Information of Client Data Processing for Residents
The personal data of residents and apartment applicants are processed only to the necessary extent in accordance with the laws and Fair Rental Practices in the renting activities of Y-Foundation Corporation. Data processing is based on the General Data Protection Regulation of EU 2016/679. This statement illustrates how we process your client data and what your legal rights are based on the General Data Protection Regulations. If you need further information, please contact our client service.
By Y-Foundation Corporation we mean Y-Foundation, M2-Kodit and the other companies of the corporation. In this statement, all of these are called the Foundation. We guarantee that your personal data are processed appropriately and that your data are not handed over to third parties. Our personnel have been briefed in the matters of data protection and data security. In addition, we have signed a non-disclosure agreement. We conform to the regulations and official guidelines and we require the same from our data processing partners.
This privacy statement illustrates the basics of the personal data processing and the rights of registered persons as is required by the General Data Protection Regulations. If you need more detailed instructions to handle your case, you can contact our client service.
Keeper of the Register
Y-Foundation (registered in the Register of Foundations)
Persons in Charge of Register Matters and their Contact Information
Director of renting activities Eeva Tammisalo is responsible for the register.
Corporate lawyer Timo Mutalahti is the Data Protection Officer of the Foundation.
Contact the client service in the matters related to the register.
Name of the Register
The Client Register of Y-Foundation (hereinafter referred to as the “Register”)
The Use of the Personal Data
We process your personal data in so far as it is necessary in the renting activities and maintenance of real estate. The processing is based on you applying for an apartment, your living in an apartment or having rented an apartment from Y-Foundation corporation (for example, from M2-Kodit). We require your personal data primarily to fulfil the rights and obligations of a tenant and a landlord in accordance with the legislation. We use your personal data, for example, for the following purposes:
- compliance with the guidelines and principles of resident selection,
- maintenance and fault notifications of apartments,
- renting account ledger and other payment transactions; and
- residential guidance, resident activities, customer surveys and resident information.
In addition, we use our clients’ personal data on a general level in the development of our services to better meet the needs of our clients. Use of the data in research is carefully guided as well as made anonymous or pseudonymous. We also use personal data in order to make direct marketing and target marketing more interesting for the clients. Personal data is partly processed automatically. However, decisions concerning our clients’ rights or responsibilities are not made solely based on automatic processing or profiling.
Contents of the Register
Client register includes personal data of persons who have applied for an apartment from the Foundation, live in an apartment of the Foundation or have lived in an apartment of the Foundation. The following data can be processed in the register of apartment applicants, tenants or possible co-tenants:
Basic information of all the applicants and residents
- name, national insurance number, address, phone number, e-mail address.
Information regarding the need of an apartment
- current apartment; duration and quality of employment; income and wealth; credits; debts; arrangements with creditors and debt recoveries; possible legal guardians; guardianship of an underage applicant; giver of payment commitment or surety; duration of residence permit; other information required by ARA resident selection.
Information regarding residency
- rental contract; information of rent, payments and insurances; communication with the representatives of the landlord; decisions and actions regarding residency; bank account information for refunds or compensations; possible permissions or prohibition of marketing.
Other client data of some of the clients
- membership of residential democracy cooperations body and possibly a picture of the person; data of life situations and the usage of the services informed of by the clients of residential information; data of housing benefits accessed with the clients’ permit; service plans and contracts; bans on disseminating information.
The IP addresses of people who have visited the ysaatio.fi and m2kodit.fi web pages as well as information on the Internet usage collected with cookies can be recorded in the systems.
We store your personal data for the time period specified by the basis on compilation. The time period, concerning different pieces of data, is determined by the legislation, official guidelines and contracts. We erase the data when there is no more legitimate grounds for the processing. The data collected with cookies are stored no more than three (3) years depending on the nature of the cookies.
Sources of Information
We collect your personal data primarily from yourself. In addition, we can process data compiled during rental relationships which are collected primarily from our cooperation partners, such as maintenance companies, working on our behalf.
We can collect and inspect your data from the Population Register Centre, Suomen Asiakastieto Oy’s credit reference register and from Social Insurance Institution of Finland in regards to accommodation benefits. During real estate and residence businesses, we obtain the information of business transitions straight from the vendor. IP addresses and cookies can be recorded as the web pages of the Foundation are used.
Disclosure and Transfer of Data
As a rule, we do not disclose your information outside the Foundation. An exception to this rule is the disclosure of your information, in a necessary extent, to the partners acting to the Foundation’s account (such as maintenance companies) to fulfil our services. Legitimate rights, obligations or contracts to disclose such data are also an exception. Examples are monitoring of residential selection by municipality and STEA and accommodation benefit matters of Social Insurance Institution of Finland. We can disclose your data to other parties with your written consent. We do not transfer your data outside EU or EEA countries.
Principles of the Register Protection
We comply with the legislation and official guidelines, good practice on information management and data security and data safety policies of the Foundation in the protection of your personal data. Personal data can be processed only by persons that have been entitled to do so in the capacity of their tasks.
We store manual data reliably in a locked space. Only persons appointed by the Foundation can access the digital data. These persons are given temporary user names and passwords. The right to use the register is designated from task to task. The data is recorded in locked and monitored spaces.
You have the right to know if we process your personal data. You have the right to check what information about you has been recorded. If there are errors in your information, you can ask them to be rectified. You have the right to ask your information to be erased (‘right to be forgotten’) unless the processing or storage of the data is based on contractual relationship or other legitimate interest of the Foundation. If necessary, you can obtain more detailed instructions on the fulfilment of the rights of the registered party.
In addition, you have the right to get matters relating to the fulfilment of your rights examined by a competent authority (data protection supervisor), if, in your opinion, we have not complied with the rules or official guidelines regarding data protection. The phone number of the data protection supervisor’s office is +358 (0)29 5666 700 and address is Ratapihantie 9, 00520 Helsinki, Finland.
You can direct all informal questions and inspection requests concerning personal data processing to the client service of the Foundation in person or in writing. We will answer your messages as soon as possible. You can use your right for an inspection once per year. If your inspection requests are visibly groundless or unreasonable, especially if they are made repeatedly or multiple copies are requested, we will charge a fee of 50 euros per request to cover the administrative costs or we will decline to fulfil the request.