Managing personal data
KTI Rental benchmarking
General information
This document describes the procedures according to which KTI processes the personal data it collects for the purpose of providing the Rental benchmarking service. If you wish, you can suggest changes to these procedures or provide KTI with instructions on the processing of personal data.
A description of the general principles of managing confidential information compliant with the EU’s Data Protection Regulation at KTI can be found here. This document specifies these principles with regard to the processing of rental benchmarking data.
Subject and duration of the processing of personal data
Personal data is collected for the purpose of providing the KTI Rental benchmarking service.
KTI will retain the personal data provided by the data supplier for 12 months after the end of the service project, after which the personal data will be destroyed and the results will be anonymised.
Nature and purpose of the processing
KTI processes apartment-level residential rent data provided by the data supplier in order to produce the information on the residential rental market included in the Rental benchmarking service. The data is collected from the data supplier via secure email intended for transmitting confidential information or through a machine-readable data transfer solution, according to the supplier’s choice.
Type of personal data and categories of data subjects
The data provided to KTI consists of apartment-level residential lease data from the data supplier. The data includes an apartment identifier and other apartment-specific information. Although the data does not directly contain the tenant’s name or other personal data, the collected apartment-level rental data is still considered personal data under the EU General Data Protection Regulation (GDPR), as the tenant may be indirectly identified by combining the data with other data sources.
Subcontractors used by KTI
KTI ensures that its subcontractors are bound to the obligations applicable to data processors as set out in the EU General Data Protection Regulation (GDPR).
With regard to the personal data of its own customers, data supplier is regarded as the data controller of the personal data register in accordance with the EU’s Data Protection Regulation and data protection legislation, and KTI and the subcontractor are regarded as data processors who act on behalf of data supplier.
For further information, please contact Matti Heiskanen (tel. +358 40 832 6698 / matti.heiskanen(at)kti.fi).