Processing the personal data of apartment applicants and tenants at Hoas

Foundation for Student Housing in the Helsinki Region sr, later on referred to as Hoas
Business ID FI01165149
Pohjoinen Rautatiekatu 29, 00100 Helsinki
P.O. Box 799, 00101 Helsinki
Tel. +358 (0)9 5499 01

Contact person
Sanna Siitonen, sanna.siitonen[at]hoas.fi

The prerequisite for establishing a contractual relationship and maintaining the tenant relationship is that our applicants and tenants provide us with the necessary personal data. Failure to provide personal data may lead to a situation where we cannot manage our responsibilities and commitments as a lessor, due to which we may not be able to sign a tenancy agreement or continue a tenancy agreement that has already been signed.

The purposes of processing personal data are rental services of apartments and parking spaces, tenant support and tenant democracy as well as management and development of related matters, management and development of customer relationships, management of tenancy agreements and management of lessor’s rights and obligations.

We may record calls made to and from our customer service numbers, and otherwise save messages from other customer service channels, such as email, chat, MyHoas messages, Facebook Messenger messages, or WhatsApp messages. Recordings may be used to verify customer interactions, ensure the quality of customer service, develop services, and for training purposes.

We use camera surveillance data in order to ensure safety and legal protection at the Hoas office and buildings and the areas surrounding them, such as nearby entrances, waste collection points and parking lots. This information will be used for reviewing criminal activities and accident situations. The premises and areas with camera surveillance have been marked with signs.

Processing personal data is based on a contract relationship, legal requirement or a legitimate interest of Hoas or the client.

We will process the personal data of the applicant/tenant, their possible guardian, co-applicant(s) and other security deposit payer, other rent payer or trustee that are essential for achieving the processing purposes we have defined.

Cookies are used on Hoas’s website at Hoas.fi. Hoas and its service providers collect metadata from the use of the Hoas.fi website, i.e., observed and derived data from the use of the website. This metadata does not contain personally identifiable information, and Hoas never attempts to identify individual visitors to the Hoas.fi website using this metadata.

We will receive the data about the applicant/tenant, their possible guardian and co-applicant/co-tenants directly from the applicant, excluding the information concerning a person subletting the apartment which we will receive from the main tenant and credit information, which we will verify from the register of Suomen Asiakastieto Oy. Personal data concerning the exchange students of the University of Helsinki we will receive from the universities.

Phone conversations made to and from our customer service numbers are automatically recorded.

Camera surveillance data is recorded automatically as the person arrives in the surveillance area while the camera is on.

Personal data are stored in supervised and guarded premises. The telecommunication connections to any databases containing personal data will be protected with encrypted connection and appropriate authentication. Databases and the systems using them have been protected with technical and administrative measures.

Using the personal register always requires a login and a password. User rights will be determined based on a person’s role according to what is necessary for that employee’s duties. The staff has been trained to process data in a protected manner and they operate under confidentiality. Third party organisations in the roles of personal data processors are bound by confidentiality agreements between the two parties.

We do not disclose the data concerning applicants to other parties. Data concerning tenants is disclosed to Kela, social welfare office, educational institutes, Svea Perintä Oy, Securitas Oy, internet service providers, the companies that maintain parking garages, Aimo Park Finland Oy, the partners determined in our building management and maintenance agreements and the municipalities. Additionally, we may disclose information if specifically required by law or if authorities explicitly demand it.

The period for which the personal data are stored is based on instructions concerning state-subsidised and interest-subsidised apartments, the act concerning deb collection of receivables, the act on changing the act concerning debt collection of receivables and the Accounting Act and data protection legislation.

In the event of transfer of personal data outside the EU or the EEA, processors receiving personal data are required to process the personal data in accordance with the EU General Data Protection

Regulation, and the adequate level of protection is ensured by appropriate safeguards.

Right to review data concerning oneself

Right to rectification and erasure of data and right to have the controller restrict the processing of one’s personal data

Right to object to processing

Right to transfer data from one system to another

The data subject may exercise their rights by presenting a request about the rights to Hoas in person or in writing. We request that you deliver any written requests concerning exercising these rights to our customer service by email: privacy@hoas.fi or by mail to address Hoas, Privacy, P.O. Box 799, 00101 Helsinki. Exercising these rights requires the data subject to prove their identity and they can be asked to specify their requests.

The applicant or the tenant has the right to file a complaint to the competent supervisory authority (www.tietosuoja.fi, tietosuoja@om.fi) or to the supervisory authority of the EU member state in which the data subject’s official place or residence or workplace is located, if the data subject feels that their personal data has not been processed in accordance with the applicable data protection legislation.

The aforementioned information may be updated from time to time, for example, due to changes in legislation. Unless otherwise required by mandatory legislation, changes will not be notified to registered individuals personally. The information was last updated on March 20, 2025.