Retta Isännöinti Oy provides property management services to housing associations, which are its clients.
Retta Isännöinti’s business operations require it to collect certain personal data from its customers and stakeholders. In doing so, Retta Isännöinti acts as a data controller within the meaning of data protection legislation. The purpose of this document is to inform data subjects about the processing of their personal data.
With regard to the property management services it provides, Retta Isännöinti acts as a data processor. Retta Isännöinti also acts as a data processor in relation to the customer service it provides to its clients’ customers under a property management agreement.
DATA CONTROLLER: Retta Isännöinti Oy (business ID 0871684-7)
Retta Isännöinti acts as an independent data controller in relation to the processing of personal data described in this privacy notice. Although personal data may be shared between group companies as described below, each group company is independently responsible for its own processing, and there is no joint controllership between the companies within the meaning of Article 26 of the EU General Data Protection Regulation (GDPR).
LEGAL BASIS AND PURPOSE OF THE PROCESSING OF PERSONAL DATA
Retta Isännöinti maintains a customer register in connection with the provision of property management services to housing associations. The legal basis for the processing of personal data is the performance of the contract between the customer and Retta Isännöinti and the fulfilment of statutory obligations (e.g. the Accounting Act, the Money Laundering Act, the Housing Companies Act). Personal data may also be processed on the basis of Retta Isännöinti’s legitimate interests (Article 6(1)(f) of the GDPR), such as the organisation of business operations and internal group management.
The Act on the Prevention of Money Laundering and Terrorist Financing (444/2017) requires the identification of customers and the verification of information concerning their beneficial owners, decision-makers and contact persons. This information is used to prevent, detect and investigate money laundering and terrorist financing.
Personal data processed
The following information is collected about Retta Isännöinti’s customers: the person’s name, position within the client company, and contact details (telephone number, email address, postal address). In addition, the register contains any customer complaints and the personal data included in them.
To fulfil the obligations under the Money Laundering Act, information is also collected on the client company’s beneficial owners, decision-makers and contact persons, such as name, personal identification number or date of birth, nationality, politically exposed person (PEP) status, and whether they are included on sanctions or asset-freeze lists.
The customer register also stores the user profiles of individuals registered with the OmaRetta service. A user profile may include the person’s name, telephone number, address, the name of the housing association or property management company and the flat reference number, email address, IP address, personal identification number, account number and, where applicable, a profile picture. The service also contains other information entered by the user. Separate terms of use and a privacy notice have been drawn up for the OmaRetta service; these set out in more detail, amongst other things, the types of data collected for the purpose of developing the service.
In connection with its residential letting business, Retta Isännöinti also collects the following personal data in its customer register:
Date of birth, personal identification number, previous address, language of communication, politically exposed person (PEP) status, information on whether the customer is on an international sanctions list, information on whether the customer is on an international asset-freeze list (a public register of freezing decisions maintained by the National Bureau of Investigation), identification details of the document used for identity verification or a copy thereof, information on guardianship or trusteeship, information concerning the property to be let, occupation, duration of employment, financial status, income details, any other information contained in the application for a rental property, credit history, information contained in the tenancy agreement, and any other information provided by the customer that is necessary for the performance of the letting service.
In the residential letting business, the legal basis for the processing of personal data is the performance of a contract and compliance with a statutory obligation.
Data subjects’ personal data is not used for profiling or automated decision-making.
Use of AI tools and applications
We use AI-powered tools and applications to support the delivery and improvement of our services and to help manage communications with you. We use these tools only for the purposes explained in this privacy notice and where we have an appropriate lawful basis for processing your personal data.
Our AI service providers. Where our AI service providers process personal data on our behalf, they are required to act on our instructions and comply with applicable data protection laws. They are not permitted to use your personal data to train their AI models.
Location and transfers. Personal data processed through the AI tools is generally stored in the European Economic Area (EEA). Where personal data is transferred outside the EEA, we rely on approved safeguards the European Commission’s standard contractual clauses.
Human oversight. We do not use AI to make decisions about you that produce legal or similarly significant effects without human involvement. AI supports our work, but people remain responsible for decisions that affect you. If this changes, we will only carry out such solely automated decision-making where permitted by applicable data protection law. We will also inform you of your rights, including the right to request human intervention, express your views, and challenge the decision.
Sensitive personal data. Please provide only the personal data necessary for us to deal with your enquiry or request. Avoid including sensitive personal data, such as health details, about yourself or others unless it is necessary for the matter you are asking us to handle.
If you provide this information, it may be processed by the AI services we use to support our handling of communications. We will process it only to the extent necessary to handle the relevant matter.
Interacting with AI. Whenever you are interacting directly with an AI feature in our systems or applications, we will clearly inform you that you are communicating with AI.
REGULAR SOURCES OF DATA
Personal data is generally obtained from the data subjects themselves. Data may also be obtained from official registers, such as the Trade Register, from public sources, such as the housing association’s own website, and from Suomen Asiakastieto Oy. The ‘know your customer’ information required under the Money Laundering Act is collected directly from the data subject via the DOKS service (Suomen Tunnistetieto Oy).
DATA PROCESSORS AND REGULAR DISCLOSURES OF DATA
In providing services to its customers, Retta Isännöinti uses various service providers acting as data processors, such as providers of customer relationship management and sales systems.
Retta Isännöinti uses the DOKS service (Suomen Tunnistetieto Oy) to assist in fulfilling its identification and reporting obligations under the Money Laundering Act; DOKS processes personal data on behalf of Retta Isännöinti as a data processor.
Personal data may be shared between our group companies to the extent necessary for developing the business or fulfilling statutory obligations. Within the group, personal data is shared in particular for purposes relating to customer relationship management, customer service, sales, marketing, financial administration and reporting, and with Ador Vakuutuspalvelut Oy in order to comply with obligations under anti-money laundering legislation. The legal basis for processing related to the management and development of the business is Retta Isännöinti’s legitimate interest in managing the group’s business operations in a uniform manner. The legal basis for processing related to compliance with anti-money laundering obligations by Ador Vakuutuspalvelut Oy is a legal obligation.
Personal data may be disclosed to other companies in the same group as Retta Isännöinti to the extent necessary for developing business operations. Personal data is shared between group companies, in particular for purposes relating to customer relationship management, customer service, sales, marketing, financial administration and reporting. The legal basis for this processing is Retta Isännöinti’s legitimate interest in managing the group’s business operations in a unified manner.
Personal data may also be disclosed to a debt collection agency for the purpose of recovering debts. Furthermore, data may be disclosed to public authorities upon request. The establishment, exercise or defence of legal claims may also require the disclosure of personal data, for example to an insurance company or a legal adviser.
Data from brokerage assignment registers may also be disclosed to the authority supervising brokerage activities (the Licensing and Supervisory Authority) or to other public authorities (e.g. a tenant selection notification submitted to ARA) as required by law. The handling of brokerage assignments also requires that data be disclosed to the other party to the assignment.
As a general rule, personal data is not transferred outside the EU or the EEA.
RETENTION PERIODS
The retention period and the criteria for determining it vary depending on the type of personal data and the purpose for which that specific personal data is processed.
As a general rule, personal data collected on the basis of a contractual relationship is retained for the duration of the contractual relationship and, after its termination, for as long as is necessary for any potential legal proceedings. Personal data collected on the basis of a statutory obligation is retained for the period required by law.
Tenders submitted, together with the personal data they contain, are retained for a maximum of two years from the end of the tender process.
Legislation on customer identification requires that customer identification data be retained for five years from the end of the assignment or contract.
PRINCIPLES OF DATA PROTECTION
Personal data is protected by appropriate technical and organisational measures. Paper-based material is stored in a locked facility, and access to it is restricted to persons authorised to process the data. Electronic data is protected by technical measures, and access rights to systems are granted only to those individuals for whom such access is necessary for the performance of their work or duties. The data controller’s staff are bound by a duty of confidentiality and receive regular training and instruction in the lawful processing of personal data.
External data processors used by Retta Isännöinti are also required to implement adequate technical and organisational security measures and to commit to a duty of confidentiality.
RIGHTS OF THE DATA SUBJECT
The data subject has the right to obtain confirmation as to whether the data controller is processing personal data relating to them. If data is being processed, the data subject has the right to obtain a copy of the personal data being processed. If the personal data is incomplete, incorrect or otherwise inaccurate, or if the data is out of date, the data subject has the right to request that their data be rectified.
Where the processing of personal data is based on the data subject’s consent or a contractual relationship, the data subject has the right to receive the personal data concerning them that they have provided to the data controller in a structured, commonly used and machine-readable format and to transmit that data to another controller. This right applies only to personal data processed by automated means.
The data subject has the right, in certain circumstances, to request that the processing of their personal data be restricted. This right applies, for example, in a situation where the data subject disputes the accuracy of their personal data or the lawfulness of the processing. In such cases, processing is restricted while the accuracy of the data or the lawfulness of the processing is being verified.
The data subject has the right to request the erasure of personal data concerning them. This right applies only if the personal data is no longer necessary for the purposes for which it was collected, there is no other legal basis for the processing, and there is no legal obligation to retain the data. The data therefore cannot be erased whilst there is a legal basis for retaining it.
If the processing of personal data is based solely on the data subject’s consent, the data subject has the right to withdraw their consent at any time. The data subject also has the right to object to the processing of their personal data if the processing is based on the controller’s legitimate interests.
The data subject also has the right to lodge a complaint with the Data Protection Ombudsman (https://tietosuoja.fi/ilmoitus-tietosuojavaltuutetulle) if they consider that the data controller is not fulfilling its obligations as a data controller or is otherwise failing to comply with applicable data protection legislation.
For any enquiries regarding the processing of personal data or the rights of data subjects, please contact us by email at tietosuoja@retta.fi. To protect personal data and to ensure that the request has been made by the correct person, we ask the data subject to verify their identity before the request is processed. This privacy notice was last updated on 10 November 2026.