Data controller contact information
The data controller is Veritas Pensions Insurance Company Ltd. (0141187-2). Our address is PO Box 133, (Lemminkäisenkatu 34), 20101 Turku
For what purpose and on what lawful grounds is Veritas processing your personal data?
Veritas conducts leasing operations as part of its investment activities. We process and store personal data for the purposes of managing contractual relationships concerning the leasing of commercial premises and residential flats or of carrying out measures prior to the signing of an agreement and of enacting obligations and rights related to property management and of fulfilling statutory duties.
We store and process the personal data of flat applicants and tenants as well as personal data related to property management. Information concerning you is processed in the following situations:
• For the establishment and maintenance of lease agreements for commercial premises or residential flats
• To ensure your ability to pay through the checking of credit records by virtue of the Credit Data Act (Luottotietolaki 527/2007)
• To implement property management
• To maintain and develop the relationships with commercial property customers (incl. marketing)
• For the purposes of customer identification in accordance with the Act on Preventing Money Laundering and Terrorist Financing and in accordance with other special legislation and regulation.
We do not process your personal data for any reason other than the aforementioned purposes.
This document is based on the requirements of the EU General Data Protection Regulation.
To whom can Veritas disclose your personal data?
Veritas does not disclose the personal data of its tenants for any reason other than those required by law.
Is your personal data transferred and processed outside the EU/EEA?
Your personal data will not be transferred to parties outside of the EU/EEA area.
For how long and on what grounds does Veritas store your personal data?
We store information concerning you for the purposes of managing the contractual relationships for leased commercial premises and/or residential flats. Veritas is obligated to store all data related to its contractual relationships for specific time periods, set in advance, as well as accounting data related to these contractual relationships for the time specified in accounting legislation. Information concerning you is only stored for the period of time that is determined as being necessary for the management of the contractual relationships for commercial premises and/or residential flats. At the end of the set time period, we shall remove any information concerning you from the data systems of Veritas Pension Insurance.
The set time periods are as follows:
- Information related to lease agreements and invoicing as part of property management: a minimum of 6 years from the end of the year in which the financial year has ended
- Tax information related to lease agreements and invoicing as part of property management: a minimum of 10 years from the end of the financial year
- Customer identification data is stored for 5 years beyond the end of the permanent customer relationship.
Are you entitled to obtain information about personal data concerning yourself?
You are entitled to get a confirmation about whether personal data concerning you is being processed by Veritas.
If we are processing your personal data, you are entitled to get a copy of this processed information.
Please submit your information request via the veritas.fi website. An information request requires strong authentication.
We will send the requested information to you no later than one month from the date on which we receive your request. This time limit can be extended to a maximum of two months in certain situations. If the time limit is extended, we will notify you thereof within one month after receiving your request.
How can you complete, correct or remove your personal data?
If the personal data that we send to you is deficient, incorrect or erroneous, you are entitled to request that your information be completed or corrected. This also concerns outdated information. We ask that you submit your completion or correction request to Veritas through our website.
You have the right to request that Veritas, as data controller, removes, for example, any outdated information concerning you.
Upon request, this information must be removed without delay as soon as there are no longer grounds for the processing of this information. The right in question is applicable to situations in which the personal data is no longer necessary in relation to the purpose for which the information was collected, or if you withdraw your consent for the processing of the information and there are no longer any legal grounds for such processing, and they are not required to be saved on any legal basis.
The right to require the removal or deletion of personal data, as intended by the data protection legislation, does not apply to situations in which continued storage of the information is required by law or necessary for the purpose of drafting, issuing or defending a legal claim. The information cannot, therefore, be removed during any period for which they must be stored for the aforementioned reasons.
However, your personal data will be removed, without any separate request, after the prescribed period of storage has ended.
Can you refuse or restrict the processing of your personal data?
As our activities involve the implementation of statutory pension security, we are obligated to process your personal data and, thus, you cannot refuse or restrict this processing, unless there are clear grounds for such restrictions.
You have the right to request that Veritas, as data controller, restricts the processing of personal data concerning you in certain situations. The restriction of processing refers to the marking of saved data for the purpose of restricting the processing of the data beyond a certain date.
Despite this, your information can still be stored. Before the restriction is lifted, you will be informed of the matter. You can exercise your right, for example, if you contest the accuracy of the data or the lawfulness of the processing. The processing is restricted for a period required to verify the accuracy of the personal data or the lawfulness of the processing. If the processing of the data has been restricted, the data can only be processed under certain conditions, such as with your consent or for the establishment of legal claims.
You also have the right to refuse direct marketing (including profiling) if your personal data is being processed for the purposes of direct marketing.
Can you demand the transfer of your personal data to another system?
If the automated processing of your personal data is based on your consent or a signed agreement with you, you have the right to receive any data concerning you, after which you can, if desired, transfer the data in question to another data controller. This concerns only personal data which you have yourself submitted to Veritas. We transfer all personal data in a commonly used electronic format.
Veritas does not transfer your personal data to other companies, with the exception of outsourced services, nor does Veritas accept personal data from external companies.
To whom can you lodge a complaint about the processing of your personal data?
In case we refuse to take measures as requested by you, we inform you without undue delay of the legally justifiable reason for our refusal no later than one month from the date on which we received your request.
If you have received a negative response to your request from Veritas, you can submit the matter for review to the Office of the Data Protection Ombudsman. The contact information to the Office of the Data Protection Ombudsman is provided in our response. You can appeal the decision of the Office of the Data Protection Ombudsman to the Administrative Court in accordance with the Administrative Judicial Procedure Act (Hallintolainkäyttölaki 586/1996). The decision of the Office of the Data Protection Ombudsman contains appeal instructions that guide you through the process of appeal to the Administrative Court.
Is your personal data used for making automated decisions or profiling?
No, it is not.
What personal data does Veritas process?
In order for us to manage the lease agreement relationship for commercial premises and residential flats, we process information about you that falls within the following categories of personal data:
- Personal data related to the lease agreement
- Basic information and information for identification and communication purposes
- Information related to the payment of rent and securities
- Information related to the rent security deposit, such as its payment
- Information related to property management
This information includes:
- Information about lease agreements, the term of the lease, rent, possible separate compensations, e.g., for electricity and water, information about rent adjustments and information about the rental premises/flat
- Basic information and information for identification and communication purposes, such as name, personal ID number, mailing address, postal code, phone number, e-mail address
- Information related to the payment of rent and rent security deposits, i.e., payment history
- Other information related to the identification of the customer, including the owners or actual beneficiaries of a legal entity, the full names, birth dates and nationalities of the members of the board or a similar body of a legal entity, as well as information concerning the representation rights of the leaseholder’s representative
From where does Veritas obtain the personal data that is necessary for handling your matter?
Lease application form
- General customer databases
- Trade register
The aforementioned parties are bound by obligations for confidentiality. They are permitted to disclose to Veritas only such personal data that is necessary for the handling of your matter and only in accordance with the provisions on confidentiality.
What type of security measures does Veritas use to protect your personal data?
We always process your personal data carefully and in a manner that protects your privacy. This is ensured through the use of the necessary technical and administrative measures.
Through access rights management, we ensure that your personal data is only accessed and processed by persons who have the authority to do so.
Our personnel are bound by the statutory obligation of confidentiality and every employee has signed a separate confidentiality agreement. Our personnel are trained and instructed on the processing of personal data and the prevention of related risks. Through internal supervision, we ensure that our personnel comply with the principles for processing personal data.
The same provisions relating to secrecy and confidentiality agreements also apply to our subcontracting partners.
With the help of access control and different security systems, your information is safely stored in protected data centers and Veritas’ own premises. We also utilise separate technical data security solutions to ensure that the reliability, integrity, usability/accessibility and fault tolerance of your personal information meets the criteria specified in the data protection legislation.
Where can you get more information about the processing of your personal data?
If you would like further information about the processing of your personal data at Veritas, please read the ‘Data protection’ section on our website at veritas.fi.
With regard to personal data requests, please contact us primarily through our website at veritas.fi.
You can also contact Veritas by phone, mail or via a protected e-mail service.
Do you have the right to withdraw your consent at any time?
If your personal data is being processed on the basis of your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the legitimacy of any processing carried out on the basis of the consent prior to its withdrawal.