Privacy Notice – Umia Oy

Updated: September 7, 2026

1. Data Controller

  • Company: Umia Oy (Business ID: 3377672-9)
  • Address: Luotsikatu 9 A 8, 00160 Helsinki
  • Contact person: Elina Riutta
  • Email: elina.riutta@umia.fi
  • Phone: +358 40 5955 266

2. Purpose and Legal Basis for Processing

Managing assignments and communication: Performing and managing assignments from clients.

  • Legal basis: Legitimate interest of the data controller (managing the client relationship, assignment, and collaboration).

Invoicing: Invoicing fees and monitoring payment transactions.

  • Legal basis: Legitimate interest of the data controller (collecting receivables and financial administration).

Accounting and statutory obligations: Retaining receipts, invoices, and bank transaction records, as well as statutory official reporting.

  • Legal basis: Compliance with a legal obligation.

3. Processed Data and Data Sources

Data: Client’s and/or contact person’s name, title/role, company, email address, phone number, and billing, contract, and assignment details.

Sources: Data is collected directly from the client or the client organization in connection with commencing the assignment and day-to-day communication.

Website use and cookies: The website only uses cookies that are necessary for its functionality.

4. Data Recipients and Processors

Data is processed and disclosed to complete assignments and statutory obligations as follows:

  • Accounting firm: Acts as a personal data processor for handling accounting materials.
  • Email and cloud services (Microsoft): Managing communications and assignment materials (Outlook / Microsoft 365).
  • Bank (Nordea): Payment transactions.
  • Public authorities: To the extent required by law.

5. Data Transfers Outside the EU/EEA

Data is primarily processed within the EU/EEA. When using cloud services (Microsoft), data may be transferred outside the EU/EEA. In such cases, data transfers are based on the service provider’s (Microsoft) commitment to the EU-U.S. Data Privacy Framework and the European Commission’s Standard Contractual Clauses.

6. Data Retention

  • Accounting materials: Retained for the statutory duration required by the Accounting Act (accounting records and receipts and vouchers for 6–10 years from the end of the financial year).
  • Assignment and contact details: Retained for the duration of the active client or assignment relationship. Data will be deleted once there is no longer a valid ground for its retention.

7. Data Security

Access to devices and services is restricted with personal usernames and passwords. Devices are kept updated and protected.

8. Rights of the Data Subject

The data subject has the right to:

  • Gain access to their personal data and request the rectification of inaccurate data or the erasure of their data.
  • Request restriction of processing or object to processing based on legitimate interest.
  • File a complaint with the competent supervisory authority (Office of the Data Protection Ombudsman, www.tietosuoja.fi), should they consider the processing of their data to violate data protection regulations.

Requests regarding the exercise of these rights can be submitted to the email address given in Section 1.