Privacy Policy / Users of UKKO.fi Services

1. Data Controllers

The following entities are responsible for processing the personal data described in this Privacy Policy:

UKKO Yrittäjyyspalvelut Oy
Business ID 2485076-3
Keilaniementie 1
02150 Espoo
Finland

SLP Wallet Oy
Business ID 3184032-8
Keilaniementie 1
02150 Espoo
Finland

SPL Company Oy
Business ID 2871479-3
Keilaniementie 1
02150 Espoo
Finland

Hereinafter collectively referred to as “UKKO.fi” or “we”.

UKKO Yrittäjyyspalvelut Oy, SLP Wallet Oy, and SPL Company Oy are joint controllers of the personal data processing described in this Privacy Policy. They have agreed on the division of responsibilities between them, and their status as joint controllers is described in more detail in the document “Notice on Joint Controllership within the UKKO.fi Group.”

2. Who Does This Privacy Policy Apply To?

This Privacy Policy applies to current and former customers who have registered for UKKO.fi services (“users”), including:

users of the UKKO Light Entrepreneur without a Business ID service;
users of the UKKO Light Entrepreneur with a Business ID service;
users of the UKKO Entrepreneur service for private traders; and
users of the UKKO Entrepreneur service for Limited Liability Companies.

This Privacy Policy also applies to any other individuals whose personal data the user provides to us for the purpose of providing the service, such as persons acting on the user’s behalf under a power of attorney.

3. What Personal Data Do We Process?

The data processed depends on the service you have selected and the nature of your business. We may process the following types of data:

Basic and Contact Information

name;
Finnish personal identity code and date of birth;
nationality;
address, email address, and telephone number; and
company information, such as the trade name or name and Business ID of a limited liability company, as well as the company’s industry.

Customer Due Diligence Information

identification information;
information regarding politically exposed person (“PEP”) status;
information regarding matches with sanctions or asset-freeze lists; and
information about the nature and scope of the business and the beneficial owners of limited liability companies.

Service, Billing, and Financial Information

username and login information;
information about the services you use and your agreement with us;
billing, income, salary, and expense reimbursement information;
tax-related information, such as information concerning tax withholding;
information about any marketing prohibition;
bank account number; and
information about the enforcement of a garnishment of salary or business income.

Customer Service and Communications Information

contacts, messages, and other information you provide in connection with customer service; and
feedback and responses to customer satisfaction surveys and user testing.

Technical Information

IP address; and
service usage logs and technical information about your device and browser.

Providing basic, contact, and identification information is a prerequisite for entering into a service agreement and fulfilling our statutory obligations. Without this information, we cannot provide the service.

As a general rule, we do not process special categories of personal data. If such data comes up, for example in connection with customer service, we will process it only on the basis of your consent or where it is necessary to exercise rights or fulfill obligations arising from an agreement or applicable law.

4. For What Purposes Is Personal Data Processed?

Providing the Service and Managing the Customer Relationship

We process your data to provide the service you have selected, for example, to register you, verify your identity, establish a Private Trader business or a limited liability company, handle billing, pay salaries and expense reimbursements, manage your user account, and provide customer service.

We may also send you messages relating to your use of the service and your customer relationship. Such communications are not marketing.

Complying with Statutory Obligations

We process data in order to fulfill our statutory obligations, which may include:

tax-related obligations, such as tax withholding and reporting to the Incomes Register;
customer due diligence and transaction monitoring related to the prevention of money laundering and terrorist financing, as well as compliance with sanctions;
accounting obligations;
obligations relating to enforcement proceedings; and
responding to legally based requests for information from authorities.

Financial Reporting

We process billing and financial information for the financial reporting of the UKKO.fi and Finago groups, including group accounting, financial statements, and business monitoring. UKKO.fi is part of the Finago group.

Targeted Marketing

We may create customer segments based on factors such as the service you use, your industry, the duration of your customer relationship, and your activity in using the service, in order to target marketing relating to our services to you. If the segmentation we carry out constitutes profiling, you have the right to object to it.

Customer Satisfaction and Service Development

We may process data to conduct customer satisfaction surveys and user testing, as well as to develop and analyze statistics concerning our services.

Information Security and Preventing Misuse

We process data to ensure the security of our services and systems and to prevent and investigate misuse.

Handling Legal Claims

We may process data to prepare, present, or defend a legal claim.

We do not make decisions based solely on automated processing that would produce legal effects or similarly significant effects concerning you.

5. On What Legal Basis Do We Process Personal Data?

Contract

Processing is necessary for the performance of a service agreement entered into with you or for taking steps at your request before entering into an agreement. This applies to providing the service and managing the customer relationship.

Legal Obligation

Processing is necessary for compliance with our statutory obligations. Such obligations arise in particular from tax, anti-money laundering, accounting, and enforcement legislation.

Legitimate Interest

We may process personal data on the basis of our legitimate interests for:

the group’s financial reporting;
targeted marketing;
customer satisfaction surveys, user testing, and service development;
ensuring information security and preventing misuse; and
preparing, presenting, or defending legal claims.

Our legitimate interests are based on conducting our business, the financial management and reporting of the group, developing and marketing our services, and protecting our services and customers.

6. Where Do We Obtain Personal Data?

We primarily obtain personal data directly from you, for example when you register for or use the service or contact customer service.

In addition, we may receive information from:

identification services when you identify yourself in the service;
authorities and public sources, such as the Suomi.fi service, the Finnish Tax Administration, enforcement authorities, and the Trade Register;
services providing sanctions and PEP information; and
fi’s own systems, in which data is generated when the service is used.

7. To Whom Is Personal Data Disclosed?

Disclosures Within the Group

We may disclose data to other companies belonging to the UKKO.fi group.

Personal data may also be transferred to the parent company of the Finago group and to other companies belonging to the Finago group for the purposes of the group’s financial reporting. The data transferred is limited to what is necessary for reporting purposes.

Authorities

We disclose data to authorities as required by law, including the Finnish Tax Administration and the Incomes Register, enforcement authorities, and the Financial Intelligence Unit.

Recipients of Your Invoices

When you invoice your customer through our service, the information displayed on the invoice is provided to the recipient of the invoice.

Service Providers

We use service providers that provide us with, for example, customer and service management systems, payment and banking services, identification services, customer service and survey tools, as well as IT, artificial intelligence, and cloud services. Service providers process data only on our behalf and in accordance with our instructions, and we enter into agreements with them as required by the GDPR.

We may also disclose data to other parties if you have given your consent.

We do not sell personal data to third parties.

8. Is Personal Data Transferred Outside the EU or the EEA?

Some of our service providers or their subcontractors may process personal data outside the European Union or the European Economic Area, for example in the United States. In such cases, we ensure that the transfer is based on a legal mechanism under the GDPR, such as:

an adequacy decision by the European Commission, such as the EU–U.S. Data Privacy Framework for U.S. recipients certified under that framework; or
standard contractual clauses approved by the European Commission and, where necessary, supplementary safeguards.

9. How Long Is Personal Data Retained?

We retain personal data only for as long as it is needed for the purposes described in this Privacy Policy or as required by law.
In the UKKO Light Entrepreneur service, data is deleted no later than ten years after the most recent customer transaction.

In other services, data is retained for the duration of the customer relationship and deleted no later than five years after the service has ended.

Data may be retained for a longer period if necessary due to a criminal investigation, pending legal proceedings, or a legal claim, or if otherwise required by law.

10. How Is Personal Data Protected?

We protect personal data using appropriate technical and organizational measures. Data is stored in secure systems, and access is limited to individuals whose duties require access to the data. Individuals who process the data are subject to a duty of confidentiality.

We use, for example, access rights management, access controls, technical security measures for systems, and staff instructions and training. If a personal data breach occurs, we will take action and provide notifications as required by law.

11. What Rights Do You Have?

Under the GDPR, you may, depending on the circumstances, have the right to:

find out whether we process your personal data and what personal data we process;
request the correction of inaccurate or incomplete data;
request the deletion of your data;
request the restriction of processing;
object to processing based on a legitimate interest on grounds relating to your particular situation; and
lodge a complaint with a supervisory authority; see Section 14.

We cannot delete data that we are required by law to retain or that is necessary for the performance of a contract. The Anti-Money Laundering Act restricts the right of access to data collected for the prevention of money laundering and terrorist financing.

You may object at any time to the processing of your data for direct marketing, including profiling related to targeted marketing. In such cases, we will stop processing your data for this purpose.

You may exercise your rights by contacting us as described in Section 13.

12. Processing Your Customers’ Data

When you enter your own customers’ personal data into the service, for example for billing purposes, you act as the data controller of that data, and UKKO.fi processes the data on your behalf as a data processor. This is agreed in more detail in the terms of use of the service.

13. Contact Information

For matters relating to data protection and the exercise of data subject rights, you may contact us through the data request form on our website or by email at: [email protected]

14. Right to Lodge a Complaint with a Supervisory Authority

If you believe that your personal data has been processed in violation of data protection legislation, you have the right to lodge a complaint with the competent supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

15. Changes to This Privacy Policy

We may update this Privacy Policy, for example, when our operations, processing practices, or applicable legislation change. The current version of this Privacy Policy is available on the UKKO.fi website.

Updated: October 27, 2026