Tirronen & Nousiainen Attorneys Ltd

Privacy Notice
Updated 26 October 2026

Controller
Asianajotoimisto Tirronen & Nousiainen Oy (Business ID 3189306-7), Töölöntullinkatu 8 A 5, 00250 Helsinki, office (at) tnlaw.fi.
Please address any enquiries concerning the processing of personal data to the e-mail address above.

Whose data we process
We process data relating to our clients and their representatives and to other parties to our engagements, such as opposing parties and witnesses. In court-appointed roles, we process data relating to the shareholders of estates and other parties concerned. We also process data relating to users of our website and persons who contact us.

Purposes and legal bases of processing
We process personal data in order to handle and invoice our engagements. As regards the client, processing is based on the engagement agreement and, as regards other parties to the engagement, on our legitimate interest in handling our client’s engagement. We process special categories of personal data where this is necessary for the establishment, exercise or defence of legal claims.
Before accepting an engagement, we verify in accordance with the Code of Conduct for Attorneys-at-Law that we have no conflict of interest. This processing is based on our legitimate interest in complying with these obligations.
Processing for customer due diligence and sanctions screening is based on the Act on Preventing Money Laundering and Terrorist Financing and on sanctions legislation. When we act in court-appointed roles, such as estate administrator or estate distributor, processing is based on the legislation governing the role. Processing for bookkeeping is based on accounting legislation.
Responding to enquiries and maintaining the website and its security are based on our legitimate interest in responding to enquiries and keeping the website functional and secure.
We do not use personal data for automated decision-making or profiling.

Data processed and sources of data
We process contact details, personal identity codes and identity document details, information required for customer due diligence, such as information on beneficial owners and politically exposed person status, information and documents relating to the engagement, and invoicing and payment details.
We obtain data mainly from the data subject or from our client. We also obtain data from public authority registers and other public sources, such as the Population Information System, the Trade Register and the courts, as well as from the service provider we use for customer due diligence.
Providing the information required for customer due diligence is a statutory requirement for accepting an engagement. Without this information, we cannot accept the engagement.

Recipients of data
We disclose data only to the extent necessary for handling the engagement, for example to courts and authorities, and where required by law.
We use service providers that process data on our behalf. These include providers of IT systems, cloud and artificial intelligence services, electronic signature and identification service providers, a customer due diligence and sanctions screening service provider, invoicing and accounting service providers and our website host.

Transfers of data outside the European Economic Area
Some of our service providers may process data outside the European Economic Area, in particular in the United States. Such transfers are based on an adequacy decision of the European Commission (the EU-U.S. Data Privacy Framework) or on standard contractual clauses approved by the Commission. Further information on the safeguards is available on request.

Retention periods
In accordance with the guidelines of the Finnish Bar Association, we generally retain engagement files for ten years after the end of the engagement, customer due diligence data for five years after the end of the client relationship and accounting records for the period required by the Accounting Act.
We retain enquiries that do not lead to an engagement for no more than 12 months. We retain the basic information necessary for conflict checks, such as the names of the parties and the nature of the matter, for as long as necessary for that purpose.

Website
Our website does not use analytics or marketing cookies. The server records standard log data, such as IP addresses, to ensure the operation and security of the website. The website uses Google Fonts, which means that the browser’s IP address is transmitted to Google in order to load the fonts. Messages sent through the contact form are checked for spam using the Akismet service (Automattic Inc.).

Other parties to engagements
We do not separately notify other parties to our engagements of the processing of their data, as the data is subject to the statutory duty of confidentiality of attorneys.

Rights of the data subject
Data subjects have the right to access their personal data and to request its rectification or erasure, restriction of processing and the transfer of the data from one system to another. Data subjects also have the right to object to processing based on legitimate interest. These rights may be restricted to the extent required by the attorney’s duty of confidentiality or by a statutory retention obligation.
Requests may be sent to office (at) tnlaw.fi. Data subjects also have the right to lodge a complaint with the Office of the Data Protection Ombudsman (www.tietosuoja.fi).