Privacy Policy

Updated 28 May 2025

The previous privacy policy is available via the attached link.

1. Introduction

For Toivo Group Oyj ("we"; "Toivo"), processing personal data is essential to our operations. We follow practices and processes that protect personal data in accordance with the requirements of data protection legislation.

This privacy policy sets out the basis for data collection and how the collected data is used. The principles and practices set out in this privacy policy apply to all our operations involving the processing of personal data. Examples of application scenarios include informing and marketing new developments to target groups, or processing personal data related to rental management. This privacy policy also applies to the processing of personal data of our employees and job applicants, as well as the personnel of other Toivo partners.

The data controller is Toivo Oyj and/or the group company with which you are dealing. This privacy policy is shared across the group.

2. Purposes and legal basis of processing

Purposes of processing personal data

Toivo collects and processes personal data in order to:

Market, target, inform and communicate Toivo's or selected third parties' services, products and developments to potential customers, such as individuals interested in various Toivo developments, and to current customers, such as tenants, through newsletters, marketing campaigns or event invitations, for example. This also includes communicating about additional services related to various rental properties, sending customer satisfaction surveys and any related prize draws.
Manage Toivo's services, products and various developments. This also includes evaluating and processing enquiries and applications related to developments received by Toivo. In order to enter into a tenancy agreement and plan debt collection, Toivo checks the applicant's personal credit information.
Toivo can fulfil its contractual obligations towards customers, partners and, for example, employees. This means, for example, complying with obligations arising from a partnership agreement, employment contract or tenancy agreement.
Toivo can develop services and products and improve the user experience of services and products.
Toivo can prevent, block and investigate possible misuse.

Legal basis for processing personal data

Toivo has a legitimate interest in marketing, maintaining and developing its business. Toivo markets, informs and communicates its services, products and developments to potential customers and customers on the basis of legitimate interest. Toivo also has a legitimate interest in preventing, blocking and investigating possible misuse.

When managing services, products and various developments, Toivo processes personal data on the basis of an existing contractual relationship or a statutory obligation. If Toivo does not have a contract, Toivo processes data for this purpose on the basis of legitimate interest or to fulfil a statutory obligation.

Checking personal credit information is based on the Credit Information Act, either for the purpose of planning debt collection or entering into a tenancy agreement.

In fulfilling its contractual obligations, Toivo processes personal data on the basis of the contract.

In addition, Toivo processes personal data to fulfil its obligations arising from legislation, such as accounting and tax legislation.

The processing of personal data may also be based on consent. The processing of personal data is described separately in connection with each consent, such as consent for direct marketing or cookies, in accordance with data protection legislation, so that the individual knows what they are consenting to.

3. From whom do we collect personal data and what data do we collect?

We collect personal data from individuals in marketing target groups, potential customers, customers, residents, contract contact persons, employees and job applicants.

The personal data we collect and otherwise process can be divided into the personal data groups listed below, with examples of the personal data included in each. The example lists are not exhaustive, as the data content processed depends on, among other things, the nature of the customer relationship or other relationship and the developments, products and services held by the customer or resident:

A) Information you provide to Toivo

Basic information, such as name, personal identity code, date of birth, contact details; and
Information related to statutory requirements and taxation, which legislation requires us to collect;
Contract and product information;
Transaction information, such as communication regarding the customer relationship or other cooperation and responses to customer satisfaction surveys;
Background information, such as nationality, occupation, employment information and preferences for rental property;
Financial information, such as personal credit information, salary information, information on debts and assets, and payments made, invoices and debt collection information;
Information on consents and prohibitions, i.e. information on consents and prohibitions given by the data subject, for example, for direct marketing or other communication based on consent or legitimate interest.

B) Technical data observed and derived from the use of services:

Toivo observes and derives data using cookies and similar technologies. These technologies collect information about the pages browsed by the user, the model of the device used for browsing, the unique device identifier, IP address and session. Toivo uses cookies for the following purposes:

Necessary cookies: these session cookies or functional cookies are necessary for the website to function properly. For example, these cookies ensure that the information you enter in forms can actually be sent. Session cookies are checked by default.
Analytical cookies: these cookies help us understand how you use the website. For this purpose, we collect data that we analyse. We use this data to further improve our websites and services.
Marketing cookies: These cookies allow us to tailor advertisements and information to your interests. Marketing cookies are also used to interact with social media.

Most browsers have a Help menu that provides more detailed information about the cookies used by the site and how cookie use can be managed.

C) Data collected from other sources

We collect personal data from publicly available sources, such as registers maintained by authorities (e.g. population register, Tax Administration registers) and from commercial data intermediaries, such as personal credit information from credit information providers.

4. Automated decision-making and profiling

Automated decision-making is based solely on automated processing, such as profiling, and has legal effects concerning you or similarly affects you significantly. We do not use automated decision-making or profiling in our processing of personal data.

5. How long is user data retained?

Toivo retains users' personal data only for as long as it is needed to provide the service or for the maximum period permitted by law. Data retention periods may vary depending on the purpose of processing, the nature of the personal data and the requirements applicable to their processing. We delete or anonymise data at the end of their retention period.

6. With whom may we share your data?

Group companies

We may transfer personal data to companies within our group. In such cases, processing on behalf of another group company takes place on the basis of a processing agreement.

Service providers

We transfer personal data only to the extent that third parties need access to the personal data we process on the basis of a processing agreement in order to provide services to Toivo for the purposes defined in this privacy policy. Such third parties include, for example, our partners that we use to provide our IT services.

Corporate arrangements

Personal data may be transferred or disclosed in connection with corporate arrangements.

For legal reasons

Your personal data may be disclosed in accordance with the requirements of a competent authority and the conditions based on law.

7. International data transfers

Toivo aims to implement services and process personal data using operators and services located in the EU or EEA area.

However, in some cases, services may also be implemented using operators, services and servers located elsewhere. In such cases, your personal data may be transferred between different countries. Such transfers may include transfers of personal data outside the EU or EEA area to countries whose legislation on the processing of personal data differs from the requirements of Finnish law. In such cases, Toivo ensures an adequate level of protection of personal data, for example by agreeing on this with the data processor.

8. Data protection

Data security is ensured by appropriate administrative, technical and physical safeguards.

9. Third-party services

This privacy policy applies only to Toivo's services and sites, and we are not responsible for the privacy practices of other sites. We recommend that users check the privacy policies of the sites they use.

10. Changes to the privacy policy

Toivo may change this privacy policy. If there are changes to the privacy policy, we will always notify you of these changes in this privacy policy.

11. Your rights

Right of access

You have the right to check what data concerning you is being processed.

Right to request rectification of data

You have the right to request the correction or completion of incorrect, inaccurate, incomplete, outdated or unnecessary data.

Right to request erasure of data

You may request that we delete your personal data from our systems. We will carry out the actions in accordance with your request, unless we have a legitimate reason not to delete the data.

Right to restrict the processing of data

Subject to separately specified conditions, you have the right to have us restrict the processing of your personal data.

Right to object to the processing of data

In addition, you have the right to object to the processing of your personal data for direct marketing purposes and otherwise to the extent that the processing is based on the pursuit of our or a third party's legitimate interests, unless we have a justified reason to retain the data.

Right to data portability

You have the right to receive your personal data from us in a structured and commonly used format so that you can transmit the data to another data controller.

Right to withdraw consent

If the processing of your data is based on consent, you have the right to withdraw your consent at any time.

12. Exercising your rights

You can exercise your rights by contacting:

info@toivo.fi or vuokraus@toivo.fi.

Indicate in your contact which of the rights mentioned in section 11 your request concerns. We may request additional information that is necessary to verify your identity. We may reject requests that are repeated unreasonably often, are excessive or are unfounded.

If you feel that the processing of your personal data is in conflict with applicable legislation, you may contact the Data Protection Ombudsman: https://tietosuoja.fi/etusivu.