Storage of personal data
Hoas pays specific attention to the protection of the client’s privacy and personal data. The prerequisite for establishing a contractual relationship and maintaining the tenant relationship is that our applicants and tenants provide us with the necessary personal data.
Processing the personal data of apartment applicants and tenants at Hoas
Foundation for Student Housing in the Helsinki Region sr, later on referred to as Hoas
Business ID FI01165149
Pohjoinen Rautatiekatu 29, 00100 Helsinki
P.O. Box 799, 00101 Helsinki
Tel. +358 (0)9 5499 01
Riitta Sorjonen, riitta.sorjonen[at]hoas.fi
2) The purpose of use and grounds for processing personal data
The prerequisite for establishing a contractual relationship and maintaining the tenant relationship is that our applicants and tenants provide us with the necessary personal data. Failure to provide personal data may lead to a situation where we cannot manage our responsibilities and commitments as a lessor, due to which we may not be able to sign a tenancy agreement or continue a tenancy agreement that has already been signed.
The purposes of processing personal data are rental services of apartments and parking spaces, tenant support and tenant democracy as well as management and development of related matters, management and development of customer relationships, management of tenancy agreements and management of lessor’s rights and obligations. We need personal data also for security deposits and other invoicing and debt collection purposes, maintaining payment data, study records and tenant contacts, managing the maintenance of apartments and buildings, managing notices of defect, repair, inspection and apartment change situations, sauna and laundry room reservations, hallway listings and for other similar purposes.
We also use the personal data of our applicants and tenants for sending notices and electronic
The personal data of applicants and tenants will be used for system testing only in special situations, if the development and functional integrity of the system it requires.
In order to ensure safety and legal protection, we may collect camera surveillance data at the Hoas office and buildings and the areas surrounding them, such as nearby entrances, waste collection points and parking lots. This information will be used for reviewing criminal activities and accident situations. The premises and areas with camera surveillance have been marked with signs.
Processing personal data is based on a contract relationship, legal requirement or a legitimate interest of Hoas or the client. When processing is based on a legitimate interest, the legitimate interest will be one of the following:
• Ensuring general safety
• Ensuring the legal protection of tenants
• Protecting the property of Hoas
• Developing the operations of Hoas
• Ensuring the functionality of Hoas’ information systems.
3) Processed personal data
We will process the personal data of the applicant/tenant, their possible guardian, co-applicant(s) and other security deposit payer, other rent payer or trustee that are essential for achieving the processing purposes we have defined.
The register will process the following personal data of applicants:
The first names and last name of the applicant, their personal identification number or date of birth,
passport number and/or EU ID’s number, email address, telephone number, sex, nationality, preferred language, monthly income, assets and student loans, mention about credit information, information concerning studies, customer number.
If the applicant is under 18 years of age, the first names and last name, social security number or date of birth, nationality and contact information as well as mention of credit information of the applicant’s guardian must be provided.
If the applicant has a spouse or lives with a friend, the co-applicant’s (2nd applicant) and the possible children’s first and last names, personal identification number or date of birth, nationality, passport number and/or EU ID’s number, sex, preferred language, monthly income, assets and student loans, mention about credit information, information concerning studies, customer number must also be provided.
If the applicant has a trustee, the first names and last name, social security number or date of birth, nationality and contact information of the applicant’s trustee must also be provided. Additionally, information concerning current housing, wishes related to the applied apartment and reason for applying for the apartment will be recorded from the electronic apartment application form.
The register will process the following personal data of tenants:
The customer number, first names and last name of the tenant, their personal identification number or date of birth, passport number and/or EU ID’s number, address and new address for when the tenant moves out of Hoas apartment, email address, telephone number, sex, nationality, preferred language, residence permit, monthly income, assets and student loans, mention about credit information, information concerning studies, bank account number, information concerning the security deposit and its payment, information concerning rent invoicing and rent payments, information concerning other invoicing and payments related to the rental relationship, information concerning debt collection, information about the prohibition of information transfer.
If the tenant is under 18 years of age, the first names and last name, social security number or date of birth, nationality and contact information, mention about credit information of the tenant’s guardian must also be provided.
If the tenant has a family or lives with a friend, the following information is required: first names and last names of the co-tenant and possible children, their personal identification number or date of birth, nationality and the co-tenant’s customer number, passport number and/or EU ID’s number, sex, preferred language, residence permit, monthly income, assets and student loans, mention about credit information, information concerning studies, bank account number, information concerning the security deposit and its payment, information concerning rent invoicing and rent
payments, information concerning other invoicing and payments related to the rental relationship, information concerning debt collection, information about the prohibition of information transfer.
If the deposit or rent is paid by someone else than the tenant, the first names and last name/company information and contact information of the party are required.
If the tenant has a trustee, the first names and last name, personal identification number or date of birth and contact information of the tenant’s trustee must also be provided.
The first names and last name, personal identification number or date of birth, address, phone number, e-mail address and sex of a person subletting the apartment.
With regard to our tenants, we process, in addition to the abovementioned data, the following information: tenancy agreement information, invoicing address, data concerning the rented apartment, contacts during tenancy including reclamations, feedback and other factual communication related to the client relationship as well as information about participation in activities arranged by the tenant committees, key information and access information, if the apartment has an electronic locking system.
Sensitive data is only processed when the data has been acquired from the applicant or tenant themselves, for example for verifying right of tenancy or similar, or restrictedly from other legitimated sources, i.e. from authorities.
The camera surveillance data includes information about the people moving around the camera surveillance area. In addition to video image, the date and time of the event will be recorded.
3.1) Metadata collected in cookies
Hoas collects data that is recorded in the log data of the Hoas Web site in connection with regular
site maintenance, as well as analytics data by using our own cookies and service providers’ cookies regarding the use of the Hoas.fi Web site. Hoas utilises the Google Analytics service. The collected data never contains a person’s name, SSN, or any other identifiable piece of information, and Hoas shall never attempt to identify an individual visitor to the Hoas.fi site on the basis of this metadata.
4) Regular data sources
We will receive the data about the applicant, their possible guardian, co-applicant and their children directly from the applicant through the apartment application form they have filled in and the attachments they have provided and sent through Hoas’ website. In connection to inspecting the application, we will add a mention about credit information, which we will verify from the register of Suomen Asiakastieto Oy.
We will receive personal data concerning the exchange students of the University of Helsinki from
We will receive information concerning the tenants from the apartment application form, provided attachments and the tenancy agreement. We will receive information related to studies from the student register extract sent by the tenant and data about contacting the tenant during their tenancy face-to-face, by phone or by email. Notifications concerning repair or maintenance needs in the apartment will be received directly from the tenant. When the rental relationship is terminated, the resident will share their new address.
We will receive information about a person subletting the apartment directly from the main tenant.
Camera surveillance data is recorded automatically as the person arrives in the surveillance area
while the camera is on.
5) Protection of personal data and data security
Personal data are stored in supervised and guarded premises. The telecommunication connections to any databases containing personal data will be protected with encrypted connection and appropriate authentication. Databases and the systems using them have been protected with technical and administrative measures.
Using the personal register always requires a login and a password. User rights will be determined based on a person’s role according to what is necessary for that employee’s duties. The staff has been trained to process data in a protected manner and they operate under confidentiality. Third party organisations in the roles of personal data processors are bound by confidentiality agreements between the two parties.
6) Regular disclosure of register data
We regularly disclose the personal data of tenancy agreements to Kela concerning tenants who are students as well as data about the amount of their rent and the rented subject.
We will regularly disclose reports to Kela and social welfare office concerning the security deposits paid by them, which Hoas has realised, in part or in full, at the end of the rental relationship.
We will regularly disclose information to educational institutes concerning contracts as well as other important related information incl. unpaid rents of exchange students that are registered in their institute.
For Svea Perintä Oy, we will regularly disclose data concerning those tenants whose debts the operator will be assigned to collect (personal information of the debtor and the debts to be collected).
For Telia Finland Oyj and DNA Oyj, we will regularly disclose information about the tenants
(personal information) for opening, maintaining and terminating Internet connections.
For Securitas Oy, we will regularly disclose data about the tenants (personal information) for the
door opening service.
For partners defined in the building management and maintenance agreements valid at the time, we will disclose data about tenants (name, address and contact information) for the purposes of finding out reparation needs and carrying out repair operations in the apartments.
For Tehomen Oy, we will regularly disclose data (personal information) about all tenants of parking lots in the properties located in Berliininkatu 5, Brysselinkatu 3 and Rörstrandinkatu 3. Data is used for remote control of heating poles and EV charging service.
For Tapiolan Lämpö Konserni, we will regularly disclose data (personal information) about all tenants of parking lots in the properties located in Anna Sahlsténin katu 4. Data is used to open the lift door to the parking garage.
For Matinkylä Huolto Oy, we will regularly disclose data (name, email and telephone number) about tenants of parking lots in the properties located beside Rantaharju 10. Data is used to open the lift door to the parking garage by phone.
For Jätkäsaaren Pysäköinti Oy, we will regularly disclose data (personal information and the registration number of the car) about the Hoas tenants using Rokkiparkki. Data is used for a key card and a PIN code.
We will publish updated hallway listings on the electronic bulletin board of the buildings daily and on the physical bulletin boards three times a year, reporting the number of the apartment and the tenant’s last name.
We will regularly disclose information to the municipalities about tenant selections based on sections 4a-4d of the Act on the Use, Assignment and Redemption of State-Subsidized (ARAVA) Rental Dwellings and Buildings, sections 11a–11d of the Act on Interest Subsidy for Rental Housing Loans and Right of Occupancy Housing Loans as well as the government decree concerning selection of occupants for state-subsidised and interest-subsidised apartments.
Data from camera surveillance will not be disclosed unless the police or some other competent authority sends a written request for the disclosure of identified camera surveillance data for specifically legislated purpose.
We do not disclose other personal data.
7) The period for which the personal data will be stored
An applicant’s data will be stored in the register for the application’s period of validity, after which they are transferred to history data. If the application did not lead to having an apartment, the history data will be stored for three years. If the application leads to having an apartment, the history data will be stored as long as the tenant data.
A tenant’s data will be stored in the register for the tenancy agreement’s period of validity, after which they are transferred to history data. Tenants’ history data will be stored in the register for ten years from the time the tenancy agreement has ended and the obligations related to the rental relationship have been fulfilled on both sides.
After the period for which the personal data will be stored, the documents will be disposed of as appropriate.
Camera surveillance data is stored for a maximum of one year unless the drafting, proposing or defending of a legal claim requires a longer period for which the personal data will be stored.
8) Transfer of personal data outside the EU or the EEA
9) Rights of the data subject
The data subject may exercise their rights, listed below, by presenting a request about the rights to Hoas in person or in writing. We request that you deliver any written requests concerning exercising these rights to our customer service by email: email@example.com or by mail to address Hoas, Privacy, P.O. Box 799, 00101 Helsinki. Exercising these rights requires the data subject to prove their identity and they can be asked to specify their requests.
9.1) Data subject’s right to review data concerning oneself
The applicants and tenants have the right to receive confirmation from Hoas whether the personal data concerning them is being processed or not processed.
We do not disclose camera surveillance data and log data about system use, because these materials would also include the personal data of other people or would require an unreasonable amount of work.
We execute the right to review data usually within one month and at latest within three months after the request has been presented.
We deliver the data to the requester as one copy in person in exchange for them proving their identity or otherwise by using a protected, reliable form on identification. We will respond to an electronic request electronically, if this is possible from the perspective of data security.
If the requests are evidently unfounded or unreasonable, especially in cases where they are presented repeatedly or more copies are requested, we can, as controllers, charge reasonable administrative costs for executing the request or refuse to execute the request.
9.2) Right to rectification and erasure of data and right to have the controller restrict the processing of one’s personal data
The applicant and tenant may request the rectification of erroneous information, in which case we make the decision concerning the rectification of the information. We may rectify observed erroneous data after the person or some other reliable source has provided us with the correct information.
The applicant and the tenant have the right to have the data concerning them erased from the register (right to be forgotten) after the period for which the personal data will be stored has ended, if the personal data are no longer needed for the purposes for which they were collected, if the person objects to processing without a well-founded reason or if the personal data has been processed unlawfully or if Hoas is obligated by law to erase the data. As a controller, Hoas makes the decision concerning erasure of data without undue delay in accordance with the valid legislation.
Applicants and tenants have the right to have Hoas restrict the processing of personal data, if
• Hoas no longer needs said personal data for the purposes of processing, but the applicant
or tenant requires them or drafting, proposing or defending a legal claim.
• the applicant or tenant has objected to processing of personal data when awaiting the
verification on whether the legitimate grounds of the controller supersede their grounds
• the applicant or the tenant awaits our response to a request concerning the rectification or
erasure of personal data,
• the processing is unlawful and the applicant or tenant objects to the erasure of their
personal data and demands the restriction of processing instead.
If the processing has been restricted based on the aforementioned grounds, the personal data can be processed, excluding storing them, only with the consent of the applicant or tenant or in order to draft, propose or defend a legal claim or in order to protect the rights of another natural or juridical person or for reasons concerning important public interest.
9.3) Right to object to processing due to a special personal reason
The applicant and the tenant have the right, based on a special personal reason, to object to the processing measures we use with personal data on the basis of the controller’s legitimate interest.
The demand concerning the objection should specify the grounds based on which the processing is objected, to the controller’s contact person of this register statement (page 1). Hoas may refuse to execute the request concerning the objection based on legal grounds.
9.4 Data subject’s right to transfer data from one system to another
The applicant and the tenant have the right to receive their own personal data delivered to Hoas, which we process based on the contract relationship, in a machine readable format and as directly transferred to another controller, if this is technically possible and secure.
If this transfer is not technically possible, the applicant or the tenant may deliver their personal data, which they have received on the basis of their review right, to another controller, if they so wish.
10) Right to file a complaint to a supervisory authority
The applicant or the tenant has the right to file a complaint to the competent supervisory authority (Tietosuojavaltuutettu, Ratapihantie 9, PL 800, 00521 Helsinki or firstname.lastname@example.org) or to the supervisory authority of the EU member state in which the data subject’s official place or residence or workplace is located, if the data subject feels that their personal data has not been processed in accordance with the applicable data protection legislation.