Processing of personal data in the Hoas Match service

Foundation for Student Housing in the Helsinki Region sr (later Hoas)
Business ID FI01165149
Pohjoinen Rautatiekatu 29, 00100 Helsinki
P.O. Box 799, 00101 Helsinki
Tel. +358 (0)9 5499 01

Contact person
Riitta Sorjonen, riitta.sorjonen[at]test.test.dev.hoas.fi

In Hoas Match, the purpose of processing personal data is to match two or more housing applicants to the same apartment in the Hoas housing application process by generating a common flatmate application code for the applicants.

The processing of personal data is based on the data subject’s consent or a legitimate interest of Hoas.

The personal data processed in the Hoas Match service: first name, last name, sex, profile picture, date of birth, spoken languages, information on pets, information on smoking, place and location of studies, current place of residence, email address, informal introduction of the person, wishes related to the apartment, personality and habits, wishes related to the flatmate, search machine criteria.

Personal data are collected directly from the data subject when they are using the service or from a third party (Facebook). The registration to the service occurs via Facebook, and in this context Facebook provides us with certain data you have entered in Facebook (your name and profile picture) and some technical information. In addition, data concerning the user are collected from the user themself as they use the service.

Hoas Match data is stored at Microsoft Azure in the EU area. Telecommunications to any databases containing personal data have been protected using encrypted connections and appropriate authentication. The databases and systems using them have been protected with technical and administrative means. In service reporting, the data has been pseudonymised. User data is accessible only by third party application development experts for development and maintenance of this particular service. Hoas staff does not have access to this data. Log data and metadata accumulating on the server is only used to investigate any technical problems and, by authorities, possible misconduct of the service.

No Hoas Match data is transferred to Hoas Applicant and tenant register except the flatmate code. Use of a personal data register of Hoas always requires login and password. User rights are defined role-specifically according to what is necessary at the time for the employee in question to fulfil their duties. The staff is trained to process data in accordance with good data security practices, and they have a duty to maintain confidentiality. Any third party organisations with the role of personal data processor are bound by bilateral confidentiality agreements.

No personal data from Hoas Match is released to third parties, nor are any personal data used for marketing purposes.

The personal data of a registered user is stored for one year after the last login. A data subject can, should they so wish, delete their own data immediately by logging in the service and deleting their user account.

A data subject can inspect their own personal data by logging in the service. The user may, for their own part, suspend the use of the service. The user may also, at any time, withdraw their consent for personal data processing and completely delete their own user account from the service. If the data is not updated and the service is not used for more than a year, the user’s account and all data therein are permanently deleted.

In certain situations, the data subject may also have the right to object to the processing of their personal data. The right to object is applicable in situations where the processing of personal data is based on Hoas’ legitimate interest, and Hoas is liable to abide by the data subject’s request unless they have compellingly legitimate grounds to override the interests, rights and freedoms of the data subject, or if the processing is necessary for the establishment, exercise or defence of legal claims. In addition, in some situations the data subject has the right to request Hoas to restrict the processing of their personal data.

The user has the right to access their personal data they had submitted to Hoas in a computerised form and the right to transfer the data to another data controller without restriction by Hoas.

The applicant or tenant has the right to lodge a complaint to a competent supervisory authority (The Data Protection Ombudsman, Ratapihantie 9, POB 800, 00521 Helsinki, Finland or tietosuoja@om.fi) or the supervisory authority of the EU member state where the data subject’s domicile or workplace is located, should they deem their personal data not having been processed in accordance to applicable data protection legislation.