Privacy statement

Updated 12.1.2023

The controller referred to in this privacy policy is Kojamo plc (Business ID: 0116336-2) on behalf of itself and the companies belonging to the same Group (hereinafter referred to as “Kojamo”). Lumo is part of the Kojamo Group.

Kojamo’s rental operations require the processing of personal data. The processing of personal data is based on carrying out measures that precede the signing of a tenancy agreement or the execution of the agreement, our legitimate interests to process the data, the applicable legislation or your consent. Accordingly, personal data is used, for instance, in customer relationship management, apartment maintenance, customer satisfaction surveys, other surveys and customer communications, the development of housing-related services as well as the marketing of apartments and direct marketing.

Personal data is mainly collected directly from you. In addition, personal data is collected, among other sources, from the credit information register maintained by Suomen Asiakastieto Oy and from the Population Information System of the Digital and Population Data Services Agency. In customer service situations, telephone calls are recorded as evidence of the service events and in order to monitor and improve customer service quality. In addition, Kojamo may collect information related to the users’ terminal devices with the aid of cookies and other similar techniques on its website (for more information see our terms of use).

We place particular attention to protecting your privacy and we comply with good data processing practices in all of our operations. This privacy policy provides a detailed description of how we collect, use, store and protect your personal data.

This privacy policy contains the following sections:

• What data is collected about me?
• What sources is my data collected from?
• For what purpose, and according to what legitimate interests, is my personal data processed?
• For how long is my data stored?
• Who processes my personal data?
• Is my personal data disclosed to third parties?
• Profiling and automated decision-making
• How is my personal data protected?
• How is my data used for marketing?
• Are cookies used on the websites and is any other party able to collect data on my visits to Kojamo websites?
• What opportunities do I have to influence these matters?
• Can this privacy policy be amended?
• Who can I contact?

We collect personal data necessary for the purposes described later in this privacy policy. The purpose determines what kind of data is collected on you in different situations. We can process the following personal data and information on changes thereto, relating to apartment searchers, apartment applicants, recommended customers, tenants and any co-tenants:

Data collected from apartment searchers:

When you log in to lumo.fi website as an apartment searcher we collect your

• e-mail
• phone number (only if you choose to use your phone number to receive the sign in code)
• nickname

While you search for an apartment as a logged-in apartment searcher, we collect some of your browsing activities on our website, such as the filters you use, apartment pages you visit and apartments you add to favorites.
This data is used to develop our AI-based Apartment Agent and for the personalized suggestions the Apartment Agent makes for you. If you wish to remove all the data we have collected from your browsing and also your login
data, please contact our customer service. We also do data mass deletions every twelfth month to the accounts that haven't been logged in during this time. From the mass deletions we inform the users affected beforehand.

Basic data and data related to identity verification when you turn to apartment applicant:

• name
• personal ID
• contact details (address, phone number, e-mail address)
• gender
• number of people living in the same household
• information about the current form of housing
• information on employment
• information on income

Data related to the customer relationship, tenancy relationship, the establishment of these relationships and other appropriate contexts, such as:

• Basic data and data related to identity verification when you turn to apartment applicant
• customer number
• start date of customer relationship
• first name, family name and personal ID of spouse or partner living in the same household
• subject to the co-tenant’s consent, the first names, family names and dates of birth of everyone who lives in the same household, including minors
• information on the co-applicant’s consent given to the main tenant for the disclosure of data concerning the co-applicant to Kojamo
• information concerning a trustee, if any
• for state-subsidised apartments, the first names, family names and dates of birth of everyone who lives in the same household
• information on assets
• credit information
• information on the adjustment of debts
• information on debt collection
• information on the apartment preceding the current agreement
• information on the need for an apartment
• information related to the tenancy relationship, including tenancy agreement information, rent payment information, security deposit information and the termination of the tenancy relationship
• for tenants who are minors, identifying information on the guardian who signed the tenancy agreement
• complaints, feedback and other communication related to the customer relationship and appropriate correspondence, enquiries, communication and actions taken, including recordings of phone calls and online chat conversations
• information concerning a position of trust in organised resident activities, if any
• information collected by building systems devices
• material from possible camera surveillance, including entries about location, time and date
• information collected by electronic keys, i.e. information on the hand-over and returning of electronic keys and access data from the doors of the property (key ID information, date and time)
• marketing actions targeting the data subject, their use and the information provided in connection with them
• bank account information in relation to refunds of security deposits, if any
• consent to and refusal of direct marketing
• data concerning the use of the website of a customer who has logged in
• data about the use of the digital service while being identified
• the customer’s data concerning the use of the website and mobile services collected through cookies

Personal data is collected directly from tenants and co-tenants in connection with the signing of a rental application or tenancy agreement. Personal data is also collected later during the tenancy relationship from sources including electronic keys, electronic services, customer service phone calls and customer service communications.

Data can also be collected when you participate in Kojamo’s marketing campaigns, events and surveys.

We may also collect and update data from our other personal data files, the data files of our partners as well as official bodies and businesses that provide personal data services, such as the Digital and Population Data Services Agency and the credit information register maintained by Suomen  Asiakastieto Oy.

We only process personal data for pre-determined purposes. Personal data is processed for the purpose of establishing, managing, analysing and developing relationships based on customership, tenancy and other appropriate contexts, including:

• customer data maintenance
• rent ledger maintenance
• customer surveys, such as customer satisfaction surveys
• apartment maintenance and, in that context, the sharing of the necessary information with maintenance companies that are in a contractual relationship with Kojamo
• collection of rent receivables and other receivables
• administration and termination of tenancy agreements
• fulfilling statutory obligations as well as other obligations based on orders and instructions issued by the authorities
• managing Kojamo’s rights and obligations

The processing of personal data related to the management of customer relationships and tenancy relationships is primarily based on the implementation of the agreement between Kojamo and the data subject (tenancy agreement), the implementation of measures preceding the agreement (rental apartment application) as well as Kojamo’s legitimate interests pertaining to the processing of personal data:

• the protection of Kojamo’s property
• risk assessment and risk management
• implementation of physical security and data security
• business analysis and development
• implementation and targeting of marketing and communications
• Contractual relationships and tenancy relationships are conditional on the customer providing the necessary personal data.
• Personal data can also be used for Kojamo’s customer communications and marketing. More information on the use of your personal data for marketing purposes is provided here.

We only store your data for as long as necessary to fulfil the purposes specified in section 3 above and in accordance with the currently valid legislation.

Personal data collected in connection with the submission of an application for an apartment is stored for a period of 3 years from the time of the applicant’s latest application unless the applicant has signed a tenancy agreement with Kojamo.

The personal data collected and formed from the data during the rental process is stored for a period of 6 months.

The personal data on the tenant and other individuals residing in the rental apartment based on the tenancy agreement is erased no later than 7 years after the tenancy agreement has been terminated or when Kojamo’s and the tenant’s rights and obligations stipulated by the tenancy agreement have expired.

Personal data collected for the purpose of Kojamo’s business development and marketing, whose processing is based on Kojamo’s legitimate interests or your consent, shall be stored for as long as it is necessary to process them for the purposes of use of the collected personal data, unless you cancel any prior consent you may have given. Nonetheless, the personal data in question shall be processed for a maximum of one (1) year from the latest communication between you and Kojamo.

Personal data may be stored for a longer time, if necessary to fulfil an obligation imposed on Kojamo by a law, decree or some other official source. The communication channels on certain social media platforms may retain the content you have produced even after the end of the customer relationship.

The data of possible recording camera surveillance are kept for a maximum of two weeks, depending on the capacity of the recorder, unless there is a special need to store the data for a longer period of time in order to fulfil the purpose of camera surveillance. The data are automatically erased by overwriting them with new data.

Kojamo Group companies may process personal data in accordance with the currently valid data protection legislation. We have signed agreements with selected partners that include the processing of personal data on Kojamo’s behalf. Personal data may thus also be transferred to Kojamo’s subcontractors, such as payment service providers, other service providers or maintenance companies, which process personal data on behalf of Kojamo in accordance with a confidentiality obligation and a binding data protection agreement.

Following the termination of a contractual relationship, personal data processed on the basis of Kojamo’s legitimate interests may be transferred, within the limits of the law, to Kojamo’s direct marketing data file unless you have indicated that you do not consent to the use of your data for direct marketing. Please refer to section 8 for more information on the further processing of your personal data in such circumstances.

As a rule, we do not transfer data outside the area of the member states of the EU or the EEA, unless it is necessary for the purpose of processing personal data or the technical implementation of processing data, in which case the transfer of personal data shall conform to the requirements of data protection legislation pertaining to the implementation of suitable or appropriate protective measures, for example, using model contractual clauses approved by the European Commission or otherwise such that the processing of personal data takes place in accordance with this privacy statement.

As a rule, personal data is not disclosed outside Kojamo Group. Personal data may be transferred or disclosed within the limits permitted and required by currently valid laws to, for example, contractual partners that carry out debt collection activities on Kojamo’s behalf as well as parties with a statutory right to access the information, or if the establishment, exercise or defence of a legal claim requires the disclosure of personal data.

If the apartment is transferred to the ownership of a party outside the Kojamo Group, Kojamo Group shall have the right to transfer the personal data of the registered tenants and residents to the new owner of the apartment.

We may disclose personal data in response to requests by the competent authorities or other parties where such requests are based on currently valid legislation.

We protect your personal data against unauthorised access, disclosure and other unauthorised processing by employing the necessary technical and organisational data security measures, including the careful selection of subcontractors, appropriate access control, the restricted granting of access rights and providing employees with instructions on matters related to the processing of personal data.

Electronically processed data file information is protected with firewalls, passwords and other required technical means that are commonly approved in the data security sector at a given time. Manually maintained materials are located in premises where unauthorised access is prevented .

In addition, only the designated employees of Kojamo and the companies operating commissioned by Kojamo and on its behalf who have signed a non-disclosure agreement have access to the information in the data file with an individual access right granted by Kojamo.

We may use the personal data associated with your account for customer communications and marketing, including direct marketing, and analyse your data in order to target our marketing to better match your interests. In addition, Kojamo may use your personal data for service and business development and planning purposes. The processing described above is based on Kojamo’s legitimate interest to utilise the personal data for business analysis and development as well as customer communications and marketing.

Direct marketing may include telephone marketing, direct mail and/or electronic marketing communications. Electronic direct marketing may include e-mail and SMS communications. We may tailor the content of our direct marketing to better fit your interests based on your account data or data you have otherwise shared with us. This data can be supplemented by behavioural data we collect from our services.

Not all electronic communications are considered direct marketing. The e-mails and SMSs you receive from us may include, for example, service notifications, notifications about service interruptions or our customer newsletter (by subscription only).

We use cookies and other similar techniques for statistically monitoring the number of visitors using our services and measuring the effectiveness of our marketing. We may collect data, for example, with the help of tracking codes to find out whether a newsletter or advertisement has been opened and the visitor has, for example, entered the webstore as a result of the newsletter or advertisement. Visitors of our website can be identified by cookies if the visitor has allowed the use of marketing cookies and has either been our resident, applied for an apartment, subscribed to our newsletter or made a contact request. In this case, the data collected from advertising and targeting may be combined with the data collected during the customer relationship in accordance with data protection legislation. In addition, our websites and advertisements may contain our own as well as our cooperation partners’ tracking codes that help us determine how often advertisements are clicked and how often clicks lead to a purchase or other event, such as a newsletter subscription.

Below, you can find a more detailed account of our electronic direct marketing as well as instructions for unsubscribing and opting out of our marketing communications.

DIRECT MARKETING DELIVERED BASED ON THE CUSTOMER RELATIONSHIP

This type of marketing content is sent to Lumo customers who have provided their contact details when concluding a contract with us. When signing the contract, they have been notified that their data may be used for such communications. Based on your account with Kojamo (the Lumo account), we may send electronic direct marketing communications that concern better urban living or provide information about the unique benefits and bonuses offered by us and specific Kojamo partners. These benefits may include, but are not limited to, discounts for products, services and events as well as other benefits centred around urban living and tailored to Lumo residents. The communications are sent on a regular basis, usually once a month. To unsubscribe from our marketing communications, click the unsubscribe link at the end of each e-mail. Alternatively, you can log in to the My Lumo service and select the unsubscribe option or contact our customer services directly.

Your data may be recorded in our marketing data file, for example, when your current tenancy relationship ends, or when you submit your contact details for a competition organised by us or participate in one of our marketing campaigns, events or surveys. We may also collect and update data from our other personal data files, the data files of our partners as well as official bodies and businesses that provide personal data services.

The personal data held in our marketing data file will be processed for the purposes of direct mail advertising, distance selling and other direct marketing as well as organising opinion polls or market surveys and engaging in any other corresponding addressed direct communications. We may also process and analyse your personal data to target our marketing to better match your interests as well as to develop both our business and services.

In the cases set out above, the processing of personal data stored in our marketing data file is based either on your consent or Kojamo’s legitimate interest to utilise the personal data for business analysis and development as well as customer communications and marketing.

In our marketing data file, we will store your name and contact details (mail addresses, telephone numbers, e-mail addresses) as well as your age, gender, native tongue, profession and any specific interests you have shared with us. In cases where your data is used for purposes of marketing targeted to companies, our data file will include your current official function or role in business. Additionally, the data file will include any consent you have given us, the prohibitions you have made as well as the change history for the data specified above.

Example of Lumo e-mail marketing

Automated decision-making refers to decisions made without human involvement.

Profiling refers to the use of personal data to predict a person’s behaviour, preferences or interests. We profile customers for the purpose of service development and marketing, for example. This type of profiling does not have legal effects as referred to in the General Data Protection Regulation.

We use automated decision-making in our renting process as part of the user-initiated rental of apartments through the Lumo webstore. The renting process complies with legally stipulated principles as well as Kojamo’s own principles pertaining to the selection of residents, and the process may also include automatic decision-making. In connection with the signing of a tenancy agreement or the submission of an application, Kojamo has the right to check the customer’s credit information for the purpose of executing an agreement. When you rent an apartment through our webstore, we will check your credit information from the credit information register maintained by Suomen Asiakastieto Oy. We will also check your information from the Digital and Population Data Services Agency and your resident history if you have previously rented a home from us, and any other information you provide at the application process. If you rent an apartment together with a partner or friend, we will check the relevant information for both of you. Any problems with your history as a resident, or in other information, serious payment delays in your credit history and overdue rent payments to us or other lessors may prevent you from being able to rent an apartment. We assess the customer's ability to pay rent based on all the information mentioned above.

If you have lived in Finland for less than three months, you are unfortunately not able to rent an apartment directly from our webstore, but this does not mean you are ineligible for an apartment.

You have the right to request a manual decision-making procedure instead of the automated procedure, submit additional information or dispute a decision that is based solely on automated processing.

We use profiling to send and target marketing messages that we believe are of interest to you. We collect and analyse personal data, such as the data you disclose to us, as well as your behaviour in our online services and your location. You have the right to refuse marketing by contacting us at markkinointi@kojamo.fi. 

The apartment agent uses artificial intelligence-assisted profiling to target apartment recommendations to logged-in users. After logging in, we collect data about the use of our site and store the user's own information about wishes for the apartment. This information is used to implement recommendations and develop the recommendation algorithm.

We collect, process and analyse data relating to the use of our websites. We may collect data concerning your terminal device with the aid of cookies and other similar techniques, such as a browser’s local data storage.

Read more about the use of cookies on Kojamo's websites.

We are committed to fulfilling your rights related to data protection as smoothly as possible and providing you with opportunities for control pertaining to your personal data. The information below describes your rights and how you can influence the collection and processing of your data.

The right to prohibit direct marketing

You have the right to prohibit the processing and disclosure of your personal data for the purpose of direct advertising, telemarketing or other direct marketing as well as marketing surveys and opinion polls by notifying Kojamo of this in accordance with section 12.

The right to revoke consent

If your personal data is processed based on your consent, you have the right to revoke your consent by notifying us in accordance with section 12.

The right of access to personal data

You have the right to access your personal data in our possession, which means that you have the right to be informed by us regarding whether your personal data is being processed and to inspect what personal data concerning you is stored in our data file. You also have the right to obtain a copy of the processed personal data. Some of the data is already accessible to you via Kojamo’s online service.

The request must include name, address and personal ID. In addition, please state whether you wish to inspect the data for a specific matter, the data in their entirety or the data for a specific time frame. The inspection request must be made in writing or in person. Inspection requests may be refused or the response to the request may be restricted based on the grounds laid out in the relevant legislation, to protect the privacy of other individuals or to protect Kojamo’s trade secrets. As a rule, exercising the access right and delivery of the copy are free of charge, but we may charge a reasonable fee for their implementation based on the administrative costs if the data subject repeatedly requests copies or the requests are manifestly unfounded or excessive.

The right to request the rectification or erasure of personal data and the restriction of the processing of personal data

We will rectify, erase or supplement any personal data in the data file that is incorrect, unnecessary, incomplete or outdated for the purposes of processing either at our own initiative or at your request (by contacting Kojamo in accordance with section 12). You also have the right to request that we restrict the processing of your personal data in circumstances such as when you are waiting for our reply to a request to rectify or erase your personal data.

You have the right to request the erasure of your personal data if you revoke your consent to data processing and there are no other legitimate grounds for processing, if you object to the processing of data and there is no acceptable reason for continuing the processing of your data, or if you object to the use of your data for direct marketing purposes. We are nevertheless obligated to retain your personal data for the duration of your customer relationship and thereafter if the processing of the data is necessary for e.g. compliance with legal obligations or the processing of legal claims.

The right to object to the processing of personal data in some cases

On the basis of a specific personal reason, you have the right to object to the processing of personal data by Kojamo that is based on Kojamo’s legitimate interests. In this case, you must contact us in accordance with section 12 and itemise the grounds on which you object to the processing. We may refuse the request on legal grounds.

You also have the right to object to personal profiling as well as other processing measures we apply to your personal data to the extent that the processing of the personal data is based on Kojamo’s legitimate interests.

The right to data portability

To the extent that you have submitted to our data file data that is processed in order to execute an agreement between you and Kojamo or on the basis of your consent, you have the right to obtain such data in a structured, commonly used and machine-readable format as well as the right to transfer said data to another controller (if this is technologically feasible). In that case, please contact us in accordance with section 12.

The right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a competent supervisory authority if we have not complied with the applicable data protection laws in our operations.

We reserve the right to amend this privacy policy on the basis of the development of our services and website or changes in legislation, for example. In the event that significant amendments are made to the privacy policy, we will announce such amendments clearly as required by law. We recommend that you read the privacy policy from time to time to stay up to date on any amendments.

If you have any questions regarding this privacy policy or you wish to exercise your rights as a data subject, please contact Kojamo's data protection officer via email at tietosuoja@kojamo.fi or by letter to Kojamo Group’s data protection officer, Mannerheimintie 168a, Helsinki. You can also reach us through customer service asiakaspalvelu@lumo.fi.