Privacy Policy

Table of contents

Introduction

Last updated 22 September 2026

Personal data must be processed in accordance with data protection principles. Data must be collected for specified, explicit and legitimate purposes and must not be further processed in a manner incompatible with those purposes. Personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

This privacy policy describes how Comodo Asunnot Oy collects and processes personal data in connection with its housing-related services.

1. Data Controller

The data controller for the processing of personal data described in this privacy policy is:

Comodo Asunnot Oy (business ID 2093063-5)
Mechelininkatu 44, 00250 Helsinki
+358 10 470 4380

Contact person for data protection matters
Email: privacy@comodo.fi

If you have any questions or requests regarding data protection, you may contact us using the details above.

2. Why and on what basis does Comodo Asunnot Oy collect data?

We collect and process personal data of our customers, business partners and staff only for predefined purposes, and we ensure that there is always a lawful basis for processing.

Managing bookings and customer relationships. We process personal data to receive and manage bookings, process payments, and handle customer inquiries and complaints. Legal basis: performance and preparation of a contract.

Credit checks. With the customer's consent, we check credit information from a service provider as part of the booking process. Legal basis: consent.

Customer satisfaction monitoring. We conduct customer satisfaction surveys with the customer's consent. Legal basis: consent.

Marketing and customer communications. We use personal data to market our services and for customer and newsletter communications. For electronic direct marketing, we request the prior consent required by law. Legal basis: legitimate interest; consent for electronic direct marketing.

Fulfilling legal obligations. We process personal data to fulfil obligations under, among others, accounting legislation, the act on accommodation and catering activities, and the Limited Liability Companies Act. Legal basis: legal obligation.

HR administration and recruitment. We process the data of employees and job applicants to fulfil employment contract obligations, for payroll and taxation purposes, and to manage recruitment processes. Legal basis: performance of a contract, legal obligation, and in part consent (e.g. aptitude tests).

Maintaining the shareholder register. The Limited Liability Companies Act requires that a shareholder register be maintained. Legal basis: legal obligation.

3. What personal data does Comodo Asunnot Oy collect?

Data concerning customers

name, phone number, address, email address
date of birth and/or personal identity code
nationality and primary language
services ordered and purpose of stay
bank account number
customer satisfaction data (with consent)
date and result of credit check (with consent)

Data concerning employees

name and contact details
personal identity code and tax number
employment contract
salary and data required for payroll
sick leave records
photograph

Data concerning job applicants

name and contact details
education, experience, skills and work history
application and CV
references and referees (with consent)
LinkedIn profile data (with consent)
aptitude test results (with consent)

4. Origin and retention of personal data

We collect customer personal data primarily from the customer themselves during the booking and purchase process. Credit information is checked with a service provider with the customer's consent. Customer satisfaction data is collected directly from the customer through surveys.

We obtain data concerning employees and job applicants primarily from the individual themselves, and, with the job applicant's consent, also from other sources (e.g. referees, LinkedIn). Data concerning shareholders is obtained from the shareholder themselves.

The register is held in our electronic systems. The systems are protected in accordance with generally accepted industry practices, and access to the register requires a personal username and password. User credentials are granted only to company staff or to a service provider carrying out tasks on our behalf. We treat the data as confidential and do not use or disclose it other than as described in this policy.

Guest registration reports and the traveller data they contain are retained for one (1) year from the date the report was signed, after which they are destroyed (Act on Accommodation and Catering Activities).

We do not retain personal data for longer than necessary for its purpose, or longer than required by contract or law. Personal data is also deleted or anonymised when the data subject withdraws their consent or requests deletion of their data, provided we have no other lawful basis for processing. For technical reasons, however, data may to some extent and for a limited time remain in our backups.

Retention periods may also be governed by legislation (e.g. accounting and accommodation legislation, and the Employment Contracts Act) and by the running of time limits related to the presentation of legal claims (e.g. limitation periods). We may also update or delete outdated or inaccurate data when necessary.

5. Who processes personal data?

Personal data is processed by our staff for the purposes described in this privacy policy in the course of performing their duties. Access to the register requires a personal username and password.

6. Disclosure of data to third parties

We may disclose personal data to our subcontractors and service providers to whom we have outsourced data processing, such as:

booking and customer information systems
financial administration and invoicing service providers
email and cloud storage services
electronic contract signing services

These service providers act under a contractual relationship with us and are not entitled to use the data for any purpose other than on our behalf.

We may otherwise disclose data where required by law, a court, or a competent authority (e.g. traveller data to the police under accommodation legislation), to prepare a legal claim, or if we were party to a corporate transaction.

7. Transfer of personal data outside the EU

We use service providers whose server infrastructure or parent company is located outside the EU, and personal data may therefore be transferred outside the EU.

The General Data Protection Regulation permits such transfers only where one of the following safeguards is in place:

transfer to a country or arrangement for which the European Commission has issued an adequacy decision;
standard contractual clauses approved by the European Commission between us and the service provider; or
another safeguard permitted under the GDPR (e.g. binding corporate rules).

We ensure that any transfer of personal data outside the EU takes place with the safeguards required by data protection legislation.

8. What rights do you have

Withdrawing consent. Where we process your data on the basis of consent, you may withdraw that consent at any time by contacting us.

Access to data. You have the right to obtain confirmation of whether we process personal data concerning you, and to find out what data we process.

Right to have errors corrected. You may request the correction of inaccurate or outdated data.

Right to object to direct marketing. You may object at any time to the use of your data for direct marketing purposes.

Right to object to processing. Where we process your data on the basis of our legitimate interest, you may object to the processing unless there are compelling grounds for the processing that override your rights.

Right to restrict processing. In certain situations, you have the right to request that processing be restricted.

Right to data portability. Where your data has been processed on the basis of consent or to perform a contract, you have the right to receive the data you provided to us in a commonly used format.

Right to lodge a complaint. If you consider that the processing of your personal data is not lawful, you may lodge a complaint with the Office of the Data Protection Ombudsman.

9. Whether providing data is mandatory

Providing personal data is mandatory for making a binding booking to the extent required by law or by the provision of the service (including name, contact details, and, at hotel properties, the details required for the statutory guest registration report). In an employment relationship, we need data to fulfil the employment contract and statutory obligations. Incomplete data may affect our ability to serve the customer or process an application.

10. How to exercise your rights

You may exercise the rights described above by contacting us using the contact details given at the start of this policy. We will verify your identity by reasonable means at the same time.

11. Updates to this privacy policy

We may update this privacy policy as our operations or data protection principles change, as well as when legislation changes. Changes take effect once the updated policy has been published. We recommend reviewing the content of this policy periodically.

12. Cookies on the Comodo Asunnot website

This cookie policy explains how we use cookies and similar technologies on our website.

Our website uses cookies to deliver our services, analyse use of the site, and develop content and advertising. Cookies are small text or code files stored on your device that allow your browser or device to be recognised when you visit our website. They allow the site to remember your previous visits and choices, and allow us to develop the site to better meet your needs.

Analytics data collected through cookies is not combined with data in the customer register.

Cookies we use:

Necessary cookies – required for the site's basic functions. Without these the site will not work properly.
Preference cookies – remember your choices, such as your language setting.
Statistics cookies – help us understand how the site is used so that we can develop it. These do not identify you as an individual; the data is aggregated. We use, among others, Google Analytics; you may opt out of its tracking at tools.google.com/dlpage/gaoptout.
Marketing cookies – used to track visitors so that we can show you advertisements considered relevant to you.

Some cookies may still be unclassified; we update the classification as we map the services we use. If you block the use of cookies, some of the site's functionality may be unavailable.

Necessary cookies do not require consent. The use of other cookies requires your prior consent, given via our cookie notice. You may change or withdraw your consent at any time through the same channel.