Etusivulle

Privacy Notice

Porin YH-Asunnot Ltd. Version: 2.0 | Published: 6 March 2026 | Last updated: 6 March 2026

This Privacy Notice describes how Porin YH-Asunnot Ltd. processes personal data in connection with housing applications, tenancy relationships, and property management.

The processing of personal data is carried out in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection legislation. In Finland, compliance with data protection legislation is supervised by the Office of the Data Protection Ombudsman.

Data Controller: Porin YH-Asunnot Ltd.


Annankatu 8, 28200 Pori, Finland
Email: asiakaspalvelu@porinyhasunnot.fi
Telephone: +358 2 623 4450
Data Protection Officer: tietosuojavastaava@porinyhasunnot.fi

For questions concerning the processing of personal data, you may contact the data controller's customer service or the Data Protection Officer.

Name of the Registers

Porin YH-Asunnot Ltd.'s:

  • Housing Applicant Register

  • Tenant and Resident Register

  • CCTV and Access Control Register

Purpose of Processing Personal Data

Personal data is processed for the following purposes:

  • Processing rental housing applications and resident selection

  • Administration of tenancy relationships

  • Carrying out the administrative duties of the housing company

  • Rent invoicing and payment monitoring

  • Debt collection where necessary

  • Customer service and communication related to housing

  • Ensuring property security and protecting property assets

Information collected during resident selection is processed in accordance with applicable legislation, particularly regulations governing the selection of residents for state-subsidized rental housing.

Legal Basis for Processing Personal Data

The processing of personal data is based on the following legal grounds:

  • Legal obligation relating to resident selection for government-subsidized rental housing (Arava and interest-subsidy housing)

  • Contract, when personal data is processed for the conclusion and performance of a tenancy agreement

  • Legitimate interest of the data controller, for example in ensuring property security and managing rental receivables

Contents of the Registers

Housing Applicant Register: the following information may be collected in connection with a housing application:

  • Applicant's name and contact details

  • Personal identity code (applicant and spouse, where applicable)

  • Information about persons moving into the dwelling (for example, children's year of birth)

  • Information about the household's income and assets

  • Information regarding housing need

  • Information about the current residence

  • Information about the dwelling being applied for

The following supporting documents may be requested as attachments to the application:

  • Salary certificate

  • Certificate of pension amount

  • Tax assessment decision and itemization of the pre-completed tax return

  • Statement of the fair market value of assets

  • Other documentation submitted by the applicant in support of the application

Tenant and Resident Register: during the tenancy relationship, the following information may be processed:

  • Name

  • Personal identity code

  • Address

  • Telephone number

  • Email address

  • Information relating to the dwelling and tenancy agreement

  • Information relating to rent payments and invoicing

  • Other information necessary for property administration

CCTV and Access Control: the properties may use:

  • Recording CCTV surveillance

  • Electronic access control systems

Sources of Personal Data

Personal data is obtained primarily from:

  • The applicant or resident

  • Public authorities

  • Other service providers or registers from which information may be updated to ensure accuracy, including, for example: Suomen Asiakastieto Oy's credit information register, and The Population Information System maintained by the Digital and Population Data Services Agency.

Disclosure of Data

Personal data may be disclosed to or processed by the following parties to the extent necessary for the performance of their duties:

  • The housing company's Board of Directors

  • Operational auditors or external auditors

  • Maintenance companies for property maintenance and upkeep tasks

  • Debt collection agencies for the collection of rent and other receivables

  • IT service providers and other service providers used by the data controller

  • The Social Insurance Institution of Finland (KELA) in connection with rent payments and housing benefits

  • Public authorities as required by law

CCTV and access control data may be disclosed to law enforcement authorities for the investigation of suspected crimes. As a rule, personal data is not transferred outside the EU/EEA. If a system provider's servers are located outside the EU/EEA, transfers will be carried out using safeguards in accordance with the GDPR.

Retention Period of Personal Data

Personal data is retained only for as long as necessary to fulfill the purposes for which it is processed.

  • Housing Applicant Register: retained in accordance with ARA guidelines for verifying resident selection, generally for 3 years.

  • Tenant and Resident Register: retained for the duration of the tenancy relationship.

  • After Move-Out: retained generally for 6 years, but information may be kept for up to 10 years for invoicing, debt collection, or legal claims in accordance with legislation governing the limitation period of debts.

  • CCTV Recordings: retained for a limited period, typically up to approximately 30 days, unless a specific incident requires longer retention for criminal investigations.

Protection of Personal Data

The data controller ensures appropriate protection of personal data through technical and organizational measures. Such measures include:

  • Access rights management

  • Protection of information systems

  • Secure server environments

  • Locked and fire-safe storage facilities for paper records

The data controller also requires an equivalent level of data protection from its service providers and subcontractors.

Rights of the Data Subject

The data subject has the following rights:

  • The right to be informed about the processing of their personal data

  • The right to access personal data concerning them

  • The right to request correction of inaccurate data

  • The right to request restriction of processing in certain situations

  • The right to object to processing when it is based on legitimate interest

  • The right to lodge a complaint with a supervisory authority

Data subjects may exercise their rights by contacting the data controller.