Storage of personal data
Urhea-asunnot Oy pays specific attention to the protection of the client’s privacy and personal data. The prerequisite for establishing a contractual relationship and maintaining the tenant relationship is that our applicants and tenants provide us with the necessary personal data.
The information may be processed in various registers, for example in housing application and tenant databases. Check our Privacy Policy to see how we collect and handle your personal data at the different stages of your custom journey, whether you are an applicant or a tenant. As a controller, Urhea-asunnot Oy processes data in accordance with the law, with care and following good data processing practices and otherwise ensuring that the privacy of the registered persons is not compromised.
Privacy policy of apartment applicant and tenant data
1. Controller
Urhea-asunnot Oy
Business ID no. 3193283-9
Mäkelänrinteen uintikeskus 3. krs
Mäkelänkatu 49
00550 Helsinki
Puh. +358 46 878 2208
Contact person Jouni Kinnunen, jouni.kinnunen@urhea.fi
2. The purpose of use and grounds for processing personal data
The prerequisite for establishing a contractual relationship and maintaining the tenant relationship is that our applicants and tenants provide us with the necessary personal data. Failure to provide personal data may lead to a situation where we cannot manage our responsibilities and commitments as a lessor, due to which we may not be able to sign a tenancy agreement or continue a tenancy agreement that has already been signed.
The purposes of processing personal data are rental services of apartments, tenant support and tenant democracy as well as management and development of related matters, management and development of customer relationships, management of tenancy agreements and management of lessor’s rights and obligations. We need personal data also for security deposits and other invoicing and debt collection purposes, maintaining payment data, study records and tenant contacts, managing the maintenance of apartments and buildings, managing notices of defect, repair, inspection and apartment change situations, sauna and laundry room reservations, hallway listings and for other similar purposes.
We also use the personal data of our applicants and tenants for sending notices and electronic newsletters.
The personal data of applicants and tenants will be used for system testing only in special situations, if the development and functional integrity of the system requires it.
In order to ensure safety and legal protection, we may collect camera surveillance data at the Urhea-asunnot Oy office and buildings and the areas surrounding them, such as nearby entrances, waste collection points and parking lots. This information will be used for reviewing criminal activities and accident situations. The premises and areas with camera surveillance have been marked with signs.
Processing personal data is based on a contract relationship, legal requirement or a legitimate interest of Urhea-asunnot Oy or the client. When processing is based on a legitimate interest, the legitimate interest will be one of the following:
- Ensuring general safety
- Ensuring the legal protection of tenants
- Protecting the property of Urhea-asunnot Oy
- Developing the operations of Urhea-asunnot Oy
- Ensuring the functionality of Urhea-asunnot Oy information systems
3. Processed personal data
We will process the personal data of the applicant/tenant, their possible guardian, co-applicant(s) and other security deposit payer, other rent payer or trustee that are essential for achieving the processing purposes we have defined.
The register will process the following personal data of applicants:
The first names and last name of the applicant, their personal identification number or date of birth, passport number and/or EU ID’s number, email address, telephone number, sex, nationality, preferred language, monthly income, assets and student loans, mention about credit information, information concerning studies, customer number.
If the applicant is under 18 years of age, the first names and last name, social security number or date of birth, nationality and contact information as well as mention of credit information of the applicant’s guardian must be provided.
If the applicant has a spouse or lives with a friend, the co-applicant’s (2nd applicant) and the possible children’s first and last names, personal identification number or date of birth, nationality, passport number and/or EU ID’s number, sex, preferred language, monthly income, assets and student loans, mention about credit information, information concerning studies, customer number must also be provided.
If the applicant has a trustee, the first names and last name, social security number or date of birth, nationality and contact information of the applicant’s trustee must also be provided.
Additionally, information concerning current housing, wishes related to the applied apartment and reason for applying for the apartment will be recorded from the electronic apartment application form.
The register will process the following personal data of tenants:
The customer number, first names and last name of the tenant, their personal identification number or date of birth, passport number and/or EU ID’s number, address and new address for when the tenant moves out of Urhea-asunnot Oy apartment, email address, telephone number, sex, nationality, preferred language, residence permit, monthly income, assets and student loans, mention about credit information, information concerning studies, bank account number, information concerning the security deposit and its payment, information concerning rent invoicing and rent payments, information concerning other invoicing and payments related to the rental relationship, information concerning debt collection, information about the prohibition of information transfer.
If the tenant is under 18 years of age, the first names and last name, social security number or date of birth, nationality and contact information, mention about credit information of the tenant’s guardian must also be provided.
If the tenant has a family or lives with a friend, the following information is required: first names and last names of the co-tenant and possible children, their personal identification number or date of birth, nationality and the co-tenant’s customer number, passport number and/or EU ID’s number, sex, preferred language, residence permit, monthly income, assets and student loans, mention about credit information, information concerning studies, bank account number, information concerning the security deposit and its payment, information concerning rent invoicing and rent payments, information concerning other invoicing and payments related to the rental relationship, information concerning debt collection, information about the prohibition of information transfer.
If the deposit or rent is paid by someone else than the tenant, the first names and last name/company information and contact information of the party are required.
If the tenant has a trustee, the first names and last name, personal identification number or date of birth and contact information of the tenant’s trustee must also be provided.
The first names and last name, personal identification number or date of birth, address, phone number, e-mail address and sex of a person subletting the apartment.
With regard to our tenants, we process, in addition to the above mentioned data, the following information: tenancy agreement information, invoicing address, data concerning the rented apartment, contacts during tenancy including reclamations, feedback and other factual communication related to the client relationship as well as information about participation in activities arranged by the tenant committees, key information and access information, if the apartment has an electronic locking system.
Sensitive data is only processed when the data has been acquired from the applicant or tenant themselves, for example for verifying right of tenancy or similar, or restrictedly from other legitimated sources, i.e. from authorities.
The camera surveillance data includes information about the people moving around the camera surveillance area. In addition to video image, the date and time of the event will be recorded.
3.1) Metadata collected in cookies
We use cookies on the Urhea-asunnot Oy website at urheakoti.fi. Urhea-asunnot Oy and the service providers we employ collect metadata regarding the use of the urheakoti.fi website, that is, observed and derived data such as the IP address associated with the user; the web address of the site via which the user accessed the urheakoti.fi site; model and operating system of the user’s end device; information about Urhea-asunnot Oy cookies already saved on the user’s device; time, date, and duration of visit to the urheakoti.fi site; and information about the specific page(s) on the urheakoti.fi site that the visitor has accessed. Urhea-asunnot Oy collects data that is recorded in the log data of the Urhea-asunnot Oy website in connection with regular site maintenance, as well as analytics data by using our own cookies and service providers’ cookies regarding the use of the urheakoti.fi web site. The collected data never contains a person’s name, SSN, or any other identifiable piece of information, and Urhea-asunnot Oy shall never attempt to identify an individual visitor to the urheakoti.fi site on the basis of this metadata.
4. Regular data sources
We will receive the data about the applicant, their possible guardian, co-applicant and their children directly from the applicant through the apartment application form they have filled in and the attachments they have provided and sent through Urhea-asunnot Oy website. In connection to inspecting the application, we will add a mention about credit information, which we will in most cases verify from the register of Suomen Asiakastieto Oy.
We will receive information concerning the tenants from the apartment application form, provided attachments and the tenancy agreement. We will receive information related to studies from the student register extract sent by the tenant and data about contacting the tenant during their tenancy face-to-face, by phone or by email. Notifications concerning repair or maintenance needs in the apartment will be received directly from the tenant. When the rental relationship is terminated, the resident will share their new address.
We will receive information about a person subletting the apartment directly from the main tenant.
Camera surveillance data is recorded automatically as the person arrives in the surveillance area while the camera is on.
5. Protection of personal data and data security
Personal data are stored in supervised and guarded premises. The telecommunication connections to any databases containing personal data will be protected with encrypted connection and appropriate authentication. Databases and the systems using them have been protected with technical and administrative measures.
Using the personal register always requires a login and a password. User rights will be determined based on a person’s role according to what is necessary for the employee’s duties. The staff has been trained to process data in a protected manner and they operate under confidentiality. Third party organizations in the roles of personal data processors are bound by confidentiality agreements between the two parties.
6. Regular disclosure of register data
We regularly disclose the personal data of tenancy agreements to Kela concerning tenants who are students as well as data about the amount of their rent and the rented subject.
We will regularly disclose reports to Kela and social welfare office concerning the security deposits paid by them, which Urhea-asunnot Oy has realised, in part or in full, at the end of the rental relationship.
We will regularly disclose information to educational institutes concerning contracts as well as other important related information incl. unpaid rents of exchange students that are registered in their institute.
For debt collecting company we will regularly disclose data concerning those tenants whose debts the operator will be assigned to collect (personal information of the debtor and the debts to be collected).
For operating company we will regularly disclose information about the tenants (personal information) for opening, maintaining and terminating Internet connections.
For security company we will regularly disclose data about the tenants (personal information) for the door opening service.
For partners defined in the building management and maintenance agreements valid at the time, we will disclose data about tenants (name, address and contact information) for the purposes of finding out reparation needs and carrying out repair operations in the apartments.
After changes in tenants we will publish updated hallway listings defining apartment numbers and last names of the tenants as soon as possible in the bulletin board of the building.
We will regularly disclose information to the municipalities about tenant selections based on sections 4a-4d of the Act on the Use, Assignment and Redemption of State-Subsidized (ARAVA) Rental Dwellings and Buildings, sections 11a–11d of the Act on Interest Subsidy for Rental Housing Loans and Right of Occupancy Housing Loans as well as the government decree concerning selection of occupants for state-subsidised and interest-subsidised apartments.
Data from camera surveillance will not be disclosed unless the police or some other competent authority sends a written request for the disclosure of identified camera surveillance data for specifically legislated purpose.
We do not disclose other personal data.
7. The period for which the personal data will be stored
An applicant’s data will be stored in the register for the application’s period of validity, after which they are transferred to history data. If the application did not lead to having an apartment, the history data will be stored for three years, if the applicant yearly confirms its validity. If the application leads to having an apartment, the history data will be stored as long as the tenant data.
A tenant’s data will be stored in the register for the tenancy agreement’s period of validity, after which they are transferred to history data. Tenants’ history data will be stored in the register for ten years from the time the tenancy agreement has ended and the obligations related to the rental relationship have been fulfilled on both sides.
After the period for which the personal data will be stored, the documents will be disposed of as appropriate.
Camera surveillance data is stored for a maximum of one year unless the drafting, proposing or defending of a legal claim requires a longer period for which the personal data will be stored.
8. Transfer of personal data outside the EU or the EEA
In the event of transfer of personal data outside the EU or the EEA, processors receiving personal data are required to process the personal data in accordance with the EU General Data Protection Regulation, and the adequate level of protection is ensured by appropriate safeguards. The data subject has the right to contact the Urhea-asunnot Oy contact person mentioned at the beginning of this Privacy Policy for further information on the transfer of personal data to third countries and the appropriate safeguards in place.
9. Rights of the data subject
The data subject may exercise their rights, listed below, by presenting a request about the rights to Urhea-asunnot Oy in person or in writing. We request that you deliver any written requests concerning exercising these rights to our customer service by email: jouni.kinnunen@urhea.fi or by mail to address:
Urhea-asunnot Oy
Tietosuoja
c/o Mäkelänrinteen Uintikeskus
Mäkelänkatu 49, 00550 Helsinki
Exercising these rights requires the data subject to prove their identity and they can be asked to specify their requests.
9.1) Data subject’s right to review data concerning oneself
The applicants and tenants have the right to receive confirmation from Urhea-asunnot Oy whether the personal data concerning them is being processed or not processed.
We do not disclose camera surveillance data and log data about system use, because these materials would also include the personal data of other people or would require an unreasonable amount of work.
We execute the right to review data usually within one month and at latest within three months after the request has been presented.
We deliver the data to the requester as one copy in person in exchange for them proving their identity or otherwise by using a protected, reliable form on identification. We will respond to an electronic request electronically, if this is possible from the perspective of data security.
If the requests are evidently unfounded or unreasonable, especially in cases where they are presented repeatedly or more copies are requested, we can, as controllers, charge reasonable administrative costs for executing the request or refuse to execute the request.
9.2) Right to rectification and erasure of data and right to have the controller restrict the processing of one’s personal data
The applicant and tenant may request the rectification of erroneous information, in which case we make the decision concerning the rectification of the information. We may rectify observed erroneous data after the person or some other reliable source has provided us with the correct information.
The applicant and the tenant have the right to have the data concerning them erased from the register (right to be forgotten) after the period for which the personal data will be stored has ended, if the personal data are no longer needed for the purposes for which they were collected, if the person objects to processing without a well-founded reason or if the personal data has been processed unlawfully or if Urhea-asunnot Oy is obligated by law to erase the data. As a controller, Urhea-asunnot Oy makes the decision concerning erasure of data without undue delay in accordance with the valid legislation.
Applicants and tenants have the right to have Urhea-asunnot Oy restrict the processing of personal data, if
- Urhea-asunnot Oy no longer needs said personal data for the purposes of processing, but the applicant or tenant requires them or drafting, proposing or defending a legal claim
- the applicant or tenant has objected to processing of personal data when awaiting the verification on whether the legitimate grounds of the controller supersede their grounds
- the applicant or the tenant awaits our response to a request concerning the rectification or erasure of personal data
- the processing is unlawful and the applicant or tenant objects to the erasure of their personal data and demands the restriction of processing instead.
If the processing has been restricted based on the aforementioned grounds, the personal data can be processed, excluding storing them, only with the consent of the applicant or tenant or in order to draft, propose or defend a legal claim or in order to protect the rights of another natural or juridical person or for reasons concerning important public interest.
9.3) Right to object to processing due to a special personal reason
The applicant and the tenant have the right, based on a special personal reason, to object to the processing measures we use with personal data on the basis of the controller’s legitimate interest. The demand concerning the objection should specify the grounds based on which the processing is objected, to the controller’s contact person of this register statement (page 1). Urhea-asunnot Oy may refuse to execute the request concerning the objection based on legal grounds.
9.4) Data subject’s right to transfer data from one system to another
The applicant and the tenant have the right to receive their own personal data delivered to Urhea-asunnot Oy, which we process based on the contract relationship, in a machine readable format and as directly transferred to another controller, if this is technically possible and secure.
If this transfer is not technically possible, the applicant or the tenant may deliver their personal data, which they have received on the basis of their review right, to another controller, if they so wish.
10. Right to file a complaint to a supervisory authority
The applicant or the tenant has the right to file a complaint to the competent supervisory authority (Tietosuojavaltuutettu, Ratapihantie 9, PL 800, 00521 Helsinki or tietosuoja@om.fi) or to the supervisory authority of the EU member state in which the data subject’s official place or residence or workplace is located, if the data subject feels that their personal data has not been processed in accordance with the applicable data protection legislation.
11. Changes to this privacy policy
This privacy policy can be updated from time to time, for example when legislation changes. This privacy policy has last been updated on 8th of April 2021.