Last updated on 10 November 2026

Contact for data protection matters: tietosuoja@kontuoy.fi.

Kontu
Head office: Läkkisepäntie 23, 00620 HELSINKI

This privacy notice applies to the companies listed below, which operate under the Kontu name. Each company is listed with its business ID and company name.

3486995-1, Kontu Group Oy
2174751-7, Kontu Isännöinti Oy
2661964-5, Kontu Tekniikka Oy
0174381-8, Jyväskylän Kiinteistöpalvelu Oy
3013760-6, Kontu Oy Pohjois-Savo

The contact details for each company can be found on our website at https://kontuoy.fi/ota-yhteytta/. Each of the Kontu companies listed above acts as an independent data controller for the personal data it processes for the purposes described in this privacy notice. In this privacy notice, each of these companies is referred to as “Kontu”.

In this privacy notice, we describe the processing we carry out as a data controller. However, when we process personal data for the purposes of providing property management services and related ancillary services, such as financial management services and customer service for the residents of our client housing associations, we act in the capacity of a data processor. In such cases, the data controller is the housing association client with which we have entered into a contract for property management and other services. If you are a resident or shareholder of a housing association and would like further information on how your housing association processes your personal data, please contact the data controller, i.e. the housing association in question. In most cases, you will find your housing association’s privacy notice on Kontu’s online service portal.

We provide our housing association clients with property management services and related ancillary services, such as financial management services and customer service aimed at the residents of our client housing associations.

We act as the data controller for the personal data that representatives of our customers or potential customers, including visitors to our website at https://kontuoy.fi/, newsletter subscribers and participants in events we organise, share with us or that we collect automatically when they use our website or in other contexts, such as through enquiries made to our customer service. We may share this personal data amongst our group companies for the purposes described in this privacy notice, such as customer relationship management, sales and marketing, and internal group administration and reporting, to the extent that this is necessary and in accordance with applicable data protection legislation. The legal basis for this processing is our legitimate interest (Article 6(1)(f) of the GDPR) in managing the Group’s business operations in a unified manner. Further information on the sharing of data can be found under ‘How your personal data is shared’.

As the data controller, we are ultimately responsible for the processing of personal data that we carry out. Trust is a key element of privacy and data protection, and protecting your privacy and personal data is of paramount importance to us. We therefore collect your personal data only to the extent that we need it to provide you with a first-class customer experience. In all our processing of personal data, we comply with applicable data protection legislation, including the European Union’s General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the supplementary national Data Protection Act (1050/2018), as well as, where applicable, the Act on Electronic Communications Services (917/2014).

Our website is located at https://kontuoy.fi/. Please note that our website contains links to third-party websites or content provided by third parties, and some of the media through which you may interact with us, such as social media channels, are services provided by third parties. Such links to third-party websites or content, as well as our presence on services provided by third parties, do not imply that we are affiliated with these third parties or that we have any control over them, and, consequently, to the extent permitted by applicable law, we are not liable for such content or services, their level of data protection, or the actions of such third parties in relation to their processing of personal data.

Why we process personal data

We process your personal data only for the purposes described in this privacy notice or for other purposes notified to you at the time your personal data is collected, and only to the extent necessary for the purposes described in more detail in each context.

We process personal data primarily for purposes that enable our customers to use our services and ensure a first-class customer experience. Accordingly, we process personal data in particular for the following purposes, based on the following legal grounds:

• Customer relationship management, such as the conclusion, performance and any subsequent amendment of the contract between us and the housing association you represent; the management and development of the customer relationship; and communications relating to the customer relationship, such as the provision of customer service, sending newsletters and other content relating to the customer relationship and our services, as well as responding to your requests and enquiries via various channels. The legal basis for this processing is our legitimate interest (Article 6(1)(f) of the GDPR) in conducting our business, the property management agreement we have entered into with the housing association you represent, and your relationship with that housing association.
• Invoicing and other management of invoices and payments, based on our legitimate interest (Article 6(1)(f) of the GDPR) in conducting our business, the property management agreement we have entered into with the housing association you represent, and your relationship with that housing association.
• Events organising, such as various seminars or training sessions, where the basis for processing is our legitimate interest (Article 6(1)(f) of the GDPR) in processing personal data for purposes related to organising the event. If, in this context, you provide us with data falling within special categories of personal data, such as information regarding allergies or special dietary requirements, from which information relating to your health may be inferred, the legal basis for processing is your explicit consent (Article 9(2)(a) of the GDPR).
• Marketing to our existing or potential customers, for example to provide up-to-date information about our services or other current matters which we believe may be of interest to the recipient. The legal basis for processing for marketing purposes is our legitimate interests (Article 6(1)(f) of the GDPR), in particular our right to promote the sale of our services and raise awareness of them and our company. The basis for processing personal data may also be your consent (Article 6(1)(a) of the GDPR), for example if you have subscribed to our newsletter or if the marketing is based on data collected via cookies on our websites and you have given your consent to the use of marketing cookies.
  • If you have accepted marketing cookies on our websites, we may process your personal data to provide you with relevant marketing content on social media platforms, via email or on websites, based on your preferences. This type of processing is known as profiling and is intended to deliver personalised marketing. We may also combine the information collected through profiling with other information we have gathered based on the customer relationship between us and the organisation you represent. If you would like further information on the use of cookies on our website, please refer to the cookie tool on our website, which you can access by clicking on the circular icon in the bottom left-hand corner of the page. You can also find further information on the use of cookies in our cookie notice at https://kontuoy.fi/evastekaytanto/.
• Sales: Promoting the sale of our services, either on our own initiative or at the initiative of a potential customer’s representative, based on our legitimate interest (Article 6(1)(f) of the GDPR) in furthering our business. We also market additional services to our existing housing association clients by contacting their representatives, again based on our legitimate interest (Article 6(1)(f) of the GDPR) in promoting our business.
• Compliance with obligations under applicable legislation, such as tax-related obligations and responding to requests from public authorities based, for example, on tax legislation, accounting legislation, anti-money laundering legislation or the Housing Companies Act, or other mandatory legislation. In such cases, the legal basis for processing is the relevant provision of the applicable law (Article 6(1)(c) of the GDPR). The Act on the Prevention of Money Laundering and Terrorist Financing (444/2017) requires the identification of customers and the verification of information concerning their beneficial owners, decision-makers and contact persons. This information is used to prevent, detect and investigate money laundering and terrorist financing.
• Ensuring compliance with the agreement and monitoring for misconduct: Ensuring and monitoring compliance with the agreement between us and the organisation you represent, as well as investigating suspected misconduct, where the basis for processing is our legitimate interest (Article 6(1)(f) of the GDPR) in conducting our business and protecting our legitimate interests in connection therewith.
• Enabling the use of our website: When you visit our website, we process your personal data to enable you to use our website and its features, and to ensure the website’s security, functionality and stability, which means we may process personal data, for example, to detect potential misuse and attacks that compromise the security of our website. The legal basis for this processing is our legitimate interest (Article 6(1)(f) of the GDPR) in the purposes described above. The collection and further processing of your personal data on our website generally takes place using automated technical means, such as cookies and similar technologies. If you would like further information on the use of cookies on our website, please refer to the additional information available on our website via the cookie tool, which you can access by clicking on the circular icon in the bottom left-hand corner of our website. You can also find further information on the use of cookies in our cookie notice at https://kontuoy.fi/evastekaytanto/.
• Other legitimate interests relating to our business: We may also process your personal data for certain other legitimate interests relating to our business, such as developing and improving our services and website; ensuring and improving data security or the security of our premises and IT networks; protecting our property; preventing misuse or investigating suspected misuse; or other similar legitimate purposes. In such cases, the processing is based on our legitimate interest (Article 6(1)(f) of the GDPR) in these business-related purposes.
• Customer feedback surveys: We send customer feedback surveys, such as customer satisfaction surveys (e.g. NPS surveys), to our customers’ representatives with the aim of measuring the quality of our services and developing them in line with our customers’ wishes. The legal basis for this processing is our legitimate interest (Article 6(1)(f) of the GDPR) in developing our services and ensuring a first-class customer experience.

The processing of personal data as described in this privacy notice is, for certain purposes, based on the contract between us and the housing association you represent concerning the provision of property management services. In these circumstances, failure to provide personal data may prevent us from fulfilling our contractual or other obligations or commitments to the housing association you represent, which may result in the termination of the customer relationship.

Use of AI tools and applications 

We use AI-powered tools and applications to support the delivery and improvement of our services and to help manage communications with you. We use these tools only for the purposes explained in this privacy notice and where we have an appropriate lawful basis for processing your personal data. 

Our AI service providers. Where our AI service providers process personal data on our behalf, they are required to act on our instructions and comply with applicable data protection laws. They are not permitted to use your personal data to train their open AI models. 

Location and transfers. Personal data processed through the AI tools is generally stored in the European Economic Area (EEA). Where personal data is transferred outside the EEA, we rely on approved safeguards such as the European Commission’s standard contractual clauses.

Human oversight. We do not use AI to make decisions about you that produce legal or similarly significant effects without human involvement. AI supports our work, but people remain responsible for decisions that affect you. If this changes, we will only carry out such solely automated decision-making where permitted by applicable data protection law. We will also inform you of your rights, including the right to request human intervention, express your views, and challenge the decision.

Sensitive personal data. Please provide only the personal data necessary for us to deal with your enquiry or request. Avoid including sensitive personal data, such as health details, about yourself or others unless it is necessary for the matter you are asking us to handle. 

If you provide this information, it may be processed by the AI services we use to support our handling of communications. We will process it only to the extent necessary to handle the relevant matter.

Interacting with AI. Whenever you are interacting directly with an AI feature in our systems or applications, we will clearly inform you that you are communicating with AI. 

What personal data do we process

Customer relationship management	Basic details (first name and surname of the housing association client’s representative, position within the housing association, name of the housing association); contact details (email address, telephone number, address), communication-related details.
Invoicing	Basic details (first name and surname of the housing association client’s representative, position within the housing association, name of the housing association); contact details (email address, telephone number, address).
Event organisation	Basic details (participant’s first name and surname, role within the housing association, name of the housing association); contact details (email address, telephone number), information regarding participation, any details of allergies or special dietary requirements.
Marketing	Representatives of our existing housing association customers: Basic details (first name and surname of the housing association client’s representative, role within the housing association, name of the housing association); contact details (email address, telephone number, address), any marketing opt-out, communication-related information. Newsletter subscribers: email address.
Sales	Basic details (first name and surname of the housing association client’s representative, position within the housing association, name of the housing association); contact details (email address, telephone number, address), communication-related details.
Compliance with obligations under applicable legislation	Basic details (first name and surname of the housing association client’s representative, position within the housing association, name of the housing association); contact details (email address, telephone number, address), communication-related details. To fulfil obligations under the Money Laundering Act, information is also collected on the client company’s beneficial owners, decision-makers and contact persons, such as name, personal identification number or date of birth, nationality, information on politically exposed person (PEP) status and information on inclusion on sanctions or freezing lists.
Ensuring compliance with the agreement and monitoring for misconduct	Basic details (first name and surname of the housing association client’s representative, position within the housing association, name of the housing association); contact details (email address, telephone number, address), billing details, board portal profile details, communication details, or only some of these.
Enabling the use of our website	Please see the information on the use of cookies in the cookie tool on our website, which you can open by clicking on the circular icon at the bottom left of our website. You can also find further information on the use of cookies in our cookie notice at https://kontuoy.fi/evastekaytanto/.
Other legitimate interests relating to our business	Basic details (first name and surname of the housing association client’s representative, position within the housing association, name of the housing association); contact details (email address, telephone number, address), billing details, board portal profile details, communication details, or only some of these.
Surveys	Basic information (first name and surname of the respondent, role within the housing association, name of the housing association); contact details (email address); feedback and rating provided in the survey (e.g. NPS score and any comments).

How we collect personal data

We generally collect your personal data directly from you, for example when you contact us by telephone or email, when you visit our website, when you fill in contact forms, when you meet our representatives at arranged meetings, at events we organise or in other contexts, or when you provide us with documents.

In some cases, we receive your personal data from other representatives of the housing association you represent: for example, when there is a change in the housing association’s board members, the previous board or the board’s contact person may provide us with the details of the new board members or the board’s contact person.

In some situations, for example where the contact details of the housing association’s board contact person have become out of date and we do not have any new contact details, we may also obtain information from public sources, such as Suomen Asiakastieto Oy or the housing association’s own website.

The customer identification data required under the Money Laundering Act is collected directly from you via the DOKS service (Suomen Tunnistetieto Oy).

When you visit our website, we use cookies and other similar technologies to collect personal data. If you would like to find out more about the use of cookies on our websites, please refer to the further information on the use of cookies available on our websites at https://kontuoy.fi/evastekaytanto/. You can also find further information on the use of cookies in the cookie tool on our website, which you can open by clicking on the circular icon at the bottom left of our website.

How your personal data is shared

We may transfer personal data to third parties as described below.

When we transfer personal data to a service provider or other party that processes personal data on our behalf, i.e. data processors, we have ensured, through contractual arrangements and other means, that these service providers or other parties process personal data in accordance with our instructions and solely for the purposes set out in this privacy notice. The processing carried out by data processors includes, for example, the provision of information systems and other IT and software services.

We may disclose personal data to the extent permitted or required by applicable laws, for example to public authorities, external advisers or other third parties, as specified below:

• Our partners, service providers and our group companies: We may share personal data with our partners and service providers, or between our group companies, provided that this is lawful and necessary for our business operations and in accordance with applicable data protection legislation. Personal data may be shared between our group companies to the extent necessary for developing the business or fulfilling statutory obligations. Within our group, personal data is shared in particular for purposes relating to customer relationship management, customer service, sales, marketing, financial administration and reporting, and with Ador Vakuutuspalvelut Oy in addition to the above in order to comply with obligations under anti-money laundering legislation. The legal basis for processing related to the management and development of the business is our legitimate interest in managing the group’s business operations in a uniform manner. The legal basis for processing related to compliance with anti-money laundering obligations by Ador Vakuutuspalvelut Oy is a legal obligation. If a partner is involved in the provision of the service under the property management agreement between us and the housing association you represent, we will provide them with the information required to provide the service, typically consisting mainly of the contact details of the designated contact person. We may also disclose personal data to advertising partners for marketing purposes, to enable targeted online advertising and marketing. We may also disclose personal data, for example, to a debt collection agency for debt collection purposes or to other service providers or partners, but only to the extent that the performance of their tasks requires the processing of the disclosed personal data.

Kontu uses the DOKS service (Suomen Tunnistetieto Oy) to assist in fulfilling its identification and reporting obligations under the Money Laundering Act; DOKS acts as a data processor (sub-processor) on Kontu’s behalf.

• Authorities: The police and other authorities may request access to personal data from us. In such cases, we will only disclose the data if there is a statutory obligation, a court order or a similar compelling obligation to do so. We may also disclose personal data if such disclosure is necessary to assert or defend against legal claims, whether in court proceedings or administrative proceedings.
• Corporate transactions: If we are involved in a merger, business sale or other corporate transaction, we will disclose personal data to the purchaser once the transaction has been finalised. We may also disclose limited amounts of personal data to prospective purchasers and their representatives in connection with the preparation of the transaction, in accordance with applicable legislation.
• Social media channels: If you post a message, comment or take other similar actions on our social media channels in forums that allow public posts, anyone with access to such forums may read and use this information, and we are not responsible for the information you post on such forums or for what third parties do with your information.

Personal data is primarily stored within the EU or the EEA. Some of our service providers to whom we transfer personal data are located outside the European Union or the European Economic Area, or may store personal data there; consequently, we may also transfer personal data outside the EU or EEA where necessary. In such cases, we ensure an adequate level of data protection for the personal data we transfer and, where necessary, apply additional safeguards to ensure the protection of personal data. The legal basis for the transfer of personal data is usually the standard contractual clauses approved by the European Commission, which you can view on the EU’s legal information service here: https://eur-lex.europa.eu/legal-content/FI/TXT/HTML/?uri=CELEX:32021D0914. If you would like more detailed information about the transfer of your personal data outside the EU or the EEA and the applicable safeguards, please contact us using the contact details provided earlier in this privacy notice.

How long we retain personal data

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, in accordance with applicable legislation. Once we no longer require the personal data, we will delete it from our systems or anonymise it irreversibly.

The retention period for the personal data of representatives of our housing association clients is ultimately linked to the duration of the client relationship between us and the housing association you represent, after which the personal data will be deleted in accordance with our retention policies. However, we may continue to retain personal data even after the retention period we have defined has expired, to the extent that the data is necessary, for example, to protect our rights.

The general minimum retention period for the personal data of representatives of our housing association clients is two calendar years from the expiry of the property management agreement concluded with the client. If a client’s contact person changes, we will delete the previous contact person’s data from our information systems within a reasonable period of time following the change of contact person. However, personal data may also be retained for longer than this if such retention is justified by a relevant connection between us and the data subject or by the data subject’s consent, for example for marketing purposes, and the individual has not objected to the processing or withdrawn their consent.

The contract documents themselves, which may also contain personal data, are retained for at least 10 years from the end of the calendar year in which the contract ended. The above also applies to all correspondence that forms part of the contract or clarifies its content. Furthermore, personal data recorded in documents considered to be part of the accounting records, such as invoices, are retained for at least 10 years from the end of the calendar year in which the financial year ended.

Customer relationship management	The general minimum retention period for the personal data of representatives of our housing association clients is two calendar years from the end of the contract concluded with the client. The contract documents themselves, which may also contain personal data, are retained for at least 10 years from the end of the calendar year in which the contract ended.
Invoicing	The retention period for invoices and the corresponding billing customer data in our billing system and in our invoice archive is six years, after which the data is deleted in accordance with our archiving process.
Organising events	Personal data collected and stored at events, including details of participants, leads or potential customers, will be deleted no later than 24 months after the event.
Marketing	Personal data stored for marketing purposes will be deleted no later than 24 months after the last recorded activity.
Sales	Once a contract has been concluded, personal data will be deleted from the sales information systems, and customer relationship data, including the customer’s contact details, will be transferred to customer relationship management, at which point the aforementioned retention periods for customer relationship management will apply. If contact between the sales department and the data subject does not immediately lead to the conclusion of a contract, the data subject’s personal data will be retained for 12 months in the sales information systems for the purpose of any future contact.
Compliance with obligations under applicable legislation	As required by applicable legislation. Customer identification data required under the Money Laundering Act, including data collected and archived via the DOKS service, is retained for five (5) years following the termination of the customer relationship, as required by law.
Ensuring compliance with the agreement and monitoring for misconduct	The general minimum retention period for the personal data of our clients’ representatives is two calendar years from the end of the contract concluded with the client. The contract documents themselves, which may also contain personal data, are retained for at least 10 years from the end of the calendar year in which the contract ended.
Enabling the use of our websites	Please see the information on the expiry periods of cookies in the cookie tool on our website, which you can access by clicking on the circular icon located at the bottom left of our website. You can also find further information on the use of cookies in our cookie notice at https://kontuoy.fi/evastekaytanto/.
Surveys	Responses to surveys are deleted within 12 months of the survey being conducted.

What are your rights

You have a number of rights relating to your personal data. Below you will find a summary of these rights, as well as information on how you can exercise them and what restrictions apply. You have the right to:

• Request access to your personal data. This right allows you to obtain a copy of the personal data we hold about you and to ensure that we are processing that data lawfully.
• Request the rectification of your personal data. You have the right to ask us to rectify any inaccurate personal data concerning you.
• Request the erasure of your personal data. This right allows you to ask us to erase your personal data where there is no longer a valid basis for processing it.
• Object to the processing of your personal data where the basis for processing is a legitimate interest and you have a reason relating to your particular personal circumstances for objecting to the processing of your data. Furthermore, you always have the right to object to the processing of your personal data for direct marketing purposes.
• Request that the processing of your data be restricted. This right allows you to ask us to stop processing your personal data, for example, whilst you verify the accuracy of the data or the legal basis for processing.
• Request the transfer of your personal data from one system to another where the basis for processing is consent.
• Withdraw your consent. If the processing is based solely on your consent, you have the right to withdraw that consent at any time. However, withdrawing your consent does not affect the lawfulness of any processing of personal data carried out on the basis of your consent prior to its withdrawal.
• Opt out of direct marketing, marketing communications and profiling by following the instructions on how to opt out contained in the marketing communications. Please note that even if you opt out of receiving marketing communications from Kontu, you may still receive administrative messages from us, such as order confirmations and notifications, which are necessary for managing your account or the services we provide to the organisation you represent.

You also always have the right to choose which cookies are used on our website by changing the settings in our cookie tool. You can open the cookie tool by clicking on the circular icon at the bottom left of our website. For further information on the use of cookies on our website, please refer to our cookie notice available at https://kontuoy.fi/evastekaytanto/ and via the cookie tool accessible from the bottom left-hand corner of our website.

Please also note that some of the rights listed above apply only in relation to specific legal bases for the processing of personal data, and their application may also be subject to other restrictions. In such cases, we will provide you with detailed information on the applicable exception or restriction and assist you in exercising your rights to the fullest extent possible in accordance with applicable legislation. You can read more about the circumstances in which data subjects’ various rights apply on the website of the Office of the Data Protection Ombudsman at: https://tietosuoja.fi/rekisteroidyn-oikeudet-eri-tilanteissa.

If you wish to exercise the rights mentioned above, please contact us using the contact details provided at the beginning of this privacy notice, or exercise your rights in the manner set out in this privacy notice.

You have the right to lodge a complaint with a data protection authority if you are dissatisfied with the way we process your personal data. In Finland, you can lodge a complaint with the Office of the Data Protection Ombudsman at https://tietosuoja.fi/ilmoitus-tietosuojavaltuutetulle.

Finally

We encourage you to review this privacy notice regularly.

We value your opinion. If you have any comments or questions regarding this privacy notice, privacy protection or any potential breaches of privacy or data protection, please send them to us using the contact details provided at the beginning of this privacy notice. We will treat your message confidentially and contact you to resolve your queries.