Privacy Policy

Privacy Policy of Bureau Real Estate Finland Oy

Combined privacy policy and information document in accordance with the Personal Data Act and the European Union's General Data Protection Regulation (2016/679/EU).

1. Data Controller

Bureau Real Estate Finland Oy
Lars Sonckin kaari 10, 02600 Espoo
Business ID: 2341325-4

Representative of the data controller for data protection matters
Master of Laws, Licensed Real Estate Agent Kristian Danielson
Telephone: +358 (0)44 723 4702
Email: kristian.danielson@bref.fi

2. Name and contents of the register

Customer register of Bureau Real Estate Finland Ltd ("Customer Register").

3. Legal basis for processing personal data – why do we collect your information?

3.1 General information about the processing of personal data

To the extent that the Customer Register contains personal data, its processing complies with the Data Protection Act and other applicable laws, regulations, directives, and official guidelines in force at the time concerning personal data processing. Personal data refers to information that can be linked to a specific individual. This document details the procedures for collecting, processing, and disclosing personal data, as well as the rights of the customer, i.e. the data subject.

3.2 Purpose of Collecting Personal Data

a) Contractual, customer, or equivalent relationships

The purpose of the customer register is for the controller to:

  • Contractual or client relationship with the principal, such as the seller or landlord.
  • Relationship relating to the execution of the assignment with the counterparty of the principal, such as a buyer or tenant
  • contractual relationship with a user of an appraisal assignment or other expert service, such as a user of legal services
  • Other equivalent professional contact

The data controller may also collect information from, for example, individuals present during property viewings to prevent, monitor, and investigate crimes or misconduct, or by other means (such as email or telephone contact) to identify potential customer interests, establish future client relationships, and provide services.

In this document, the individuals mentioned in point a) are referred to as the “Client”.

b) Legislation concerning real estate brokerage

Legislation concerning real estate agencies, including the Act on Real Estate Agencies and Rental Apartment Brokerage (1075/2000) and the Act on Brokerage of Real Estate and Rental Apartments (1074/2000), and the execution of assignments based on them, along with the client's own searches, require the storage, use, and retention of the information referred to in section 4 below. The agency must, among other obligations, maintain an assignment logbook where personal, property, and transaction information related to each assignment, along with documents, is recorded ("Assignment Logbook").

c) Statutory monitoring of anti-money laundering

In accordance with Chapter 3, Section 3 of the Act on Preventing Money Laundering and Terrorist Financing (444/2017, hereinafter the “Money Laundering Act”), customer identification data and other legally required personal data are collected, stored and may be used to prevent, expose and investigate money laundering and terrorist financing, as well as to investigate money laundering, terrorist financing and related offences involving proceeds of crime or assets targeted by money laundering or terrorist financing. Customer identification data or other personal data obtained solely for preventing and exposing money laundering and terrorist financing shall not be used for purposes incompatible with these objectives.

d) Data retention based on consent

Insofar as the registration rights based on the aforementioned laws or circumstances are exceeded or such other legal basis does not exist, separate consent is requested from the Client for the storage, processing and retention of personal data. Assignment information is also used for contractual relationships related to appraisal and other expert services and is retained similarly in the Assignment Log.

3.3 Purpose of Data Use

Information held in the customer register may be used for the following primary purposes:

  • Managing and developing client relationships
  • Provision, offering and safeguarding of services
  • billing, debt collection and verification of customer transactions
  • advertising targeting
  • Analysis and statistics related to services
  • Customer communication, marketing and advertising
  • Protection and safeguarding of the rights and/or property of the controller related to services as well as other individuals and entities involved in the assignments.
  • Handling the statutory obligations of the brokerage firm
  • other similar intended uses

3.4 Consequences of failure to provide information

If the brokerage firm does not receive the information specified in clauses 3.2 a), b) and c), customer relationships cannot be initiated or continued, nor can agreements be made or legal transactions conducted with the Customer, or facilitated.

4. Personal Data Content – What Information Do We Collect?

The mandate register and its annexes address or may address the following categories of information:

  • Customer’s basic information, such as full name, address, and language
  • Personal identity code of the individual acting personally or on behalf of the company, and possibly company ID for reliable identification
  • Information related to invoicing and collections
  • Information related to the client relationship and contract, such as services offered to the client, date of service usage, offer, its acceptance, rental or sales agreement dates, property details, brokerage fees, vendor service details, and other comparable information.
  • Licensing information and prohibitions, such as direct marketing consents and opt-outs.
  • Interests and other information provided by the registrant themselves
  • Additional event information for services
  • Complaints and their handling details
  • Tenant’s credit information and other financial details for assessing rental payment capability

Funds laundering supervision registry data may contain or process the following customer-related information:

  • name, date of birth and personal identity code
  • representative's name, date of birth, and personal identity number
  • Complete name of the legal entity, registration number, registration date, and registration authority
  • Full names, birth dates and nationalities of the members of the legal entity’s board or corresponding decision-making body
  • Legal entity sector
  • Names, dates of birth, and personal identity numbers of ultimate beneficial owners
  • Name of the document used for identity verification, document number or other identification details, and issuer or a copy of the document; or, if the customer has been identified remotely, details of the verification procedure or sources used.
  • Information on the client’s operations, quality and scale of business, financial standing, reasons for conducting the transaction or using the service, details of the origin of funds, and other necessary information obtained for client identification as required by Section 4, subsection 1 of the Money Laundering Act.
  • Information related to the origin of funds pursuant to Section 4, subsection 3 of the Money Laundering Act and necessary data collected to fulfil enhanced due diligence obligations concerning politically exposed persons under Section 13.
  • For foreign clients without a Finnish personal identity number, details of the client's nationality and travel document information.

5. Collection of transactional data through cookies

Cookies are used on the website. A cookie is data stored on your device that records information about your visit to the site. Bureau uses cookies to improve website usability, gather statistical data regarding site usage, and may deliver targeted information to you. Cookies also store personalised data about which pages you have visited. This data includes the time of your visit, visited pages, browser type, the referring web address, and the server from which you accessed Bureau's pages.

If cookie settings are not accepted, no data regarding site usage, traffic, events, or other site-related statistics will be collected. By accepting cookies, you consent to Bureau collecting the above-mentioned data. Cookies may be necessary for the proper and intended functioning of some services.

Users of the online service may consent to or refuse the use of cookies in cookie settings. If cookie functions are disabled, it may be impossible to use all of Bureau's website services.

5.1 External services on the site that use cookies

The following external services utilising cookies have been linked to these pages:

Using Google Analytics, Meta Pixel, LinkedIn Insight Tag, and Hotjar, we monitor website traffic and usage patterns. These services record data such as the number of visitors and duration of visits to different pages. With HubSpot, we collect information on website usage and users. However, we cannot identify individual users based on the data collected. Google Tag Manager manages cookie settings on the site.

We use tracking provided by Easybook to understand how our website’s chat and conversion tools are used. The tracking focuses on chat interactions to help us develop the service and improve customer experience. No personally identifiable data is collected through tracking. Any personal data is based solely on information the user provides themselves, for example through the contact form or chat conversation. Tracking is implemented per browser and does not utilise third-party cookies. From a data protection perspective, we act as the data controller and Easybook as the data processor. For more information on data processing, please refer to Easybook's privacy policy: https://easybook.fi/tietosuojakaytanto.

5.2 Is profiling carried out based on my information?

Yes, provided the user consents to the cookie policy, the user's IP address is fully transmitted for tracking. A Google Analytics cookie identifying the user is set to remain valid for the default period of 2 years. The user's cookie information may be shared with selected advertising networks for targeted marketing purposes.

The cookies and other internet identifiers used on Bureau's online service enable the functionality and development of the web services, enhance security and user-friendliness, and facilitate targeted advertising.

6. Data Retention Period

Information from the assignment log is retained for ten (10) years after the assignment concludes.

Data pursuant to the Money Laundering Act is retained for five (5) years, unless further retention is necessary for criminal investigation, ongoing legal proceedings, or for protecting the rights of the obliged party or their employees. The necessity for continued retention of data and documents is reassessed no later than three (3) years after the previous review of retention necessity (Act on Preventing Money Laundering and Terrorist Financing, 444/2017, Section 4).

Other personal data will be deleted once it is no longer necessary to retain it. If the collection and retention of personal data was based solely on the Customer’s consent, the data will be deleted upon request.

7. Regular data sources – where is the information collected from?

Personal data is collected directly from the Client during the signing of agency agreements, purchase or lease offers, and in connection with related activities, fulfilment of due diligence obligations, and document preparation, as well as when using the controller’s services otherwise or directly from the Client, for example during property viewings or communications via email or telephone. Personal data may also be collected and updated from property management offices, the population register, other official registers, and credit information registers.

Consent-based information is collected directly from the Client or, with their permission, from registers or sources maintained by authorities or third parties.

8. Disclosure of information – to whom may data be provided?

The data controller may disclose personal data within the limits permitted and required by current legislation and for the fulfilment of agreements between the parties or legitimate contact. Personal data may be disclosed, for example, to regional administrative agencies and other authorities, to banks of parties involved in sales or rental transactions, to owners, management companies, property managers, estate agents, and the National Land Survey.

Data is not regularly transferred outside the European Union or European Economic Area. However, data may be transferred or disclosed outside the EU or EEA in compliance with the law, provided it is transferred to a country where the European Commission has determined an adequate level of data protection, or contractual arrangements ensure an adequate level of data protection. Transfers outside the EU may also temporarily occur when using various cloud services, such as OneDrive, iCloud, or Dropbox.

Information is disclosed to authorities in cases required by law.

The purchase price and additional details of the transaction are also disclosed to the Central Federation of Finnish Real Estate Agencies (KVKL) Association, where the information is stored in KVKL's price monitoring service (HSP) for real estate agents to the extent required by the service. Data from the HSP may be further disclosed to brokerage firms using the price monitoring service and other HSP clients. The privacy policy for this service can be read at: https://www.hintaseurantapalvelu.fi/tietosuoja.

During the outsourcing of the data controller's information management, personal data processing may also be carried out by the data controller's subcontractors, but only on behalf of the data controller. Such subcontractors may include providers of real estate brokerage systems and marketing systems, as well as entities maintaining residential sales listing portals.

9. Principles of Data Protection – How We Safeguard Your Personal Information

Access to the register requires a user ID granted by the Customer Register's main administrator. The administrator also determines the access level granted to other users. Only employees of the controller and subcontractor staff who need access for work-related tasks are permitted entry. Data is collected into service databases protected by firewalls, passwords, and other technical measures. Databases are housed in locked and guarded premises, with access limited to specifically designated personnel. Where personal data is processed by a subcontractor on behalf of the controller, agreements ensure appropriate safeguards and compliance with data protection laws.

10. Customer Rights – How Can I Ensure the Lawful Processing of Data?

10.1 Inspection, Access, and Transfer of Data

The customer has the right to inspect the information about them stored in the Customer Register. The customer must submit the inspection request to the controller in writing, either signed personally or in an equivalently verified document, or by email.

Contrary to the above, the Customer is not entitled to inspect information obtained for fulfilling the notification or inquiry obligations under the Anti-Money Laundering Act (Section 4:3). However, upon the Customer's request, the Data Protection Ombudsman may inspect the lawfulness of the processing of these data.

The data controller will provide the aforementioned information to the Customer within 30 days of receiving a verification request. The Customer has the right to have personal data they have submitted transferred to a third party in a structured, commonly used, and machine-readable format. The data controller will, however, retain the transferred data in accordance with this privacy statement.

10.2 Correction of Incorrect Information

Customers have the right to correct their personal data stored in the Customer Register insofar as such data is incorrect.

Section 10.3 Opposition to or restriction of data processing; data deletion

The client has the right to object to the processing of their personal data for direct marketing, distance selling, and other direct marketing purposes, as well as market and opinion research and the data controller’s business development, and to restrict the processing of their data. They also have the right to have their personal data stored for these purposes removed from the register, even if there is otherwise a lawful basis for processing the data.

10.4 Withdrawal of Consent

If the data in the register is based on the Customer's consent, such consent may be withdrawn at any time by notifying the representative of the data controller specified in section 1. Upon request, all information not required to be retained by law or other basis stated in this privacy policy will be deleted.

10.5 Procedure for exercising rights

Requests for inspection, correction or other inquiries can be made by contacting the data controller's customer service using the contact details listed in section 1.

10.6 Disputes

The client has the right to submit the matter to the Data Protection Ombudsman for processing if the data controller does not comply with the client’s rectification or other request.

11. Automated Decision Making

The data controller does not make automated decisions based on personal data.