1. Contact details of the data controller for data protection matters

Data controllers

The data controllers are the landlords of the properties owned by the VAV Group companies listed below, each in respect of their own tenants; hereinafter referred to as “VAV” or “Data Controller”.

VAV Yhtymä Oy (business ID 0640915-7) and its subsidiaries listed below

• VAV Asunnot Oy
• VAV Palvelukodit
• VAV Hoiva-asunnot Oy

Contact details for data protection matters

email: tietosuoja@vav.fi

Address: VAV Yhtymä Oy, Data Protection, Veturikuja 7, 01300 Vantaa

2. Data subjects and the content of the register

The data controller lets out rental flats built using both private funding and state subsidies. Tenants of rental flats built with state subsidies are selected on social grounds.

The register contains the following information on the data controller’s tenants and the persons living with them (data subjects):

2.1 Basic details:

• the tenant’s name and that of their spouse living with them, personal identification number, contact details (email address, telephone number), language of service, preferred method of contact;
• information for verifying, identifying and distinguishing the individual, e.g. in the absence of a personal identity number, identification details from a travel document, residence permit details
• information regarding the tenant’s guardianship or administration of their affairs
• details of the housing application and tenancy agreement
• names, personal identification numbers and current contact details of other persons living in the flat, as well as the resident’s relationship to the principal tenant,
• details regarding the termination or expiry of the tenancy,
• the name and date of birth of any minor children living with the tenant. The personal identity number is collected in the case of state-subsidised rental accommodation
• information concerning the handover and return of keys, as well as moving in and out

2.2 Information relating to the tenancy, for example:

• information concerning invoicing, payments and debt collection, as well as payment behaviour and debt settlement arrangements
• reports and observations concerning disruptive behaviour by the tenant or other occupants of the same flat, or the maintenance of the property, and any remarks or warnings issued in this regard
• complaints, feedback, letters, emails, phone calls, chat messages, WhatsApp messages and other communication with customer services
• responses to customer satisfaction surveys.

2.3 Information concerning the flat and its condition, for example:

• photographs and other information relating to the flat’s condition survey
• fault reports concerning the flat
• repairs carried out on the flat
• apartment-specific consumption data

2.4 Information collected during housing advice, for example:

• general information provided by the data subject concerning health, substance abuse, financial or other problems affecting the tenant’s ability to fulfil their obligations
• data collected for the purpose of investigating and addressing reports of disturbances and observations

2.5 Information concerning the use of electronic services, for example:

• username, password or other possible identification details for services and information systems; access rights; usage history recorded during use
• the name and email address of the holder of the access rights
• browsing and usage data collected via cookies or similar means; the page from which the user accessed the Data Controller’s website; newsletter read data; device model, unique device identifier, browser version, IP address, session ID, session time and duration, as well as screen resolution and operating system.

3. Legal bases and purposes of personal data processing

The data controller processes the personal data of data subjects as follows:

Purpose of processing	Legal basis for processing	Personal data processed
Processing of tenancy agreement proposals, property inspection and handover, Rent invoicing, payment reminders, debt collection, management of the tenancy deposit Monitoring and maintenance of the property’s condition, repairs and alterations Measures relating to the termination, cancellation and expiry of the tenancy agreement and moving out	Carrying out pre-tenancy procedures at the data subject’s request, Enforcing the tenancy agreement concluded with the data subject, Article 6(1)(b) of the TSA	Basic information Information relating to the tenancy Information relating to the flat and its condition
Management of the tenancy, for example: Communication regarding the tenancy, including maintenance work and other alterations, and satisfaction surveys; Contact with the data controller’s customer service	The data controller’s legitimate interest based on the tenancy agreement, Article 6(1)(f) of the GDPR; for WhatsApp communications, the data subject’s consent	Basic informationInformation concerning the tenancyInformation concerning the flat and its condition
Housing advice	The data controller’s legitimate interest based on the tenancy agreement, Article 6(1)(f) of the GDPR. Processing of data belonging to special categories of personal data with the data subject’s consent.	Basic informationInformation relating to the tenancyInformation concerning the flat and its conditionInformation collected during housing advice
Prevention and investigation of fraud and misconduct	Legitimate interests of the data controller based on the tenancy agreement, Article 6(1)(f) of the GDPR.	All data
Statistical analysis and development of operations and services	The data controller’s legitimate interest, based on the tenancy agreement, in carrying out and developing its operations, Article 6(1)(f) of the GDPR: User consent for data collected via non-essential cookies	Data concerning the use of electronic services: Without personal identifiers (in pseudonymised form): basic information, information relating to the tenancy, information relating to the flat and its condition
Identification of users of digital servicesEnsuring the functionality and availability of services and investigating disruptionsDemonstrating the accuracy of data processing in relation to the servicesEnsuring the security of the services	Statutory obligation regarding the security of personal data processing, Article 32 of the TSA	Basic details of the data subject; Information concerning the use of electronic services
Scientific or historical research or statistical purposes	The data controller’s legitimate interest based on the tenancy agreement, Article 6(1)(f) of the TSA and Sections 4 and 6 of the Data Protection Act.	All data

4. Sources of data

The data controller collects data primarily from the data subject themselves or from a person authorised by them via the housing application form, the tenancy agreement, the data subject’s own declarations and events occurring during the tenancy, as well as from information provided by the tenant in other personal or electronic customer service interactions. In addition, data on the use of the data controller’s electronic services is collected automatically using cookies.

Tenants’ details are also collected and updated from the Digital and Population Data Services Agency, housing benefit information from the Social Insurance Institution of Finland, and credit information from Suomen Asiakastieto Oy’s credit register.  In addition, the data controller receives reports of disruptive behaviour from other residents.

5. To whom is the data disclosed or transferred

The data controller will not disclose data to external parties without the data subject’s consent, unless this is necessary for the prevention and investigation of misconduct by the police and other investigative authorities, for the purpose of handling legal claims, e.g. to legal advisers and courts, or to fulfil the data controller’s statutory obligations.

During the tenancy, we disclose our tenants’ payment default records to Suomen Asiakastieto Oy in order to monitor changes to our tenants’ details during their tenancy. If the owner of the property changes, the data controller may disclose to the new owner the information necessary for the management of the tenancy.

The data controller uses subcontractors to process personal data in accordance with this privacy notice. In such cases, personal data may be transferred to subcontractors to the extent necessary for the provision of their services. Subcontractors process personal data on behalf of and for the account of the Data Controller in accordance with its instructions. Subcontractors are bound by agreements concluded with the Data Controller regarding the processing of personal data, including provisions on confidentiality and data security. The Data Controller uses the following key subcontractors for the processing of resident data:

• Certego Oy: Key management and handover
• SOL Property Services: maintenance tasks
• Avy AB: technical provision of the ‘Oma-VAV’ service – a website for residents during their tenancy – and maintenance of the residents’ register (Tampuuri service), housing services provided by an AI assistant; 24/7 customer support, fault reporting and automated processing of service requests, the AI-assisted chat service “Veikko” on the data controller’s website
• Visma Sirius Oy: support and maintenance services for the Tampuuri service
• Call Waves Solutions Finland Oy: customer service tasks
• WhatsApp Ireland Limited: WhatsApp messaging system for customer service
• Payment service providers, debt collection agencies, Kela
• Technical providers of satisfaction surveys, communications and marketing

Third parties monitoring internet and mobile services on behalf of the data controller may also collect data via cookies for their own use in accordance with their own terms and conditions. They are responsible for their own cookies and for the data they collect for their own use. Further information on the data controller’s cookie policy.

Use of the AI assistant 

An AI-based chat service (the AI assistant ‘Veikko’) is used for service requests in the customer register maintained by the data controller and via the OmaVAV service’s customer support.  The AI assistant processes limited personal data entered by the data subject in the chat and obtained from the customer register maintained by the data controller: name, address details and information relating to the building. The processing of personal data is based on the data subject’s consent to use the AI assistant.  

The AI assistant utilises AI technology from a third-party service provider (Azure OpenAI), which is hosted on a cloud service located within the European Economic Area. The processing of personal data takes place in accordance with the applicable data protection agreements and solely for the purposes described in this privacy notice. 

The AI assistant operating on the data controller’s website processes only the personal data provided by the data subject during the conversation. Processing is based on the data subject’s consent to use the AI assistant. The AI assistant only has access to the aforementioned data from the Data Controller’s customer register.  

6. Transfer of data outside the EU/EEA

VAV and its subcontractors may process personal data within the EU/EEA and in countries whose level of data protection has been recognised as adequate by the European Commission.

If, in exceptional cases, personal data is processed in other countries, VAV ensures an adequate level of data protection by agreeing on the transfer the Standard Contractual Clauses approved by the European Commission.

7. Processing of personal data relating to the data controller’s social media users

The Data Controller’s website utilises social media features (i.e. social media plugins), such as Facebook buttons, which link to the Data Controller’s social media pages.

Social media services share users’ data with the data controller in accordance with their privacy policies and the consent given by users, e.g. comments and links relating to the data controller’s websites shared by the user on social media, as well as information contained in the user’s public profile. The data controller processes personal data obtained via its social media pages on the basis of a legitimate interest solely for the data controller’s own purposes, such as informing users about new products, services or offers, organising competitions and prize draws, receiving feedback, purchasing advertising on social media platforms, measuring the reach of pages or adverts, or providing customer service on community pages. The data controller does not process data outside of social media, nor is the data shared by social media platforms combined with the data controller’s other data or registers without the user’s consent.

Community plugins are the responsibility of the company providing them. They are primarily responsible for compliance with data protection legislation, data security and the implementation of data subjects’ rights within the service. The data controller acts as a joint data controller with Facebook regarding the data of users of the data controller’s community pages. You can familiarise yourself with social media privacy policies and information regarding joint controllership, and manage your privacy settings on a service-by-service basis:

Facebook and Instagram / Meta

8. Principles governing the protection of the register and data retention periods

Only those individuals who require the data to carry out their work duties are authorised to access it.

The data is protected by personal usernames and passwords. Access to and processing of data are granted on the basis of job duties. Staff and subcontractors processing the data are bound by confidentiality and data security obligations. The security of electronically stored data is based on access control, technical protection of databases and servers, monitoring of their use through the collection of log data, physical security of premises, access control, firewalls and other data communication security measures, as well as data backups.

Staff are briefed and trained on the processing of personal data through regularly organised data protection and information security training sessions.

Personal data is retained for 5 years after the end of the tenancy, with the following exceptions:

• All data may be retained for as long as is necessary to fulfil the rights and obligations associated with the tenancy, e.g. to complete invoicing, debt collection and legal proceedings, or to comply with a statutory obligation.
• Data relating to the use of electronic services will be retained for 2 years from the date on which access rights are revoked.
• Where processing is based on consent, data may be processed for as long as the data subject’s consent remains valid.
• Data on the use of electronic services collected via cookies will be deleted in accordance with the time limits specified in the cookie consents.
• Reports concerning a tenant’s disruptive behaviour are retained for as long as necessary for the purposes of exercising the right to terminate the tenancy of the flat in question, but for no longer than 3 years from the date of the last warning issued to the tenant.
• Information relating to rent payments is, as a general rule, retained for six (6) years in accordance with the Accounting Act.
• Information concerning the flat and its condition is retained permanently for the purposes of property maintenance and servicing, separate from other personal data (in pseudonymised form). Anonymised data (e.g. aggregate data) may be retained permanently.

9. Rights of the data subject to access, rectify and other rights

The customer has the right to access the personal data concerning them held in the register.

The data subject has the right to request the rectification or erasure of any data that is incorrect, out of date, unnecessary or unlawful.

The data subject also has the right at any time to withdraw their previously given consent to the processing of their personal data. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal of consent.

If the data subject has provided their personal data to the data controller and the processing is based on consent or a contract, they have the right to receive this data in a structured, commonly used and machine-readable format and the right to transmit the data to another data controller in accordance with applicable legislation.

Where the basis for the processing of personal data is a legitimate interest, the data subject has the right to object to the processing of their data on grounds relating to their particular personal circumstances. When making such a request, the data subject must specify the particular circumstances on which the objection is based.

In situations specified by law, the data subject may request that the processing of their personal data be restricted, for example, by suspending it in whole or in part, where the data subject considers there to be uncertainty regarding the accuracy of the data or its processing.

A request to access or restrict data may be made via the data request form on the VAV website. A request to rectify data may be made the OmaVAV service or via the data request form on the website.

Data subjects have the right to lodge a complaint regarding the processing of their personal data with the Data Protection Commissioner.

29 September 2026