We have a range of rental homes in Vantaa. Take a look at the apartments and fill in an application.
Would you like to book a parking space or a sauna session? Have you left your keys at home? Please get in touch with us.
VAV is a rental housing group founded in 1986 that enables a good and high-quality life in Vantaa.
We provide service around the clock, every day of the year.
Data controllers
The data controllers are the properties owned by the VAV Group companies listed below, each in respect of their own tenant register; hereinafter referred to as the ‘Data Controller’ or ‘VAV’.
VAV Yhtymä Oy (business ID 0640915-7) and its subsidiaries listed below:
Contact details for data protection matters
email: tietosuoja@vav.fi
Address: VAV Yhtymä Oy, Data Protection, Veturikuja 7, 01300 Vantaa
The data controller lets out rental flats built using both private funding and state support. Tenants for rental flats built with state support are selected on social grounds.
The data controller advertises all flats as available for public application on its online service at https://vav.fi/ (hereinafter referred to as the “Service”). On the Service, applicants can view the flats on offer and complete, save, edit, submit and renew their flat applications to the data controller. The following legislation applies to the processing of personal data in this context:
The data controller processes the following data concerning those interested in renting flats, flat applicants and persons moving into a flat with them:
The data controller processes the personal data of data subjects as follows:
The data controller checks the credit history of applicants whose housing applications it has approved in the credit information register maintained by Suomen Asiakastieto Oy for the purpose of concluding a tenancy agreement. Credit information is not stored in the applicant register. In the case of state-subsidised rental accommodation, payment default entries in credit records do not in themselves constitute an obstacle to selection, but outstanding rent owed to the data controller may require, for example, a documented repayment plan, a subletting agreement negotiated with the social welfare authorities, or a payment undertaking.
Data in the register is not processed for the purposes of automated decision-making or profiling.
The data controller primarily collects data from the data subject themselves or from a person authorised by them via the housing application and its annexes, in additional information requested by the data controller, and from data provided in other personal or electronic service interactions.
In addition, data on the use of the Service is collected automatically via cookies.
The data controller checks the credit history of applicants whose housing applications it has approved against the credit register maintained by Suomen Asiakastieto Oy, as well as the population register details of all persons included in the application. Applicants’ identification details are collected from the identity verification service provider when the applicant authenticates themselves on the Service.
The data controller discloses the personal identification number of the selected housing applicant to Suomen Asiakastieto Oy and the Digital and Population Data Services Agency for the purpose of checking credit information and population register data. The data controller will not otherwise disclose data to external parties without the data subject’s consent, unless this is necessary to fulfil the data controller’s statutory obligations, for example to local authorities responsible for supervising the selection of tenants, as well as to data protection, police, pre-trial investigationand prosecuting authorities, as required by them.
The Data Controller uses subcontractors for the processing of personal data in accordance with this policy. In such cases, personal data may be transferred to subcontractors to the extent necessary for the subcontractor to perform its services. Subcontractors process personal data on behalf of and for the account of the Data Controller in accordance with its instructions. Subcontractors are bound by agreements entered into with the Data Controller regarding the processing of personal data, including provisions on confidentiality and data security. The Data Controller uses the following subcontractors for the processing of stored data:
Third parties monitoring internet and mobile services on behalf of the data controller may also collect data via cookies for their own use in accordance with their own terms and conditions. They are responsible for their own cookies and for the data they collect for their own use.
VAV and its subcontractors may process personal data within the EU/EEA and in countries whose level of data protection has been recognised as adequate by the European Commission.
If, in exceptional cases, personal data is processed in other countries, VAV will ensure an adequate level of data protection by agreeing to the transfer the Standard Contractual Clauses approved by the European Commission.
The Data Controller’s website utilises social media features (i.e. social media plugins) such as Facebook buttons, which link to the Data Controller’s social media pages.
Social media services share users’ data with the data controller in accordance with their privacy policies and the consent given by users, e.g. comments and links relating to the data controller’s websites that users share on social media, as well as information contained in the user’s public profile. The data controller processes personal data obtained via its social media pages on the basis of a legitimate interest solely for the data controller’s own purposes, such as informing users about new products, services or offers, organising competitions and prize draws, receiving feedback, purchasing advertising on social media platforms, measuring the reach of pages or adverts, or providing customer service on community pages. The data controller does not process data outside of social media, nor is the data shared by social media platforms combined with the data controller’s other data or registers without the user’s consent.
Community plugins are the responsibility of the company providing them. They are primarily responsible for compliance with data protection legislation, data security and the realisation of data subjects’ rights within the service. The data controller acts as a joint controller with Facebook with regard to the data of users of the data controller’s community pages. You can familiarise yourself with the social media platforms’ privacy policies and information regarding joint controllership, and manage your privacy settings on a service-by-service basis.
Facebook and Instagram / Meta
Data is protected by personal usernames and passwords. Access to and the right to process data are granted on the basis of job roles. Staff and subcontractors processing the data are bound by confidentiality and data security obligations. Information contained in ARA-asuntojen housing applications is confidential under Section 24 of the Freedom of Information Act. The protection of electronically stored data is based on access control, technical protection of databases and servers, monitoring of their use through the collection of log data, physical security of premises, access control, firewalls and other data communication security measures, as well as data backup.
Staff are briefed and trained in the processing of personal data through regularly organised data protection and information security training sessions.
Applicants can view and edit the details of their submitted application only by logging in with strong authentication, such as bank credentials.
The data controller retains the data in the register for the 4-month validity period of the application and, thereafter, for as long as the applicant renews the application during its validity period.
Applications, including any attachments, from applicants who have been allocated a flat are retained for three years from the date of approval.
Applications that have not resulted in the allocation of a flat (including withdrawn applications) are retained for three years from the date the application was submitted.
If an application does not result in the conclusion of a tenancy agreement and relates to privately funded housing, personal data will be deleted within three (3) months of the application’s validity period ending.
Data relating to the use of the Controller’s Service is retained for 2 years from the date on which access rights are revoked.
Where consent has been given, data may be processed for as long as the data subject’s consent remains valid.
Usage data for electronic services collected via cookies shall be deleted in accordance with the time limits specified in the cookie consents.
Anonymised data (for example, aggregate data) may be retained indefinitely.
Data subjects have the following rights under the General Data Protection Regulation:
The customer has the right to access their personal data held in the register.
The data subject has the right to request the rectification or erasure of data that is inaccurate, out of date, unnecessary or unlawful.
Data subjects also have the right to withdraw their consent to the processing of their personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal of consent.
If the data subject has provided their personal data to the data controller and the processing is based on consent or a contract, they have the right to receive this data in a structured, commonly used and machine-readable format and the right to transfer the data to another data controller in accordance with applicable legislation.
Where the basis for the processing of personal data is a legitimate interest, the data subject has the right to object to the processing of their data on grounds relating to their particular personal circumstances. The data subject must specify the particular circumstances on which their objection is based when making the request.
In circumstances specified by law, the data subject may request that the processing of their personal data be restricted, for example, by suspending it in whole or in part, where the data subject considers there to be uncertainty regarding the accuracy of the data or its processing.
A request to access or restrict data may be made via the data request form available on the VAV website. A request to rectify data can be made the OmaVAV service or via the data request form available on the website.
Data subjects have the right to lodge a complaint regarding the processing of their personal data with the Data Protection Commissioner.
29 September 2026