Privacy Notice
Avara’s General Privacy Notice
Updated 19.12.2024
Avara specializes in residential investment, asset management, and property management. More information about us can be found on our website at: https://www.avara.fi/en/company
In this Privacy Notice, we explain how we process your personal data when you are a housing applicant, a tenant, or a resident of a property owned or managed by us. This Privacy Notice also describes how we process your information when you visit our website or use our services online.
Please note that when processing personal data related to tenant relationships and the management of the rental properties, we act as joint controllers with the owners of the properties. You can find the property owner's information in your rent agreement. In this Privacy Notice, "we" refers to Avara and the property owners.
Your personal data are primarily processed for various purposes related to housing applications, tenancy customer relationships, and housing-related purposes. Additionally, we process your personal data for various marketing purposes as described in this Privacy Notice.
In some rental properties, recording surveillance cameras and electronic access control and locking systems are also used to enhance the safety of the living environment.
If you have any questions regarding how we handle your personal data or the shared responsibilities and joint controllership with the property owners, or if you wish to exercise your rights protected by data-protection laws, feel free to reach out to us using the contact details provided below.
1. Contact point for Avara and Property owners
Avara Oy
Bulevardi 7
00120 Helsinki
tietosuoja@avara.fi
2. Processed Personal Data, Processing Purposes and Legal Basis
In this section, we describe how we process your personal data when you are our housing applicant or tenant customer when you use our website or digital services, or when you act as a rent payer. In certain rental properties where video surveillance is employed, we also process your personal data when you visit our rental premises.
Right to Object: When your personal data is processed based on legitimate interests, you can object to the processing based on your personal situation. Learn more in section 8.
The legal basis for processing special categories of personal data, such as health-related information, primarily relies on the data subject's explicit consent. Additionally, processing may also be justified if it is necessary for the establishment, exercise, or defence of legal claims.
|
Examples of processed data types |
Purposes of processing |
Legal basis for processing |
|
Housing applicant's basic information, such as name, contact information and citizenship, social security number. |
Processing rental apartment applications. Housing offers. |
The processing of personal data is mainly based on the use of Avara's services and preparation of rental agreement. A customer relationship between Avara and the individual is established when the individual submits a rental apartment application or creates a user account in the OmaAvara service. In addition, we process data based on our legitimate interests related to the customer or similar relationship, the good rental brokerage practice, and the good rental practice, as well as the organization and development of our business operations. |
|
ARA apartment applicant's basic information, such as name, contact information, nationality, and social security number. |
Resident selection and reporting of ARA (The Housing Finance and Development Centre of Finland) apartments. |
The processing of personal data is mainly based on the regulation regarding the selection of residents of state-subsidized rental apartments and the official instructions that specify it. |
|
Tenant’s basic information, such as name, contact information. |
Rental brokerage and rental relationship management. |
Statutory obligations related to the regulation of rental apartment brokerages and the rental of residential apartments. |
|
OmaAvara is Avara's digital service for apartment applicants and residents, where you can manage your apartment applications and information related to rental brokerage and rental relationships. |
Offering and development of the OmaAvara service. |
The processing of personal data is mainly based on using Avara's services. A customer relationship between Avara and the individual is established when the individual submits a rental apartment application or creates a user account in the OmaAvara service. |
|
Customer service requests and related customer engagement history, contact details, communication, and related technical identifiers. |
Customer service. |
Legitimate interest related to the customer or similar relationship, the good rental brokerage practices, and the good rental practices, as well as the organization and development of the business operations. |
|
Resident list, residents' names, apartment number, start and end dates of the tenancy. |
Maintaining the resident list. |
Legitimate interest related to safe housing. |
|
Information related to surveys, such as e-mail address of the survey recipient and survey responses. |
Resident, apartment applicant and customer surveys. |
Legitimate interest related to the customer or similar relationship and the organization and development of the business operations. |
|
Resident's name and contact information. |
Service, maintenance, and upkeep of apartments and properties. |
Legitimate interests related to the customer or similar relationship, the good brokerage practice and the good rental practice, and the organization and development of the business operations. |
|
Information related to key management, such as tenant's name, address, start and end dates of tenancy, key returns. |
Management of apartment keys. |
Legitimate interests related to the customer or similar relationship, the good rental practice, and safe housing. |
|
Legitimate interests related to the customer or similar relationship, the good rental practice, and safe housing. |
Resident gifts. |
Legitimate interests related to the customer or similar relationship, and development of the business operations.. |
|
Information related to resident meetings, such as invitation lists, resident meeting participants and minutes. |
Residential democracy in ARA apartment properties. |
Statutory obligations related to the state-subsidized rental apartments. |
|
Information related to knowing the customer obligations. This information is obtained through the strong authentication processes within the OmaAvara service or alternatively through our customer service. |
Customer due diligence to prevent money laundering and the financing of terrorism, and compliance with official regulations regarding sanctions and asset freezing. |
Legal obligations related to customer due diligence, preventing money laundering and the financing of terrorism, including duties related to compliance with sanctions and asset freezing. |
|
Information related to the management of parking spaces, such as name, address, parking space information. |
Management of car and other parking spaces. |
Legitimate interests related to the organization of business and housing services. |
|
Information about the apartment, such as address, apartment number and square footage. |
Energy management and energy efficiency monitoring. |
Legitimate interests related to energy management and energy efficiency. |
|
Information related to invoicing, payments, and rental deposit management. |
Billing services and rent payment. |
The processing of personal data is mainly based on the use of Avara's services and the tenant relationship. |
|
Information related to invoicing, payments, and rental deposit management. |
Property management and property secretarial services. |
Legitimate interest related to the customer or similar relationship, the good rental brokerage practices, and the good rental practices, as well as the organization and development of the business operations. |
|
Information related to marketing and communication, such as newsletters, search alert services, contact information, interests, reactions, direct marketing permissions and prohibitions. |
Marketing and communication. |
Legitimate interests related to the customer or similar relationship and the business development. |
|
Housing applicant’s and resident's basic information, such as name, social security number and contact information. Information related to financial management and accounting.
|
Complying with and demonstrating compliance with legal obligations, preventing, and investigating abuses or disturbances, monitoring and defending rights. |
Statutory obligations based on the regulation regarding rental apartment brokerages and the rental of residential apartments. |
|
Video recording and recording time. |
Recording camera surveillance. |
Legitimate interests related to safe housing. |
|
Information related to the use of the website: technical identifiers such as cookies and other similar technologies, IP address, the visited website, time stamp, device identifier, session identifier. |
Offering and developing websites and digital services. |
Legitimate interests to maintain and improve the stability and functionality of our website and digital services. |
|
Resident's name and contact information, information related to the accident and damages. |
Managing damage incidents. |
Legitimate interests related to safe housing. |
|
Resident's name and contact information, |
Booking calendars for common areas (laundry and sauna). |
Legitimate interests related to the organization of housing services. |
3. Automatic Decision-Making and Profiling
We've streamlined the rental decision process in our "Rent Now" service. Additionally, we employ automated decision-making in our rental process when you submit a housing application to us. Automated decision-making means that decisions are made without human involvement in the decision-making process. With our "Rent Now" service, you can instantly secure the apartment you desire and move in on its availability or completion date. When you submit a housing application, automation ensures that your application is processed quickly, and you receive a housing offer as soon as possible.
Evaluated Information and Data Sources
Using the "Rent Now" service and logging into OmaAvara requires strong authentication with online banking credentials or mobile ID. We obtain your name, social security number, and nationality through authentication. Reliably verified identity and meeting other criteria allows us to make rental decisions. The decision is based on your authentication data, credit information reflecting your financial capacity, age, and mandatory sanctions screening. Additionally, you must be registered in the Finnish population information system.
When you use the "Rent Now" service or submit a rental application to us, your credit information is checked through Lowell Suomi Oy’s credit decision service, which uses data from Suomen Asiakastieto Oy’s credit information register. Sanctions screening is performed against the Finnish Financial Intelligence Unit’s, EU and international sanctions lists. Regular testing ensures the functionality of the automated decision-making system.
Logic of Automatic Processing
The credit decision service automatically recommends rental decisions. Based on this information, we can better manage the risks associated with rental operations.
In the "Rent Now" service, a negative rental decision will result if you have a credit default entry or are under 18. If there are disruptions in your credit information or you are underage, renting an apartment through the "Rent Now" service is not possible. In such cases, you can still submit a housing application to us.
Similarly, for housing applications, we cannot automatically offer you the apartment you applied for if you are underage, have credit defaults, or due to sanctions screening requirements. In these situations, your application will be reviewed manually by our rental team, who will verify the accuracy of the information and assess your situation on a case-by-case basis. In cases involving sanctions, we must legally comply with applicable laws.
4. Targeting of marketing and marketing partners
We operate as a joint controller with social media service providers when we maintain our community page on a social media platform or use the platform's services for marketing purposes.
Meta and other social media providers are responsible for ensuring their services (such as Instagram and Facebook) comply with data protection regulations, maintain data security, and uphold the rights of data subjects within their services. We use information obtained via social media for marketing, communication, and customer service purposes, such as purchasing and displaying advertisements, measuring ad reach, identifying potential customers, and handling contact requests.
We use audience segments provided by social media services and Google to target advertisements. Targeting is based on audience groups defined by the platforms through their analysis of points of interest. Additionally, we may create audience segments using email addresses to form groups that resemble our current customers. For this purpose, email addresses are hashed into encrypted identifiers, which are compared with user identifiers on the platforms. Avara does not have visibility into whether these hashed identifiers match any users on the social media platform.
Our website utilizes Google’s advertising network, such as Google Ads, to target advertisements based on users’ online behavior, for purposes such as remarketing and programmatic advertising. Google may also use customer lists and its own data for ad targeting. For more information about marketing cookies on our website, see section 10.
For further details about how service providers process personal data, please refer to the privacy policies below.
As a Meta customer, you can manage your ad settings and interests here.
5. Sources of data
We primarily collect your personal data directly from you through the housing application, rental agreement, OmaAvara service, and customer service. Additionally, we receive information from our partners, such as details related to apartment maintenance, billing, electronic signatures, or key handovers. We obtain your name and social security number from the Digital and Population Data Services Agency's population information system using strong authentication. To implement energy efficiency, apartment-specific temperature and humidity data are measured with sensors.
When you submit a housing application or use the "Rent Now" service, your credit information is checked from the credit information register of Suomen Asiakastieto Oy. Our rental experts also use credit inquiries through Alma Talent Tietopalvelu.
Personal data may also be obtained from external parties, such as various partners or other entities and authorities providing services related to personal data.
6. Data retention
Personal data are processed only as long as necessary to fulfil the abovementioned purposes. We delete unnecessary and outdated personal data when there are no longer grounds for data retention.
|
Purposes of processing |
Maximum retention period |
|
Processing rental housing applications and managing customer relationships (rental brokerage) |
3 months from the submission of the housing application (privately financed properties) |
|
Tenant selection and reporting for ARA-subsidized properties. |
In accordance with regulations governing ARA-subsidized housing, tenant selection data must be retained for 3 years from the submission of the housing application. |
|
Rental Brokerage and Tenancy Management Providing and improving rental brokerage services. Customer service Handling damage incidents Complying with legal obligations and demonstrating compliance. Preventing and investigating misuse or disturbances, as well as protecting and defending rights. |
We use your data primarily during the active period of our customer relationship. Under the Act on Real Estate Brokerage and Letting Agencies (2000/1075), Avara is required to keep a record of received assignments. A rental brokerage must retain the assignment log, contracts with their attachments, offer documents, brochures, and other related documents for five years after the completion of the assignment. Additionally, good brokerage and leasing practices require considering the liability period for damages. The liability for damages expires after 10 years. We do not retain any information beyond ten years after the termination of the brokerage agreement or tenancy between the property owner and Avara. |
|
Conducting surveys related to residents, housing applicants and customers. |
Information related to surveys is retained for a maximum of 3 years to understand the development trends of operations. |
|
Maintenance, upkeep, and repair of properties and buildings. |
Personal data directly related to individuals are removed from the systems once a year. Data related to the property and maintenance are retained. |
|
Management of apartment keys and electronic locking systems. |
For the duration of the tenancy. Event logs of electronic locking systems for common areas are retained for 2-4 weeks or as long as necessary to investigate any identified security breaches. |
|
Know Your Customer (KYC) procedures to prevent money laundering and the financing of terrorism, as well as compliance with regulatory requirements related to sanctions and asset freezes. Determining the so-called PEP (Politically Exposed Person) status of individuals. |
Data are retained for at least 5 years after the termination of the customer relationship. |
|
Energy management and monitoring of energy efficiency. |
Data are retained 5 years from the date of collection. |
|
Billing services and rent payments. Financial management and accounting. |
Data are retained for the period required by accounting legislation (6 years for vouchers and 10 years for accounting records). |
|
Marketing and its targeting Sending newsletters Search Alert-services |
The data are retained s long as you remain our customer, for the duration of the marketing consent you have provided, or until you opt out of marketing. We will use your data for marketing purposes for 24 months from your last interaction with us (e.g., logging in, opening an ad or newsletter). The Search Alert-service is valid for 6 months from the order or update of the subscription. The operating times of cookies can be found in the cookie settings window. |
|
Surveillance cameras. Camera surveillance is used only in limited areas and is clearly indicated by signs. |
Recorded footage is retained for 2-4 weeks or as long as necessary to investigate any identified security incidents. |
7. Recipients of personal data and data transfers outside the European Economic Area (EEA)
In our operations, we engage external entities apart from Avara or the property owners who process data only within the boundaries we establish and for the purposes outlined in this Privacy Notice. We enter into appropriate data processing agreements with our partners, where they commit to handling personal data securely and confidentially.
Your personal data can be disclosed to the following recipients
- To companies belonging to the Avara Group
- To various IT and data center service providers
- To the energy management system supplier
- To the supplier of the electronic information board, resident application, and common space booking calendars
- To our real estate management and property maintenance partners
- To our billing and collection partners
- To our marketing partners
- To electricity and data network suppliers
- To contractors and brokers
- To security and lock services
- To the authorities
- To other third parties, such as home appliance suppliers.
- To facilitate the exchange of keys, we may provide your contact information (name, email, phone number) to the new tenant when your rental agreement ends, unless you object to the disclosure. We will contact you separately in these situations.
We mainly process your personal data in systems and data centers situated within the European Union. However, some of our partners or the services they offer may be based outside the European Economic Area (EEA), resulting in the transfer of your personal data beyond the EEA. This transfer may occur, for instance, when the IT system or cloud service used for processing personal data is situated outside the EEA or on a server provided by a U.S. service provider.
In situations where personal data are transferred outside the EEA, we implement protective measures to ensure the high level of personal data protection required by European data protection laws is maintained even after the transfer. Protective measures include, among others, a decision by the European Commission regarding the adequacy of data protection and ensuring that the recipient of personal data is committed to the required safeguards, such as the EU-US Data Privacy Framework. Additionally, we may require standard contractual clauses approved by the European Commission as part of agreements binding our partners. In addition to these, we demand compliance with appropriate technical and administrative safeguards.
8. Your rights as a data subject
The General Data Protection Regulation grants you several rights as a data subject related to processing of your personal data.
However, we would like to point out that these rights ensured by the law are not absolute. For example, we cannot delete personal data related to your tenancy in a situation where you have a valid rental agreement with us.
You can ask us to exercise your rights mentioned below by sending your request to the address mentioned in section 1 of this Privacy Notice.
The right of access to personal data. You have the right to receive confirmation on whether we process personal data relating to you. You have the right to access and ask for a copy of any such personal data. We may ask you to specify your request, when necessary, for example regarding to the details of the provision of information.
Right to rectification. You have the right to request the rectification of incorrect, incomplete, or outdated personal data relating to you.
Right to data erasure. In some situations, you have the right to request erasure of your personal data from our data systems. We will comply with your request, if there is no legitimate reason to retain the data, such as a legal obligation to continue processing the personal data.
Right to object and right to restrict the processing of your personal data. Based on a specific personal reason, you have the right to object to the processing of personal data. However, this does not mean the general right to oppose all processing, but is limited, for example, to situations where the processing is based on legitimate interest of ours or a third party. We have the right to continue to process your personal data if we have a compelling reason to do so. Such a reason may be, for example, a continuous threat or investigation of crime or abuse.
In addition, you may at any time object to the processing of your personal data for direct marketing purposes.
You also have the right to request a restriction on the processing of your personal data, for example in situations where you dispute the accuracy of your personal data.
Right to data portability. You have the right to receive your personal data from us in a structured, commonly used format so that you may transfer your personal data to another controller, provided that the processing of your personal data is based on consent or a contract between you and Avara.
Right to lodge a complaint. If the processing of your personal data is in breach of applicable legislation, you have the right to lodge a complaint with the national supervisory authority. You can lodge the complaint with a competent supervisory authority. In Finland, this is the Data Protection Ombudsman, and the complaint must be lodged in accordance with instructions provided by the Office of the Data Protection Ombudsman. Please see https://tietosuoja.fi/en/home for more information.
9. How we keep your personal data safe?
Access management. The processing of personal data is only permitted to designated, authorized persons whose duties require it. Personal data can only be accessed with appropriate access rights.
Agreements. Persons processing personal data have signed appropriate confidentiality commitments or are otherwise subject to an obligation of confidentiality. Our data processing partners have committed to take appropriate measures to ensure the security of personal data.
Staff training and guidance. We have provided comprehensive data protection training and guidance for all our personnel. We have issued binding written instructions and regulations to our employees regarding the processing of personal data, data security and data protection, which the employees have committed to comply with.
Technical measures. Personal data and systems are protected e.g. with firewalls. In addition, we monitor the processing of personal data and automatically detect anomalies. The data is stored on a server located in a locked premises where passing is restricted by access control and monitored by recording camera surveillance. Necessary physical copies of personal information will be kept in a locked premises. We regularly review the processing of personal data and the systems and equipment used for processing activities, and assess the risks associated with the processing, for example, when introducing new technology.
10. Use of cookies in our online services
We use cookies and similar technologies in our online services.
What are cookies?
Cookies are small files stored on your computer, mobile device, or other devices. They contain an anonymous, unique identifier that allows us to recognize different browsers and track the number of users visiting our website. In addition to cookies, we also use other technologies, such as tracking codes (e.g., ad pixels) and similar techniques stored on your device. These technologies are collectively referred to as "cookies" in this context.
Cookies can be used to improve page content and provide customers with personalized content. Cookies do not harm users' computers or files and may be necessary for the proper functioning of some of the pages maintained and services provided.
We collect the following types of data through cookies:
Usage and browsing data related to the service features, such as
- How and when our services are used
- The page from which you accessed the service
- When and which pages of our website you have browsed
- Which links you have viewed and clicked
- The browser you are using, screen resolution, device operating system, and its version
- The information you provide during the housing application process and in the Rent Now service until the application is submitted or the page is closed.
- Location data, if you have provided explicit consent for this
- Other data collected with the user’s consent.
Cookie settings and cookie management
We require your consent to implement services other than requested or to use cookies essential for the website's operation.
What do we use cookies for?
We use cookies to improve the quality of our services and enhance the user experience. Cookies allow us to personalize our content and advertisements, support social media features, and analyze website traffic. Additionally, we share information about how you use our site with our social media, advertising, and analytics partners.
To give you control over which cookies are used and to define how cookies can be utilized during your visit, we have categorized the cookies into four different groups. These categories are based on the purpose of the cookies and the data they collect.
Types of cookies
The cookies we use fall into the following four categories. Each category may also include third-party cookies, through which data may be transferred to these parties.
Essential cookies: These cookies are essential for the functioning of the website. They enable basic features such as navigation and other functionalities on the site. Without these cookies, the site will not work properly.
Preference cookies: Preference cookies store information that affects the appearance and behavior of the site, such as language settings or the user's location. These cookies allow the site to remember your choices and provide a more personalized experience.
Statistical cookies: Statistical cookies collect information about how users interact with the site. They help us understand website usage and analyze traffic sources. This data allows us to improve the site and offer a better user experience.
Marketing cookies: Marketing cookies help us, and our partners create a profile of the site visitor’s interests and provide targeted ads on other websites. Our goal is to show ads that are relevant and interesting.
Services using cookies on our website
We use cookies from third-party services on our website to implement content such as videos, social media features, visitor analytics, and advertising. Service providers may combine this information with other data you have provided to them or that has been collected when you use their services. The processing of data collected through cookies from third-party services is not described in this privacy notice but can be found in the privacy notices of each third party, accessible through the cookie settings.
We use Google's cookie-based services on our website. These services provide us with general data, such as the number of people visiting the site or clicking on an ad, without revealing user-specific information. Google also uses the data collected via cookies for its own advertising and analytics purposes. For more information, please refer to Google’s privacy policy.
Google Analytics: Google Analytics helps us understand how visitors use our services. It collects information about how many visitors come to our services, which pages they view the most, how long they stay on specific pages, what actions they take on the site, and where they come from (e.g., directly, via search engines, or other websites). This helps us understand what our customers want and how we can improve our services.
Google Tag Manager: Google Tag Manager helps us manage the services used on the site, such as Google Analytics, and enables interactions between these services and your device’s data.
Google Ads: Google Ads uses cookies, for example, to track which pages visitors view, count predefined actions such as form submissions, and build audiences for advertising purposes. You can control tracking by accepting or rejecting marketing cookies.
Google Signals: Google Signals uses cross-device tracking if you are logged into your Google account and have enabled "personalized ads" in your Google account settings. It collects data on how you use different devices, such as your phone and computer, and helps us better understand how we can target you with relevant ads.
HotJar: Hotjar helps us better understand how users interact with our website. It collects data on user browsing behaviour, such as clicks. This information helps us improve the user experience on our site and tailor content to better meet our users' needs.
HubSpot: HubSpot's tracking and management tools, such as the HubSpot Tracking Code, help us collect information about website usage and enable interaction with your device, for example, to improve the website experience and target marketing efforts. HubSpot uses data collected through website tracking, such as IP addresses and online identifiers, to enhance its own products and services. HubSpot’s Privacy Policy.
Adform: We use Adform to manage and target digital advertising. Adform helps us collect data on website usage, including page visits, interactions with the site, and device information. In addition to cookie settings, you can opt out of data collection by Adform on the Adform opt-out page.
Meta: We use Meta’s tracking code on our site, which collects information about visitors and actions, such as page visits, interactions, and device information. The collected data are sent to Meta’s servers, which may be associated with a Meta user account if the visitor is logged into Facebook or Instagram. This data helps measure the effectiveness of advertising campaigns, display targeted ads to users who have previously visited the site, and create lookalike audiences within Meta’s services. You can adjust your ad-related settings on Meta’s platform.
You can modify your cookie preferences or withdraw your consent to use cookies using the link below. Through this link, you will also find third-party privacy policies.
Change your cookie preferences
11. Modification of this Privacy Notice
The ways in which your personal data is processed may change as our business develops and thus this Privacy Notice may change. You will always find the up-to-date version of this Privacy Notice on this website.