of the IP address it came from — whoever made it — erased after 30 days. If we send the short automatic note that your message reached us, we keep, for 48 hours, keyed one-way hashes of your email address and of the network part of your IP address — never the address itself — so that the note goes to one address at most once a day and to one network only a few times.

If an anti-abuse check rejects a submission, nothing is stored. To avoid teaching automated tools which check caught them, the page may still report success. So if you do not hear from us within one working day, please write to the general address above instead — that always reaches a person.

Automated handling, and its limits

One automatic check reads the text of your message for the shapes spam takes: several links, embedded markup, a link whose script does not match the surrounding text. A message that matches is not rejected. It is flagged, set aside, and deleted after 30 days rather than kept for a year — because a machine-classified message holds somebody’s real details that we had no reason to collect.

That is the only automated evaluation of what you write. On the questionnaire, our admin screen highlights certain answers — a “Yes” to the PEP or sanctions questions, a higher-risk sector — so that they are not overlooked; it is a highlight for a person to read, not a score. Nothing here makes a decision about you that produces legal effects or similarly significantly affects you within the meaning of Art. 22: whether we take on a client is decided by our staff, who assess the money-laundering risk as the law requires. There is no automated scoring, no profiling for marketing and no advertising audience built from anything you send us. The newsletter’s statistics are only totals per issue; they are never used to profile anyone or to divide the list. If the filter ever misfiles a message of yours, the direct email address on our contacts page bypasses it entirely.

What this site stores is kept in the European Union. The database and the object stores — including the one that holds identity documents — were created with Cloudflare’s EU jurisdiction setting, which is chosen once, at creation, and cannot be added to an existing resource afterwards. Records written by this site stay inside that boundary.

Execution is a different question, and it is the part most policies skip. The code that produces a page, or accepts a form submission or an uploaded document, runs in whichever Cloudflare data centre is closest to the person making the request. If you open this site from outside the EU, the code handling your request runs there, and the contents of that request pass through it before being written to EU storage. Confining execution to a single region is an enterprise-tier feature that we do not have.

We would rather state that plainly than advertise a guarantee we cannot keep. Where data leaves the EEA in this way it is covered by the Standard Contractual Clauses in Cloudflare’s data processing addendum.

Of what the site itself sends, four things can leave the EU. The first is website statistics. If you allow them, the data is processed by Google, including in the United States. That transfer relies on the EU–US Data Privacy Framework — the European Commission adequacy decision of 10 July 2023 — under which Google LLC is certified; where the Framework does not apply, Google relies on the Standard Contractual Clauses. If you decline, no statistics are sent to Google at all. The second is email: the codes and links this site emails you, its alerts to our team and, for anyone who did not tick statistics, the newsletter go out through our mailbox at Google Workspace, described above, under the same Framework or the Standard Contractual Clauses. The third is the newsletter’s optional statistics. Brevo, a French company, hosts its data in France and Belgium, but staff of its group companies in the USA and India can reach it for maintenance and customer support — in the USA under the EU–US Data Privacy Framework or the Standard Contractual Clauses, in India under the Standard Contractual Clauses — and two of its suppliers, Cloudflare and Zendesk, may handle data in the USA too. If you do not tick statistics, nothing goes to Brevo. The fourth is a card payment. monobank is in Ukraine, outside the European Economic Area, and the European Commission has made no adequacy decision for Ukraine; what we send it — the invoice’s reference and purpose, the amount and, for a plan, the identifier under which it keeps your card — goes there because you chose to pay by card, which is necessary for the contract you asked for (GDPR Art. 49(1)(b)). The card details you type on its page go to the bank directly. Apart from the site: if you choose Telegram or WhatsApp for our answer, we write to you there, and that service carries the conversation under its own terms, possibly outside the EU — your choice; email is the default. There is no adequacy decision we can rely on for that: we send the answer there only because you asked for it, as part of answering your request (GDPR Art. 49(1)(b)).

For visitors in Ukraine: data reaching us is processed in the European Union, a destination Ukrainian law treats as providing an adequate level of protection for personal data. Website statistics, if you allow them, our email, the newsletter’s optional statistics, card payments, made with a Ukrainian bank, and an answer on the messenger you choose are the exceptions described above; the cookie notice names the USA before you answer.

One more sink deserves naming, because policies routinely omit it. Our hosting platform keeps a short-lived operational log of requests to the parts of this site that run code — errors, and the fact that an anti-abuse check rejected a submission. It is how we find out that something is broken. It holds no message content, no questionnaire answers, no documents, no link and no email address, it is retained for a few days and then discarded, and it sits on the same provider’s platform rather than inside the EU-jurisdiction database described above.

This is the question every Estonian accounting client eventually asks, so here is the answer before you have to ask it.

If you contacted us and never became a client, erasure is straightforward. Your enquiry is deleted outright, with everything attached to it. Nothing obliges us to keep it, so nothing does.

The questionnaire follows the same line. If you never submitted it, it is deleted on request with any documents you uploaded. If you submitted a part — whether we are still deciding on it or have declined it — a person looks at the request first: usually the questionnaire is deleted, but where we have relied on it to meet an anti-money-laundering obligation, it is kept for the period below and we tell you so. A client’s questionnaire, and a declined one we must keep, stay for their periods.

If you became a client, part of your data cannot be erased on request. Estonian law requires accounting source documents to be preserved for 7 years (Accounting Act § 12), and identification data collected under anti-money-laundering rules to be preserved for 5 years after the business relationship ends (MLTFPA § 47(1)). GDPR Art. 17(3)(b) states that the right to erasure does not apply where processing is necessary for compliance with a legal obligation under Union or Member State law. Those two obligations are exactly that case.

What we do instead is narrower than a refusal. Anything the law does not compel us to keep is deleted. Anything it does compel us to keep survives with the person removed from it wherever that is possible: the ledger entry remains, the identifying details around it are replaced with an irreversible marker. And we tell you which of the two happened and why, rather than reporting the request as complete while the data is still there.

For a contact person of a client company, erasure removes your name and contact details from our client record at once; the record of the company itself stays for its period.

If you have a subscription, erasure ends it at once: nothing more is charged, and your saved card is deleted at the bank. Your invoices and the subscription record stay for their accounting period, because the law requires us to keep them; a copy of your data includes them.

If you subscribed to the newsletter, erasure ends the subscription at once and, if you had ticked statistics, deletes your contact at Brevo. What stays is what proves we respected your choice: the one-way fingerprint that stops us mailing you again, and the record of your consent — without your address, only a fingerprint of it — for the period in “How long we keep things”, so that we can prove your consent if a complaint about an issue you received is made.

A record can also be placed under an explicit hold — because it is the subject of a dispute, an audit or an official request. A hold can cover everything we hold under one email address — or, for someone who contacted us only by phone, what we hold under their phone number — or a single questionnaire or client record — for example one an authority has asked about; the two are set and lifted separately, so lifting one never lifts the other. A questionnaire can be held for two people at once — say, the person who placed the order and the person who filled in the personal part — and lifting one person’s hold leaves the other’s in place. Either stops both routine deletion and erasure until it is lifted. A hold on a client’s record also keeps that record’s contact persons and linked enquiries from routine deletion while it lasts. A hold on one person keeps their own contact details, enquiries and questionnaire, and the client’s record they belong to — but not the details of the other people on that record, which are deleted on the usual date. Neither stops a contact person from having their own details erased, unless a hold covers them too. Setting or lifting a hold is a deliberate, logged act by a named person; the one exception is the holds already in place when we began keeping them in a single register — those were carried over into it automatically, each marked as carried over. While it lasts, it also covers what we later receive under the same email address; a hold on a phone number covers only later enquiries, and contact details without an email, under that number. If a hold is the reason we cannot erase something, we will say so and tell you what it is.