Privacy policy

Description of key file and information form

Description of processing of personal data and data subject rights. EU General Data Protection Regulation (2016/679) and the Personal Data Act (523/99) 10 §.

1. Controller

Oy Vaasan Asumisoikeus Vasa Bostadsrätt Ab
(Trade registry number 0963687-3)
Koulukatu 19
65100 Vaasa
tel. 06 325 4424
fax 06 312 2000

2. Person in charge of matters related to the data file and data protection

Manager of rentals Anne Tukia
Koulukatu 19
65100 Vaasa
tel. 06 325 4472
firstname.lastname@pikipruukki.com

3. Name of the data file

Key data file of Oy Vaasan Asumisoikeus Vasa Bostadsrätt Ab

4. Purpose of the data file, processing of and legal base of personal data in the file

The registers are used for key handing, returning, additional orders and re-serializing of the locks. In addition, registers will be used when possible to investigate crimes, vandalism and other misdemeanours occurring on the property owned by the controller.

The legal base of processing of personal data is based on the agreement between the customer and Oy Vaasan Asumisoikeus Vasa Bostadsrätt Ab about using the keys which were given.

5. Data file content

The registers include the name and address of the key holder, as well as the dates of the handing and returning the keys.

6. Regular data sources

The data sources used are the information gathered from the registered user in connection with key deliveries, as well as the passage information from readers of properties doors.

7. Regular disclosure and transfer of data outside the EU or the European Economic Area

The controller does not mainly give information outside the company, except in the case of a criminal suspect, information may be given to the police.

The personal data are not transferred outside the EU or the EEA.

Should the apartment be purchased by an owner external to the controller, the controller is entitled to disclose data required to manage the rental relation to the new owner of the apartment.

8. Storage period of personal data

The controller only stores the data for as long as is required to fulfil the function of the data file. After this, the data is removed. Customer-specific data is stored in the active database of the system for as long as is required to manage the customer relation.

9. Data security

A. Manual material (storage and protection)
Manual material is archived in locked and secure facilities according to date and subject.

10. The right to inspect, amend and have data removed

If the data subject is able to present substantial reasons, they are entitled to know what data, or if no data, is stored.

The data subject is entitled to request that the controller without reasonable delay amend unspecific and inaccurate personal data on the data subject. The controller shall on their own initiative or on the request of the data subject amend, delete or complete the personal data in the system, should they be inaccurate, no longer needed, inadequate or obsolete in regard to the purpose of processing and collection of data.

If the data subject wishes to inspect, amend or have their data removed in the manner described above, they shall send a written request signed in person to the contact person of the key data file. The identity of the data subject is verified when the request is delivered.

Once the controller has received the request, the controller shall without reasonable delay, and no later than in 30 days, send a reply to the data subject. If there are many requests or they are complicated, the controller can let the data subject know that more time is required to process the request, but by no more than an additional 2 months. The controller must provide a fair reason why the processing time is delayed.

The data subject is entitled to inspect their data free of charge once a year. If the access requests are clearly unfounded or unreasonable, and especially if they are frequent, the controller will charge 100 € per request to cover administrative costs. The fee is to be paid before the data is disclosed.

If the controller declines the request of the data subject, the controller shall supply a written statement. This statement shall include the reasons why the request is declined, as well as information on how to appeal to the supervisory authority and make use of other means of legal protection.

11. Right to withdraw consent

If the legal base of the processing of personal data is the consent of the data subject, the subject is also entitled to withdraw their consent.

The request to withdraw consent or to be opposed to processing shall be sent written and signed in person to the contact person of the key data file. The identity of the data subject is verified when the request is delivered.

12. Does the processing of personal data include automated decision-making such as profiling?

The processing of personal data does not include automated decision-making or profiling.

13. Other matters concerning the processing of personal data

If the access requests of the data subject are clearly unfounded or unreasonable, and especially if they are frequent, the controller may:

  • charge a reasonable fee considering the administrative costs caused by delivering data or messages, or by completing the requested action
  • decline to complete the requested action.

In such cases, the controller shall prove that the request is clearly unfounded or unreasonable

14. The data subject's right to appeal

The data subject is entitled to appeal to the supervisory authority, should the data subject find that the controller's processing of personal data violates this decree, but only if this does not restrict other administrative instructions for amendment applications or means of legal protection.

15. Amendments to the description of the data file

The description of this data file may be updated from time to time, for instance should the legislation change. The description of this data file was last updated on 24 May 2018.