Use of personal data in the Kojamo Group
(Updated 11 July 2019)
The data controller for the personal data described in this policy is Kojamo Plc (business ID: 0116336-2) on behalf of itself and the companies belonging to the same group with it from time to time (hereinafter ´Kojamo´). Lumo is part of the Kojamo Group.
The rental activities carried out by Kojamo require processing of personal data. This processing is based on carrying out measures preceding the tenancy agreement and performing the agreement, our legitimate interest to process data, the law or your consent. Therefore, personal data are used, e.g. for managing the customer relationship, apartment maintenance tasks, carrying out customer satisfaction surveys and other surveys as well as for customer communication, developing services related to residence as well as marketing and direct marketing of apartments.
Personal data are collected primarily directly from you. In addition, personal data are collected among others from the credit information register of Suomen Asiakastieto Oy and the population information system of the Population Register Centre. In customer service situations related to the customer service and rental control, phone calls are recorded in order to verify customer service events and to control and develop the quality of the customer service. In addition, we may collect information on our websites concerning users´ devices by means of cookies and other corresponding technologies.
In the policy, ´you´ refers to both our customers and potential customers whose data we process for marketing purposes. We also process data on different stakeholders, such as data related to corporate roles and sponsorships. More detailed information on the processing of these data is available here.
1. What kind of data are collected on me?
2. What are the sources from which my data are collected?
3. What is the purpose and the legal basis for processing my personal data?
4. How long are my data retained?
5. Who processes my personal data?
6. Are my personal data disclosed to third parties?
7. How are my personal data protected?
8. How does Kojamo use my data for marketing purposes?
10. What kind of influence do I have?
12. Who can I contact?
Basic information and information related to identification:
personal identification number
contact information (address, phone number, e-mail address)
Information related to the customer and tenancy relationship, their establishment and other relevant connections, such as:
commencement date of the customer relationship
number of the persons living in the same household
first and last name and personal identification number of the spouse or cohabiting partner living in the same household
with the consent of the co-tenant, first and last names and personal identification numbers of the persons (including underage persons) living in the same household
information on the authorisation given by the co-applicant to the principal tenant for disclosing information on himself/herself to Kojamo
information of a guardian, if any
for state-subsidised apartments and apartments financed with interest-subsidised loans, the first and last names and personal identification numbers of all persons living in the same household
information on employment
information on income and assets
information on debt arrangement
information on debt collection
information on the apartment prior to the customer relationship
information related to housing needs
information related to the tenancy relationship, i.e. tenancy agreement data, rental payment data, rental deposit data and termination of the tenancy relationship
for underage persons, identification data of the guardian who signed the tenancy agreement
complaints, feedback and other correspondence, surveys, communication and activities related to the customer relationship and relevant connections, including recorded phone calls
information on a trusteeship in tenant activities, if any
information collected by real estate machinery equipment
information collected by electronic keys, i.e. information on issuances and returns of electronic keys as well as access information (key identification information, date and time) for doors of real estates
marketing activities targeted at the data subject, their use and information disclosed in connection with them
bank account information related to the return of a deposit, if any
direct marketing approvals and refusals
Personal data are collected directly from the tenant or the co-tenant upon submitting a rental apartment application or concluding a tenancy agreement. Personal data are also collected later during the tenancy relationship from, among others, electronic keys, electronic services as well as customer service phone calls and communication.
Data may also be collected when you participate in marketing campaigns or events and surveys organised by Kojamo.
Personal data may also be collected and updated from Kojamo´s other registers of persons, from business partners and from authorities and companies providing services concerning personal data, such as from the Population Register Centre and, with respect to credit information, the credit information register of Suomen Asiakastieto Oy.
We process personal data only for pre-determined purposes. Personal data are processed for establishing, administrating, managing, analysing and developing a customer and tenancy relationship and a relationship based on other relevant connections, such as for:
maintaining the customer´s data
maintaining the rent Ledger
customer surveys, e.g. customer satisfaction surveys
maintaining apartments and sharing information necessary with respect hereto with Kojamo to maintenance companies in a contractual relationship
collecting rent and other claims
administrating and terminating tenancy agreements
performing obligations based on law and complying with authority orders and instructions
ensuring Kojamo´s rights and obligations
The processing of personal data related to the management of the customer and tenancy relationship is primarily based on performing the agreement between Kojamo and the customer (tenancy agreement), carrying out measures preceding the agreement (rental apartment application), and Kojamo´s legitimate interest to process personal data:
A contractual and tenancy relationship requires that the customer provides the necessary personal data.
Personal data may also be used for Kojamo´s customer communication and marketing. More detailed information on the use of your personal data is available in Section 8.
We will store your data for as long as necessary for carrying out the purposes defined in Section 3 above in accordance with the legislation in force from time to time.
Personal data collected in conjunction with a rental apartment application will be stored with respect to state-subsidised apartments and apartments financed with interest-subsidised loans for 5 years and with respect to others for 3 years following the applicant´s latest submitted application, unless the applicant has concluded a tenancy agreement with Kojamo.
The personal data concerning the tenant and other persons living in the rental apartment and based on the tenancy agreement will be erased, at the latest, 7 years following the expiry of the tenancy agreement or the end of Kojamo´s and the tenant´s rights and obligations related to the tenancy agreement.
Personal data that are collected for developing and marketing Kojamo´s business operations and the processing of which is based on Kojamo´s legitimate interest or your consent will be retained for as long as their processing is necessary for the purposes of the collected personal data, unless you have withdrawn any consent you may have given. However, said personal data will be processed for a maximum of one year following the latest correspondence between Kojamo and you.
Personal data can be stored for a longer period, if this is necessary to fulfil Kojamo´s obligations imposed by acts, decrees or any other authority sources. Communicative sections in some services of social media will display the content you have produced also after the termination of the customer relationship.
The companies belonging to the Kojamo Group may process personal data in accordance with the data protection legislation in force from time to time. We have entered into agreements with selected business partners. The agreements include the processing of personal data on behalf of Kojamo. Therefore, personal data can be transferred to Kojamo´s subcontractors, such as payment service providers, other service providers or maintenance companies that process personal data on behalf of Kojamo in accordance with an obligation of confidentiality and a binding data protection agreement.
After the expiry of the contractual relationship, personal data processed on the basis of Kojamo´s legitimate interest can be transferred, within the limits permitted by law, to Kojamo´s direct marketing register, unless you have objected to the use of your data for direct marketing. More detailed information on how we further process your personal data in these situations is available in Section 8.
As a rule, personal data are not disclosed outside the Kojamo Group. Personal data may be transferred or disclosed, within the limits permitted and required by the legislation in force from time to time, e.g. on behalf of Kojamo to business partners carrying out debt collection as well as to parties that have the right to obtain data in accordance with the legislation, or if the establishment, exercise or defence of a legal claim requires that personal data are disclosed.
If a party outside the Kojamo Group becomes the owner of an apartment, the Kojamo Group may disclose the personal data of the registered tenants and residents to the new owner of the apartment.
We may disclose personal data in a manner that is required as a result of the claims made by competent authorities or other parties and that is based on the legislation in force from time to time.
We protect your personal data against unlawful access, disclosure or other unlawful processing by means of necessary technical and organisational data security measures, such as careful selection of our subcontractors, proper access control, limited issuance of rights of use as well as instructing the personnel with respect to matters related to the processing of personal data.
The electronically processed data included in the register are protected with firewalls, passwords and other technical means generally approved in the field of data security from time to time. The manually maintained data sets are located in premises where unauthorised entry has been prevented.
In addition, only specified employees of Kojamo and the companies operating at the request and on behalf of it who have signed a confidentiality agreement have access to the data included in the register by an individual right of use issued by Kojamo.
We may use the personal data associated with your account for customer communications and marketing, including direct marketing, and analyse your data in order to target our marketing to better match your interests. In addition, Kojamo may use your personal data for service and business development and planning purposes. The processing described above is based on Kojamo´s legitimate interest to utilise the personal data for business analysis and development as well as customer communications and marketing.
Direct marketing may include telephone marketing, direct mail and/or electronic marketing communications. Electronic direct marketing may include e-mail and SMS communications. We may tailor the content of our direct marketing to better fit your interests based on your account data or data you have otherwise shared with us. This data can be supplemented by behavioural data we collect from our services.
Not all electronic communications are considered direct marketing. The e-mails and SMSs you receive from us may include, for example, service notifications, notifications about service interruptions or our customer newsletter (by subscription only).
Below, you can find a more detailed account of our electronic direct marketing as well as instructions for unsubscribing and opting out of our marketing communications.
DIRECT MARKETING DELIVERED BASED ON YOUR ACCOUNT DATA
This type of marketing content is sent to Lumo customers who have provided their contact details when concluding a contract with us. When signing the contract, they have been notified that their data may be used for such communications. Based on your account with Kojamo (the Lumo account), we may send electronic direct marketing communications that concern better urban living or provide information about the unique benefits and bonuses offered by us and specific Kojamo partners. These benefits may include, but are not limited to, discounts for products, services and events as well as other benefits centred around urban living and tailored to Lumo residents. You will receive regular communications from us, usually once a month. To unsubscribe from our marketing communications, click the unsubscribe link at the end of each e-mail. Alternatively, you can log in to the My Lumo service and select the unsubscribe option or contact our customer services directly.
Your data may be recorded in our marketing data file, for example, when your current tenancy ends, or when you submit your contact details for a competition organised by us or participate in one of our marketing campaigns, events or surveys. We may also collect and update data from our other personal data files, the data files of our partners as well as official bodies and businesses that provide personal data services.
The personal data held in our marketing data file will be processed for the purposes of direct mail advertising, distance selling and other direct marketing as well as organising opinion polls or market surveys and engaging in any other corresponding addressed direct communications. We may also process and analyse your personal data to target our marketing to better match your interests as well as to develop both our business and services.
In the cases set out above, the processing of personal data stored in our marketing data file is based either on your consent or Kojamo´s legitimate interest to utilise the personal data for business analysis and development as well as customer communications and marketing.
In our marketing data file, we will store your name and contact details (mail addresses, telephone numbers, e-mail addresses) as well as your age, gender, native tongue, profession and any specific interests you have shared with us. In cases where your data is used for purposes of marketing targeted to companies, our data file will include your current official function or role in business. Additionally, the data file will include any consent you have given us, the prohibitions you have made as well as the change history for the data specified above.
We collect, process and analyse data regarding the use of our websites. We may collect data concerning your device through cookies and other similar techniques, such as the browser´s local storage.
We are committed to enabling you to exercise your rights as smoothly as possible and to offering you ways to control your personal data. Below we will tell you about your rights and explain how you can control the ways your data is collected and processed.
Right to prohibit direct marketing
You have the right to prohibit the processing and disclosure of your personal data for purposes of direct advertising, distance selling and other direct marketing as well as market researches or opinion polls by notifying us in accordance with Section 12.
Right to withdraw consent
If personal data are processed based on your consent, you have the right to withdraw your consent by notifying us in accordance with Section 12.
Right to access data concerning you
You have the right to access any personal data we retain on you; in other words, you have the right to obtain confirmation of whether we process personal data concerning you and to know what personal data concerning you are stored in our register. You also have the right to obtain a copy of the personal data being processed. A part of the data is already available for you to consult on Kojamo´s website.
When requesting the data, you must mention your name, address and personal identification number and indicate whether you wish to access the data concerning a specific subject, all your data or the data concerning a certain period of time. The access request must be made in writing; it can also be made in person. The access request can be declined or complied with in a limited fashion based on the grounds provided by law, on other persons´ privacy or on Kojamo´s business secrets. The exercise of the right of access and the provision of a copy are usually provided free of charge; however, we may charge a reasonable fee based on the administrative costs of taking the action requested, if copies are requested repeatedly or the requests are manifestly unfounded or excessive.
Right to request rectification, erasure or restriction of processing of personal data
We will rectify, erase or complete any personal data in our register that are inaccurate, unnecessary, incomplete or obsolete for the purpose of the processing, either on our own initiative or at your request (you can contact us in accordance with Section 12. You also have the right to demand that we restrict the processing of your personal data, for example, in a situation where you are waiting for our response to the request concerning the rectification or erasure of your data.
You have the right to request the erasure of your data if you withdraw your consent to the processing of your data and there is no other justified reason for the processing, you object to the processing of your data and there is no acceptable reason for continuing the processing or you object to the processing of your data in direct marketing purposes. However, we are obligated to retain your personal data for the duration of your customer relationship and even after that if it is necessary to process your data, for example, to comply with statutory obligations or to handle legal claims.
Right to object to the processing of personal data in certain cases
You have the right to object, on grounds relating to a particular personal situation, to the processing of personal data by Kojamo which is based on Kojamo´s legitimate interest. In that case you should contact us in accordance with Section 12 and specify the grounds on which you object to processing. We may deny the request on the grounds provided by law.
You are also entitled to object to profiling and other processing that we carry out on your personal data to the extent that the processing is based on Kojamo´s legitimate interest.
Right to data portability
To the extent that you have provided data to our register to be processed in order to perform a contract between Kojamo and you or based on your consent, you have the right to receive this data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller (if this is technically feasible). In this case, please contact us in accordance with Section 12.
Right to lodge a complaint with a supervisory authority
You are entitled to lodge a complaint with the competent supervisory authority if we have not complied with the data protection regulations applicable to our operations.
We reserve the right to amend this policy based on, e.g. the development of our services and our website or legislative changes. If any significant changes are made to this policy, we will announce them clearly where required by applicable law. We encourage you to check the policy from time to time for up-to-date information on any changes.
Kojamo has also designated a data protection officer, who can be contacted by e-mail to or by mail to Kojamo, Tietosuojavastaava, Mannerheimintie 168a, Helsinki, Finland.