Privacy Policy

Introduction

Your privacy is important to us. Therefore, Norden Homes Group (hereinafter referred to as "Norden Homes") is committed to protecting your privacy to the best of its ability and handling your personal data transparently in accordance with current laws and good data protection practices. The companies belonging to the Norden Homes Group are joint controllers of your "personal data". This "privacy policy" outlines how we collect, process, and protect your personal data in all our operations.

1. Processing of Personal Data and Legal Basis for Processing

We collect and process personal data only to the extent necessary for our business operations and to offer and develop our services and products. We collect and process your personal data, for example, for customer communications, invoicing, marketing, and advertising, as well as for other business purposes. Similarly, we process personal data when it is necessary for drafting or executing customer agreements, complying with legal obligations, or based on our legitimate interests, such as preventing misuse or fraud. Personal data is primarily collected from you during our customer relationship. In certain situations, we also collect information from other external sources with your consent or within the limits permitted by law (e.g., when we receive guest information from a buyer, purchase marketing lists, or when your data is transferred to us from external sales channels like Booking.com). The purpose of processing determines what kind of information we collect in each situation and for what purpose. We process your personal data listed below only on legal grounds for the purposes defined below:

Purpose of Processing Personal Data and Types of Personal Data

Accommodation/Rental Agreements, Service Delivery, and Invoicing We process your personal data (such as contact details and other identifying information such as date of birth and language, as well as registration information like username and other possible unique identifiers) to prepare and execute customer agreements (including invoicing) and to comply with legal requirements. We also process your credit rating data with your consent to ensure smooth invoicing. As part of providing and delivering services, we also process your personal data based on our legitimate interest, including managing customer relationships and providing customer service, as well as investigating misuse and malfunctions (e.g., video surveillance, log data, access code usage logs, phone recordings, instant messaging history).

Norden Homes Website

To implement customer agreements, we process the following information in our online store:
(i) Contact information, such as address details, phone number, email address; and
(ii)Registration information, such as username
(iii) Transaction details, such as credit card information
(iv) Information required for identification, such as a passport or driver’s license

We process this personal data based on our legitimate interest and the agreement. In some cases, we use strong identification, for example, to confirm a payment. When using strong identification, we work with various partners.
Norden Homes only processes the identification information you, as the customer, have provided us, such as passport or ID card details. However, in some cases, the customer may need to provide a picture of themselves or other identification data to Norden Homes’ partners, or use strong identification provided by banking services. Identification data provided to partners is processed according to the partner’s privacy statement. Norden Homes does not process or store any identification data provided to partners (e.g., a picture or banking information).

Customer Service and Communication

We process customer relationship information (e.g., details about newsletter subscriptions or contact information from customer inquiries) based on our legitimate interest to provide you with customer service and respond to your inquiries.

Analysis, Statistics, and Business, Product, and Service Development

We process customer relationship data (such as purchase behavior or customer feedback information) based on our legitimate interest to develop our services.

The right to object to processing

Where Personal Information is processed for a public interest, in the exercise of an official authority vested in us or for the purposes of the legitimate interests pursued by us, you may object to such processing by providing a ground related to your particular situation to justify the objection. You must know that, however, should your Personal Information be processed for direct marketing purposes, you can object to that processing at any time without providing any justification. To learn whether we are processing Personal Information for direct marketing purposes, you may refer to the relevant sections of this document.

Direct Marketing and Marketing Campaigns

We market our services based on our legitimate interest. Our traditional and electronic direct marketing is primarily targeted at business customers. Business customers always have the right to opt out of direct marketing.
As a private customer, you can subscribe to our newsletter via our website. In that case, newsletter marketing is based on the consent you provide. You have the option to withdraw your consent at any time.
At certain events, such as open house days, you may leave your contact details, for example, to participate in a raffle. In such cases, we may contact you later to market our services. However, you have the right to refuse marketing.
In marketing, we generally only process your contact information (such as address, email address, and phone number). For business customers, purchase history also affects the targeting of marketing messages.

Analysis of Website Usage

We collect your data only with your consent. You can read more in our cookie policy here.

Recruitment

We process standard job application data based on our legitimate interest, to the extent necessary and appropriate for assessing the suitability of the applicant for the open position. The personal data processed primarily depends on what the applicant provides to us. Generally, the information we process includes name and other contact details, completed studies, work experience, language skills, IT skills, information about the applicant’s personal website, the application, cover letter, and information from third parties (such as possible background checks, personality and suitability assessments, information collected by a recruitment agency, and information from social media used for recruitment, such as LinkedIn).

Access Control

We may pilot technology that collects information from the property to help us determine whether the property is occupied and whether all the keys are available when guests arrive and leave. This information would be used to improve the accommodation experience by reducing disputes over lost keys and optimizing cleaning and maintenance schedules. All data collected from pilot programs is permanently deleted well in advance and is only accessible to Norden Homes employees directly involved in the pilot project. Any information shared with third parties is anonymized.

2. Automated Decision-Making

Automated decision-making refers to a decision that is made entirely automatically, without human involvement, and that could have legal or similarly significant effects on you. Norden Homes' processing of your personal data currently does not include automated decision-making.

3. Sensitive Data

Special categories of personal data, also known as “sensitive personal data,” include information that reveals race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, or data concerning a natural person’s health or sexual behavior or orientation.

The processing of sensitive personal data is only permitted in situations where it is necessary to comply with the obligations and specific rights of the controller or data subject in the field of employment law, social security, and social protection, as permitted by Union law or Member State legislation or a collective agreement, or when explicit consent has been obtained from the data subject.

Norden Homes processes sensitive data only with your explicit consent and only if the processing of such sensitive data is necessary to provide services as agreed in the accommodation contract.

4. Disclosure and Transfer of Data

We process your personal data confidentially and do not disclose it to third parties, except in the following cases:
Within the Group: Norden Homes is an international company with international clients. Data is shared with companies within the group.
Authorities: In certain situations, we may be required to disclose personal data to authorities or legal bodies when required by law. We do this only based on a valid court order, a mandate from the authorities, or a subpoena.
Business Transactions: In the event of business acquisitions or restructuring, the acquiring party may gain access to relevant customer data.
Consent: We may disclose your personal data to third parties if you have given your consent.

In some cases, service providers and partners we use for purposes such as marketing, product, and service development may use your personal data for their own purposes. For instance, our website and messages sent to you may contain links to third-party websites, plugins, or applications. Following such links or interacting through them may permit third parties to collect or share data about you. Norden Homes does not control these third-party services and is not responsible for the practices of third parties acting as independent data controllers in processing your personal data. Please review their privacy policies for details on how they process personal data.

We also use subcontractors and external service providers (for example, for technical maintenance, carrying out campaigns and direct marketing, cleaning and maintaining accommodation properties, providing customer service support, or managing security and monitoring services, or other similar services such as catering). They are only authorized to process your data to the extent required for the agreed services. This means they cannot use your data for their own purposes. We contractually require them to ensure a sufficient level of data protection and the legal compliance of all data processing activities involving your personal data.

The data we collect may be stored and processed outside the European Economic Area (EEA), for example, when the service provider we use is located or stores data outside the EEA. We only work with partners whose data protection processes are appropriately arranged and who guarantee sufficient safeguards (such as the European Commission's standard contractual clauses). All service providers we use are contractually obligated to ensure that an adequate level of data protection is maintained in all processing of your personal data.

5. Data Security

We have appropriate technical and organizational security measures in place to protect personal data from loss, misuse, or other similar unlawful access. These security measures include the use of firewalls, encryption technologies, and secure devices and premises. Access to your personal data is also internally restricted through access control and the granting and monitoring of user rights. Only employees who have the right to access personal data as part of their duties are permitted to process your personal data.

6. Access to Data and Exercising Your Rights

You have the right to review what personal data we process and to influence how we use it. You can decide whether you wish to receive direct marketing and review the data we process about you and the basis for it. In certain cases, you also have the right to be forgotten, restrict, or object to the processing of your personal data. Below is a description of your rights under current legislation:

Right to Withdraw Consent: If the processing of personal data is based on your consent, you have the right to withdraw your consent at any time. For example, you can withdraw your consent for electronic direct marketing at any time.

Right to Access and Rectification: You have the right to review the data we have collected about you at any time or to receive confirmation that we do not hold any personal data about you. If your data is incorrect, inaccurate, or incomplete, you can request a correction or supplement.

Right to Restrict or Object to Processing:In certain situations, you have the right to request the restriction of the processing of your personal data. For example, if some of your information is inaccurate, you have the right to request the temporary restriction of processing until we have verified the accuracy of the data. In some situations, you also have the right to completely object to the processing of your personal data. For example, you may at any time opt out of direct marketing (including profiling).

Right to be Forgotten: In certain cases, you have the right to be forgotten. We will delete all the data we have collected about you if the personal data is no longer needed for the purposes for which it was originally collected. We will also delete the data if the processing of personal data was based on your consent and you withdraw your consent, or if you object to the processing of your personal data, unless there is another basis for processing.

Right to Data Portability:You can request the transfer of your personal data in situations where we process your personal data based on your consent or an agreement. The right to transfer applies only to the data you have provided to us, and which is processed automatically (i.e., not in paper documents). When you request the transfer of your data, we will provide your personal data in a machine-readable format so that you can store it yourself or transfer it to another controller (e.g., another service provider). If technically possible, we will also transfer your data directly to another controller at your request.

Right to File a Complaint:In addition to the aforementioned rights, you have the right to file a complaint with the supervisory authority regarding the processing of your personal data.

You can exercise your rights related to the processing of your personal data in the following ways:

• By making a request in person at Norden Homes’ office with a valid ID (e.g., passport); or
• By sending your request to: [email protected].

In your request, you should provide the information necessary for us to verify your identity, such as:

• Your full name;
• The phone number/email address you have used in communications with us when concluding accommodation agreements; and
• The contract number or customer ID.

If you have any questions regarding your rights mentioned above, please contact us at: [email protected].

8. Data Retention

We retain your personal data for the duration necessary for the purposes of processing, for as long as required by law, or until we receive a deletion request.

We only retain your data as long as necessary to fulfill the purposes defined in Section 1, within the limits set by applicable law. The retention period of your personal data depends on the following factors: contractual obligations, requirements under national legislation (e.g., accommodation and accounting laws), withdrawal of consent, and the necessity of the data for providing or ensuring our services.

After this, the data will either be deleted or anonymized by irreversibly transforming it into a form in which an individual can no longer be identified.

Use of Cookies

With your consent, we may collect information about you and your preferences on our website through cookies and other similar technologies. A cookie is a small text file that your browser stores on your computer. Cookies contain a unique identifier and are used to recognize and count the browsers visiting our site. You have the right to block the use of cookies, but this may affect the functionality of our services. You can delete cookies in your browser settings.
Learn more about website analytics and the use of cookies, as well as how to block their use, by reviewing our cookie policy.

9. Changes to the Privacy Statement

We continuously develop our privacy practices, and as a result, we may update this privacy statement from time to time. Changes may also be based on legislative updates. We recommend that you revisit this privacy statement page periodically to notice any changes. If necessary, we will also inform you directly about changes.

10. Data Controller and Contact Information

Norden Homes group companies are joint data controllers of your personal data. If you have any questions or comments, please contact us:

Norden Homes Oy Business ID: 3220449-7
Head Office: Linnankatu 55
I 304, 20100 Turku
For privacy-related inquiries:[email protected]
For other inquiries: [email protected]
Customer service: +358 40 801 9945