Privacy statement

PROCESSING OF CUSTOMERS’ PERSONAL DATA AT HUONEISTOKESKUS OY

Huoneistokeskus Oy’s operations require that the company collect certain personal data concerning its customers. In such cases, Huoneistokeskus serves as a data controller as defined in data protection legislation. The purpose of this document is to inform data subjects about the processing of their personal data.

What personal data does Huoneistokeskus process, and for what purpose?

Customer register

Huoneistokeskus maintains a customer register, and the information it contains is used to manage the contractual relationship with each customer and to provide services. Customer registers contain the personal information of customers, including name, email address and phone number. The register may also contain other information needed for identifying the customer as well as information on any customer complaints and the personal data contained in them.

Personal data contained in the customer register can also be used for additional sales and marketing purposes. In such cases, the processing is based on the contractual relationship between Huoneistokeskus and the customer, and the data controller’s legitimate interest.

In addition, Huoneistokeskus collects personal data (name, email address and telephone number) from potential customers for sales and marketing purposes in its customer register. In such cases, the legitimate interest of Huoneistokeskus is the justification for the personal data processing.

Broker assignment register

Huoneistokeskus is a property brokerage company. The management of brokerage assignments and the laws regulating brokerage operations (including the Act on Detecting and Preventing Money Laundering and Terrorist Financing) require the collection and processing of certain personal data. This data is included in brokerage assignment registers. In such cases, the processing of personal data is based on the contractual relationship between the customer and Huoneistokeskus, and statutory obligations.

The personal data listed below may be necessary and may be collected in the course of brokerage activities relating to sellers, buyers, potential buyers, lessors, lessees and applicants for rental facilities.

Name, date of birth, personal identity code, address, previous address, telephone number, email address, preferred language, information about political influence (politically exposed person, PEP), identification information about or a copy of the document used for identity verification, information about guardianship or supervision of interests, other information included in the agreement concerning the assignment, information about the brokered property, profession, length of employment relationship, form of household and number of people moving into the apartment, information about any pets, income information, other information included in the application for a rental apartment, credit history information, information related to the purchase offer and its approval, information contained in the rental agreement or the deed, information about rental collateral, statement on the origin of funds, and any other information provided by the customer necessary to complete the brokerage assignment.

Brokerage assignment registers also include personal data related to the brokered property, such as the names of, and possibly contact information for, the limited liability housing company’s property manager and board members. In such cases, the processing of personal data is based on statutory obligations. The registers also contain information about any complaints related to brokerage assignments, including personal data. In such cases, the processing is based on a legitimate interest.

The brokerage assignment register also includes a pre-booking register of new properties, and the personal data in this register is used in the process of selling new properties. Pre-booking registers for new destinations contain the personal data of customers, including name, email address and phone number. The registry may also contain other information necessary to identify the customer. Processing of personal data is necessary for the performance of brokerage assignments and for ensuring compliance with statutory obligations.

Marketing register

Huoneistokeskus also maintains a marketing register containing personal data used for direct marketing, email marketing, customer surveys and other similar marketing activities. The marketing register includes names, email addresses, telephone numbers and addresses, as well as any other information provided by data subjects, such as residence status or property of interest. Processing is based on the legitimate interest of the controller or the consent of the data subject.

Where does Huoneistokeskus obtain personal data from?

Data is mainly collected from data subjects. Data may also be collected from sources related to the authorities, such as the Trade Register. In addition, information concerning company contact persons is obtained from public sources, such as corporate websites. Companies’ contact information for sales and marketing purposes may also be obtained from companies providing such information for these purposes.

Clients provide personal data when entering into an agreement on an assignment. Personal data concerning applicants for rental apartments is obtained from their applications. Personal data concerning tenants is obtained when they enter into a rental agreement. Personal information concerning buyers is obtained from their purchase offer or when preparing the deed. In addition, information concerning brokered properties is obtained, for example, from representatives of limited liability housing companies (e.g. a property manager’s certificate, financial statement information) or from registers maintained by the authorities (e.g. land register). Credit history can be obtained from the registers of third-party service providers (e.g. Suomen Asiakastieto Oy).

The information in the marketing register is obtained from the data subject, for example through filling in online contact forms or participating in contests or events. Personal data may also be collected or updated from other personal information systems maintained by Retta Group, from the registers of partners, from companies selling personal data, and from the authorities.

Is data disclosed to third parties?

Personal data may be disclosed within the Retta Group.

Personal data may also be disclosed to debt collection agencies. In addition, establishing or defending a legal claim may require the disclosure of personal data to an insurance company or legal adviser.

Data contained in brokerage assignment registers may be disclosed to the authorities supervising brokerage operations (Regional State Administrative Agencies) or other authorities as required by law. The management of brokerage assignments also requires the disclosure of data to the counterparty of the assignment in accordance with the applicable legislation and good brokerage practices.

Data on sales that have been realised may be disclosed to the Central Federation of Finnish Real Estate Agencies (KVKL), which stores the data in its HSP price monitoring service.

Data is not disclosed to non-EU or non-EEA parties.

How long is personal data stored?

Personal data contained in customer registers is retained for the duration of the contractual relationship, and after its termination for as long as is necessary due to possible legal measures and handling of the customer account.

We are required by law to store the personal data included in the brokerage assignment registers for five years after the end of the assignment. After this time, the data is stored for as long as necessary for any legal procedures.

Customer feedback and complaints are stored until they have been processed, or for as long as necessary for any legal procedures.

The information in the marketing register is stored for as long as it is used for customer communications and marketing purposes, or until the date subject withdraws their consent. The necessity of data storage is regularly evaluated.

How is the data protected?

The data is protected by means of appropriate technical and organisational measures. Paper documents are stored in a locked facility. Digital material is protected through technical measures, and access rights are only granted to people who need to access the material because of their job or assignment. The employees of Huoneistokeskus are bound by a confidentiality obligation. Employees are provided with training and instructions on the lawful processing of personal data.

Any processors of personal data outside the Retta Group are also required to implement sufficient technical and organisational protection measures and commit to a confidentiality obligation.

What are the data subject’s rights?

Data subjects have the right to know whether a data controller is processing personal data concerning them. If the data controller processes such personal data, the data subject has the right to receive a copy of the personal data concerning them. If the personal data is deficient, erroneous, inaccurate or outdated, the data subject has the right to request that the data controller correct the data.

If the processing of personal data is based on the data subject’s consent or a contractual relationship, the data subject has the right to receive the personal data concerning them in a structured, commonly used, machine-readable and interoperable format, and to transmit it to another controller. This right only applies to personal data that the data subject has provided to the data controller and that is processed automatically.

In certain circumstances, the data subject has the right to restrict the processing of their personal data. This is the case when, for example, the accuracy of the personal data is contested by the data subject. In such cases, processing will be restricted until it has been confirmed that the data is accurate and its processing is lawful.

The data subject has the right to request that the personal data concerning them be erased. This right is only applicable when the personal data is no longer needed for the purposes for which it was collected, there are no other legal grounds for its processing and it does not need to be stored to meet the requirements of the law. In other words, data cannot be erased while there is a valid legal basis for its storage.

If the processing of personal data is only based on the data subject’s consent, they have the right to withdraw their consent at any time. In addition, the data subject has the right to object to the processing of their personal data if its processing is based on the data controller’s legitimate interest.

The data subject has the right to file a complaint with the Data Protection Ombudsman(www.tietosuoja.fi) if the data controller fails to meet their obligations or otherwise fails to comply with the applicable data protection laws.

If you have any questions about personal data processing and data subjects’ rights, please contact us via email.