We have a range of rental homes in Vantaa. Take a look at the apartments and fill in an application.
Would you like to book a parking space or a sauna session? Have you left your keys at home? Please get in touch with us.
VAV is a rental housing group founded in 1986 that enables a good and high-quality life in Vantaa.
We provide service around the clock, every day of the year.
VAV Group’s Privacy Notice on Call, Chat and WhatsApp Recordings.
Data controllers
The data controllers are the housing companies owned by the VAV Group companies listed below, each in respect of their own residents’ register; hereinafter referred to as the “Data Controller” or “VAV”.
VAV Yhtymä Oy (business ID 0640915-7) and its subsidiaries listed below,
Contact details for data protection matters
email: tietosuoja@vav.fi
Address: VAV Yhtymä Oy, Data Protection, Veturikuja 7, 01300 Vantaa
Data subjects are customers who contact customer service, as well as customer service staff who respond to enquiries.
The following details are recorded from calls:
The following data is recorded from chat conversations on the website:
The following data is recorded from WhatsApp conversations:
The data controller processes the personal data of data subjects as follows:
Applicants for VAV housing, tenants and other residents (customers) may contact VAV’s customer service in the manner of their choice – by telephone, via chat or via WhatsApp. VAV records telephone, chat and WhatsApp conversations with its customer service team so that interactions, communications and the matters discussed therein can be verified in order to safeguard the rights and legal protection of customers and VAV. In addition, the recordings are used to ensure the quality of VAV’s customer service, to provide guidance and training for staff, to prevent and investigate misconduct, to maintain and develop customer service and its systems, and for statistical purposes.
The legal basis for processing the recordings is VAV’s legitimate interest, which, in the case of housing applicants, is based on the applicant relationship, in the case of tenants, on the tenancy relationship; in the case of residents, on the tenancy relationship; and in the case of VAV’s employees, on the employment relationship (Article 6(1)(f) of the EU General Data Protection Regulation).
Customer data relating to recordings is collected from telephone, chat and WhatsApp conversations, as well as from the registers of housing applicants, tenants and residents. Data on VAV employees or those of its subcontractors is collected from VAV’s customer service information systems.
VAV does not disclose data from recordings to external parties without the data subject’s consent, unless this is necessary for the prevention and investigation of misconduct by the police and other investigative authorities, to deal with legal requirements, e.g. to legal advisers and courts, or to fulfil VAV’s statutory obligations.
VAV uses subcontractors in the processing of personal data in accordance with this privacy notice. In such cases, personal data may be transferred to subcontractors to the extent necessary for the subcontractor to perform its services. Subcontractors process personal data on behalf of and for the account of VAV in accordance with its instructions. Subcontractors are bound by agreements concluded with VAV regarding the processing of personal data, including provisions on confidentiality and data security. VAV uses the following subcontractors for the processing of stored data:
Use of the AI assistant
An AI-based chat service (the AI assistant “Veikko”) is used to handle service requests in the customer register maintained by the data controller and via the OmaVAV service’s customer service. The AI assistant processes limited personal data entered by the data subject in the chat and obtained from the customer register maintained by the data controller: name, address details and information relating to the building. The processing of personal data is based on the data subject’s consent to use the AI assistant.
The AI agent utilises AI technology from a third-party service provider (Azure OpenAI), which is hosted on a cloud service located within the European Economic Area. The processing of personal data is carried out in accordance with applicable data protection agreements and solely for the purposes described in this privacy notice.
The AI assistant operating on the data controller’s website processes only the personal data provided by the data subject during the conversation. Processing is based on the data subject’s consent to use the AI assistant. The AI assistant only has access to the aforementioned data from the data controller’s customer register.
VAV and its subcontractors may process personal data within the EU/EEA and in countries whose level of data protection has been recognised as adequate by the European Commission.
If, in exceptional circumstances, personal data is processed in other countries, VAV ensures an adequate level of data protection by agreeing to the transfer using Standard Contractual Clauses approved by the European Commission.
Only those persons who require the data to carry out their work duties are authorised to access it. Access to stored data is restricted to designated personnel who maintain the customer service information systems and the data therein, as well as to customer service representatives handling customer transactions and their supervisors. Each customer service representative has access to the recorded data relating to the transactions they have handled, whilst their supervisor has access to the recorded data relating to all transactions handled by their subordinates.
The stored data is protected by personal usernames and passwords. Access and processing rights to the data are granted on the basis of job roles. Staff and subcontractors processing the data are bound by confidentiality and data security obligations. The protection of electronically stored data is based on access control, technical protection of databases and servers, monitoring of their use through the collection of log data, physical security of premises, access control, firewalls and other data communication security measures, as well as data backup.
Staff are briefed and trained on the processing of personal data through regularly organised data protection and information security training sessions.
Recordings are retained for one month, after which they are automatically deleted. Recordings may be retained for a longer period if necessary for a specific reason, for example, for the submission and processing of legal claims or due to suspected criminal offences and related official investigations.
The customer has the right to access their personal data held in the register.
The data subject has the right to request the rectification or erasure of data that is inaccurate, out of date, unnecessary or unlawful.
The data subject also has the right to withdraw their previously given consent to the processing of their personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal of consent.
If the data subject has provided their personal data to the data controller and the processing is based on consent or a contract, they have the right to receive this data in a structured, commonly used and machine-readable format, and the right to transfer the data to another data controller in accordance with applicable legislation.
Where the basis for the processing of personal data is a legitimate interest, the data subject has the right to object to the processing of their data on grounds relating to their particular personal circumstances. When making such a request, the data subject must specify the particular circumstances on which the objection is based.
In situations specified by law, the data subject may request that the processing of their personal data be restricted, for example by suspending it in whole or in part, where the data subject considers there to be uncertainty regarding the accuracy of the data or its processing.
A request to access or restrict data may be made using the data request form on the VAV website. A request to rectify data may be made the OmaVAV service or via the data request form available on the website.
Data subjects have the right to lodge a complaint regarding the processing of their personal data with the Data Protection Commissioner.