Privacy Policy

1. Data Controller

Lakiasiaintoimisto A&Co. Legal Oy
Merikotkantie 1, 01450 Vantaa
tel. +358 45 1368392
email: helsinki@acolegal.fi

2. Register Name

Lakiasiaintoimisto A&Co. Legal Oy's client register, which includes the Lakipyyntö register of the A&Co. Legal application.

2a. Handling a Contact Request in Two Systems

When you submit a contact request (legal request) on the website, it is processed in two systems:

• Lakipyyntö register of the A&Co. Legal application: the request is stored in this register, where the firm's lawyers assess it, assign it for handling and record the stages of handling (status of processing, internal comments, conflict check).
• The firm's matter handling system: the same request is forwarded to the firm's matter handling system for receiving and handling the matter.
• Common purpose: assessing the contact request, contacting the client, and preparing and handling a possible engagement.
• Roles: the controller is Lakiasiaintoimisto A&Co. Legal Oy (section 1). Technical systems of external service providers are used to receive and handle contact requests. The roles and data protection responsibilities of those service providers are determined by the applicable agreements and data protection legislation.

3. Purposes and Legal Bases of Processing

Personal data is processed for the following purposes, each with its corresponding GDPR legal basis:

• Managing client relationships and assignments — contract (Art. 6(1)(b)): receiving, processing and forwarding legal requests to the handling system, drafting and fulfilling engagement agreements, providing legal services.
• Billing and financial administration — contract and legal obligation (Art. 6(1)(b) and (c)): creating, sending and tracking invoices, receiving payments, fulfilling accounting and retention requirements.
• Client communication — contract (Art. 6(1)(b)): contacting the client, acknowledgments and status updates.
• Statutory obligations — legal obligation (Art. 6(1)(c)): fulfilling authority requirements, accounting, retention duties.
• Website maintenance and security — legitimate interest (Art. 6(1)(f)): technical maintenance, information security and prevention of disruptions.
• Analytics and advertising measurement — consent (Art. 6(1)(a)): website usage analytics and Google Ads conversion tracking (a successful contact form submission and a phone link click), only if the user has given consent in the cookie banner. Consent can be withdrawn at any time.

3a. Advertising Measurement and Google Ads

The website uses Google Ads conversion tracking and its own website analytics. Measurement is activated only with your consent.

• Measured conversions: a successful contact form submission and a phone link click (tel: link).
• Analytics events only, not Ads conversions: a click on an email link and a click on a WhatsApp link.
• Advertising parameters: gclid, wbraid, gbraid and UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) that arrive with an ad click or campaign.
• Consent Mode: advertising and analytics storage (ad_storage, ad_user_data, ad_personalization, analytics_storage) is denied by default and activated only with your consent. Without consent, no conversions or advertising storage are sent.
• Recipient: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Data is processed in accordance with Google's advertising data processing and privacy terms (policies.google.com/privacy).

4. Data Content of the Register

The data stored in the register includes:

• Name and contact information (email, phone number, address)
• The situation described by the client and related information
• Documents and files related to the assignment
• Billing information and payment transactions
• Personal identity number (see section 5)
• Selected service and its subcategory
• Files and attachments submitted with the contact request
• Technical log data (server and platform access logs, such as timestamp and browser information), used to ensure the operation and security of the website
• Other information necessary for providing the service

5. Special Categories of Personal Data (GDPR Art. 9 and 10)

Law firm assignments may involve the processing of special categories of personal data (GDPR Art. 9) and data relating to criminal convictions and offences (GDPR Art. 10). These are processed only when necessary for the assignment. Family law matters (divorce, custody, child support) are not in themselves special category data, but may involve Art. 9 data such as health information.

• Health data (Art. 9): e.g. in personal injury, employment or custody cases where health is legally relevant.
• Personal identity numbers: identity numbers of the client and potential opposing parties, needed for authority matters and documents.
• Financial data: income information for legal aid applications, billing data and payment transactions.
• Data on opposing parties and witnesses: information necessary for carrying out the assignment.

5a. Legal Bases for Processing Special Category Data

The processing of special category data is based on the following legal grounds:

• Establishment, exercise or defence of legal claims (Art. 9(2)(f)): processing is necessary for the establishment, exercise or defence of legal claims in connection with the assignment.
• Criminal conviction and offence data (GDPR Art. 10 and Data Protection Act 7 §): processing is based on Section 7 of the Finnish Data Protection Act (1050/2018) and is necessary for the establishment, exercise or defence of legal claims. Processing of actual criminal records data is based on the Criminal Records Act (770/1993).

6. Sources of Data

Data is primarily obtained from the client themselves in connection with legal requests, engagement agreements, and client communication. Additionally, data may be collected from public registers, such as the Finnish Business Information System (YTJ), with the client's consent, and from authorities on the basis of statutory requirements.

7. Recipients and Service Providers

Data is not disclosed to third parties without the client's consent, unless required by law. Data may be disclosed to authorities on the basis of statutory requirements. The following service providers process personal data on our behalf:

• Base44 platform (website hosting, database and file storage): website hosting, client register and document storage. Data processing and transfers are governed by Base44, Inc., whose privacy practices and subprocessor list are publicly available at base44.com/dpa.
• Email service (Plus Five Five, Inc. (Resend)): sending invoices, reminders and invitations. Processing location: United States (account data, message content and delivery logs).
• Payment service (Stripe): creating invoice payment links and receiving payments. Stripe Ireland Ltd operates in the EU.
• Analytics: internal website analytics via the Base44 platform. The website does not use third-party analytics cookies.
• Advertising measurement (Google Ireland Limited): measuring Google Ads conversions (a successful contact form submission and a phone link click). Google Ireland Limited operates in the EU. Google Ireland Limited is an EU-based service provider (Gordon House, Barrow Street, Dublin 4, Ireland) that processes data in accordance with its advertising data processing terms.

8. Transfers Outside the EU/EEA

Personal data is transferred outside the EU or EEA in the following cases:

• Base44 platform: the client register, documents and other data are stored on the Base44 platform. Transfer safeguards: Some service providers may process data outside the EU and EEA. In such cases, safeguards required by applicable data protection legislation are used for the transfer. Further details are determined by the service provider's current data protection and contractual terms.
• Stripe (United States): payment data processing. Stripe Ireland Ltd operates in the EU, but some processing may occur in the United States. Transfer safeguards: Some service providers may process data outside the EU and EEA. In such cases, safeguards required by applicable data protection legislation are used for the transfer. Further details are determined by the service provider's current data protection and contractual terms.
• Email service (Plus Five Five, Inc. (Resend)): email delivery. Processing location: United States. Transfer safeguards: Some service providers may process data outside the EU and EEA. In such cases, safeguards required by applicable data protection legislation are used for the transfer. Further details are determined by the service provider's current data protection and contractual terms.
• Google (Google Ireland Limited): advertising measurement. Google Ireland Limited operates in the EU. Transfer safeguards: Some service providers may process data outside the EU and EEA. In such cases, safeguards required by applicable data protection legislation are used for the transfer. Further details are determined by the service provider's current data protection and contractual terms.

9. Data Retention Period

Personal data is retained as long as the client relationship is active and after its termination in accordance with statutory retention requirements. Unnecessary data is securely deleted. Retention periods for contact requests (the Lakipyyntö register and the related handling system) are retained only as long as the handling of the request and the preparation of a possible engagement require, and, where an engagement is formed, for the duration of the client relationship and in accordance with statutory retention obligations.

10. Rights of the Data Subject

The data subject has the right to:

• know what data has been stored about them
• request the correction of incorrect data
• request the deletion of data when possible
• restrict the processing of data in certain situations
• withdraw consent for data processing
• object to automated processing of data
• file a complaint with the data protection authority

11. Automated Decision-Making

The controller does not use automated decision-making or profiling that would have legal effects on the client or similarly affect them.

12. Data Protection

Personal data is processed with appropriate technical and organizational measures. Access to the data is limited to designated persons involved in processing the relevant assignment.

13. Contact

For privacy matters, contact us by email: helsinki@acolegal.fi