1. Data controller

For questions on processing personal data related to rental operations, please contact: 

Kiinteistö Navigare Oy

Y-tunnus: 2345437-1

Pasi Venho

Jousitie 5, 20760 Kaarina

+358 4054 144 50

pasi.venho@navigarekiinteistot.fi

2. Purpose of processing personal data 

In rental operations, personal data is collected to select a tenant, enter into the lease agreement, manage the lease, and develop rental operations. If the security deposit is given by way of a personal guarantee, personal data is also collected to make a guaranteed obligation. 

Processing of personal data is based on an agreement between the tenant or the person providing a guaranteed obligation or on performing pre-agreement actions at the request of an applicant. Processing of personal data can also be based on tenant consent. For other persons living in the same apartment with the tenant, for the tenant’s contact person (if any), and for a secondary tenant, the processing is based on the landlord’s legitimate interest. 

3. Data included in the registry 

The following data is stored in the rental operations registry:

• Name, address, phone number, and email address 
• Tenant’s and guarantor’s social security number or business ID, birth year for other residents
• Information related to the lease
• Information related to invoicing and collecting
• Financial information to evaluate financial standing
• Information concerning the need for an apartment
• Other information disclosed by the tenant when applying
• Opt-ins and opt-outs (such as opt-out of direct marketing if data is used for direct marketing purposes)

4. Data sources and data retention

Data concerning the applicant is primarily collected from the applicant. Applicant’s credit information is checked with a credit information or enforcement registry maintained by a party specialized in credit references. If an application fails to lead to an agreement, data concerning the applicant is retained for as long and to the extent necessary for selecting a tenant and for any related legal actions.

Data concerning the tenant and the persons living in the same apartment, tenant’s contact person (if any), secondary tenant, and guarantor are primarily collected from the tenant and the guarantor. Tenant’s and guarantor’s credit information is checked with a credit information or enforcement registry maintained by a party specialized in credit references. Data related to the lease is retained for the entire duration of the lease. The controller shall not retain personal data for longer than is necessary for use. The personal data of the tenant will be kept for the duration of the tenancy and a period of 5 calendar years after the end of the tenancy. Data relating to an unsuccessful rental housing application personal data including the application and its annexes will be kept for 6 months after submission of the application.

If a rental broker is used for selecting the tenant and managing the lease, data concerning the applicant, tenant, and guarantor are provided by the broker.

5. Disclosure of data 

As a rule, data stored in the rental operations registry are not disclosed to other parties nor transferred outside the European Union or the European Economic Area. 

The tenant’s name, contact information, and information regarding the lease can be disclosed to the housing company’s list of residents.

6. Data protection

All processing of personal data respects the privacy of the individuals in the registry, and access to the data is only available to those who require it for carrying out their duties.  

The data is stored in electronic systems and protected with user-specific IDs, passwords, and access rights. The data registry is backed up regularly. Documents printed on paper are stored securely and protected from external access. 

7. Rights of the data subject 

The data subject is entitled to review the data stored in the registry and demand correction or removal of any erroneous or inaccurate information. The data subject’s data can be removed at the request of the data subject if the legal basis for processing the data no longer exists. 

Any requests for reviewing or rectifying the data must be presented to the data controller in writing. Reviewing the data and demanding rectification are free of charge. 

The data subject can opt out of data processing for direct marketing. 

The data subject is entitled to file a notice of appeal regarding the data controller’s actions to a supervisory authority. In Finland, the data protection ombudsman is the national GDPR supervisory authority.