Privacy Policy

Privacy Policy – Panka Investing Oy

Updated: 7.10.2026

1. Controller

Panka Investing Oy
Business ID: 3251391-9
Registered office: Lieksa, Finland

Data protection contact:
Timo Karppanen
timo.karppanen@pankainvesting.fi

2. Whose personal data do we process?

We may process personal data relating to:

• contact persons, responsible persons and beneficial owners of our client companies
• contact persons of prospective client companies
• website users who submit a contact form or background questionnaire

3. Purposes of processing and legal bases

We process personal data for the following purposes:

4. Personal data we process

Depending on the purpose of processing, we may process the following information:

• name and position in the company
• contact details, such as email address and telephone number
• company details, including Business ID and e-invoicing address
• agreement and invoicing information
• correspondence and other information provided in connection with the client relationship
• customer due diligence information required under the Finnish Anti-Money Laundering Act, including identity verification, beneficial ownership information, and PEP and sanctions screening information
• information concerning marketing opt-outs, so that we can respect your preferences

5. Sources of personal data

We primarily collect personal data directly from the data subject or their company.

We may also obtain information from publicly available sources, such as:

• the open data of the Finnish Patent and Registration Office (PRH)
• the Business Information System (YTJ)
• company websites
• the Vainu business information service
• identification and screening services

6. Data we process on behalf of clients

When we provide accounting or payroll services to a client, we may process personal data relating to the client’s employees and business contacts on behalf of the client.

In these situations, we act as a data processor and process the personal data in accordance with our agreement with the client and the TAL2023 general terms of the Association of Finnish Accounting Firms (Taloushallintoliitto).

The client company remains the data controller for this personal data.

7. Recipients and processors of personal data

We use service providers that process personal data on our behalf under appropriate agreements. These may include:

• Accounting software: Fennoa, Netvisor, Procountor and NoCFO
• CRM and invoicing: Koho
• Email and file storage: Google Workspace
• Electronic signatures: Visma Sign
• Messaging: WhatsApp Business and Messenger
• Website maintenance and hosting providers
• AI-based tools and assistants that support our work

We may disclose personal data to public authorities where required by law.

We do not sell personal data or disclose personal data to third parties for their own marketing purposes.

8. Transfers outside the EU/EEA

Some of our service providers, such as Google and Meta, may process personal data outside the European Union (EU) or European Economic Area (EEA).

Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework, where applicable.

The applicable safeguards are also addressed in the data processing agreements with our service providers.

9. Retention of personal data

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by law.

The retention periods include:

• Client relationship data: for the duration of the client relationship and thereafter for as long as necessary to settle any liabilities and claims.
• Customer due diligence data: for at least five years after the end of the client relationship, in accordance with Chapter 3, Section 3 of the Finnish Anti-Money Laundering Act.
• Our own accounting records: for the period required under the Finnish Accounting Act.
• Prospective client data: for a maximum of two years from the last contact.
• Marketing opt-outs: for as long as necessary to ensure that the opt-out is respected.

10. Your rights

Depending on the circumstances and applicable data protection legislation, you have the right to:

• access your personal data
• request correction of inaccurate or incomplete personal data
• request erasure of your personal data
• request restriction of processing
• receive your personal data in a structured, commonly used and machine-readable format and transfer it to another controller
• object to processing based on legitimate interest
• opt out of direct marketing at any time
• withdraw consent at any time where processing is based on consent

Personal data that we are legally required to retain cannot be erased before the applicable statutory retention period has ended.

To exercise your rights or ask questions about the processing of your personal data, please contact:

Timo Karppanen
timo.karppanen@pankainvesting.fi

You also have the right to lodge a complaint with the Finnish Office of the Data Protection Ombudsman:

Office of the Data Protection Ombudsman
tietosuoja.fi

11. Automated decision-making

We do not make decisions about data subjects based solely on automated processing, and we do not use profiling.

We do not use profiling that produces legal or similarly significant effects on data subjects.

12. Cookies

We use cookies and similar technologies on our website. Information about the cookies we use and how they are managed is provided in our separate Cookie Policy.