Privacy statement of the client register
Information for Residents about the Processing of Personal Data
At the Y-Foundation Group, we process the personal data of residents and apartment applicants only to the extent necessary to conduct renting activities and other activities of the Group in accordance with the laws and Fair Rental Practices. Our data processing methods are based on the General Data Protection Regulation (EU) 2016/679. This privacy statement illustrates how we process your personal data and what legal rights you have under the General Data Protection Regulation. If you need further information, please contact our customer service.
By Y-Foundation Group we mean the Y-Foundation, Kiinteistö Oy M2-Kodit and the other companies of the Group. In this statement, these are together referred to as the Foundation. We are responsible for ensuring that your personal data is processed appropriately and that your data is not wrongfully disclosed to third parties. Our personnel have been briefed on the matters of data protection and information security. In addition, we have signed a non-disclosure commitment. We conform to the regulations and official guidelines and require the same from our partners that process personal data.
This privacy statement provides a basic account of our personal data processing methods and the rights of data subjects as required by the General Data Protection Regulation. If you need more detailed information for your specific situation, you can contact our customer service.
Data Controller
Y-Foundation (registered in the Register of Foundations)
Persons in Charge of the Register and their Contact Information
Director of Customer Relations Eeva Tammisalo is responsible for the register.
Corporate lawyer Timo Mutalahti is the Data Protection Officer of the Foundation.
Please contact our customer service in matters related to the register.
Name of the Register
The Client Register of the Y-Foundation (hereinafter referred to as the “Register”)
Purpose of Processing Personal Data
We process your personal data in so far as it is necessary for our renting activities and the maintenance of real estate. The processing is based on you having applied for an apartment, living in an apartment or having rented an apartment from the Y-Foundation Group (for example, from M2-Kodit). We require your personal data primarily to fulfil the rights and obligations of tenants and landlords in accordance with the legislation. We use your personal data, for example, for the following purposes:
- compliance with the guidelines and principles of resident selection,
- apartment maintenance and fault notifications,
- rent ledger and other payment transactions; and
- residential guidance, resident activities, customer surveys and resident information.
In addition, we use our clients’ personal data on a general level in the development of our services to better meet the needs of our clients. Data usage for research purposes follows strict guidelines, and the data is made anonymous or pseudonymous. We also use personal data for direct marketing and in order to tailor marketing to our clients and their interests. Personal data is partly processed automatically. However, decisions concerning our clients’ rights or responsibilities are not made solely based on automatic processing or profiling.
Contents of the Register
The client register contains personal data about persons who have applied for an apartment owned by the Foundation, live in an apartment owned by the Foundation or have lived in an apartment owned by the Foundation. The following personal data of apartment applicants, tenants or possible co-tenants may be processed in the register:
Basic information about all applicants and residents
name, personal identity code, address, phone number, e-mail address.
Information regarding the need for housing
current apartment; duration and type of employment; income and wealth; loans; debts; arrangements with creditors and debt recoveries; possible legal guardians; guardianship of an underage applicant; provider of a payment commitment or surety; duration of residence permit; other information required by the ARA resident selection.
Information regarding residency
rental contract; rent, payment and insurance information; communication with the representatives of the landlord; decisions and actions regarding residency; bank account information for refunds or compensations; possible marketing permissions or prohibitions.
Additional information about certain clients
membership of a residential democracy cooperation body and possibly a picture of the person; data provided by users of residential advisory services on their life situations and their use of the services; data on housing benefits, service plans and contracts accessed with the clients’ permission; possible orders of non-disclosure for personal safety reasons.
The IP addresses of the visitors of the ysaatio.fi and m2kodit.fi websites as well as data collected by cookies on their browsing activities may be saved in our systems.
Data Retention
We store your personal data for the time period determined by the grounds for processing. The time period for different types of data is determined by legislation, official guidelines and contracts. We erase the data when there are no more legitimate grounds for processing. The data collected by cookies is stored no more than three (3) years depending on the nature of the cookies.
Regular Sources of Information
We receive personal data about you primarily through your application and its attachments, i.e. from you. In addition, we process data collected during rental relationships which we receive primarily from our partners, such as maintenance companies, acting on the Foundation’s behalf.
benefits. From time to time, we may retrieve data about you from the Digital and Population Data Services Agency, Suomen Asiakastieto Oy’s credit data files and the Social Insurance Institution of Finland as regards housing benefits, and inspect this data. During real estate and apartment transactions, we obtain information regarding customer transfers straight from the vendor. We may collect IP addresses and information on cookies when visitors browse the Foundation’s websites.
Disclosure and Transfer of Data
As a rule, we do not disclose your data outside the Foundation. An exception to this rule is the disclosure of your data to our partners (such as maintenance companies) acting on behalf of the Foundation to the extent necessary to perform our services. Legal and contractual rights or obligations to disclose data are also an exception. These include the monitoring of our resident selection by municipalities and the Funding Centre for Social Welfare and Health Organisations (STEA) and matters related to housing benefits received from the Social Insurance Institution of Finland. We may also disclose your data to other parties with your explicit written consent. We do not transfer your data outside the EU or EEA.
Principles of Register Protection
We comply with the legislation and official guidelines, data management best practices and the Foundation’s data protection and information security policies in the protection of your personal data. Personal data may only be processed by persons authorised to do so as part of their duties.
We store physical data securely in a locked space. Only persons appointed by the Foundation can access the digital data. These persons are given temporary usernames and passwords. The right to access the registers is determined on a task-by-task basis. The data is recorded in locked and monitored spaces.
Your Rights
You have the right to know if we process your personal data. You have the right to check what information has been recorded about you. If the data is incorrect, you have the right to ask for rectification. You have the right to ask for your information to be erased (‘right to be forgotten’) unless the processing or storage of the data is based on a contractual relationship or other legitimate interest of the Foundation. If necessary, you can contact our customer service to obtain more detailed instructions on the fulfilment of the rights of data subjects.
If technically possible, you have the right to have your data transferred to another data controller in a machine-readable form. You have the right to prohibit the use of your data for direct marketing or research requests. Disabling cookies does not affect the use of the websites.
In addition, you have the right to have matters relating to the fulfilment of your rights examined by the competent authority (the Data Protection Ombudsman), if, in your opinion, we have not complied with the rules or official guidelines regarding data protection. The phone number of the Data Protection Ombudsman’s office is +358 (0)29 5666 700 and the address is Ratapihantie 9, 00520 Helsinki, Finland.
You can direct all questions and inspection requests concerning personal data processing to the customer service of the Foundation in a free format in person or in writing. We will respond to you as soon as possible. You can use your right for an inspection free of charge once per year. If your inspection requests are manifestly groundless or unreasonable, especially if they are made repeatedly or multiple copies are requested, we will charge a fee of 50 euros per request to cover the administrative costs or we will decline to fulfil the request.