Privacy Policy

This Privacy Policy explains how XBRTags Ltd ("XBRtags", "we", "our", "us") collects, uses, stores and protects personal data when you use our website at xbrtags.fi, submit an enquiry, or engage our iXBRL filing services. We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and applicable Finnish data protection law.

1. Data Controller

XBRTags Ltd
hello@xbrtags.fi
+ 31 (10) 8906661
1 Canada Square, Canary Wharf, London E14 5AB, United Kingdom

XBRTags Ltd is the data controller for personal data processed in connection with our website and services. For data processed as part of an iXBRL filing engagement, we act as data processor on behalf of the client (data controller).

2. Data We Collect

We collect and process the following categories of personal data:

• Contact and identity data: Full name, job title, company name, business email address, telephone number.
• Enquiry and service data: Information provided in quote requests, filing briefs, annual reports and financial statements submitted for iXBRL processing.
• Account data: Login credentials for the XBRTags client portal (email and hashed password).
• Communication data: Records of emails, messages and calls between you and our team.
• Technical data: IP address, browser type, device type, and usage data collected via server logs and cookies (see Section 9).

3. How We Use Your Data

We use your personal data for the following purposes:

• To respond to quote requests and provide iXBRL filing services under a contract.
• To manage your client portal account and deliver completed filing packages.
• To communicate with you about your engagement, including status updates and delivery.
• To comply with legal obligations, including invoicing, financial record-keeping, and regulatory requirements.
• To improve our website and service quality (using aggregated, anonymised analytics data only).
• To send service-related communications (not marketing, unless you have separately opted in).

4. Legal Basis (GDPR)

We process personal data on the following legal bases under Article 6 GDPR:

• Contract (Art. 6(1)(b)): Processing necessary to perform a service agreement with you or to take steps at your request prior to entering a contract.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with Finnish law (e.g. accounting, invoicing, VAT records).
• Legitimate interests (Art. 6(1)(f)): Processing for our legitimate business interests such as security monitoring, fraud prevention and service improvement, where these are not overridden by your rights.
• Consent (Art. 6(1)(a)): Where you have actively opted in to marketing communications or non-essential cookies.

5. Data Sharing

We do not sell, rent or trade your personal data. We share data only in the following limited circumstances:

• Sub-processors: Cloud infrastructure (Amazon Web Services EU, Ireland), email platform, and accounting software — all under Data Processing Agreements (DPAs) and GDPR-compliant data transfer mechanisms.
• Legal disclosure: Where required by Finnish law, court order, or to protect the rights, safety or property of XBRTags or others.
• Business transfer: In the event of a merger or acquisition, data may be transferred to the successor entity under equivalent protection obligations.

All staff and contractors with access to client data sign confidentiality agreements. Annual reports and financial statements submitted for iXBRL processing are treated as strictly confidential and are never shared with third parties beyond the sub-processors listed above.

6. Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Client records and filing documentation: 7 years from the end of the relevant financial year, in accordance with Finnish accounting law (Kirjanpitolaki).
• Enquiry and correspondence data: 3 years from last contact, unless a service agreement was concluded.
• Portal account data: Retained for the duration of the account; deleted within 90 days of account closure.
• Website analytics data: 26 months (aggregated and anonymised).

7. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): You may request deletion of your data, subject to legal retention obligations.
• Right to restriction (Art. 18): You may request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21): You may object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, email hello@xbrtags.fi. We respond within 30 days. If you are unsatisfied, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu, tietosuoja.fi).

8. Security

XBRTags is certified to ISO 27001 (Information Security Management) and ISO 9001:2015 (Quality Management). All data is hosted on Amazon Web Services infrastructure in the EU (Ireland). Data in transit is protected by TLS 1.3 encryption. Access to client data is restricted to authorised staff on a need-to-know basis, and all staff sign confidentiality agreements.

9. Cookies

Our website uses the following categories of cookies:

• Strictly necessary cookies: Required for the website and client portal to function. No consent required.
• Analytics cookies: Used to understand website usage in aggregate (no personal profiling). Require your consent.
• Functional cookies: Store your preferences such as language and session state. Require your consent where not strictly necessary.

You can manage cookie preferences through the cookie banner shown on your first visit, or by contacting us directly. Most browsers also allow you to control cookies through their settings.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services or applicable law. The "Last updated" date at the top of this page will reflect any changes. We will notify active clients of material changes by email.

11. Contact & DPO

For any questions about this Privacy Policy or your personal data, please contact: