DEN

Customer and marketing register

Data controller

DEN Finland Oy
Business ID: 2347517-2
Pakkalankuja 7, FI-01510 Vantaa
Phone number: –
Email: tietosuoja [at] den.fi

Contact details

Data privacy matters
tietosuoja [at] den.fi

Register name

Customer and marketing register

Purpose of processing personal data

DEN processes the personal data of its potential, current and former consumer customers on the following legal grounds and for the following purposes:

  1. carrying out inquiries, requests for quotations, newsletters, orders for products and services and other pre-contractual measures at the request of the data subject and to check credit data in connection therewith;
  2. performance of the contract between the data subject and DEN, e.g. delivery of products and services, invoicing, monitoring and collecting payments;
  3. in the legitimate interest of the customer relationship between DEN and the data subject, managing, maintaining and developing the customer relationship; designing and developing business, products and services; customer and other feedback and satisfaction surveys and other customer-related communications by letter, telephone, email, SMS or other electronic means;
  4. fulfilling DEN’s legal obligations under housing, consumer protection, data protection and other legislation;
  5. in the legitimate interest of DEN, detecting, preventing and investigating fraud, money laundering and other crimes and misconduct;
  6. in the legitimate interest of DEN and its partners, conducting opinion and market research, organizing marketing contests, sweepstakes and other marketing events, as well as the direct marketing and targeting of products and services by telephone, mail, email, SMS and other electronic means, subject to separate consent;
  7. processing of data collected through the use of cookies, advertising tags or other similar technical means of tracking your use of DEN’s online and mobile services for the purposes specified in the cookie consent. For more information on our use of cookies, click here.
  8. in the legitimate interest of DEN and its partners, the advertising of their products and services on their own channels and other internet and mobile medias, services, applications as well as targeting of advertising;
  9. in the legitimate interest of DEN and its partners, analysing, profiling, segmenting and statistical processing of data subjects and their data in connection with and for the purposes mentioned above.

Description of the data content of the register

The register contains the following information about DEN’s potential, current and former consumer customers:

  1. Basic data of the data subject, e.g.: name, personal identification number, customer identifier, year of birth, gender, native language, language of service, title and job title, postal address, email address, telephone number, preferred method of contact;
  2. Marketing data: marketing activities targeted at the data subject, housing types, destinations, characteristics and areas of interest to the customer; household size, type of housing; number of dwellings owned by the data subject and other interests and information provided by the customer; direct marketing prohibitions and consents;
  3. Customer history: customer relationship start and end date and method, contract, order, purchase, suspension and cancellation data for products and services, delivery data, customer feedback and complaints, customer service call records; responses to customer and market surveys; other contacts; billing, payment and collection data and creditworthiness data;
  4. Usage data of electronic services: e.g. registration data required for accessing DEN services, such as username, nickname, password and other possible unique identifiers; usage and browsing data of the services, reading data of newsletters, ads displayed and clicks on ads; the page from which the user has accessed DEN’s website, device model, unique device and/or cookie identifier, data collection channel (web browser, mobile browser, app), browser version, IP address, session ID, session time and duration, screen resolution and operating system, location on country/city level.
  5. Profile and classification information: Customer/user and marketing segments and profiles based on the analysis and profiling of the data described above, as well as classification and other data collected from regular data sources.
  6. Social security numbers are only processed for purposes permitted by law where it is important to identify the data subject, e.g. in the sale and rental of housing, credit or debt collection. For direct marketing to potential and former customers, only basic data (except for the social security number) and marketing, analytics and profiling data are used.

Description of the recipients of personal data

DEN may disclose information from the register to companies and partners belonging to the same group as DEN, when this is necessary for the purposes for which the register is used, e.g. for the delivery and invoicing of upon agreed products or services. Otherwise, data will not be disclosed to third parties without the consent of the data subject, except where necessary to comply with DEN’s legal obligations in connection with legal proceedings, at the request of public authorities or as part of business arrangements.

DEN has the right to use subcontractors for the processing of personal data under this Privacy Statement. In such cases, personal data may be transferred to subcontractors to the extent necessary for the performance of the subcontractor’s services. DEN uses subcontractors for the following tasks:

Retention period of personal data

Personal data will be stored for as long as necessary for the purpose for which it is collected. Customer data is stored after the end of the customer relationship until the warranty obligations and other contractual and legal obligations between the parties have been fulfilled and the retention periods and liability periods specified in legislation, such as the Housing, Consumer Protection and Accounting Acts, have expired.

DEN may retain anonymised data after the end of the customer relationship and, for direct marketing purposes, the data subject’s basic data (except for the social security number) and marketing data as defined above in this Privacy Policy.

Is the register data transferred outside the EU or EEA

Yes

Transfer of data outside the EU or EEA

Personal data may also be transferred for processing to a country outside the EU/EEA. Unless the European Commission has decided that the level of data protection in the country of processing is acceptable, DEN will ensure adequate data protection by entering into written contracts with subcontractors under standard contractual clauses approved by the European Commission or by any other legal procedure.

Are automatic decisions made on the basis of the data

No

How data subjects can exercise their rights

Access, rectification and other rights of the data subject

The data subject has the right to access the data stored in the personal data file concerning him/her and to request the rectification or removal of inaccurate, outdated, unnecessary or unlawful data.

The data subject also has the right to withdraw his/her consent to the processing of his/her personal data at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal of consent.

The data subject has the right to object to the processing of his/her personal data for the purposes of direct marketing and related profiling.

If the data subject has provided his/her personal data to DEN and the processing is based on consent or a contract, he/she has the right to receive this data in a structured, commonly used and machine-readable format and the right to transfer the data to another DEN in accordance with applicable law.

Where the processing of personal data is based on legitimate interests, the data subject has the right to object to the processing of his/her data on grounds relating to his/her particular personal situation. The data subject must provide the specific situation justifying the objection at the time of the request.

In the situations defined by law, the data subject may request the restriction of the processing of his/her personal data, for example the total or partial suspension of processing, where the data subject is in doubt as to the accuracy of the data or the processing thereof.

Requests must be submitted in person, by letter or by email using the contact details given in item 1. If necessary, DEN may ask the data subject to specify his/her request in writing and to prove his/her identity.

The data subject has the right to lodge a complaint regarding the processing of personal data with the Data Protection Ombudsman.

Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State where he/she has his/her habitual residence or place of work or where the alleged breach has occurred, if he/she considers that the processing of personal data concerning him/her infringes the GDPR.