Privacy policies

1. PROCESSING OF PERSONAL DATA
   
   1.1 The purpose of data protection is to safeguard the privacy and personal integrity of individuals when their personal data is being processed. Aalto University Student Union (“AYY”) complies in all its activities with the legislation in force concerning the processing of personal data. We are committed to protecting your privacy and will act in accordance with your expectations in all processing of personal data. Protecting your trust and acting responsibly are of utmost importance to us.
   
   1.2 All information you provide to us will remain confidential. It is important to us that all our members, employees, and partners receive transparent information about how we use their personal data. In this privacy policy, we explain how your personal data is collected and processed, to whom we disclose your data, how long we store it, and what your rights are in relation to your personal data. By personal data, we mean information that can be linked to you directly or indirectly.
   
   1.3 This privacy policy explains how personal data is processed in connection with the student union’s housing activities.
   
   
2. PURPOSE AND BASIS OF PROCESSING
   
   2.1 The purpose of AYY’s housing activities is to provide student housing for AYY members. The prerequisite for establishing a contractual relationship and maintaining a tenancy agreement is obtaining the necessary information from housing applicants and residents.
   
   2.2 The purpose of processing personal data is to rent apartments and parking spaces, provide housing advice and resident services, manage and develop related activities, maintain and develop customer relationships, manage lease agreements, and ensure that the rights and obligations of the landlord are fulfilled.
   
   2.3 Some of our properties also have CCTV surveillance. We use this information to ensure safety and legal protection on properties owned by AYY and in their immediate vicinity. We use the information for clarifying criminal incidents and accidents and for ensuring public safety. We inform about camera surveillance with signs in the premises and areas where cameras are located.
   
   2.4 The basis for processing personal data in housing activities varies case by case: for example, the processing of data relating to a person in a tenancy relationship is based on the contractual relationship between AYY’s housing activities and the data subject, whereas camera surveillance on properties is based on AYY’s legitimate interest.
   
   2.5 You have the right to refuse to disclose your personal data to us. However, we cannot guarantee that we will be able to provide all of our services to you if you prohibit us from using your personal data.
   
   
3. DATA SUBJECTS AND CATEGORIES OF PERSONAL DATA
   
   3.1 The data subjects are apartment seekers, current residents, and their potential guardians and co-applicants. In addition, the data subjects include any other persons paying security deposits or rent other than those mentioned above, as well as the personal data of any guardians necessary for the purposes of processing.
   
   3.2 As a rule, data is collected from the data subject themselves, with the exception of credit information, which we obtain from a credit registry maintained by a third party.
   
   3.3 The personal data collected includes:
   (a) Basic information, such as name, personal identity number, contact details and gender;
   (b) Information about the right to study, such as the place of study;
   (c) Information about people living in the same household, such as the number of persons, any spouses or cohabiting partners and children;
   (d) Income, wealth and credit information;
   (e) Information related to the tenancy, such as lease agreement details, rent payment details, and security deposit details;
   (f) Communication related to customer relationship and housing applications, such as AYY’s communications, complaints and feedback.
   
   3.4 As a rule, we do not process special categories of personal data (e.g. health data). In some cases, however, such data may be processed in accordance with Finnish law. However, if we process special categories of personal data, we will always inform you of this separately.
   
   
4. GROUPS OF RECIPIENTS OF PERSONAL DATA
   
   4.1 We may disclose residents’ information to Kela, social services, debt collection agencies, educational institutions, telecommunications operators, parking garage operators, and partners and municipalities in accordance with property management and maintenance agreements.
   
   4.2 We use the DOMO system for housing searches and to help organise the selection of residents. Information about housing applicants and residents may be disclosed to system administrators in order to ensure the smooth operation of the system and to resolve any problems that may arise.
   
   
5. DATA PROTECTION
   
   5.1 Register data is not stored in any form other than electronic. When transferred over the network, data is protected using SSL or SSH technology. The server hardware of the register is maintained in accordance with good maintenance practices. Access to the database containing the registration data is restricted by means of network technology and personal identification codes. The rights to maintain the register are restricted to administrators responsible for the student union’s systems.
   
   
6. PRINCIPLES OF PERSONAL DATA PROCESSING
   We comply with the following general principles for the processing of personal data in our operations:
   
   6.1 Lawfulness, fairness and transparency
   All processing of personal data carried out by AYY is always based on a legal basis that guarantees the legality of the processing. The collection or processing of your personal data is always linked to a specific legal basis, and the collection and processing of data is always carried out for a specific, pre-determined and limited purpose.
   
   6.2 Purpose limitation, data minimisation and storage restriction
   We only collect and process personal data that is necessary for the operations of our student union and for providing effective customer service.
   
   We only collect and process your personal data that is necessary for a specific purpose. The type and scope of personal data collected is always considered on a case-by-case basis and limited to the information necessary for the purpose of use. Your personal data will only be stored in an identifiable form for as long as there is a need to process it in this form. Data retention periods are mainly based on existing legislation.
   
   6.3 Accuracy
   We keep your personal data accurate and up to date. Inaccurate or incorrect information will be deleted or corrected using reasonable measures. 
   
   6.4 Integrity and confidentiality
   Your personal data will always be treated confidentially. This is ensured by appropriate organisational and technical measures to prevent unauthorised and unlawful processing of data. These measures also ensure that personal data is not accidentally lost, altered or destroyed. 
   
   
7. TRANSFER OF PERSONAL DATA OUTSIDE THE EU/EEA
   
   7.1 DOMO system data may be transferred outside the EU and EEA. We maintain the necessary safeguards and implement additional measures to protect personal data to the extent required by applicable law. Data transfers are based on the appropriate safeguards provided for in Article 46 of the General Data Protection Regulation 2016/679, using the Commission’s standard clauses.
   
   7.2 No data other than that contained in the DOMO system will be transferred outside the EU or EEA.
   
   
8. DATA SUBJECT’S RIGHTS
   8.1 You can exercise your rights listed below by sending an email to tietosuojavastaava@ayy.fi. Each data subject has the right to check their data stored in the register and request that any incorrect data be corrected or supplemented. If a person wishes to check the information stored about them or request that it be corrected, the request must be sent in writing to the data controller. If necessary, the data controller may ask the data subject to prove their identity. As a rule, the data controller responds to the request within one month. If you feel that our processing is not lawful, you can contact the Data Protection Ombudsman.
   
   (a) Checking the data. The data subject has the right to check their data. We disclose the data subject’s data upon request.
   (b) Correction of data. At your request, we will correct any inaccurate personal data and supplement your data.
   (c) Right to object to processing. You have the right to object to the processing of your personal data when it is based on the legitimate interests of AYY or a third party, if your personal situation overrides such legitimate interests. We may refuse your request if the processing is necessary to fulfil mandatory and legal rights. You can object to the processing of your personal data for direct marketing purposes and related profiling at any time.
   (d) Deletion of data. We delete personal data at your request if there are no valid reasons for continuing the processing, e.g. if you withdraw your consent.
   (e) Transfer of data. We will disclose your personal data obtained on the basis of your consent or the performance of the agreement to you or a third party in a commonly used and machine-readable format.
   (f) Restriction of processing. In certain situations, you may request that the processing of your personal data be restricted, for example, while the accuracy of your personal data is being verified.
   (g) Withdrawal of consent. You can withdraw your consent to the processing of personal data at any time.
   
   
9. DELETION OF DATA
   
   9.1 AYY complies with the principle of data minimisation under data protection legislation, according to which the storage period for personal data must be kept as short as possible.
   
   9.2 The periods for which residents’ personal data is stored are based on the Act on the Collection of Receivables and the Act on the Amendment of the Act on the Collection of Receivables, as well as the Accounting Act.
   
   9.3 Other data will be deleted within one year of the purpose of use ceasing to apply.
   
   
10. CONTACT AND AMENDMENTS TO THIS PRIVACY POLICY
    
    10.1 We are happy to answer any questions you may have about this additional privacy policy. The data controller’s contact person for this privacy policy is Annika Ojelma, who can be contacted by email at tietosuojavastaava@ayy.fi.
    
    10.2 This privacy policy may be updated from time to time, for example, in the event of changes in legislation. This privacy policy was last updated on 16 May 2025.