PROCESSING OF CUSTOMERS’ PERSONAL DATA AT REALIA MANAGEMENT LTD
Realia Management’s business operations require that the company collect certain personal data concerning its customers. In such cases, Realia Management serves as a data controller in accordance with data protection legislation. The purpose of this document is to inform data subjects about the processing of their personal data.
Realia Management provides its customers with property management services. It therefore serves as a personal data processor in accordance with data protection legislation, with regard to, for example, personal data registers for the limited liability housing companies it manages, with the limited liability housing company serving as the data controller. Requests and enquiries concerning data subjects’ privacy must always be addressed to the data controller. In other words, concerning the personal data registers of limited liability housing companies, real estate companies or lessors, enquiries must be addressed to the relevant data controller.
What personal data does Realia Management process and for what purpose?
Corporate customer registers
Each business unit of Realia Management has a corporate customer register. The information contained in a corporate customer register is used to manage the contractual relationship and provide services. Contact information may also be used for additional sales and marketing purposes. In such cases, the processing is based on the contractual relationship between Realia Management and the customer and on the data controller’s legitimate interest.
The corporate customer registers include the names, email addresses and telephone numbers of each corporate customer’s contact persons and representatives, as well as their position in the company. The register may also contain other information necessary to identify the customer, such as information related to the verification of the identity of the company’s representative, as well as information about the company’s board members, authorised signatories and beneficial owners. In addition, the registers include any customer complaints and related personal data. Agreements between corporate customers and Realia Management also include information about related properties and/or real estate companies, and this information may include data regarded as personal data (e.g. address information).
Realia Management also collects contact information (names, email addresses and telephone numbers of contact persons or representatives) related to potential corporate customers for sales and marketing purposes. In such cases, Realia Management’s legitimate interest is the justification for personal data processing.
Brokerage assignment registers
Realia Management engages in residential rental and real estate brokerage operations. The management of brokerage assignments and the laws regulating brokerage operations (including the Act on Detecting and Preventing Money Laundering and Terrorist Financing) require the collection and processing of certain personal data. This data is included in brokerage assignment registers. In such cases, the processing of personal data is based on the contractual relationship between the customer and Realia Management and on statutory obligations.
In residential rental operations, the personal data listed below may be collected concerning lessors, lessees, other people moving into the apartment (excluding minors) and applicants for a rental apartment. In commercial facility brokerage operations, the same data may be collected concerning lessors, lessees and applicants for rental facilities, as well as sellers, buyers and potential buyers, as far as applicable.
Name, date of birth, personal identity code, address, previous address, telephone number, email address, preferred language, information about political influence (politically exposed person, PEP), identification information about or a copy of the document used for identity verification, information about guardianship or supervision of interests, other information included in the agreement concerning the assignment, information about the brokered property, profession, length of employment relationship, form of household and number of people moving into the apartment, information about any pets, income information, other information included in the application for a rental apartment, credit history information, information related to the purchase offer and its approval, information contained in the rental agreement or the deed, information about rental collateral, statement on the origin of funds, and any other information provided by the customer that is necessary to complete the brokerage assignment.
People who have filed an application for a rental apartment may be sent information about apartments that meet their criteria by email for three months from the date of application. In such cases, the processing is based on Realia Management’s legitimate interest.
Brokerage assignment registers also include personal data related to the brokered property, such as the names of, and possibly contact information for, the limited liability housing company’s property manager and board members. In such cases, the processing of personal data is based on statutory obligations. The registers also contain information about any complaints related to brokerage assignments, including personal data. In such cases, the processing is based on a legitimate interest.
Realia Management has a centralised customer service centre. Its customer service system records all communications, such as email messages and telephone calls. The recorded data includes the date and time and the customer’s name, telephone number and email address. The system also records the content of email messages and telephone calls. This data is used to provide customer service, verify the content of telephone calls and further develop the operations of the customer service centre. The processing of the personal data mentioned above can be based on a contractual relationship or Realia Management’s legitimate interest.
How does Realia Management obtain personal data?
Data is mainly collected from data subjects. Data may also be collected from sources related to the authorities, such as the Trade Register. In addition, information concerning company contact persons is obtained from public sources, such as corporate websites. Companies’ contact information for sales and marketing purposes may also be obtained from companies providing such information for these purposes.
Personal data related to brokerage assignments is mainly obtained from the people concerned. Clients provide personal data when entering into an agreement on an assignment. Personal data concerning applicants for rental apartments is obtained from their applications. Personal data concerning tenants is obtained when they enter into a rental agreement. Personal information concerning buyers is obtained from their purchase offer or when preparing the deed. In addition, information concerning brokered properties is obtained, for example, from representatives of limited liability housing companies (e.g. a property manager’s certificate, financial statement information) or from registers maintained by the authorities (e.g. land register). The credit history of an applicant for a rental apartment is obtained from the registers of third-party service providers (e.g. Suomen Asiakastieto Oy).
Is data disclosed to third parties?
Personal data may be disclosed within the Realia Group.
Personal data may also be disclosed to debt collection agencies. In addition, establishing or defending a legal claim may require the disclosure of personal data to an insurance company or legal adviser. Data may also be disclosed to the authorities as required by law.
Data contained in brokerage assignment registers may be disclosed to the authorities supervising brokerage operations (Regional State Administrative Agencies) or other authorities (e.g. information about the selection of tenants to the Housing Finance and Development Centre of Finland or a transfer tax report to the Finnish Tax Administration) as required by law. The management of brokerage assignments requires the disclosure of data to the counterparty of the assignment. For example, personal data concerning applicants for rental apartments must be disclosed to the lessor for them to select a tenant, and personal data concerning a potential buyer who has made a purchase offer must be disclosed to the seller for them to make a decision.
Data is not disclosed to non-EU or non-EEA parties.
How long is personal data stored?
The personal data contained in the corporate customer registers is stored over the duration of the contractual relationship. After the termination of the contractual relationship, personal data is stored for as long as necessary in accordance with the applicable laws, or for as long as necessary because of any legal procedures.
Personal data concerning contact persons at potential customer companies is stored for as long as the person in question, according to our information, remains in the position they held when they were included in the register, or for as long as the information in question is used for customer communication and marketing purposes. Offers received, including related personal data, are stored for as long as necessary for the competitive bidding process.
We are required by law to store the personal data included in the brokerage assignment registers for five years after the end of the assignment. After this time, the data is stored for as long as necessary for any legal procedures.
The data recorded in the customer service system is stored for 180 days. Data may be stored for longer to the relevant extent if this is necessary to complete a customer service assignment.
Customer feedback and complaints are stored until they have been processed, or for as long as necessary for any legal procedures.
How is the data protected?
The data is protected by means of appropriate technical and organisational measures. Paper documents are stored in a locked facility. Digital material is protected through technical measures, and access rights are only granted to people who need to access the material because of their job or assignment. Realia Management’s employees are under a confidentiality obligation. Employees are provided with training and instructions on the lawful processing of personal data.
Any processors of personal data outside the Realia Group are also required to implement sufficient technical and organisational protection measures and commit to a confidentiality obligation.
What are the data subject’s rights?
Data subjects have the right to know whether a data controller is processing personal data concerning them. If the data controller processes such personal data, the data subject has the right to receive a copy of the personal data concerning them. If the personal data is deficient, erroneous, inaccurate or outdated, the data subject has the right to request that the data controller correct the data.
If the processing of personal data is based on the data subject’s consent or a contractual relationship, the data subject has the right to receive the personal data concerning them in a structured, commonly used, machine-readable and interoperable format, and to transmit it to another controller. This right only applies to personal data that the data subject has provided to the data controller and that is processed automatically.
In certain circumstances, the data subject has the right to restrict the processing of their personal data. This is the case when, for example, the accuracy of the personal data is contested by the data subject. In such cases, processing will be restricted until it has been confirmed that the data is accurate and its processing is lawful.
The data subject has the right to request that the personal data concerning them be erased. This right is only applicable when the personal data is no longer needed for the purposes for which it was collected, there are no other legal grounds for its processing and it does not need to be stored to meet the requirements of the law. In other words, data cannot be erased while there is a valid legal basis for its storage.
If the processing of personal data is only based on the data subject’s consent, they have the right to withdraw their consent at any time. In addition, the data subject has the right to object to the processing of their personal data if its processing is based on the data controller’s legitimate interest.
The data subject has the right to file a complaint with the Data Protection Ombudsman(www.tietosuoja.fi) if the data controller fails to meet their obligations or otherwise fails to comply with the applicable data protection laws.
If you have any questions about personal data processing and data subjects’ rights, please contact us via email.