Privacy Notice
Updated: 12 August 2026
1. Who is behind this website
KHT-tilintarkastus is the name and domain of this website. It is a brand, not a company and not a legal person.
The website is operated by GuidanceWorks Oy (business ID 3361228-1). GuidanceWorks Oy is not an audit firm and does not perform audits. GuidanceWorks Oy provides the advisory and other non-audit services presented on the website.
Audit services and audit engagements are provided and performed by David Vatka, Authorised Public Accountant (APA), personally and in his own name.
Some pages cover both audit and other services. In those cases the service provider is determined by the individual engagement, not by the page.
2. Controller
The controller is determined by the stage of the processing.
GuidanceWorks Oy is the controller for the technical operation of the website, for the prevention of misuse, for the general receipt of contact and quote requests before a request has been directed onward, and for contacts and engagements concerning GuidanceWorks Oy's own advisory services.
David Vatka is the controller from the moment a contact has been identified as concerning his personal audit service and is transferred to him for handling, and for all processing relating to an audit engagement.
Each acts as an independent controller at its own stage.
Contact in data protection matters: David Vatka, david.vatka@kht-tilintarkastus.fi, Neljäs Linja 26, 00530 Helsinki, Finland. Where necessary, we forward your request to the correct controller.
3. What data we process and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Quote request details (name, company, business ID, email, telephone, service, message) | Responding to your request and preparing a possible engagement | Steps taken at your request before entering into a contract, when you act in your own matter. When you contact us as a representative of a company, our legitimate interests in responding to a genuine business enquiry |
| Misuse-prevention counters (salted identifiers) | Preventing misuse of the service | Our legitimate interests in protecting the service |
| Messages you send on WhatsApp and the telephone number and profile name shown in them | Contacting you and answering your question, if you choose this channel | Steps taken at your request before entering into a contract, or our legitimate interests in responding to a contact you initiated yourself |
| Audit engagement documents | Performing the engagement | Contract and the legislation governing audits |
Text you write into the site guide is not in the table, because it is not sent to us and is not stored (section 4).
The website does not use a cookie consent banner, because it does not set non-essential cookies and uses no tracking tools. There is no intention to add tag management or an external analytics script to the website. Should this ever change, this notice and the cookie assessment will be updated first.
4. Site guide
The website may use a site guide that runs in your browser and helps you find website content and suitable service pages. Text you write into the site guide is processed in your browser and is not sent to a server or to any artificial intelligence or language model service, and is not stored.
The guide searches for answers in the website's own, pre-prepared content index and suggests pages to you. It gives general information only; an engagement-specific assessment or conclusion is always made by a professional.
Do not write personal data, confidential client information or sensitive information into the guide (section 5). When you wish to contact us, please use the quote request form, email, telephone or WhatsApp.
5. Confidential and sensitive information
The site guide and the forms are not intended for sending confidential or sensitive information, and no such information is requested at any stage. Please do not send it through these channels. The same applies to WhatsApp messages. If such information nevertheless reaches us, it is processed in a limited manner and is deleted from general-purpose channels once there is no longer a basis for retaining it. Confidential material relating to an engagement is handled in the engagement's own channel intended for that purpose.
6. Notifications and recipients
Website data is stored in the website's backend system, which is located in the European Union.
Messages sent to the published email address are handled in an email service. The domains of the email addresses in use are directed to the email service of Proton (Proton AG), which is therefore, for its part, a recipient of the data.
When you send a contact or quote request, we receive an internal email notification about it, so that your request reaches us reliably. The notification is delivered by our email service provider Brevo, which acts in this respect as a processor of personal data on our behalf. The contracting party is Sendinblue SAS, trading as Brevo (9–17 rue Salneuve, 75017 Paris, France; RCS Paris 498 019 298), and the processing is governed by the provider's data processing agreement.
The notification contains only the minimum information we need in order to react: your name, one contact detail (your email address, or your telephone number if you did not provide an email address), the service the request concerns, the time of the request, the language of the request and a short reference code. It does not contain your company details, your business ID, the details of the quote request, your free-text message, your second contact detail, site guide text or our internal identifier.
The notification is sent to two of our own work addresses as two separate notifications, so that a request is not missed. The notification is not sent to you, and it is not used for marketing.
The legal basis is the same as for processing the request itself; sending the notification is part of responding to your request.
The provider states that its servers and database storage are located in the European Union. No claim wider than that is made in this notice about the provider's processing chain.
The provider retains sending logs for one month, and message previews are not stored. Our own internal sending record is retained for as long as is necessary to show that your request was received and handled.
Data is not sold and is not used for marketing.
6 a. WhatsApp as a voluntary contact channel
WhatsApp is a voluntary way of contacting us. You can always use the form, email or telephone instead.
The WhatsApp contact channel is taken into use in connection with the publication of this notice. When the channel is in use, the website shows the number +358 40 369 8852 and an ordinary link https://wa.me/358403698852. If the website does not yet show a WhatsApp link, the channel has not been taken into use and no processing relating to it takes place.
The WhatsApp link on the website is an ordinary link. The website does not load any WhatsApp or Meta plug-in, widget or tracking script merely because you open a page, and no data is sent to WhatsApp or Meta on the basis of opening a page. A connection to the external service is created only when you click the link yourself.
When you click the link, you move to the WhatsApp service. If you choose to send a message, your message and the related data are processed in the WhatsApp service in accordance with its own privacy policy. In the European Economic Area the WhatsApp service is provided by WhatsApp Ireland Limited, which states that it also transfers data outside the EEA and uses, among other things, the European Commission's adequacy decisions and standard contractual clauses for those transfers. We cannot influence how WhatsApp processes data in its own service.
We handle messages arriving through WhatsApp in the same way as other contacts (sections 3, 5 and 7).
7. Retention periods
| Data | Retention period |
|---|---|
| Contact and quote requests | 730 days |
| Misuse-prevention counters | Short-term, for the duration of the counting period |
| Email notification sending logs in the provider's system | 1 month |
Data is deleted automatically at the end of the retention period.
There is no retention period for the site guide, because the text you write into the guide is not stored anywhere.
Separate rules: if you become an audit client, audit engagement documents are retained by David Vatka in accordance with the legislation governing audits and are covered by the auditor's professional secrecy. These rules are independent of the website retention periods described above.
Messages received by email are retained in the email account for as long as handling the matter requires, and are deleted on request unless the law requires retention. WhatsApp conversations remain in the WhatsApp service for as long as they are stored on the devices or in the service; we delete our side of the conversation once handling the matter no longer requires it.
8. Your rights
You have the rights provided by the General Data Protection Regulation: the right of access to your data, to rectify it, to request its erasure, to restrict processing, to object to processing and to have the data transmitted. The rights apply as relevant to the processing in question and subject to the conditions laid down in the General Data Protection Regulation; for example, a statutory retention obligation may restrict erasure.
Requests may be addressed to david.vatka@kht-tilintarkastus.fi. A request is forwarded to the controller it concerns (section 2). No separate data protection officer has been designated as responsible for the processing.
You also have the right to lodge a complaint with a supervisory authority. In Finland the supervisory authority is the Office of the Data Protection Ombudsman (tietosuojavaltuutetun toimisto, tietosuoja.fi).
---