Privacy policy
Updated 8 October 2026
This policy explains what personal data we process when you use emberg.fi, send a form or write to us in the chat. It follows Article 13 of the EU General Data Protection Regulation (2016/679). The Finnish version (Tietosuojaseloste) is the primary one; if the two differ, the Finnish text applies.
1. Controller
Emberg Group Oy
Business ID 3341667-8
Arielinkatu 16, 00540 Helsinki, Finland
Email: [email protected]
Phone: +358 50 438 1672
For data protection questions, contact Anastasia Emberg: [email protected]. We have not appointed a data protection officer.
2. What data we process
Contact form: name, email address, phone number (if you give it), company name (if you give it), topic and message.
Quote request form: company name, business ID (if you give it), company form, estimated number of documents and people on payroll, current accounting software (if you give it), email address, phone number (if you give it) and notes.
Chat: your messages, the topic you choose, the page you wrote from, the site language, and your name, email address or phone number if you give them so we can reply after you leave the page. A chat session ID is stored in your browser (see section 7).
Email and phone: if you contact us directly, we process your contact details and what you write.
Technical data: IP address, browser and device details, time of the request and the result of simple spam checks on the server. We need these to run the site, keep it secure and stop spam.
Please don't send personal identity codes, bank credentials or other sensitive data through the forms or chat. If your matter needs them, we'll agree a safer way.
3. Why we process data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to you, arranging a free consultation and preparing a quote | Steps taken at your request before entering into a contract (Art. 6(1)(b)). For general questions, our legitimate interest in answering messages sent to us (Art. 6(1)(f)) |
| Running the chat and replying by email if you leave the page | Pre-contract steps (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) |
| Running the site, security, preventing abuse and spam | Legitimate interest (Art. 6(1)(f)) |
| Managing the customer relationship if you become a client | Contract (Art. 6(1)(b)) and legal obligations such as the Finnish Accounting Act (Art. 6(1)(c)) |
Giving us your data is voluntary, but without an email address or phone number we can't reply.
We don't sell your data, and we don't use it for direct marketing without your separate permission.
4. Where the data comes from
From you. Technical data is created when your browser connects to the site.
5. Who processes the data
At Emberg Group Oy, only the people who need the data to reply to you can see it. We also use these service providers:
Cloudflare, Inc. (United States)
Hosting, server functions for the forms and chat, chat message storage and forwarding of @emberg.fi email. Cloudflare acts as our processor. Data may be transferred to the United States under the EU–US Data Privacy Framework, in which Cloudflare participates, and the standard contractual clauses in Cloudflare's data processing addendum.
Usercentrics A/S (Cookiebot), Denmark
The cookie banner. When you make a choice, Cookiebot stores a consent record so we can show that consent was given: a consent ID, the date and time, the choices you made and a shortened IP address. The data is processed in the EU.
Telegram
Form submissions and chat messages arrive as notifications in our company Telegram account, and we answer chat messages through Telegram. A notification contains the message, the topic and any contact details you gave. Telegram is provided by Telegram FZ-LLC (Dubai, United Arab Emirates) and Telegram Messenger Inc.. These companies operate outside the EU, and there is no EU adequacy decision for these countries. The transfer takes place because it is necessary for the pre-contract steps you asked for (Art. 49(1)(b)). We send to Telegram only what we need to reply. If you'd rather your message didn't pass through Telegram, email [email protected] instead.
Google (Gmail)
Email sent to @emberg.fi addresses is forwarded to a Gmail mailbox, where we read and answer it. In the EEA the service is provided by Google Ireland Limited. Data may also be processed on Google LLC servers in the United States under the EU–US Data Privacy Framework and standard contractual clauses.
We disclose data to authorities only when the law requires it.
Fonts are served from our own server and the map is an image, so opening the site doesn't connect your browser to Google or other third-party services.
6. How long we keep data
| Data | Retention |
|---|---|
| Chat conversations | 90 days from the last message, then deleted automatically. Telegram notifications are deleted on the same schedule |
| Form messages and emails | Up to 24 months from the last contact, unless you become a client |
| Client data | For the duration of the relationship and afterwards as long as the law requires. Under the Finnish Accounting Act, for example, vouchers are kept for six years and financial statements for ten |
| Technical logs | Cloudflare's short-term logs |
Cookie choice (CookieConsent cookie) | 12 months or until you change your choice |
| Chat session ID in your browser | Until you clear browser storage, at most 90 days |
When we keep a client's books or run their payroll, we process the personal data in the client's material on the client's behalf under our client agreement. That is agreed separately and is not covered by this policy.
7. Cookies and browser storage
The site uses only storage it needs to work:
| Name | Purpose | Duration |
|---|---|---|
CookieConsent (Cookiebot) | Remembers what you chose in the cookie banner | 12 months |
| Chat session ID (localStorage) | Keeps your messages in one conversation. Created only when you open the chat | Up to 90 days |
__cf_bm (Cloudflare) | Tells people and bots apart and protects the site | 30 minutes |
We don't use analytics or marketing cookies. If we add them later, we'll ask for your consent first and update this policy. You can change your choice with the "Cookie settings" link at the bottom of every page.
8. Your rights
You have the right to:
- know what data we process about you and get a copy
- have incorrect data corrected
- have your data erased
- have processing restricted
- object to processing based on our legitimate interest
- receive the data you gave us in a machine-readable format, where processing is based on a contract
Send your request to [email protected]. We'll reply within one month. We may ask you to confirm your identity before we release any data.
If you think we process your data unlawfully, you can complain to the Office of the Data Protection Ombudsman in Finland: tietosuoja.fi/en.
9. Automated decisions
We don't make automated decisions or profile visitors.
10. Security
The site uses encrypted HTTPS connections. Access to data is limited, and our service accounts use two-factor authentication. Chat and Telegram bot credentials are stored encrypted in Cloudflare's environment settings.
11. Changes
We update this policy when our services or the law change. The current version is always on this page, with the update date at the top.
---