Privacy Policy

Votto Group Oy

3174206-6

otto@votto.fi

3.1.2026

Cookies

 What is a cookie and what is it used for?

A cookie is a small text file that your browser stores on your computer, tablet or smartphone. The cookie is not a program and does not contain malware or viruses.

Some cookies are necessary for the functioning of the website. Cookies also give us information about why you visit our site. We use this information to optimise the site to better meet your needs and interests. Cookies remember things like your previous visits to the site, the language and currency you use on the site. Cookies allow you to see our advertisements targeted to you on other sites.

The tools that store cookies and the purposes for which cookies are used are explained under the different categories of cookies.

How long are cookies stored for?

The validity period of cookies stored on devices and browsers varies. The expiry date of a cookie is calculated from the last time you visited the site. When a cookie expires, it is automatically deleted. The expiry dates for all our cookies are set out in our Cookie Policy.

Blocking or deleting cookies

You can block all cookies and/or third-party cookies at any time by changing the browser settings on your computer, tablet or smartphone. The location of these settings depends on the browser you are using. However, please remember that if you block all cookies and/or third-party cookies, you will not be able to use all the functions and services of the site (as they are based on cookies).

Statistical cookies

Google Analytics

Purpose: The company uses an analytics tool to analyse the number of users and their behaviour on websites. The tool is used to track events relevant to our business, such as page loads and length of visit.

Shelf life: session - 2 years  More information: https://support.google.com/analytics/answer/11397207?hl=en

MANAGING THE REGISTER

Votto Group Oy's customer register (hereinafter "Customer Register").

CRITERIA FOR THE PROCESSING AND RECORDING OF PERSONAL DATA

General information

To the extent that the Customer Register contains personal data, its processing complies with the Data Protection Act and other applicable laws, regulations, orders and official instructions concerning the processing of personal data. Personal information refers to information that can be combined to a specific person. This document describes in more detail the procedures for the collection, processing and disclosure of personal data and the rights of the customer concerning it.

Purpose of collection and processing of personal data:

Contractual, customer or similar relationship

The purpose of the customer register is for the registrar to:

• a contractual or customer relationship with the other party to the transaction (e.g., tenant or lessor)

• the relationship related to fulfilling the service with other parties of the transaction (e.g., a member of the tenant’s family)

• a relationship based on a marketing authorization granted by the customer, the purpose of which is, inter alia, multi-channel marketing communications to the customer, for example by e-mail, online, telemarketing or mail

The Registrar may also collect information from other persons present in the apartment it manages in order to prevent, monitor and investigate crime or misconduct, or by other means to identify potential customer interests or to establish a subsequent customer relationship / provide and market services of the registrar.

The persons described above are referred to in this document as a “Customer”.

Statutory control of money laundering

Pursuant to Chapter 3, Section 3 of the Act on the Prevention of Money Laundering and Terrorist Financing (444/2017, hereinafter “the Money Laundering Act”), customer information and other personal data in accordance with the law are stored, stored and used and for the purpose of investigating the offense for which the benefit of money laundering or terrorist financing have been obtained. Customer identification or other personal information obtained solely for the purpose of preventing and disclosing money laundering and terrorist financing shall not be used for a purpose incompatible with those purposes.

Data storage based on consent

To the extent that the right to register customer information described above is exceeded or there is no other legal basis mentioned, the Customer will be asked separately for consent to the storage, processing and storage of personal data. The customer may also be specifically asked for consent to analyze the information provided and customer behavior for marketing purposes.

Penalties for failure to obtain the mentioned information:

If the Registrar does not receive the above-mentioned information, the customer relationship may not be initiated or continued, or another agreement may be entered into or participate in legal proceedings with the Customer.

Purpose of the data collected

The information in the customer register is mainly used for the following purposes:

• customer relationship management and development

• production, provision, development and improvement of services

• invoicing, collection and verification of customer transactions

• targeting advertising

• analysis and statistics on services

• customer communication, marketing and advertising

• targeting marketing content based on information and behavior provided by the Customer

• protection and safeguarding the rights and / or property of the Registrar and other persons and entities involved in the production of the Registrar's services

• fulfilling the statutory obligations of the Registrar

• other similar uses

INFORMATION CONTAINED IN THE CUSTOMER REGISTER

Votto Group Oy processes information in its Reservation Management System, in the register information concerning the supervision of the Money Laundering Act and in the customer contact information listing.

These entities and their annexes may cover data belonging to the following categories:

• Basic customer information such as full name, address, language, date of birth

• the personal identification number of the person acting on his/her own behalf or on behalf of the company, and possibly the company business ID for reliable identification

• billing and collection information

• information related to the customer relationship and the contractual relationship, such as the services provided to the Customer, the date of their use, the date and time of purchase and acceptance of the services and other similar information

• authorization information and prohibitions, such as direct marketing authorizations and prohibitions

• information on Customer interests

• other transaction information concerning the services provided

• complaints and information on their handling

• tenant credit information and other financial information for assessing the ability to pay rent

• a copy of the Customer's ID

• other information provided by the Customer

• information on the Customer's operations, quality and scope of business, financial position, grounds for the use of the transaction or service and information on the origin of funds and other information referred to in section 4 (1) of the Money Laundering Act acquired to know the Customer

• Information related to the determination of the origin of funds pursuant to Section 4 (3) of the Money Laundering Act, and information necessary to fulfill the enhanced duty of knowledge related to a politically influential person pursuant to Section 13

• in the case of a foreign Customer who does not have a Finnish personal identity number, information on the Customer's citizenship and copy of the travel document

DATA RETENTION PERIOD

All information described above will be retained for ten (10) years from the end of the service / lease / customer relationship.

Data in accordance with the Money Laundering Act shall be retained for five (5) years, unless further retention of such data is necessary to safeguard a criminal investigation, a pending proceeding or the rights of the controller or its employee. The need for further retention of data and documents will then be examined no later than three (3) years after the previous review of the need for retention (Law on the Prevention of Money Laundering and Terrorist Financing, 444/2017, section 4).

Other personal data will be deleted when there is no longer a need to retain personal data. If the collection and storage of personal data has been based solely on the Customer's consent, the personal data will be deleted at the Customer's request.

REGULAR SOURCES OF INFORMATION

Personal data is collected from the data subject himself, among other things, when the data subject uses the data controller's services or plans to use them (for example, when booking an apartment or registering as a Registrar's customer). Personal information may also be collected directly from the registrant himself, for example through contact forms, e-mail inquiries, newsletter subscriptions, customer satisfaction surveys or raffles. Personal data can also be collected and updated from, for example, the population register and other authority registers as well as credit data registers.

DISCLOSURE OF INFORMATION

Access to all data relating to the data subject shall be limited to those persons to whom access to the data contained in the register is necessary for the maintaining purposes of processing the register or for the production of other tasks related to the services provided by the Registrar. The Registrar may disclose personal data to the extent permitted and binding by applicable law and for the purpose of implementing an agreement between the parties or establishing a material connection. Thus, personal data may be disclosed, for example, to the authorities, partners involved in the provision of the service and, in the event of a dispute, to legal assistants.

Data may also be transferred or given outside the European Union or the European Economic Area as permitted by law, provided that contractual arrangements guarantee an adequate level of data protection. Transfers outside the EU can also take place in connection with the use of various cloud services.

Information is provided to the authorities in cases required by law.

In connection with the outsourcing of the controller's information management, the processing of personal data may also take place by the controller's subcontractors, but in that case only on behalf of the controller. Such subcontractors may be, for example, the service providers of the registrar's reservation management system, as well as the parties maintaining the housing sales notification portals and the companies performing customer satisfaction measurements.

CUSTOMER RIGHTS

Checking, obtaining and transmitting data

The customer has the right to check what information about him is stored in the Customer Register. The customer must submit the request for verification to the data controller in a handwritten form in writing or in an equivalent certified document, or by e-mail.

By way of derogation from the above, the Customer is not entitled to inspect information obtained in order to fulfill the notification or reporting obligation provided for in the Money Laundering Act (Section 4: 3 of the Money Laundering Act). However, the Data Protection Officer may, at the Customer's request, verify the lawfulness of the processing of this information.

The Registrar shall provide the above information to the Customer within 30 days of the submission of the inspection request.

The customer has the right to have the customer data about him / her supplied to him / her transferred to a third party in a structured and commonly used machine-readable form. However, the controller will retain the transferred data in accordance with this privacy statement.

Correction of incorrect information

The customer has the right to correct the personal data stored in the personal register insofar as they are incorrect.

Opposing or restricting the processing of data and deleting data

The customer has the right to object to the processing of personal data for direct advertising, remote marketing and other direct marketing, market and opinion research and the development of the controller's business, and to restrict the processing of personal data already registered for that purpose.

Withdrawal of consent

If the information in the register is based on the consent given by the Customer, the consent may be revoked at any time by notifying the representative of the Registrar mentioned in this description. Upon request, all information that is not or cannot be retained pursuant to law or any other basis mentioned in this Privacy Statement will be deleted.

Procedure for the exercise of rights

An inspection, correction or other request may be made by contacting the controller with the contact details provided in this leaflet.

Disagreements

The Customer has the right to refer the matter to the Data Protection Officer if the Registrar does not comply with the Customer's request for rectification or other change.

PROFILING AND AUTOMATIC DECISION MAKING

The registrar does not perform profiling on the basis of personal data or use automatic decision-making.

© 2026 by Votto Group Oy

Privacy Policy

Contact