1. Contact details of the data controller for data protection matters

Data controllers

The data controllers are the subsidiaries of the VAV Group listed below, each in respect of their own residents’ register; hereinafter referred to as the “Data Controller” or “VAV”.  

VAV Group Ltd (business ID 0640915-7) and its subsidiaries listed below:

• VAV Asunnot Oy
• VAV Palvelukodit Oy
• VAV Hoiva-asunnot Oy

Contact details for data protection matters 

email: tietosuoja@vav.fi

Address: VAV Yhtymä Oy, Data Protection, Veturikuja 7, 01300 Vantaa

2. Data subjects and the content of the register

The register contains the following information on the residents (data subjects) of the Data Controller’s property:

The Data Controller lets out ARA-funded rental flats (ARA flats) built using both private funding and state support.

2.1 Basic information:

• name and flat number, date of birth, contact details (email address, telephone number), language of service, preferred method of contact;
• the tenant’s personal identity number, details regarding the rent calculation unit
• names, personal identification numbers, up-to-date contact details and relationship to the main tenant of other people living in the property
• data for verifying, identifying and distinguishing the data subject

2.2 Information concerning services:

• details of agreements relating to housing services, billing address and personal identification number
• information regarding invoicing, payment and debt collection, and credit history
• Information concerning the handover and return of keys
• Information on booking slots and usage of doors, parking spaces, saunas, laundry rooms and other services

2.3 Information concerning residents’ activities

• names and flats of participants in residents’ meetings
• names, contact details and account numbers of elected representatives, as well as information on attendance at meetings

3. Legal bases and purposes for the processing of personal data

The data controller processes the personal data of data subjects as follows:

Purpose of processing	Legal basis for processing	Personal data processed
Management of the tenancy relationshipOrganisation of housing services	The data controller’s legitimate interests based on the tenancy relationship, Article 6(1)(f) of the GDPR.	Basic resident detailsInformation concerning services
Communication with residents, e.g. providing information on maintenance work and alterations, as well as resident events, and resident satisfaction surveys	The data controller’s legitimate interests based on the tenancy relationship, Article 6(1)(f) of the TSA.	Resident’s basic details; Information relating to services
Prevention and investigation of fraud and misconduct	The data controller’s legitimate interest based on the tenancy relationship, Article 6(1)(f) of the TSA.	All data relating to residents
Intervention in disruptive behaviour	The data controller’s legitimate interest based on Sections 61 and 62 of the Act on the Letting of Residential Premises	Reports concerning a tenant’s disruptive behaviour
Processing of fault reports concerning the flat, repair and maintenance tasks	The data controller’s legitimate interest based on the tenancy relationship, Article 6(1)(f) of the GDPR.	Basic tenant details
Tenant democracy, for example, verifying the voting rights and eligibility of participants in tenants’ meetings, and managing related activities, such as the payment of remuneration to elected representatives	The legal basis for processing data relating to resident democracy is compliance with the obligations laid down in the Act on Joint Management in Rental Properties; the legal basis for processing data relating to associated activities is the data controller’s legitimate interest in promoting joint management and resident democracy	Information concerning residents’ activities
Emergency response	The data controller’s legitimate interest in ensuring residents’ safety Municipal building regulations	Flat number and residents’ surnames on the stairwell nameplate.
Statistical analysis and development of operations and services	The data controller’s legitimate interest based on the tenancy relationship, Article 6(1)(f) of the GDPR.	All resident data
Scientific or historical research and statistics	The data controller’s legitimate interest based on the tenancy relationship, Article 6(1)(f) of the TSA and Section 4 of the Data Protection Act	All resident data

4. Where data is collected from

The data controller collects residents’ data primarily from the data subject themselves or from a person authorised by them via the housing application form, the tenancy agreement and housing service agreements, on the basis of the resident’s own declarations and events occurring during the tenancy, as well as from information provided by the resident in other customer service situations.

Data for the residents’ register is also collected and updated from the Digital and Population Data Services Agency, as well as credit information from Suomen Asiakastieto Oy’s credit information register. In addition, the data controller receives reports from other residents regarding behaviour that disrupts the resident’s life.

5. To whom is data disclosed or transferred?

The names and flat numbers of the chairpersons and members of the residents’ committees elected at residents’ meetings, as well as those of elected representatives, are provided to VAV’s property manager and published on the building’s noticeboard. The name, address, email address and telephone number of the chairperson of the residents’ committee and elected representatives are also provided to the chairperson of the regional committee for the purposes of communication. 

The property manager attending a residents’ meeting may check the residents’ register and inform the chair of the meeting of a resident’s voting rights and eligibility to stand for election.

Otherwise, the data controller will not disclose data to external parties without the data subject’s consent, unless this is necessary for the prevention and investigation of misconduct by the police and other investigating authorities, for the purpose of handling legal claims, e.g. to legal advisers and courts, or to fulfil the data controller’s statutory obligations.

The Data Controller uses subcontractors in the processing of personal data in accordance with this privacy notice. In such cases, personal data may be transferred to subcontractors to the extent necessary for the subcontractor to perform its services. Subcontractors process personal data on behalf of and for the account of the Data Controller in accordance with its instructions. Subcontractors are bound by agreements entered into with the Data Controller regarding the processing of personal data, including provisions on confidentiality and data security. The Data Controller uses the following subcontractors for the processing of resident data:

• Certego Oy: Key management and handover
• SOL Property Services: maintenance tasks
• Avy AB: technical provision of the ‘Oma-VAV’ service – a website for residents during their tenancy – and maintenance of the resident register (Tampuuri service), housing services provided by an AI assistant; 24/7 customer support, handling of fault reports and automated processing of service requests, the AI-assisted chat service “Veikko” on the data controller’s website
• Visma Sirius Oy: Support and maintenance services for the Tampuuri service
• Call Waves Solutions Finland Oy: customer service tasks
• WhatsApp Ireland Limited: WhatsApp messaging system for customer service
• payment service providers, debt collection agencies, Kela
• Technical providers of satisfaction surveys, communications and marketing
• Third parties monitoring internet and mobile services on behalf of the data controller may also collect data via cookies for their own use in accordance with their own terms and conditions. They are solely responsible for their own cookies and the data they collect for their own use.

Use of the AI assistant 

An AI-based chat service (the AI assistant ‘Veikko’) is used to handle service requests relating to the customer register maintained by the data controller and the customer service of the OmaVAV service.  The AI assistant processes limited personal data entered by the data subject in the chat and obtained from the customer register maintained by the data controller: name, address details and information relating to the building. The processing of personal data is based on the data subject’s consent to use the AI assistant.  

The AI agent utilises AI technology from a third-party service provider (Azure OpenAI), which is hosted on a cloud service located within the European Economic Area. The processing of personal data takes place in accordance with the applicable data protection agreements and solely for the purposes described in this privacy notice. 

The AI assistant operating on the Data Controller’s website processes only the personal data provided by the data subject during the conversation. Processing is based on the data subject’s consent to use the AI assistant. The AI assistant only has access to the aforementioned data from the Data Controller’s customer register.  

VAV and its subcontractors may process personal data within the EU/EEA and in countries whose level of data protection has been recognised as adequate by the European Commission.

If, in exceptional circumstances, personal data is processed in other countries, VAV will ensure an adequate level of data protection by agreeing to the transfer the Standard Contractual Clauses approved by the European Commission.

6. Principles governing the protection of the register and data retention periods

Only those persons who require the data to carry out their work duties are authorised to access it.

The data is protected by personal user IDs and passwords. Access to and the right to process data are granted on the basis of job duties. Staff and subcontractors processing the data are bound by confidentiality and data security obligations. The protection of electronically stored data is based on access control, technical protection of databases and servers, monitoring of their use through the collection of log data, physical security of premises, access control, firewalls and other communications security measures, as well as data backups.

Staff are briefed and trained in the processing of personal data through regularly organised data protection and information security training sessions.

Personal data is retained for the duration of the tenancy and for one year thereafter, or for as long as is necessary to fulfil the rights and obligations associated with the tenancy, e.g. to complete invoicing, debt recovery and legal proceedings, or to comply with a statutory obligation.

Reports concerning a tenant’s disruptive behaviour are retained for as long as necessary to exercise the right to terminate the tenancy of the flat in question, but for no longer than three years from the date of the last warning issued to the tenants.

7. The data subject’s rights to access, rectification and other rights

The data subject has the following rights under the General Data Protection Regulation:

The customer has the right to access the personal data held in the register concerning them by submitting a request for access by email or in writing.

Data subjects have the right to request the rectification or erasure of data that is inaccurate, out of date, unnecessary or unlawful.

Data subjects also have the right at any time to withdraw their previously given consent to the processing of their personal data. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal of consent.

If the data subject has provided their personal data to the data controller and the processing is based on consent or a contract, they have the right to receive this data in a structured, commonly used and machine-readable format, and the right to transfer the data to another data controller in accordance with applicable legislation.