Privacy Notice for Residential Leasing and Services of the Colliers Finland Group
1. Data Controller
Colliers Finland Group Oy
Business ID 2396296-6
Firdonkatu 2 T 173
00520 Helsinki
2. Contact Information for Register Matters
Hille Amnell
Firdonkatu 2 T 173, 00520 Helsinki
hille.amnell@colliers.com
Tel. +358 44 723 8719
3. Service and Colliers' Role
This privacy notice describes the processing of personal data in Colliers' residential leasing operations, concerning apartment applicants, co-applicants, tenants, and users of Colliers' digital resident portal and resident application.
Colliers engages in residential leasing as well as management and rental administration services on behalf of its clients – the apartment owners. Colliers operates in two different roles in the processing of personal data:
- Regarding the processing of rental applications, Colliers acts as the Data Controller. In this capacity, Colliers itself determines the purposes and means of personal data processing, and the data subject may direct data protection requests directly to Colliers at the contact information specified in Section 2. Colliers also acts as the Data Controller with respect to the processing of personal data necessary for fulfilling obligations under the Anti-Money Laundering Act.
- After the conclusion of the lease agreement, the processing of personal data related to property management and rental administration takes place on behalf of the apartment owner (Data Controller), in which case Colliers acts as a Data Processor. The Data Controller in such cases is the landlord or the property company. In this regard, Colliers will forward any data protection requests and inquiries from data subjects to the relevant Data Controller.
The practices described in this privacy notice apply to all processing of personal data carried out in Colliers' residential leasing operations.
4. Name of the Register
Residential Leasing and Services Register
5. Legal Basis for the Processing of Personal Data
The processing of personal data by Colliers Finland Group Oy and companies belonging to the same group (hereinafter “Colliers”) is based on the legitimate interest of Colliers or the data subject, a contract between Colliers and the data subject, consent given by the data subject, or compliance with a legal obligation. Legal obligations include, among others, customer due diligence obligations under the Act on Preventing Money Laundering and Terrorist Financing (444/2017, hereinafter the “Anti-Money Laundering Act”).
Colliers’ legitimate interest encompasses the customer relationship between Colliers and the data subject or Colliers’ business interests, such as customer satisfaction, quality control of services, and development of services. Colliers’ legitimate interest may also relate to risk assessment and management as well as the protection of rights and property. The processing of data is based on Colliers’ legitimate interest in order to provide rental apartment leasing services to apartment owners and rental apartment applicants. When the processing of personal data is based on legitimate interest, the benefits and potential adverse effects on the data subject are assessed. Colliers has assessed that the rights and interests of data subjects do not override Colliers’ legitimate interest. Colliers will provide further information on the processing of personal data based on legitimate interest upon request.
The processing of personal data is based on the fact that the data subject has applied for a rental apartment through Colliers, resides in an apartment leased by Colliers or in an apartment owned by a Colliers client for which Colliers provides apartment leasing and services, has previously resided in an apartment leased by Colliers, uses Colliers’ digital resident portal, has requested information about available/upcoming apartments, or has subscribed to the newsletter.
Customer communications during the tenancy, such as information related to housing and the lease relationship, are based on the contractual relationship between Colliers and the data subject as well as Colliers' legitimate interest.
Colliers processes personal data for electronic direct marketing based on Colliers’ legitimate interest and pursuant to Section 200(3) of the Act on Electronic Communications Services. Where electronic direct marketing is not based on Colliers’ legitimate interest, personal data is processed only if the data subject has given consent to electronic direct marketing.
Services offered by Colliers’ external cooperation partners, such as cleaning services, may also be marketed through the resident application. The processing of personal data for such marketing is based on the data subject’s separate consent. Consent may be withdrawn at any time.
6. Purposes of the Processing of Personal Data
Colliers processes personal data of data subjects to the extent necessary in residential leasing and brokerage activities as well as property management. Providing personal data on the apartment application form is a prerequisite for the establishment of a contractual and/or customer relationship. Without the necessary personal data, Colliers cannot provide the leasing service.
Colliers uses the data subject's personal data for, among others, the following purposes:
• tenant selection
• use, maintenance, and development of Colliers' digital resident portal and resident application (online service and mobile application for residents), including resident services offered through the application, communications, fault reports, bookings, rent payment, and marketing of services offered by Colliers’ cooperation partners with the resident’s consent
• preparation of lease agreements
• establishment of the lease relationship and conducting checks under the Anti-Money Laundering Act: When an apartment is leased to the data subject, personal data is required for concluding and maintaining the lease agreement as well as for conducting checks required by anti-money laundering legislation
• management and development of the customer relationship
• customer service quality and development: conducting resident satisfaction surveys during the tenancy
• attending to the rights and obligations of the landlord
• maintenance of rental apartments and lease agreement management: personal data is processed in connection with the maintenance of rental apartments, handling of fault reports, management of lease agreements, and inspections and warranty inspections carried out in connection with moving
• rental administration and other payment transactions: the customer's personal data is required for the invoicing and collection of rents, utility charges, and other invoices, as well as related services
• marketing and communications, including customer communications and sending marketing messages by email through the LianaMailer service (Liana Technologies Oy) during the tenancy
• customer service and communications, for example messages sent through the Colliers Asunnot website chat are stored by Colliers to respond to inquiries and requests concerning the rental apartment applicant's application
• training and security purposes: stored emails, phone calls, and chat conversations may be used for, among others, employee training, ensuring personal safety, and preventing or investigating situations that threaten safety or property
• administration, provision, and development of business and services
• risk management and information security: personal data is processed in risk assessment, protection of the rights and property of Colliers and its clients, and implementation of physical security and information security
• ensuring security and legal protection
Some of the purposes listed above relate to management and rental administration during the tenancy, in which case Colliers primarily acts as a Data Processor on behalf of the apartment owner as described in Section 3.
7. Personal Data Processed
The register may contain data on rental apartment applicants, tenants, users of Colliers' digital resident portal, as well as their spouses, co-payers, other persons moving in, and subtenants and re-tenants. The register contains the following personal data:
Basic Information
• first and last name of the person
• personal identity code or, in the absence of a personal identity code, proof of right of residence, for EU citizens a registration certificate, and where necessary a copy of a travel document for the purpose of verifying nationality
• telephone number
• email address
• address
• bank account details for refunds or compensations
• preferred language of communication
Customer Due Diligence Information
• Customer due diligence information required by anti-money laundering legislation, such as information necessary for identifying the customer and determining their financial position and political exposure. Information on whether the person is subject to sanctions.
Customer and Contract Information
• Data identifying and classifying the customer relationship, such as the application number. Information on contracts between the Data Controller and the data subject, such as the contract start date, security deposit details, and information for the execution of rent payments.
Information Concerning the Apartment Applicant and Tenant Selection
• application type (new application/apartment exchange)
• type and other details of the apartment sought (e.g. location, building type, and housing need)
• previous address and information on current housing
• employment, occupation, duration of employment, and income and asset information
• tax information, debt and debt restructuring information
• residence permit information
• credit and payment behaviour information
• population register information
• the person's corporate connections
• other information submitted by the customer, such as health information, marital status, and gender
• if the rental apartment applicant is under 18 years of age, the register additionally contains the following information about their guardian: guardian's first and last name, personal identity code or date of birth, contact details, and a note on credit information
Customer Transaction Data
• Tasks and events related to the management of the customer relationship.
Recordings and Message Content
• Messages in various formats in which the data subject is a party, such as email messages, call recordings, complaints, or other communications.
Technical Identification Data
• An identifier assigned by a device or application, by means of which the user of the device or application can be identified using additional information as necessary, or electronic identification data.
Behavioural Data
• Monitoring of the data subject's use of services and online behaviour, for example by means of cookies.
Information Related to the Resident Portal and Housing
• lease agreement information, invoicing, payment, and debt collection transaction data
• fault reports and their processing
• monitoring of apartment-specific consumption and energy data
• measures related to the maintenance and repair of the apartment
• key management and electronic locking system
• resident information for the housing company's digital stairwell displays, if the property has a digital stairwell display
• parking space, sauna, and laundry bookings
• door opening services
• communications regarding apartment or property repairs and other communications related to the lease relationship
• delivery of rent payment receipts
• measures related to the collection of rent receivables and customer invoicing
• handling of housing disturbances
• rent payment information
Information Related to the Use of the Resident Application
• application and online service usage data, such as login information and usage history
• AI Co-Pilot chatbot conversation history and interaction data
• order and contract information related to resident services (Avy Marketplace) and related consents
Information Related to Applications for State-Subsidised Rental Apartments
The processing of personal data is primarily based on the regulations governing tenant selection for state-subsidised rental apartments and the related official guidelines. Where the apartment applied for/to be leased is a state-subsidised property, Colliers requests, among others, the following information:
• basic information of the state-subsidised rental apartment applicant, such as name, contact details, nationality, and personal identity code
• information related to the application for a state-subsidised rental apartment, such as apartments applied for and application history, employment situation, credit information, housing need, and information on current housing
• attachments to the apartment application, such as proof of income/salary statement, other proof of livelihood, or a pre-completed tax return
• lease relationship information, information on co-movers
• with the data subject's own consent, a pregnancy certificate and estimated due date
8. Regular Sources of Data
Colliers obtains register data from the data subject's apartment application form and its attachments. In addition, data is obtained, for example, in connection with the conclusion of the lease agreement, when the data subject logs into or uses Colliers' digital resident portal, and through the data subject's phone calls or email messages. Information on the guardian of a rental apartment applicant under 18 years of age is obtained from the applicant or the guardian themselves. Personal data may also be collected and updated from co-residents, maintenance companies, the credit register of Suomen Asiakastieto Oy, corporate contact information and population register data, and from authorities such as the Digital and Population Data Services Agency, the enforcement authority, and Kela.
Personal data may also be collected and updated from other personal data registers, cooperation partners, and authorities and companies providing personal data services to the extent required by the Anti-Money Laundering Act or other legislation.
9. Disclosures and Transfers of Data
As a rule, Colliers does not disclose the personal data it has collected and observes a duty of confidentiality with respect to personal data, unless otherwise required by legislation or the establishment, exercise, or defence of legal claims. Personal data may be disclosed to companies belonging to the same group as Colliers Finland Group Oy for purposes that are not inconsistent with the purposes of personal data processing described in this notice.
The provision of the leasing service requires that data may be disclosed to the landlord. Data of the rental apartment applicant and any co-applicant must be disclosed to the landlord, for example, for the purpose of making the leasing decision or in connection with the conclusion of the lease agreement. During the management and rental administration phase, Colliers acts as a Data Processor on behalf of the apartment owner. A description of each apartment owner's personal data processing activities can be obtained from the relevant Data Controller.
Data may be disclosed to the builder and locksmith for the purpose of arranging the customer's moving preparations or carrying out maintenance measures in the apartments.
In debt collection situations, data is disclosed to the debt collection agency. Data may also be disclosed to authorities as required by legislation, such as to the authority supervising brokerage activities, the centre for state-subsidised housing construction, or the Tax Administration.
Colliers uses an external service provider, Visma Sirius Oy, for the collection and management of personal data. The service provider processes personal data only to the extent necessary for the maintenance and troubleshooting of the service system.
Colliers uses the LianaMailer service of Liana Technologies Oy for sending customer communications and marketing messages. LianaMailer is a Software as a Service solution in which Liana Technologies Oy handles the technical implementation and maintenance, and Colliers is responsible for content production and use of the service. Liana Technologies Oy processes personal data on behalf of Colliers as a Data Processor only to the extent required for sending the messages.
In addition, Colliers uses the service of Suomen Asiakastieto Oy for checking the credit information, corporate connections, and population register data of rental apartment applicants, in which Suomen Asiakastieto Oy acts as a Data Processor on behalf of Colliers.
Colliers uses the service of Zendesk Inc. as its customer service ticketing system. Chat conversations on the Colliers Asunnot website, information submitted through the contact form, and fault report form data are directed to the Zendesk ticketing system. Zendesk Inc. acts as a Data Processor on behalf of Colliers and processes the customer's name, contact details, telephone number, email address, and address.
Colliers uses Avy AB (business ID 559163-3259, Sweden) for the provision of the resident application, and Avy AB acts as a Data Processor on behalf of Colliers. Avy AB uses the following sub-processors in the provision of the service: Tink (payment processing, EU), SendInBlue (communications, EU), Google Cloud Platform (cloud service and data storage, EU), and Microsoft Azure / OpenAI (AI functions, such as Co-Pilot, EU). All sub-processors of Avy AB process personal data within the EU/EEA. In connection with resident services offered through the resident application (Avy Marketplace), the resident's personal data may, with the resident's consent, be transferred to the service partners participating in the application at any given time, such as providers of insurance, electricity contracts, broadband services, and cleaning services, as well as other partners offering housing-related services, for the purpose of providing the service. Avy AB has the right to add and remove service partners from the application.
10. Transfer of Data Outside the EU or EEA
As a rule, personal data is not transferred outside the EU or EEA, with the exception of limited transfers to the United Kingdom. The transfer to the United Kingdom is based on the adequacy decision issued by the European Commission pursuant to Article 45 of the GDPR, as in force from time to time. With respect to Zendesk Inc., personal data may be transferred to the United States; the transfer is based on the EU-U.S. Data Privacy Framework and/or the European Commission's standard contractual clauses.
Subcontractors may be used in the processing of data, and data may be transferred outside the EU/EEA. When data is transferred outside the EU/EEA, the transfer is carried out using the European Commission's standard contractual clauses or another transfer mechanism permitted by legislation.
11. Principles of Register Protection and Retention Periods
Colliers complies with EU and national data protection legislation in the protection of the register and the supervision of its use. Data is stored in Colliers' information systems, which employ both technical and programmatic measures to ensure information security and to monitor the use of data. Access rights to the register data are restricted to specifically designated persons to the extent required by their duties. All persons using the register data are bound by a duty of confidentiality. Colliers ensures the implementation of data protection through data processing agreements concluded with its subcontractors that process personal data.
Colliers retains personal data only for as long as necessary for the purposes defined above, possible legal proceedings, and requirements set by legislation.
Apartment applications that have not resulted in an offer or agreement are retained for a maximum of five (5) years. In accordance with the Real Estate Brokerage Act, information and documents related to a brokerage assignment are retained for five years after the termination of the assignment. After the retention periods specified in legislation and other guidelines, Colliers retains personal data for as long as necessary for invoicing, debt collection, and possible legal proceedings, however for a maximum of 10 years.
Customer due diligence information under the Anti-Money Laundering Act is retained for a minimum of five (5) years from the termination of the customer relationship in accordance with Chapter 3, Section 3 of the Anti-Money Laundering Act.
Customer feedback and complaints are retained for as long as necessary for the processing of the feedback or complaint or for possible legal proceedings.
Call recordings, email correspondence, and other dialogue are retained for a maximum of ten (10) years from the termination of the lease relationship or, if no lease relationship has been established, for a maximum of five (5) years from the date of recording.
In the service of Suomen Asiakastieto Oy, the applicant's credit inquiries, enrichments, and decision proposals are stored in encrypted form for a maximum of twelve (12) months. In addition, inquiry data is stored in a reporting database, where it is pseudonymised within one month of storage and fully anonymised when the cases are 60–72 months old.
Personal data of data subjects is retained for as long as the data subject resides in a rental apartment owned by a Colliers client. If the service agreement between Colliers and the apartment owner is terminated, all personal data concerning the data subject will be deleted, unless Colliers has another statutory or contractual basis for retaining the data.
12. Automated Decision-Making and Profiling
Colliers uses automated decision-making and profiling as part of the self-service leasing on the Colliers Asunnot website (Rent Now service). In addition, the resident application features an AI Co-Pilot function that utilises artificial intelligence to answer residents' questions and provide service guidance. The AI Co-Pilot does not make legally or otherwise significant automated decisions concerning residents. The use of the Rent Now service requires the rental apartment applicant to undergo strong authentication using online banking credentials or a mobile certificate. If the apartment is rented together with another person, strong authentication is also required from the co-applicant. Through authentication, we obtain the applicant's name, personal identity code, and nationality. The leasing decision is made based on the applicant's authentication data, credit information, age, and possible international sanctions. The applicant must be registered in the Finnish Population Information System.
When a rental apartment applicant uses the Rent Now service, Colliers checks, as part of the automated decision-making, the applicant's credit information, corporate connections, and population register data through the service of Suomen Asiakastieto Oy, as well as any international sanctions targeting the applicant and any prior tenancy history if the applicant has previously resided in an apartment leased from Colliers. The service of Suomen Asiakastieto Oy generates an automated decision proposal based on the inquiries, enrichments, and conditions selected by Colliers, based on which Colliers can better manage the risks associated with leasing operations. Users authorised by Colliers also have the right to make manual credit decisions. Possible credit information defaults, international sanctions, and problems in tenancy history may prevent the leasing of an apartment through the Rent Now service.
Leasing an apartment through the Rent Now service is not possible if the apartment applicant has moved to Finland less than three (3) months ago or if the apartment applicant is under 18 years of age. In such cases, the applicant may submit a standard apartment application.
If the apartment is rented together with another person, Colliers checks the information of both rental apartment applicants. A lease agreement through the Rent Now service may be concluded jointly for a maximum of two persons. In the Rent Now service, the prerequisite for concluding a lease agreement is that neither applicant has any of the above-mentioned impediments to leasing an apartment.
The data subject has the right to contest a decision based solely on automated processing and to submit additional clarification. The data subject may also request a manual decision-making procedure instead of an automated one. Inquiries and requests concerning automated decision-making may be submitted by the data subject to the email address: asiakaspalvelu@colliers.com.
13. Rights of the Data Subject
Right to access personal data
The data subject has the right to obtain confirmation as to whether Colliers processes personal data concerning them. If personal data is processed, the data subject has the right to access the personal data stored in the personal data register concerning them and to receive a copy of the personal data being processed. However, the data subject's right to obtain personal data may be restricted or refused under the EU General Data Protection Regulation if the disclosure of personal data would adversely affect the rights or freedoms of others. Such protectable rights include, for example, Colliers' trade secrets and the personal data of another person. The right may also be restricted on grounds provided for in national law.
When data is requested, Colliers has the right to ask the data subject to specify in sufficient detail which personal data or processing activities the request concerns.
Right to request rectification, restriction, erasure, and portability of personal data
The data subject has the right to request the rectification of their data if the personal data is inaccurate, incorrect, incomplete, or outdated.
In certain situations, the data subject has the right to restrict the processing of their personal data. Such a right exists, for example, in a situation where the data subject contests the accuracy of the personal data or the lawfulness of the processing. In such cases, the processing of data is restricted until Colliers has verified the accuracy of the data or the lawfulness of the processing.
The data subject has the right to request the erasure of personal data if there is no longer a justified reason for the processing of the data. Notwithstanding such a request, Colliers is, however, obliged to retain personal data for as long as the processing of data is necessary for compliance with legislation or for possible legal proceedings.
Where the data subject's personal data is processed on the basis of consent or a contractual relationship, the data subject has the right to receive such personal data concerning them that they have provided to Colliers in a structured, commonly used, and machine-readable format, and the right to transmit such data to another Data Controller.
Right to withdraw consent
Where the processing of personal data is based solely on the data subject's consent, the data subject has the right to withdraw their consent at any time.
Right to prohibit direct marketing
The data subject has the right at any time to prohibit the use of their personal data for direct marketing purposes. If the data subject prohibits the use of personal data for direct marketing, the data may no longer be processed for that purpose.
Right to object to the processing of personal data in certain cases
The data subject has the right to object to the processing of their data when personal data is processed based on legitimate interest. The data subject does not have the right to object to the processing of their personal data when the processing is based on a contract between Colliers and the data subject.
Right to lodge a complaint with a supervisory authority
The data subject has the right to lodge a complaint with the competent supervisory authority if the data subject considers that their personal data has not been processed in accordance with applicable data protection legislation. The website of the Finnish Data Protection Ombudsman can be found at: https://tietosuoja.fi
Exercising rights in a processor situation
To the extent that Colliers acts as a Data Processor on behalf of the apartment owner during the management and rental administration phase as described in Section 3, the data subject should direct their requests and inquiries concerning the processing of personal data directly to the relevant Data Controller, i.e. the landlord or the property company. In such situations, Colliers will forward the requests it receives to the relevant Data Controller.
14. Requests Related to the Rights of the Data Subject
For questions related to the processing of personal data and matters related to the exercise of their rights, the data subject may contact the Colliers contact person referred to in Section two (2).
If the data subject requests multiple copies, the Data Controller may charge a reasonable fee based on administrative costs. The Data Controller may also charge a reasonable fee for fulfilling the request if the data subject's request is manifestly unfounded or excessive. Alternatively, the Data Controller may refuse the request.
15. Changes to This Privacy Notice
Colliers may update this privacy notice as its business develops or legislation changes. This privacy notice was last updated on 1 September 2026.