1. Contact details of the data controller for data protection matters

Data controllers

The data controllers are the landlords of the VAV Group companies listed below, each in respect of their own tenants; hereinafter referred to as ‘VAV’ or ‘Data Controller’.

VAV Yhtymä Oy (business ID 0640915-7) and its subsidiaries listed below

• VAV Asunnot Oy
• VAV Palvelukodit
• VAV Hoiva-asunnot Oy

Contact details for data protection matters

email: tietosuoja@vav.fi

Address: VAV Yhtymä Oy, Data Protection, Veturikuja 7, 01300 Vantaa

2. Data subjects and the content of the register

The register contains the following information on key personnel, decision-makers and other potential contact persons involved in the data controller’s construction project:

• the names, employers and contact details (postal address, email, telephone number) of key personnel, decision-makers and other possible contact persons amongst contractors and designers.
• information required under the Act on the Contractor’s Liability, such as details of the applicable collective agreement, certificates confirming that employees’ pension insurance has been taken out and that pension insurance contributions have been paid, as well as certificates confirming the determination of employees’ social security entitlements.  The information required under the Act on the Contractor’s Liability is always checked before the works contract is signed and, where necessary, during the course of the works. The report is attached to the works contract only if it was provided as part of the tender.

3. Purpose and legal basis for the processing of personal data

The processing of personal data is based on law or the data controller’s legitimate interests. Personal data is used to fulfil obligations and exercise rights arising from statutory provisions as well as from works contracts and other agreements, such as:

• the management of site and contractor data at the data controller’s own sites and the fulfilment of obligations
• fulfilling the data controller’s statutory obligations, such as those required under the Act on the Contractor’s Liability
• identification of individuals on site by the main contractor
• contacts relating to specific construction projects
• to manage the rights and obligations of other stakeholders at work sites, e.g. communicating with residents at work sites based on the implementation of a contract for repair works.
• testing and development of services and systems on the basis of the data controller’s legitimate interests.

4. Regular sources of data

Data for the register is routinely collected from the parties to the construction project themselves, as well as residents’ data from the data controller’s resident data register. Personal data may also be collected and updated from public and private registers, such as those maintained by Suomen Asiakastieto Oy and Vastuu Group Oy.

5. Regular disclosure of data and transfer of data outside the EU or the EEA

The data controller may disclose data to its subcontractors in order to fulfil obligations arising from contracts or under the law.

Subcontractors process personal data on behalf of and for the account of the data controller in accordance with the data controller’s instructions and only to the extent necessary for the subcontractor to perform its tasks. Subcontractors are bound by agreements entered into with the data controller regarding the processing of personal data, including provisions on confidentiality and data security.

Personal data will not be transferred outside the EU or the EEA.

6. Principles governing the protection of the register and data retention periods

Only those persons who require the data to perform their work duties are authorised to access it. Manual records are stored in locked premises commensurate with the data’s security level. Staff and subcontractors processing the data are bound by confidentiality obligations. The security of electronically stored data is based on access control, technical protection of databases and servers, physical security of premises, access control, communication security and data backup.

Personal data is retained for as long as is necessary for the purpose for which it was collected or to comply with legal obligations. Data relating to stakeholders at work sites, i.e. residents, is retained until the parties’ obligations towards one another have been fulfilled, unless a longer retention period is required by law.

Data collected in accordance with the Act on the Contractor’s Liability shall be retained by the client for at least two years after the completion of the work covered by the relevant contract.

7. The data subject’s rights to access, rectify and other rights

The data subject has the following rights under the General Data Protection Regulation:

• The data subject has the right to access their personal data held in the register.
• The data subject has the right to request the rectification or erasure of data that is inaccurate, out of date, unnecessary or unlawful.
• Data subjects also have the right to withdraw their previously given consent to the processing of their personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

If the data subject has provided their personal data to the data controller and the processing is based on consent or a contract, they have the right to receive this data in a structured, commonly used and machine-readable format, and the right to have the data transferred to another data controller in accordance with applicable legislation.

Where the basis for the processing of personal data is a legitimate interest, the data subject has the right to object to the processing of their data on grounds relating to their particular personal circumstances. When making such a request, the data subject must specify the particular circumstances on which the objection is based.

In situations specified by law, the data subject may request that the processing of their personal data be restricted, for example by suspending it in whole or in part, where the data subject considers there to be uncertainty regarding the accuracy of the data or its processing.

A request to access or restrict data can be made via the data request form on the VAV website. A request to rectify data can be made the OmaVAV service or via the data request form on the website.

Data subjects have the right to lodge a complaint regarding the processing of their personal data with the Data Protection Commissioner.