Privacy policy

1. Controller

Tikkapuu Oy has not appointed a separate data protection officer, as it is not required to do so under the GDPR.

2. What data we process

When you send a rental application

Name, phone number, email address, the apartment you are interested in, your preferred move-in date, and anything you tell us in the free-text field — for example the number of occupants, your work or study situation, and pets.

Before a lease is signed

Finnish personal identity code, credit record entries, proof of income or study place, and the contact details of your previous landlord if you have one.

During the tenancy

Lease details, rent payment records, fault reports and other correspondence relating to the tenancy.

3. Why we process it, and on what basis

• Processing applications and selecting a tenant. Basis: steps taken prior to entering into a contract (GDPR Article 6(1)(b)).
• Managing the lease and communicating with the resident. Basis: performance of a contract (Article 6(1)(b)).
• Checking credit records before a lease is signed. Basis: our legitimate interest as a landlord in verifying ability to pay rent (Article 6(1)(f)) together with the Finnish Credit Information Act. The personal identity code is processed under Section 29 of the Finnish Data Protection Act in order to identify the applicant.
• Accounting and other statutory obligations. Basis: legal obligation (Article 6(1)(c)).

We do not use the data for marketing. We do not make automated decisions and we do not profile applicants — a person makes the tenant selection.

4. Where the data comes from

Primarily from the applicant. Credit information is obtained from the credit information register maintained by Suomen Asiakastieto Oy. We only check the credit records of applicants we are about to offer an apartment to, not of everyone who applies.

5. Who we share data with

We do not sell data and we do not disclose it for marketing purposes. Data may be disclosed to:

• the housing company and the building manager, to the extent that living in the building requires it — for example resident lists and key management
• our accountant and auditor, in order to meet statutory obligations
• a debt collection agency or a court, if rent goes unpaid
• an authority, where required by law

Data is not transferred outside the EU or the EEA.

6. How long we keep it

• Rejected and withdrawn applications: no more than six months from the date of the application, after which they are deleted.
• The lease and related data: for the duration of the tenancy and ten years after it ends, which is the limitation period for claims.
• Accounting records: six years, as required by the Finnish Accounting Act.
• Credit reports: destroyed as soon as the tenant has been selected.

7. Your rights

You have the right to:

• know whether we process data about you, and to receive a copy of it
• have incorrect or incomplete data corrected
• have data erased when there is no longer a basis for processing it
• restrict or object to processing
• receive the data you have given us in a machine-readable, portable form

Send requests by email to info@tikkapuu.fi. We respond within one month. We may ask you to prove your identity before releasing any data.

If you believe we are not processing your data lawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman: tietosuoja.fi/en.

8. Data security

Electronic data is kept in password-protected accounts and paper documents in a locked space. Only those whose duties require it have access. Credit reports and personal identity codes are not stored in email.

9. Cookies and website use

This site uses no cookies, no visitor tracking and no analytics. For technical reasons the server records a log entry for each visit: IP address, time and the page requested.

The site's typefaces are loaded from Google Fonts, which means your browser's IP address is passed to Google LLC. No other information is transferred.

Apartment addresses are links to Google Maps. The link opens in a new tab only when you click it, and Google's own privacy policy applies from that point on.

The application form does not send data to any server: it opens your own email program with the message filled in, and you send it yourself.

10. Changes to this policy

This policy may be updated if our practices or the law change. The date of the most recent update is shown at the top of the page.