Data protection

Date of drafting: 20.12.2024

SATO respects your privacy. We value the trust you put in us and are fully committed to protecting your personal data. This Privacy Policy explains why we collect certain personal data, how we protect it and what rights you have in relation to your data.

SATO Corporation (Business ID 0201470-5) for its part and on behalf of SATO Group companies (hereinafter SATO or we) is an expert in housing in Finland and one of the country’s largest rental housing providers. SATO is responsible for the processing of the personal data of visitors to its website, its potential and actual tenants and buyers of its homes.

Our main office is located at Panuntie 4, PO Box 401, FI-00601 Helsinki, Finland.

This Privacy Policy answers the following questions:

• What is personal data and what does the processing of personal data mean?
• When are we allowed to process personal data?
• What personal data to we process and why?
• When do we share your personal data with third parties?
• How does SATO protect your personal data?
• How long does SATO keep your personal data?
• What are your rights?
• How to contact SATO
• Changes to this Privacy Policy

1. What is personal data and what does the processing of personal data mean

Personal data is any data that relates to an identified or identifiable person. Examples of personal data include name, address, phone number, personal identity code, health data and financial data.
The processing of personal data means all operations performed on personal data, such as collection, recording, organisation, structuring, storage, retrieval, use, disclosure, restriction, combination, erasure or destruction.

2. What is the legal basis for our processing of your personal data

SATO processes personal data with care and transparency. We only process personal data when there is a legal basis for the processing. The following are the legal grounds for personal data processing by SATO:

Conclusion of an agreement with SATO
When we rent or sell you a home, we conclude an agreement with you. We collect your personal data in order to prepare, draft and comply with the lease agreement or deed of sale. Compliance with a lease agreement involves aspects such as offering you a home and charging rent.

Consent given to SATO
We may process your personal data when you have given us (explicit) consent for this. We ask for your consent for sending you electronic direct marketing, for example, and for placing cookies (for more information, please see https://www.sato.fi/en/data-protection/cookies).

Statutory obligation on the part of SATO
SATO may process your personal data when we are subject to a statutory obligation to do so. Statutory obligations may be based on guidance from the authorities or legislation on topics such as renting homes, selling homes, consumer protection or accounting, for example. One instance where processing is based on legislation is when you apply for state-subsidised housing (ARA housing). Checking sanctions data is also based on a statutory obligation.

Legitimate interest on the part of SATO
SATO has the right to process your personal data when we have a legitimate interest in doing so. Legitimate interest means that SATO has a reasoned and justified interest that takes precedence over the customer’s rights. SATO’s legitimate interest has to do with our business interests, such as service quality control, development of services and housing provision, customer satisfaction measuring and direct marketing. Legitimate interest also has to do with risk assessment and risk management, protecting the rights and assets of SATO, implementing physical and information security, and transferring data between SATO Group companies. Examples of processing measures implemented on the basis of legitimate interest include marketing measures, establishing customer relationships and performing preparatory measures for agreements, conducting customer surveys and studies, preventing abuse, verifying the actual residents of homes and preventing vandalism and crime (incl. CCTV and access control) as well as limiting prohibited sub-letting and reporting abuses to the authorities and other relevant parties. SATO always balances these interests to determine whether we have a legitimate interest in processing your personal data.

3. What personal data to we process and why?

SATO processes personal data in a variety of situations. This Privacy Policy applies to:

1. Persons interested in our homes and potential tenants or buyers
2. SATO tenants and buyers of SATO homes
3. Third parties, such as visitors to our properties
4. Users of our website

1. Interested persons and potential tenants and buyers

When you register your interest in a SATO home (for example by setting up a search alert or subscribing to our newsletter), we process your following personal data:

• Your email address, name and phone number
• Any message you have left in the free text field
• The data you entered in your search alert

When you are no longer interested in our homes, you can cancel your search alert by using the cancellation link in search alert messages. When you no longer wish to receive SATO’s newsletter, you can cancel your subscription at https://www.sato.fi/en/unsubscribe.

We may request personal data from you before a home viewing in order to streamline the process. In such a case, we process the following personal data:

• your name and contact information
• any additional information requested or other requests made regarding the viewing

SATO may use semi-automated decision-making in tenant selection in online transactions in order to ensure letting that is responsible with regard to all parties concerned (see section 2 below for more details).

Before concluding a lease agreement or deed of sale on a home, we process your personal data for purposes of the document. We may process your following personal data (as well as the personal data of any co-tenant, co-buyer or person also moving in):

• The information necessary for drafting the lease agreement or deed of sale (see point 2 below), credit information included
• Information voluntarily provided to the sales consultant, for example the specifics of the home you are looking for

In addition to the above, we also use your personal data for the following purposes:

• Sending marketing and newsletters as well as information on homes and buildings in which you have expressed an interest (for example by search alert)
• Preparing lease agreements and deeds of sale and checking credit information
• Communicating with customers and other customer relationship management
• Conducting customer surveys and producing analyses and studies

2. Automated decision-making and profiling

In order to enable online rental transactions, we make use of profiling and automated decision-making. Profiling and automated decision-making takes place on the basis of personal data you have disclosed. In such cases, we process your following personal data:

• Strong authentication
• Credit information
• Income information
• Co-tenant and details of other persons over the age of 18 moving in as well as number of persons under the age of 18
• Details of your customer history with SATO in relation to matters such as incidents of disturbance in the home or payment of rent

However, you always have the opportunity to submit a regular housing application to apply for a home, in which case your application will be handled by a real person.

3. SATO tenants and buyers of SATOhomes

When you rent or buy a home from SATO, we process your personal data in order to prepare and comply with the lease agreement or the deed of sale. We may process the following personal data on you (as well as on any co-tenant, co-buyer or other person moving in):

• Name, personal identity code (or e.g. passport number), address, IP address, contact details
• Details (name, personal identity code) identifying those over the age of 18 moving in with you (as well as those under the age of 18 at ARA buildings)
• language of communication, language of materials and, at ARA rental buildings, also nationality
• In relation to renting and selling, details on guardianship where necessary, gender, occupation, employment status, type and duration of employment, household form, credit and payment history information, information on housing allowance, details of current home, marital status, data disclosure prohibitions ordered by the authorities, details of application for home, payment information regarding rent, other rental fees or sales price, details of security deposit
• Data accruing during residence history on e.g. incidents of disturbance in the home or rent payment defaults
• Data on any alterations, repairs and additional work on home
• When necessary, we may retrieve from public registers data that is necessary or supplemental for concluding the transaction, such as contact details
• Where required by regulations on sanctions (e.g. ownership or control of corporate entity), we may process data on whether you appear on the sanctions list of any private or public body. If you are listed, we will determine the reason for the listing.

When you disclose personal data of another person such as a family member to us, it is your responsibility to ensure that the person concerned is aware of the processing of their personal data by SATO.

SATO rental homes use a heating regulation system based on real-time temperature measurement in the homes collecting data on temperature and humidity. Some homes have remote-read water meters. The data on home temperature, humidity and water consumption is used in property maintenance, billing and monitoring.

SATO conducts regular customer satisfaction surveys. SATO processes your responses for this purpose.

In addition to the purposes listed above, we also use your personal data for the following:

• Measures relating to the drafting of lease agreements and deeds of sale
• Charging rent and collecting sales price, handover of home
• Measures relating to property upkeep and handling of service requests
• Dealing with allegations and claims relating to lease agreements and deeds of sale
• Conducting customer surveys and producing analyses and studies
• Providing housing-related services at certain buildings (e.g. lists of names at building entrance and doorplates, lists of sauna turns and laundry room reservations, and measurements and controls relating to property and building services technology)
• Decision-making on offering new rental homes, also in online transactions

4. Miscellaneous

Visitors (incl. tenants) at SATO properties

Some SATO buildings have CCTV or electronic access control. SATO uses the CCTV footage and access control data only in the following cases:

• In order to investigate crime and to identify perpetrators, parties and/or witnesses;
• Where a data subject expressly requests access to footage in which they appear;
• Where necessary, for separately justified reason to ensure that everyone complies with provisions, rules and regulations or terms and conditions concerning tenants.

SATO may process personal data necessary to identify you, such as your name and contact details, for the following purposes:

• To deal with complaints and claims;
• To address disturbances so as to ensure a safe and pleasant living environment and protect SATO assets;
• SATO also carries out statistical analysis of the personal data it processes with the aim of generating business intelligence. This only takes place when it is compatible with additional processing or necessary, for example, in order to inform and improve our operating policies;
• Fulfilment of any other statutory obligations.

Visitors to website

Cookies and comparable technologies
We use cookies and other comparable technologies on our website. These allow us to collect data on matters such as website behaviour, data on your device such as the IP address from which you access our website (and the associated imprecise location data), browser data and type of device, device identifiers, sign-in logs and regional and language settings. We use this data to measure and improve user experience on our website and to enhance and optimise our products and services.

We do this on the basis of the legitimate interest of improving the quality and functionality of our website. We also ask for your consent for placing cookies for marketing purposes. Please see our Cookie Policy for more information on the use of cookies, giving and withdrawing consent, and purposes.

Online forms and communication
You can disclose personal data and communicate with us on our website. We use the contents of your messages to us, such as feedback, reviews and questions and information to customer support, in order to appropriately deal with your question, complaint or comment. In addition, we use your personal data for learning purposes and to enhance our services and processes.
Your phone call to us or chat conversation with us may be recorded for training purposes.

These purposes are based on legitimate interest, in particular our interest in appropriately responding to and dealing with your requests, complaints and comments. Additionally, SATO has a legitimate interest in learning from its communication with you so that we may continue to improve our website and our services.

Newsletter and updates
On our website, you can subscribe to our newsletter or order updates on residential properties, for example. You are required to give your consent. This consent may be withdrawn at any time (please also see under “rights of data subjects”).

4. When do we share your personal data with third parties?

We keep your personal data confidential. This means that we only share personal data when this is absolutely necessary and do so in compliance with applicable legislation and regulations. In all cases, as little personal data as possible is shared.

When you have given consent
If you have given your consent e.g. to cookies when visiting our website, we will share with the parties listed in the Cookie Policy the personal data you have consented to disclosing.

When necessary in order to conclude a lease agreement with you
In order to check your credit information, we share with third parties your personal data that is absolutely necessary for this purpose.

When there is a legitimate interest
SATO may share your personal data when we have a legitimate interest in doing so. This means that sharing your personal data must be of vital importance to SATO. We may, for example, disclose your personal data to the police or other authorities in order to report and investigate crimes. We may also use independent experts such as lawyers, insurance experts or auditors.

When required by law
In some cases, we are required by law to share personal data with third parties. For example, we must share personal data with the financial supervisory authorities, tax authorities, municipal authorities and the police at their request.

When another person is acting on your behalf
If you ask another person, for example a lawyer, to communicate with SATO on your behalf, we may share your personal data with that person.

When necessary in order to perform a lease agreement or deed of sale
Data sharing may be necessary in order to perform an agreement. In such a case, we may disclose personal data to parties such as contractors, building managers or maintenance personnel in relation to residential buildings and to e.g. payment services providers in relation to charging and collecting rent.

With processors of personal data
Certain service providers under contract with us may process personal data on our behalf as part of the service they provide. In these cases, we have entered into the appropriate contracts and in this way ensured processing as required under applicable data protection regulation and our data protection statement also in these cases. For example, we use a cloud services provider to record personal data and an SaaS provider for the system in which your account is used. In addition, SATO uses a financial services provider in processing payments.

5. Regular sources of data

As a rule, we collect personal data from persons themselves, for example in the context of visiting our website, concluding an agreement or customer communications (such as correspondence, e-communication and appointments). Personal data may also be collected and updated from the Population Register, KELA, Posti, credit information registers, the prohibition registers maintained by the Data & Marketing Association of Finland (ASML) and other comparable public and private registers.

6. How SATO protects your personal data

We are committed to the safe and secure processing of your personal data so that we may prevent any unauthorised access to or disclosure of the data, maintain the correctness of the data and ensure its appropriate use. To this end, we have implemented physical, electronic and organisational controls to protect and safeguard personal data.

SATO has undertaken appropriate technical and organisational measures to restrict the use of the personal data in its possession and to protect this data from loss, unintentional destruction, abuse and unauthorised alteration. The right to use personal data is limited to those persons (employees of and service providers to SATO) who need the data for the purposes for which the data was collected. With any eventual contractual partners, SATO drafts a contract ensuring a high level of security in data processing.

A. Manual materials / place of storage and protection: Materials are kept on locked and monitored premises. Data is only accessible by persons designated by the SATO Group.

B. Electronically recorded data / principles of file access and access control and physical protection of hardware: Data is only accessible by persons designated by the SATO Group. The access rights to a data file are determined individually for each position. SATO’s internal processes are observed in the determination of access rights. The databases and data networks used to store data are protected by means of organisational and technological measures. The supervision and protection of data files complies with regulations applied within the EU.

How do we protect personal data that we share with third parties?
We enter into a personal data processing contract with organisations that process your personal data on our behalf. The contract states that the organisation should process your personal data at the same level of security and confidentiality as SATO.

How do we protect personal data that we share outside the EU?
As a rule, SATO does not share personal data with organisations located outside the European Union or the European Economic Area. Your personal data may be transferred outside the EU or the EEA as provided in data protection legislation and within the limits imposed in that legislation.

By complying with the equivalence decisions issued by the European Commission, we ensure an adequate level of protection in accordance with the General Data Protection Regulation also in situations where data is transferred outside the EU or the EEA.

When necessary, we use the standard clauses and supplementary protective measures approved by the European Commission. We share your personal data only when the data is appropriately protected. We observe international guidelines in order to ensure appropriate protection.

7. How long does SATO keep your personal data?

We keep your personal data for as long as it is necessary for the purposes described in this Privacy Policy. For example, when the processing of personal data is based on legislation or guidelines from the authorities, as a rule we keep your personal data until the end of the defined storage period.

The main storage periods relating to SATO’s operations have been determined in the manner described below. Please note that SATO may keep personal data for longer than determined below when this is necessary in order to defend SATO against claims or it results from a mandatory requirement under law.

1. Visitors to our website
Personal data is kept for three months

2. Persons interested in our homes and potential tenants
The personal data collected in the context of a rental home application that does not result in the conclusion of an agreement is kept for six months from the submission or most recent modification of the application by the applicant. ARA housing applications are kept for three years from the submission or most recent modification of the application.

3. Tenants
The personal data of tenants and other persons living in the rental home on the basis of a lease agreement are erased not later than seven years after the expiration of the lease agreement or the rights and obligations of SATO and the tenant relating to the lease agreement.

Personal data collected for the purpose of business development and marketing at SATO is kept for as long as necessary for these purposes or until you withdraw the relevant consent. However, this data will only be processed for one year following our most recent communication with you.

4. CCTV and access control
Any recording CCTV data is kept for approximately a month, depending on the capacity of the recording device, unless there is a special reason due to implementing the reason for CCTV surveillance to keep the data for a longer period of time. The data is erased when new data is automatically recorded over it.

8. Your rights related to the processing of personal data

As a data subject, you have the right:

1. To withdraw the consent you have given and to prohibit direct marketing
You can let us know that you are withdrawing consent by sending us an email to this effect at tietosuoja@sato.fi. To unsubscribe from our newsletter, please visit https://www.sato.fi/en/unsubscribe

2. To obtain information about the processing of your personal data and to gain right of access to your data
You have the right of access to your data, including the right to check the kinds of personal data that we process. When you submit a request for right of access to your personal data, SATO will verify your identity by checking your name, address and personal identity code. Requests to check may only be refused on lawful grounds.

3. Correct and restrict your data, object to the processing of your data and request erasure of your data
SATO will verify your identity when you submit to us a request to erase or alter your data or to restrict the processing of your data.

In some cases, SATO has the right to refuse these requests. Data cannot be erased, for example, if the processing of the data remains necessary for the purpose for which the data was originally collected (such as performance of an agreement). Personal data processing cannot be objected to or restricted when, for example, the processing of the personal data is necessary due to mandatory legislation or to prepare, file or defend a legal claim.

4. To transfer your data to another system
Data portability applies to such automatically processed personal data which concerns you personally, which you yourself have disclosed to SATO and which does not infringe the rights or liberties of others. When technologically feasible, data may be transferred directly to another controller at the data subject’s request.

5. To not be subject to automated decision-making
You have the right not to be subject to a decision based solely on automated processing which significantly affects you as a person.

Data subjects cannot exercise all of the rights under all circumstances. The situation depends on factors including the basis for the processing of your personal data. As a rule, no fee is charged for exercising your rights. A fee may only be charged in a limited number of situations (recurring requests, for example). The data subject is always informed in advance if the request will result in a fee being charged.

If you wish to exercise your rights, please contact:
Privacy issues, Panuntie 4, PL 401, FI-00601 Helsinki, Finland
email: tietosuoja@sato.fi