Privacy Policy

General

This privacy policy describes how Rentcal Oy ("Rentcal") processes personal data. This privacy policy applies to our websites, marketing and customer relationship management, as well as the end products and services offered by Rentcal ("Services").

In all processing of personal data, we comply with applicable data protection legislation, such as the EU General Data Protection Regulation (2016/679) ("GDPR") and other applicable national legislation.

Our Services and websites may also contain links to external websites and services operated by other organisations that we do not control. This privacy policy does not apply to their use, so we encourage you to review their privacy policies. We are not responsible for the privacy practices of other websites or external services (even if you access them via links on our pages). Rentcal may also act as a technical administrator for a service produced for its customer, in which case that customer acts as the controller of the service.

"Personal data" means any information relating to a natural person ("data subject") from which that person can be directly or indirectly identified, as more specifically defined in the GDPR.

Controller

Rentcal Oy

Business ID: 3118447–1

Address: Lapinlahdenkatu 16, 00180 HELSINKI

Email: [email protected] or [email protected]

www: www.vuokrakulut.com or www.rentfol.io

Purposes and legal basis for processing personal data

The services provided by the controller ("Services") are available to both natural persons and legal entities and require registration for both. The Services are used in accordance with the terms and conditions applicable to the Services. When using the Services, a natural person may share their information at their own discretion with other natural persons or companies using the Service.

As the controller, we only process personal data that is necessary for each purpose of use. We process personal data in accordance with legislation mainly for the following purposes:

Customer service and communication
Providing, monitoring and developing services
Marketing, including market research, other marketing promotion and analytics, as well as producing statistics and measuring marketing effectiveness
Improving the user experience of our services and website and monitoring user traffic
Fulfilling statutory obligations (e.g. accounting and other special legislation) and fulfilling reporting obligations
Preventing misuse

The legal basis for processing personal data is mainly the performance of a contract between the data subject and Rentcal and Rentcal's legitimate interest. Our legitimate interests include, for example, the management and development of the Services, customer service and communication, marketing and monitoring the effectiveness of marketing measures. When we process personal data based on legitimate interest, we weigh the benefits and possible disadvantages of the processing for the data subject and have assessed that the rights and interests of data subjects do not override the legitimate interest.

If we process personal data to comply with legal requirements or to fulfil our reporting obligations, the legal basis for processing is primarily a legal obligation.

Personal data processed and data sources

Data category	Examples of data content and purpose of use
User identification and contact details	Customer name, phone number and email address provided, for example, when entering into a contract and/or registering for the Service. In addition, contact details of the registered Service Provider and information related to the property shared in the Service are collected. The user of the Service may share the above information in the service publicly and/or directly with another user.
Identification and contact details contained in the profile and other content created by the user	Information added to the Service by the user, such as property-related information, identification and contact details, comments, reviews and user ratings.
Marketing and event-related information and consents and objections given by the data subject	Information provided, for example, when registering for an event or collected from public sources.
Information concerning the use of services and websites	IP address, electronic communication identification data, search and browsing data, browser and operating system information, and registration data

We may also collect information from public sources, such as business information services and social media services such as Facebook, LinkedIn, Twitter and Instagram.

The user of the Service may, at their discretion, share the information they provide in the service either publicly or directly with another user.

Joint controllership with social media service providers

When we maintain business pages on social media for which Rentcal acts as administrator, the relevant social media service provider and Rentcal are joint controllers within the meaning of data protection legislation, to the extent applicable, with regard to the personal data of visitors to that social media service provider's page. The social media service provider and Rentcal are also joint controllers, to the extent applicable, with regard to the social media service provider's social plugins (such as Facebook's Share function, which can be used to share website content on social media).

The relevant social media service providers process personal data in accordance with their own privacy policies, which can be found on the websites of the relevant social media service provider. The relevant social media service provider is primarily responsible for complying with data protection legislation and implementing the rights of the data subject in its service. Rentcal is responsible for complying with data protection legislation on its part and processes visitor information from business pages in accordance with this Privacy Policy, for example for targeting advertising.

More information on the processing of personal data carried out by social media service providers and page administrators, as well as on the division of responsibility between joint controllers, can be found on the websites of social media service providers (for example, Facebook's controller addendum and here.)

You can manage the privacy settings of social media service providers on the websites of those service providers, and you can also contact the service providers if you wish to exercise your rights as a data subject. Contact details can be found in the privacy policies of these service providers.

Retention of personal data

We retain personal data for as long as necessary to fulfil the purposes defined in this privacy policy, but always for the period required by law (for example, obligations and duties related to accounting or reporting obligations), or for the purpose of resolving litigation or a similar dispute. After the purpose of use ends, personal data is deleted within a reasonable time or anonymised.

The necessity of retaining personal data, as well as the accuracy of the data, is checked regularly. We will provide additional information on personal data retention practices upon request.

Information related to the profile created by the user of the Service and other information content uploaded to the profile will remain in the Service until the data subject personally deletes the information.

Recipients of personal data

Personal data may be transferred to service providers and partners used by Rentcal, such as providers of technical solutions or server space, and accounting and financial administration service providers. We ensure through contractual arrangements that personal data is processed in accordance with applicable data protection legislation and otherwise appropriately. We will provide additional information on recipients upon request.

Personal data may be disclosed to third parties in situations required by law or an authority, or to investigate misuse of our Services and to ensure security. In addition, personal data may have to be disclosed in connection with litigation or similar legal proceedings.

If Rentcal is involved in a merger, business transfer or other corporate arrangement, personal data may be disclosed to the other parties to the arrangement or to parties assisting in the arrangement.

Transfer of personal data outside the EU/EEA

If personal data is transferred outside the EU/European Economic Area, we ensure an adequate level of protection for personal data, for example by agreeing on matters related to the processing of personal data as required by data protection legislation, such as by using standard contractual clauses approved by the European Commission.

With regard to the transfer of personal data related to the use of social media, the instructions of the relevant social media service providers are followed in accordance with their privacy policies.

Protection of personal data

We use appropriate technical and organisational safeguards to protect personal data. We also ensure the fault tolerance of our systems and the possibility of data recovery.

Access to personal data is restricted to separately authorised parties only. We ensure that our service providers meet the required information security requirements.

All parties processing personal data have a duty of confidentiality regarding matters related to the processing of personal data. Access to personal data is restricted to only those employees who need it to perform their duties.

Rights of data subjects

Data subjects have the following rights under the GDPR:

Right of access. The data subject has the right to obtain confirmation as to whether personal data concerning them is being processed and other information about the processing of personal data. The data subject has the right to access personal data and obtain a copy of the personal data.
Right to rectification and erasure. The data subject has the right to request the correction or deletion of incorrect or inaccurate information. The data subject also has the right to request the deletion of their personal data. If personal data is needed, for example, to fulfil a contractual obligation, comply with a legal obligation or resolve a legal dispute, a deletion request cannot always be fulfilled.
Right to restriction of processing. The data subject has the right to request the restriction of processing of personal data. In addition, in a situation where personal data suspected to be incorrect cannot be corrected or deleted or there is uncertainty about a deletion request, the company restricts access to personal data.
Right to data portability. The data subject has the right to request the transfer of personal data they have provided, which is processed automatically, to another controller, where processing is based on the data subject's consent or a contract.
Right to object to processing. The data subject has the right to object to certain types of processing of personal data, such as profiling based on legitimate interest. The data subject also has the right to object to the processing of their personal data for direct marketing.
Right to withdraw consent. If the processing of personal data is based on consent given by the data subject, the data subject has the right to withdraw their consent. Withdrawal of consent does not affect processing carried out before it. In addition, consent for electronic direct marketing can be withdrawn by following the instructions included in marketing communications (e.g. the unsubscribe function attached to an email or text message).

Exercising rights

The data subject may send a request by letter or email using the contact details provided in section 2. We may request additional information as necessary to fulfil the above requests.

Upon receiving your request, we will process all necessary information related to your request (including verifying identity). The request will be answered within a reasonable time and usually no later than one month from the submission of the request and verification of identity. If the request cannot be granted, refusal will be notified separately. We may refuse to process requests that are excessively repetitive, unreasonable or manifestly unfounded

Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with the competent data protection authority if the data subject considers that their personal data has been processed in violation of applicable legislation. You can find the contact details of the Finnish data protection authority here.

Changes to the privacy policy

This privacy policy may need to be changed from time to time. Changes may also be based on changes in data protection legislation. We therefore recommend checking the privacy policy regularly to detect changes. We will notify you separately of any material changes.