Privacy notice

Asuntoseppä LKV Oy Privacy Notice, 1 September 2026

Combined privacy notice and information document under the Finnish Data Protection Act and the EU General Data Protection Regulation (2016/679/EU).

This privacy notice explains how Asuntoseppä LKV Oy collects, uses, stores and protects personal data, and describes the rights of the customer, or data subject.

We process personal data for several reasons. In this notice, “you” and “Customer” refer to customers, prospective customers, our customers’ beneficiaries, authorised representatives and persons responsible for a company.

CONTROLLER AND CONTACT DETAILS

Asuntoseppä LKV Oy

Yliopistonkatu 31, 3rd floor, 20100 Turku

Business ID 3638684-9

(hereinafter “we” or “Asuntoseppä”)

 

Contact person for data protection matters:

Jere Reijonen

Phone 0449092405

Email jere@asuntoseppa.fi

 

NAME AND CONTENTS OF THE REGISTER

Asuntoseppä customer register

1. LEGAL BASIS FOR PROCESSING PERSONAL DATA / WHY DO WE COLLECT YOUR DATA?

We use or may use your personal data for the following main purposes, among others:

• maintaining, managing and developing customer relationships
• producing, developing and providing services
• fulfilling our statutory obligations
• invoicing, debt collection and verifying customer transactions
• targeting advertising
• service analysis and statistics
• customer communications, marketing and advertising
• protecting and safeguarding the rights and/or property of Asuntoseppä and other persons and parties involved in agency assignments in connection with the services
• other comparable purposes

To the extent that the customer register contains personal data, it is processed in accordance with the Finnish Data Protection Act and other applicable laws, regulations, provisions and official guidance concerning the processing of personal data.

1. A contractual, customer or comparable relationship, or steps prior to entering into a contract (contract and performance of a contract)
   
   The main purpose of processing personal data is to collect, process and verify the personal data of the client and the client’s counterparty before a tenancy agreement is concluded, and to document, manage and perform the agreed tasks.
   
   Personal data is also processed in rental applications, offers, letting documents and their attachments during contract negotiations and subsequently during the tenancy.
    
2. Compliance with requirements and obligations laid down by law, regulations or decisions of authorities and supervisory bodies (legal obligation)
   
   In addition to performing a contract, the controller must process personal data to comply with requirements and obligations laid down by law, regulations or decisions of authorities and supervisory bodies. These include, for example:

• Legislation governing real estate agencies, including the Act on Real Estate Agencies and Letting Agencies (1075/2000) and the Act on Real Estate and Letting Agency Services (1074/2000), and carrying out assignments under those Acts and clarifying the Customer’s own property search requirements, require the recording, use and retention of the information listed below under “Contents of the customer register”. An agency must, among other things, maintain an assignment register recording the personal, property and transaction details and documents relating to each assignment.
• Under Chapter 3, Section 3 of the Act on Preventing Money Laundering and Terrorist Financing (444/2017, hereinafter the “Anti-Money Laundering Act”), Customer due diligence data and other personal data required by law are recorded and retained and may be used to prevent, detect and investigate money laundering and terrorist financing, and to refer for investigation money laundering, terrorist financing and the offence that generated the assets or proceeds involved in them. Customer due diligence data or other personal data obtained solely to prevent and detect money laundering and terrorist financing are not used for purposes incompatible with those purposes.
• accounting legislation
• any reporting to tax, police, supervisory or other comparable authorities

1. Marketing, profiling, establishing or defending legal claims and business development (legitimate interest)
   
   Personal data is processed for marketing, profiling, establishing or defending legal claims and business development. These purposes are necessary for the controller’s business and justified by the customer relationship between the Customer and the controller.
    
2. Recording data on the basis of consent (consent)
   
   Where the right to record data under the laws or circumstances described above is exceeded, or no other legal basis mentioned above exists, the Customer is asked separately for consent to record, process and retain personal data. Assignment data is also used for contractual relationships relating to valuation and other expert services and retained in the same manner as the assignment register.
   
   The controller needs consent to process personal data for purposes such as electronic direct marketing. Consent may be withdrawn at any time.
   
   If we do not receive all the necessary information, we cannot begin or continue a customer relationship, enter into another agreement or undertake a legal transaction with you. If sufficient information to identify a visitor is not obtained at a property viewing, that person may not be admitted to the viewing.

 

2. CONTENTS OF THE CUSTOMER REGISTER / WHAT DATA DO WE COLLECT?

We process or may process the following categories of data:

• basic details: name, address, phone number and email address
• due diligence details: the personal identity code of a person acting on their own behalf or on behalf of a company and, where applicable, the company’s Business ID, for reliable identification
• customer and contractual relationship data and related transaction data: products and services, dates of use, rental applications/offers and their attachments and acceptance, the date and details of a tenancy or other agreement, property details, agency commission, details of the service provider and other comparable information, deposit handling details, and the number of keys and details of key handovers and returns
• information relating to invoicing and debt collection
• complaints and information on their handling
• permissions and objections, such as direct marketing permissions and opt-outs
• other information provided by the customer

For landlords, we may also process the following information:

• Ownership details concerning the rental property, including information obtained from estate inventories or similar documents; the address, property register or housing company details, condition and renovation details, housing company charges, size, number of rooms, availability, asking rent and additional property details provided by the customer

For persons submitting a rental application/offer, we may also process the following information:

• place of study, study programme and related information
• employer, nature of employment and related information
• number of children and their dates of birth
• information about pets
• smoking information
• financial circumstances, income, credit information and other financial details used to assess the ability to pay rent
• name and phone number of the current landlord
• name and phone number of a referee
• details of any guardian, guarantor, provider of a payment undertaking, legal representative or other contact person
• any other information the customer voluntarily provides in an application or in another context

We may also process information you voluntarily provide in an application or other enquiry.

Providing the personal data we request is a prerequisite for establishing a contractual and/or customer relationship. Without the necessary personal data, we cannot provide the service.

The following Customer details are or may be processed in records relating to compliance with the Anti-Money Laundering Act:

• name and personal identity code
• representative’s name and personal identity code
• legal entity’s full name, registration number, date of registration and registration authority
• full names, dates of birth and nationalities of the members of the legal entity’s board of directors or equivalent decision-making body
• legal entity’s line of business
• names and personal identity codes of beneficial owners
• the name, number or other identifier and issuer of the document used to verify identity, or a copy of the document, or, where the Customer has been identified remotely, details of the verification procedure or sources used
• information on the Customer’s activities, the nature and scope of their business, financial position, reasons for using the transaction or service, the origin of funds, and other necessary Customer due diligence information referred to in Section 4(1) of the Anti-Money Laundering Act
• information relating to establishing the origin of funds under Section 4(3) of the Anti-Money Laundering Act, and information necessary to fulfil enhanced due diligence obligations relating to a politically exposed person under Section 13
• for a foreign Customer without a Finnish personal identity code, the Customer’s nationality and travel document details

 

3. REGULAR DATA SOURCES AND UPDATES / WHERE DO WE COLLECT YOUR DATA?

We collect personal data primarily directly from you in connection with agency agreements, rental applications/offers and other assignment-related events (including emails, telephone conversations and other communications), fulfilling our duty to obtain information, preparing documents and your other use of Asuntoseppä’s services.

 

We may also collect and update personal data from third parties, such as your employer on the basis of our customer relationship, housing company management offices, property maintenance companies, the Population Information System, business registers, the National Land Survey of Finland and other official registers, and credit information or similar registers. Our premises have CCTV surveillance for security reasons.

 

We collect consent-based information directly from you or, with your consent, from registers or sources maintained by an authority or third party.

 

4. DISCLOSURE OF DATA / TO WHOM MAY YOUR DATA BE DISCLOSED?

We may disclose your personal data within the limits permitted or required by applicable legislation, to perform an agreement between the parties or where an appropriate connection exists. We may therefore disclose your personal data, for example, to the Regional State Administrative Agency and other authorities, and when concluding a tenancy agreement and at different stages of an assignment, to housing company managers, maintenance companies, locksmiths or the landlord’s accountant.

Your data is not routinely transferred outside the European Union or European Economic Area. However, your data may be transferred or disclosed outside the EU or EEA as permitted by law if it is transferred to a country that the European Commission has found to provide an adequate level of data protection, or if contractual arrangements can ensure an adequate level of protection. Temporary transfers outside the EU may also occur when using cloud services such as OneDrive, iCloud or Dropbox.

When the controller outsources its IT services, personal data may also be processed by the controller’s subcontractors, but only on the controller’s behalf. These subcontractors may include providers of marketing systems and operators of rental listing portals.

 

5. PRINCIPLES FOR PROTECTING THE REGISTER / HOW DO WE PROTECT YOUR PERSONAL DATA?

Access to the register requires a user account granted by the administrator of the customer register. Only employees of the controller and its subcontractors who need access to perform their duties can access the data. Data is collected in service databases protected by firewalls, passwords and other technical measures. The databases are located in locked and guarded premises, and only certain predefined persons can access the data.

Where a subcontractor processes personal data on the controller’s behalf, agreements between the controller and subcontractor provide for appropriate safeguards and ensure that the processing meets the requirements of data protection legislation.

 

6. DATA RETENTION PERIOD

We retain your data for as long as necessary for the purposes for which it was collected and processed, or as required by law and regulations, generally for ten (10) years after the assignment ends, but potentially longer depending, for example, on the length of the tenancy.

Your data under the Anti-Money Laundering Act is retained for five (5) years unless continued retention is necessary for a criminal investigation, pending legal proceedings or safeguarding the rights of the controller or its employees. The need for continued retention of data and documents is then reviewed no later than three (3) years after the previous review (Act on Preventing Money Laundering and Terrorist Financing, 444/2017, Section 4).

 

If the collection and retention of your personal data were based solely on your consent, it will be deleted at your request.

 

7. CUSTOMER RIGHTS / HOW CAN I ENSURE THAT PROCESSING IS LAWFUL?

As a data subject, you have rights concerning the personal data we hold about you. You have the following rights:

1. Access to and receipt of data

You have the right to check what data concerning you we have recorded in the customer register. You must submit an access request to us in writing, signed by hand or in an equivalently verified document. We may also ask you to specify sufficiently which data or processing activities your request concerns.

As an exception to the above, you do not have a right of access to data obtained to fulfil the reporting or information-gathering obligations under the Anti-Money Laundering Act (Chapter 4, Section 3). However, at your request, the Data Protection Ombudsman may review the lawfulness of the processing of this data.

We will provide the above information within 30 days of your access request.

1. Rectification of inaccurate data

You have the right to have inaccurate personal data concerning you in the register corrected, unless legislation restricts this right.

1. Objecting to or restricting processing and erasure of data

You have the right to object to the processing of your data for direct advertising, distance selling and other direct marketing, market and opinion research and the controller’s business development, to restrict the processing of your data, and to have personal data already recorded for those purposes erased, even if there would otherwise be a basis for processing it.

1. Withdrawal of consent

If data in the register is based on your consent, you can withdraw that consent at any time by notifying us using the contact details in this notice. On request, we will delete all data that is not required to be retained, or cannot be retained, under law or another basis mentioned in this privacy notice. Withdrawal of consent may, however, affect the availability and functionality of services.

An access, rectification or other request must be submitted to us in writing and signed by hand. Requests cannot be made by telephone. When requesting data, you must provide your name, address and personal identity code. Requests are generally handled free of charge. If requests are manifestly unfounded or excessive, for example because they are repetitive, we may refuse the requested action or charge a reasonable fee taking into account the administrative costs of providing the information.

If you consider that the processing of your personal data is unlawful, you have the right to lodge a complaint with a supervisory authority.

 

8. PROFILING AND AUTOMATED DECISION-MAKING

Asuntoseppä does not profile you on the basis of your personal data or use automated decision-making.

 

9. CHANGES TO THE PRIVACY NOTICE

We continually improve and develop our services, so this privacy notice may be amended from time to time. The notice is therefore always available with a date. If changes are significant, we may also inform you in other ways, such as by email or a notice on our website. We recommend visiting our website regularly and noting any changes to this notice.