Tenant’s data processing

Asuntosalkku-group’s tenant data base in Finland

The controller of data processing described in this privacy notice are Asuntosalkku Oyj, Asuntosalkku Suomi Oy and Suomen Asuntovarainhoito Oy (jointly ”Controllers”).

Please refer questions to asiakaspalvelu@asuntosalkku.fi.

Contractual relationship: We process your personal data to perform or enter into a contract with you as meant in the General Data Protection Regulation (GDPR) article 6(1)(b).

Consent: You have given us consent to process your data as meant in the General Data Protection Regulation (GDPR) article 6(1)(a) or 9(2)(a) .

Legitimate interests of the controller: The data are also processed for legitimate interests of the controller or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms as meant in the General Data Protection Regulation (GDPR) article 6(1)(f). If the legal basis of data processing is our legitimate interest, we have performed the balance test to carefully evaluate, whether or not such interests are overridden by your interests or fundamental rights and freedoms. For more information about the balance test please contact asiakaspalvelu@asuntosalkku.fi.

The table below describes the purposes of data processing and the relevant legal basis. We have also described the nature of our legitimate interest if that is the legal basis.

Purpose/activity	Legal basis of processing including nature of legitimate interest
Processing a tenancy application	Necessary to perform or enter into a contract with you. Additional information is processed based on your consent.
Making a lease agreement	Necessary to perform or enter into a contract with you.
Issues regarding your lease	Necessary to perform a contract with you.
Making or defending against legal claims or lawsuits	We have a legitimate interest to defend against legal claims or lawsuits and make them, if we think that our rights have been violated.
Business development	Processing is necessary for the purposes of the legitimate interest that is developing our business.

We can collect, use, store and disclose different types of personal data that we have grouped as follows:

• Identification data mean your full name and personal identification code.
• Contact data mean your email, phone number and address or those of your contact person or legal representative.
• Rent data mean rent related information about contract(s) that we are entering or have entered into with you including, but not limited to, billing information, debt collection information, payment information and name of rent payer.
• Profile data mean non-rent related information about contract(s) that we are entering or have entered into with you including, but not limited to, services and products (eg. parking space, apartment modifications, complaints), dates and times related to services and products use, seller information, language information, start and end of the lease and details about the object of the lease.
• Additional information means data processed based on your consent. This data is voluntarily disclosed in correspondence or by other similar means or is related to other people mentioned in the tenancy application or lease contract. Examples include, but are not limited to, employment information (eg. profession, employer, start and end of employment, full time/part time, work contact details), student information (eg. educational institution, study program; data applies to students only), income information related to ability to pay the rent, name of spouse that is a joint applicant, information related to need for housing, information related to maintaining the apartment (eg. smoking, pets), pay­ment de­fault en­tries, and other information volunteered by the data subject.

Usually the data are collected directly from you in the tenancy application, lease contract or from correspondence during or after the lease. Based on consent, data is also collected from the credit information register of Suomen Asiakastieto Oy. Data can also be collected from or updated based on the Finnish Population Information System per the law about the Population Information System and the Population Register Centre’s certificate service.

Providing data is a necessary requirement to enter into a lease agreement. Data that does not apply to you can be left unprovided without consequences to entering into a lease agreement. For example, you don’t need to provide an email address if you don’t have an email address.

Failure to provide data in a tenancy application or withdrawing consent for the processing of a tenancy application before the signing of a lease agreement will result in the non-formation of a lease agreement.

We process special categories of data to manage the lease relationship when you or your legal representative provide us with said data and request the processing. This can include, but is not limited to, a request to consider your health in a matter related to the lease, a notification that your spouse is moving in to the same apartment, or another issue related to the management of a lease relationship.

We can disclose your data to other companies in the Asuntosalkku-group when that is necessary for the purposes described above. This processing is based on our legitimate interest to handle functions as a group. This includes, but is not limited to, using a common IT-system for group companies and harmonizing business operations and strategies.

We can disclose your data to third parties as follows:

• When it is necessary for a purpose described under the heading ”PURPOSES AND LEGAL BASIS OF THE PROCESSING”.
• Data can be disclosed to government agencies such as tax officials or enforcement officer as required by law, statute or equivalent.
• Data can be disclosed to third parties, when this is appropriate for apartment maintenance or repair. Typical third parties that are data recipients include a housing company, its manager, its maintenance provider, a renovation partner, a damage inspector and other equivalent parties.
• Data can be disclosed to third parties for the purposes of leasing or selling the apartment. Third parties that are data recipients include real estate agencies and realtors.
• We can disclose your data when we sincerely believe that such disclosure is necessary to defend against legal claims or lawsuits or enforce our legal rights, in the interest of your or others’ personal safety, fraud investigation, or replying to a government request.

We disclose personal data to trusted third party service providers. These services include data processing on our behalf and according to our instructions. These third parties can have access to or the ability to process personal data in order to provide services to us. These third parties are only allowed to process your data for the services that they provide to us. We use contracts to ensure that our service providers process your personal data accordingly.

Data is not transferred outside the European union or European Economic Area.

We store the data for as long as we have a legitimate interest to store the data. When the legitimate interest ends, we erase or anonymize your data.

We store your personal data throughout your lease and for six (6) calendar years after the conclusion of the lease. This is based on retaining accounting records, which can include lease contracts. However we store data from denied tenancy applications including possible appendixes for two (2) calendar year after the application expires based on the Non-discrimination Act.

However, our realtor partner(s) store the lease agreement, rent debt and rent prepayment data and end of lease information for at least the legally required five (5) years. Data can be stored for longer if we have a legal obligation to do so or this is needed to make or defend against legal claims or lawsuits.

Manual files are stored in locked and guarded premises. Access to this data is restricted to specific personnel.

Electronic files are stored in an environment, the use of which requires a personal user identification and permission provided by an administrator or master user. The administrator or master user also defines the access level. The electronic environment requires a personal password to use. Use is monitored with logs.

Electronic storages are protected with firewalls, passwords and other technical means. Servers, back-up disks and other electronic storage mediums are located in locked and guarded premises, and access is restricted to specific personnel.

You have several rights regarding your personal data. Below is a summary of these rights, information about using these rights and information about restrictions.

Subject to certain prerequisites you have the right to:

• Access your personal data. Based on this right you can get a copy of your personal data that we process and ensure that we process your data lawfully.
• Rectify inaccurate data. Based on this right you can ask us to rectify errors in your data and supplement incomplete data.
• Ask for erasure of your data. Based on this right you can ask us to erase your data if the purposes of data processing no longer apply to that data.
• Object to the processing of your data if our legal basis for that data processing is our (or a third party’s) legitimate interest and you have grounds to object based on your particular situation.
• Ask for restriction of processing. Based on this right you can ask us to restrict processing your personal data for a specific reason, e.g. while the accuracy of the data is verified or corrected or the legal basis is verified.
• Ask to transmit your data to another controller.
• Withdraw consent to process your personal data if the legal basis of processing is your consent. You can withdraw your consent at any time. Withdrawing your consent has no effect on the validity of consent as the legal basis of data processing that has been done prior to your withdrawal of consent.

If you want to use any of these rights, please contact our customer service by email at asiakaspalvelu@asuntosalkku.fi. We will process your request after we receive your email.

You have a right to lodge a complaint with a supervisory authority if you are unsatisfied with our processing of your data. In Finland such complaints are lodged with the Office of the Data Protection Ombudsman at https://tietosuoja.fi/ilmoitus-tietosuojavaltuutetulle.

We request that you contact our customer service for more information if you wish to exercise your rights. Customer service can be contacted by email, phone or mail. The contact details are

email	asiakaspalvelu@asuntosalkku.fi
phone	040 1522 069
mail	Asuntosalkku Oyj Ilmalankuja 2 L 00240 Helsinki

This privacy notice can be updated to reflect changing legal or operational requirements. We recommend that you visit this website regularly to find out about possible updates.

Updated 22.9.2023