Privacy policy

Last Updated 16.02.2024

The controller for the processing described in this Privacy Policy is IN Yhteiskuntakiinteistöt Holdco Oy (”we”, ”us” or ”our”). We process your personal data when you interact with us in various contexts.

We value your privacy and are committed to safeguarding the personal data we process. This Privacy Policy may be updated at our discretion, and the last modification date is indicated at the beginning of this Privacy Policy. In the event of substantial changes, we will notify you through this website or another appropriate manner before the alterations take effect.

This Privacy Policy covers different roles you may assume in your interactions with us: website visitor, representative or employee of an existing or potential client (namely tenants) or supplier, job applicant, or government or public authority official or employee. Accordingly, this Privacy Policy is organized into sections based on such different roles.

For website visitors, we also have a separate Cookie Policy describing our use of website cookies and related data processing. The Cookie Policy is available here ›

1. How we collect your personal data

We collect your data directly from you or from the relevant existing or potential supplier, client or other entity you represent, within the context of our business relationship. We may also generate certain data from your use of our website or other services.

2. Our processing of personal data

2.1 General

We may process personal data as part of the business operations, such as information that a representative or contact person for e.g., a tenant or potential tenant provides to us. Relevant personal data in this regard includes name, address, telephone number and email address. We may also process personal data in recruitment processes for job applicants filing e.g., their CV and cover letter which may include additional personal data than the aforementioned.

We may process your personal data based on the following legal grounds:

  • Legitimate interest: This is when the processing of personal data is essential to fulfill our legitimate interests, such as managing our tenancies, operations and related processes, or establishing, exercising, or defending legal claims, particularly in connection with disputes or legal processes. Where your personal data is processed based on our legitimate interest, you may request further information through our contact details below.
  • Legal obligation: This is when the processing of personal data is necessary to comply with our legal obligations, such as for accounting or taxation purposes.
  • Consent: We may, in some cases, separately request your consent to processing certain personal data.

We do not process any personal data for automated decision-making or profiling. Your personal data will be processed only for the duration necessary for the purposes outlined herein. The purposes for which we process your personal data and relevant legal grounds are explained in more detail below

2.2. Processing of personal data for tenants or potential tenants

We process personal data for the purposes and in accordance with legal grounds as stated below.

  • Purpose: to manage our relationship and fulfil our commitments to you or the entity or tenant you represent.
    Legal ground: When you are the contact or representative for a tenant or entity or potential tenant, the processing is necessary for our legitimate interest of managing and fulfilling our obligations in the business relationship.
  • Purpose: To continually manage and maintain the rental premises.
    Legal ground: When you are the contact or representative for a tenant or entity or potential tenant, the processing is necessary for our legitimate interest of managing and maintaining our rental premises and related proprietary interests, which also benefits our tenants.
  • Purpose: To provide service and manage fault reporting.
    Legal ground: When you are the contact or representative for a tenant or entity or potential tenant, the processing is necessary for our legitimate interest of addressing faults and problems in the property and on the premises, which also benefits our tenants.
  • Purpose: Collating statistics at an overall level.
    Legal ground: The processing is necessary to satisfy our legitimate interest of acquiring greater market and customer insight and evaluating our business, which also benefits our tenants.
  • Purpose: To communicate relevant offers to you about our and other companies’ products and services.
    Legal ground: The processing is necessary in order to satisfy our legitimate interest of communicating relevant offers and services to you.

If you are a representative or contact for a tenant or potential tenant or other entity, your personal data is processed for as long as you remain the designated contact. We delete your personal data no more than six months after the end of our relationship unless we need to save the data for a longer period due to legal requirements or because there are outstanding rent receivables or other legal claims.

2.3. Processing of personal data for job applicants

We process personal data when you (i) apply for an advertised position with us, or (ii) register interest in employment with us via an unsolicited application. Such personal data includes the details you provide in connection with your application, such as name, contact details, date of birth, CV, cover letter, certificates and/or study grades, previous and/or current duties, title, employers, job descriptions and other information that you submit to us voluntarily. We may also process personal data comprising notes about you from interviews and reference conversations with referees nominated and accepted by you, as well as the results of any tests and background checks. Additionally, we may process other similar personal data shared by external recruiters who have been part of the recruitment process.

We process your personal data exclusively for the purpose of recruiting new employees, with the legal ground that such processing is necessary for our legitimate interest of recruiting new employees as well as for potentially performing or preparing the employment contract with you. In certain instances, for some of our positions, a background check may be conducted on the selected individual before extending an offer of employment for the respective position. We may also request certificates, for example evidence that you completed your degree. In such cases, we obtain your consent at a later stage of the recruitment process, and not in connection with you applying for the position.

If your application relates to an advertised position and does not lead to an offer of employment, we save your data for two years in case we should need it for any potential discrimination claim. If you have submitted an unsolicited application, we save your personal data for two years.

2.4. Other processing

  • If you are the contact person for engagements, agreements, or reporting (other than for tenants or potential tenants), our processing of your personal data may be related to you being named as the contact person representing your employer in a business relation with us on basis of an agreement, an assignment or to receive reports. In such a case we may process personal data such as your name, telephone number, address and/or email address to contact you and your company in order to fulfil our legal obligations or pursue our legitimate interests in carrying out our business operations.
  • Notice of interest: If you have shown an interest in our business and contacted us personally or through a mediator, we may process your personal data to be able to get back to you if an opportunity would arise that we believe you would be interested in. If you have shown an interest in participating at an event or a conference or other arrangement that we arrange or partake in, we might process your personal data in accordance with our legitimate interest to be able to invite you to a future event that we deem would be of interest to you.
  • Other contacts: If you contact us, we will process your contact details in accordance with our legitimate interest to be able to answer your questions or provide requested information.
  • Electronic processing and data protection: We may process personal data in accordance with our legitimate interest to improve our services, protect or enhance our IT-security and to investigate or prevent trespassing or data breaches (e.g., by using cookies or IP-addresses: please see information about cookies in our Cookie Policy).
  • Investigations, complaints, breaches, crimes, or litigation: It could happen that personal data about you have to be processed in accordance with our legitimate interest to ascertain or exercise responsibilities, to investigate possible breaches of contracts or crimes, or to defend our legal rights.

3. Your rights

You have, under certain circumstances, the following rights when it comes to your personal data:

  • Right of access – You are always entitled to receive certain information on our processing of your personal data and seek confirmation of whether or not such processing occurs. If your personal data is indeed being processed, you have the right to access your personal data along with additional details, including the purpose of the processing. You are also entitled to obtain a copy of the personal data we process about you.
  • Right to rectification – You are entitled to have incorrect or inaccurate personal data about you rectified and considering the purpose of the processing, to have incomplete personal data pertaining to you completed.
  • Right to erasure – Under certain circumstances, such as when your personal data is no longer necessary for the initially intended purpose, you are entitled to have your personal data erased. This is usually known as “the right to be forgotten”. However, certain legal obligations or overriding legitimate interests may prevent the erasure of your personal data.
  • Right to restriction of processing – Under certain circumstances, e.g., when specific processing is unlawful, but you do not wish your personal data erased, you are entitled to demand that the processing of your personal data be restricted. If our processing has been restricted, we may mainly only process your personal data, besides storing it, with your consent or for the establishment, exercise, or defense of legal claims or to protect the rights of others.
  • Right to data portability – Under certain circumstances, you have the right to receive your personal data in a structured, commonly used and machine-readable format and have the right to transmit the data to another controller.
  • Right to object – You are entitled to object to our processing of your personal data where it is based on a legitimate interest. In such instances, we will cease processing your personal data, unless we can demonstrate that compelling legitimate grounds override your privacy or that the use of your personal data is essential for managing or defending legal claims. In any case, we will no longer process your personal data for direct marketing if you object to such processing.
  • Withdrawal of consent – You have the right to withdraw your consent to the processing of personal data at any time, to the extent that the processing is based on your consent.

If you have any questions or complaints on our processing of your personal data or you wish to invoke your rights, contact us at info@suohki.fi. Additionally, you always have the right to lodge complaints pertaining to the processing of your personal data to the Office of the Data Protection Ombudsman (i.e., “Tietosuojavaltuutetun toimisto”).

4. How and when we share information about you to others

We may share your personal data with our parent company Infranode AB established in Sweden to ensure a swift and relevant communication about our businesses and our relationship to you. Additionally, to fulfill the processing purposes of your personal data and operate our business effectively, we share personal data with external entities, including third-party service providers and other partners with whom we have engaged. These external entities function as our data processors, bound by our instructions and not authorized to process your personal data for their own purposes. We retain the role of data controller for the processing of personal data undertaken by these external parties on our behalf. In general, we do not share your personal data with parties outside the European Union or European Economic Area (”EU/EEA”) and strive to retain the processing of personal data within the EU/EEA.

Personal data processed within the IT-systems that we use to provide our services may be shared with IT-service providers outside EU/EEA. Such may be deemed necessary in ensuring a qualitative and reliable service provision through secure techniques to you. In such a case, we will ensure an adequacy decision (on third country’s adequate level of data protection) adopted by the European Commission or appropriate safeguards are in place (such as the EU Commission’s standard contract clauses), along with any necessary supplementary measures, to safeguard the personal data. Additionally, we regularly conduct risk assessments to determine and implement any supplementary measures required to protect the personal data subject to the transfer or disclosure. If you have any questions about the applied safeguards, please contact us at info@suohki.fi.

  • If you are a member of the board or senior manager in our organisation or group your personal data will be shared with our accounting firm, with the payment service provider, with the property manager, and as necessary any maintenance providers.
  • In the event of litigation, legal processes or other circumstance that might require outside advice, the personal data may also be shared with a legal firm, an authority or other relevant party.
  • We do not sell personal data or other information about our relations to third parties.

Additionally, we may disclose your personal data to other data controllers, where these recipients independently determine the purposes and means of processing without our direct involvement. Such instances may arise, e.g., with authorities acting on their own mission in accordance with laws or authority decisions, such as Financial Supervisory Authority (i.e., Finansinspektionen / Finanssivalvonta), the Office of the Data Protection Ombudsman (i.e., Dataombudsmannens byrå / Tietosuojavaltuutetun toimisto), courts, the tax authority, the police or other regulatory bodies or authorities as permitted or required by applicable law.

5. How we protect your personal data

We apply both technical and organizational measures to protect your personal data against unlawful access and loss. Specific authorization and/or technical authentication is required to process and/or move personal data within our organisation or to an external, authorized, party.