Customer Register

1. Controller
Varsinais-Suomen Asumisoikeus Oy (Business ID: 0831852-3)
Rauhankatu 4,
20100 Turku
Tel. +358 2 274 7000

2. Person in charge of registry matters
Housing Manager
Rauhankatu 4,
20100 Turku
Tel. +358 2 274 7000
vaso@vaso.fi

3. Register name
Register based on client relationship and other legitimate connection with Varsinais-Suomen Asumisoikeus Oy

4. Reasons for collecting personal data
Personal data are processed for the management, administration, analysis and development of client relationships and other legitimate relationships, such as:
• maintaining information about clients,
• maintaining a ledger for maintenance fees and rent payments,
• conducting surveys, such as client satisfaction surveys,
• for the maintenance of the residences and sharing the related and necessary information with the maintenance companies contracted by the controller,
• collecting outstanding maintenance fees and rent payments, as well as other outstanding residence-specific rent payments,
• terminating agreements,
• communicating with clients, and
• planning and developing the controller’s business.

5. Contents of the register
The following personal data, and changes thereto, pertaining to housing applicants, recommended clients, residents and possible co-residents may be processed in the register.
Basic data
• name
• personal ID number
• contact information (postal addresses, telephone numbers, e-mail addresses)
• sex
Data based on client relationship and other legitimate connection
• client number
• client relationship start date
• number of persons living in the same household
• first and last name and personal ID number of the spouse or partner living in the same household
• first and last names and personal ID numbers of all persons living in the same household
• first and last names and personal ID numbers of persons residing in the same household, with the consent of the data subject
• consent given by a co-applicant to the data subject to give to the controller
• a client’s possible guardianship
• employment and the duration and quality of employment
• income and asset information
• credit history
• debt settlement information
• debt collection information
• residence prior to becoming a client
• the need for housing
• information related to the contractual relationship, i.e., the right-of-occupancy agreement, maintenance fee payments, deposit, and
• termination of agreement
• complaints, feedback and client-specific communication and other legitimate communication and measures
• call recordings
• marketing, use of marketing and the information gathered in connection with marketing targeted at the data subject
• bank account information related to termination of the agreement
• consent to/refusal of direct marketing

6. Regular sources of data
Personal data is collected from the data subject via the right-of-occupancy application form, electronic services and sales and marketing partners, for example.
Personal data may also be collected and updated from the controller’s other personal registers, from residents when they move house, the controller’s partners, and authorities and companies providing services that involve personal data, such as the Digital and Population Data Services Agency and Suomen Asiakastieto Oy’s credit information register.

7. Retention period of personal data
Right-of-occupancy applicants’ personal data are kept for six years from the time the applicant(s) last submitted an application, unless the applicant(s) has entered into a right-of-occupancy agreement.
If an applicant has entered into a right-of-occupancy agreement, the personal data therein may be kept for ten years after the end of the agreement, and both parties in the agreement have fulfilled their obligations as stated in the agreement. The same retention period applies to all persons living at the residence and, e.g., the call recordings and other dialogue/communication with the residents.

8. Disclosure and transfer of data
As a rule, personal data are not disclosed outside VASO. However, personal data may be disclosed to the extent permitted and required by applicable law, for example, to debt collection agencies contracted by VASO, as well as to parties who have a legal right to access the data. For the purpose of providing housing-related services, data may also be disclosed to construction, maintenance and security companies, locksmiths, and companies specialising in real estate.
If a third party becomes the owner of a residence, VASO may disclose to the new owner the personal data necessary to manage the agreement.
The data will not be transferred outside the territory of the European Union’s member states or the European Economic Area.

9. Registry protection
The electronically processed data contained in the register is protected by firewalls, passwords and other necessary technical means generally accepted in the field of information security.
Materials in printed format are located in premises that are blocked from unauthorized access.
Only the designated employees of the controller, companies commissioned by the controller and companies acting on its behalf, who have signed a non-disclosure agreement and have been granted the right to access the data in the register shall have access to it.

10. Data subject’s right to access, object to the processing of and rectify personal data
According to the General Data Protection Regulation, data subjects have the right to access their personal data that is stored in the register. To access the information, data subjects must make a written and signed request to the person in charge of registry matters (housing manager). Data subjects may also visit the controller in person and request access.
Data subjects also have the right to object to the processing and disclosure of their personal data for the purposes of direct marketing, distance selling and other direct marketing, as well as market surveys and polls. To exercise this right, data subjects should contact the controller.
Further, data subjects have the right to request the rectification of incorrect information and can do so by contacting the controller.