Privacy Policy
What personal data KotienKoti processes, why, who it is disclosed to and what rights you have
Table of contents
Controller
Home Of Homes Oy
Business ID: 3603016-4
Domicile: Jyväskylä
Email: info@kotienkoti.fi
Privacy matters: tietosuoja@kotienkoti.fi
In brief
We process data you provide yourself (account, properties, documents, photos, messages) and data generated by your use of the service. We use artificial intelligence to analyse documents and photos, which means the content is sent to processors outside the EU. We do not sell your data. You can download your own data and delete your account at any time.
1.Controller and how to contact us
1.1Controller
The controller of your personal data is Home Of Homes Oy (business ID 3603016-4, domiciled in Jyväskylä).
Privacy questions and requests to exercise data subject rights: tietosuoja@kotienkoti.fi. All other matters: info@kotienkoti.fi.
The Company has not appointed a separate data protection officer. Data protection matters are the responsibility of company management, and enquiries are directed to the address above.
1.2Supervisory authority
You have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes data protection law. In Finland the supervisory authority is the Office of the Data Protection Ombudsman.
2.What this policy covers
This policy covers all processing of personal data in the KotienKoti service: the website, the KotienKoti account, HintaPulssi, AsuntoPulssi, the ARVO agent, the Asuntomarkkinat listing platform, PRO features, the service provider directory, and marketing and enquiries.
When you use the service to deal with a third party — for example by accepting a service provider's offer — that party is its own controller to the extent it processes your data for its own purposes. Its own privacy policy then also applies.
3.What data we process
3.1Account and contact details
- Name, email address and phone number
- Password hash and identifiers used for signing in
- User role (consumer, professional, administrator)
- Notification settings and marketing permissions and objections
- Organisation and business ID if you use the service as a professional
3.2Properties, documents and photos
- Property address, type, floor area, year of construction and technical details
- Ownership and possession relationships and the access roles granted to other users
- Documents you upload, such as property manager certificates, energy performance certificates, condition assessments and financial statements
- Photos you upload and the condition observations derived from them
- Financial and cost data, maintenance history and events
Documents may contain other people's data
Property manager certificates and sales brochures typically contain other people’s names and contact details, and photographs may show people. You are responsible for ensuring you are entitled to submit such data to the service. We process it only on your behalf in order to provide the service.
3.3Service usage data
- HintaPulssi tendering data: current contracts, consumption data and service preferences
- AsuntoPulssi inputs, results and share links
- ARVO agent conversations, notes and the actions the agent proposes
- Deals and assignments and the contact details disclosed in connection with them
- Reviews you give and their star ratings
- Messages between users
- Marketplace listings and enquiries about them
- Paid order data: product, price, status and payment confirmation
3.4Technical data
- IP address, browser and device information and server logs
- Cookie identifiers and analytics events, if you have given consent
- Sign-in and security events and rate-limiting counters
3.5Data we do not collect
We do not collect payment card details: those are handled directly by the payment processor on its own payment page. Nor do we ask for special categories of personal data (such as health data), and we do not process personal identity codes. If you upload a document containing such data, please remove it first.
4.Purposes and legal bases
We process personal data only where there is a legal basis under the GDPR. The purposes and their legal bases are set out below.
| Purpose | Legal basis |
|---|---|
| Creating and maintaining an account, managing properties and documents | Performance of a contract (6(1)(b)) |
| HintaPulssi tendering and forwarding data to the service providers you select | Performance of a contract (6(1)(b)) |
| AsuntoPulssi analysis and producing a report from documents you submit | Performance of a contract (6(1)(b)); document analysis always begins on your own initiative |
| ARVO agent conversations and assistive functions | Performance of a contract (6(1)(b)) |
| Proactive reminders and suggestions | Consent (6(1)(a)); you can turn these off in notification settings |
| Processing and invoicing paid orders | Performance of a contract (6(1)(b)) |
| Accounting and statutory obligations | Legal obligation (6(1)(c)) |
| Service security, prevention of misuse and rate limiting | Legitimate interest (6(1)(f)): protecting the service and its users |
| Developing the service and improving quality | Legitimate interest (6(1)(f)): developing a service that works |
| Direct marketing by email | Consent (6(1)(a)); marketing messages are off by default |
| Analytics cookies (Google Analytics) | Consent (6(1)(a)) and the Finnish Act on Electronic Communications Services |
| Cookieless visit measurement | Legitimate interest (6(1)(f)): understanding service usage without tracking |
| Open-data building registry and property analysis (section 7) | Legitimate interest (6(1)(f)); you may object to this processing |
Legitimate interest and the right to object
Where processing is based on legitimate interest, we have balanced our interest against your rights. You have the right to object to such processing on grounds relating to your particular situation (section 13). You can always object to direct marketing without giving reasons.
Kimppahinta interest without an account
In the Kimppahinta service you can register your interest without an account. We then process the service, postal code, email address, optional property and timing details, your chosen routing and source/campaign data to prepare a contract (6(1)(b)) and to develop the service (6(1)(f)). The email address is verified by link. Companies see only the service and the postal area — your name, exact address or contact details are not shared until you choose an offer and proceed to a contract. Marketing consent is requested separately and voluntarily. You can withdraw your interest at any time from the status link.
5.Where the data comes from
5.1From you
Most data comes from you: when you register, complete forms, upload documents and photos, and use the features of the service.
5.2From other users
You may also receive data from other users: when you are invited to a property, when a service provider makes you an offer, or when another user sends you a message or an enquiry.
5.3From public and official sources
We supplement property data from open interfaces. The sources used are:
| Source | What we obtain |
|---|---|
| Ryhti (Finnish Environment Institute / Ministry of the Environment) | Building and building permit data |
| National Land Survey of Finland | Address geocoding and property data |
| Statistics Finland (StatFin, Paavo) | Regional and price statistics |
| Digitransit (Fintraffic) | Public transport accessibility |
| Finnish Patent and Registration Office | Company data for verifying service providers |
| Geological Survey of Finland | Soil data |
| OpenStreetMap | Local amenities and property location data |
These sources concern buildings and areas in the first instance. To the extent the information relates to an identifiable person, section 7 applies.
6.Artificial intelligence and automated processing
6.1Where AI is used
- Reading documents and extracting data for AsuntoPulssi analysis
- Identifying and scoring risks and forming recommendations
- Structural analysis of property photos to produce condition observations
- ARVO agent conversation responses and proposed actions
During analysis the content is sent to the language model providers named in section 8. We send only what the analysis requires, but we do not automatically filter document content — if a document contains names or contact details, they are included.
6.2No use for model training
Our agreements with language model providers are made so that content submitted to the service is not used to train the provider's models. A provider may retain requests for a short period for abuse monitoring.
6.3Automated decision-making
We do not make decisions about you that produce legal or similarly significant effects solely by automated means. AI-generated reports, scores and suggestions support decision-making, and binding actions always require your own confirmation.
You have the right to request human review of an automatically produced outcome, to express your point of view and to contest the outcome.
7.Building registry and property analysis
7.1What this is about
From the open sources listed in section 5.3 we compile a building registry that we use internally to identify and analyse properties. The registry contains technical and location data about buildings, not owners’ names or contact details.
In analysis, comparison values may be calculated for a property, such as an estimate of deferred maintenance and an estimate of how likely the property is to come up for sale. Because a property is identified by its address, the information may be linkable to its owner or occupant. We treat such information as personal data.
7.2Basis and balancing
The processing is based on legitimate interest: being able to identify properties suitable for a buyer and to target the service sensibly. The balancing takes into account that the data originates from public sources, that the processing is internal, that results are neither published nor sold on, and that no automated decisions about any person are made on the basis of them.
7.3Your rights regarding this processing
You have the right to object to this processing on grounds relating to your particular situation. Send the address of the property concerned to tietosuoja@kotienkoti.fi and we will exclude it from analyses and will not use it for targeting. You may also ask what data the registry holds about your property.
8.Disclosures and processors
8.1We do not sell your data
We do not sell or rent your personal data. Data is disclosed only in the situations described below and only to the extent the purpose requires.
8.2Disclosures to other users and parties
- HintaPulssi: to the service providers you select, for the purpose of making an offer
- Deals and assignments: the other party’s contact details, to carry out the assignment
- Property sharing: to the people you invite, to the extent of the role you grant
- AsuntoPulssi share link: to anyone you share the link with
- Marketplace: contact form data to the seller who published the listing
- Reviews: published in the service provider directory
In these situations the recipient is its own controller to the extent it processes the data for its own purposes.
8.3Processors acting on our behalf
The following providers process personal data on our behalf under a written data processing agreement. They may use the data only to provide the service, not for their own purposes.
| Processor | Purpose | What data | Location |
|---|---|---|---|
| Supabase Inc. | Database and file storage | All data stored in the service: account, properties, documents, photos, messages and conversations | EU region |
| Vercel Inc. (USA) | Hosting and serverless execution | HTTP requests, server logs and IP addresses | EU region; support and logging also in the United States |
| Vercel Inc. (USA) — Web Analytics | Cookieless measurement of visits and page views. It sets no cookies, reads nothing from the device and does not track visitors across sites. | Page URL, referrer, coarse location, device type and browser, plus a short-lived identifier derived from these that cannot be linked to a person | EU region and the United States |
| OpenAI, Inc. (USA) | Document content extraction and generation of AsuntoPulssi reports and ARVO responses | Content of uploaded documents, property data and conversation messages. Documents may contain the name and contact details of a seller, agent or property manager. | United States |
| Anthropic PBC (USA) | Structural analysis of property photos and ARVO agent responses | Uploaded property photos and conversation messages. Photos may show people, vehicles or neighbouring properties. | United States |
| Resend, Inc. | Email delivery (notifications, confirmations, shared reports) | Recipient's name, email address and message content | United States |
| Stripe, Inc. | Payment processing for paid orders | Transaction data, payer's name and email address. Card details are handled directly by Stripe and never pass through KotienKoti's systems. | EU region and the United States |
| Google Ireland Ltd. / Google LLC (USA) | Usage analytics. Loaded only if the user has consented to analytics cookies. | Page views, events, cookie identifier and truncated IP address | EU region and the United States |
8.4Authorities
We may disclose data to an authority where the law requires it or where it is necessary to establish or defend a legal claim.
9.Transfers outside the EU and EEA
Some of our processors are located in the United States. This applies in particular to language models, email delivery and analytics. The following safeguards are used for transfers:
| Processor | Location | Transfer basis |
|---|---|---|
| Supabase Inc. | EU region | Processing within the EEA |
| Vercel Inc. (USA) | EU region; support and logging also in the United States | EU–US Data Privacy Framework |
| Vercel Inc. (USA) — Web Analytics | EU region and the United States | EU–US Data Privacy Framework |
| OpenAI, Inc. (USA) | United States | EU–US Data Privacy Framework |
| Anthropic PBC (USA) | United States | EU–US Data Privacy Framework |
| Resend, Inc. | United States | EU–US Data Privacy Framework |
| Stripe, Inc. | EU region and the United States | EU–US Data Privacy Framework |
| Google Ireland Ltd. / Google LLC (USA) | EU region and the United States | EU–US Data Privacy Framework |
You can request more information about transfer bases and the safeguards used from tietosuoja@kotienkoti.fi.
10.Retention periods
10.1General principles
We retain data for as long as necessary to fulfil the purpose or to comply with a statutory obligation. Incorrect and outdated data is corrected or deleted without delay.
| Data | Retention period |
|---|---|
| Account and profile data | For the lifetime of the account; anonymised when the account is deleted |
| Properties, documents and photos | Until you delete them, the property or your account. Where a property has other owners or access rights, the data remains for them. |
| ARVO conversations and agent tasks | Until you delete the conversation or your account |
| HintaPulssi requests and offers | For the lifetime of the account; contact details are removed when the account is deleted |
| Kimppahinta interests without an account | Unverified interests are deleted after 30 days. Verified interests that do not lead to a contract are anonymised after six months. Data leading to a contract is retained like a deal. |
| Contracts made on the platform and acceptance timestamps | Six years from the end of the contract for complaints and accounting |
| Deals, assignments and reviews | Six years from the end of the assignment for complaints and accounting; a review remains in the directory but is detached from your identifying data |
| Accounting vouchers | Six years from the end of the calendar year in which the financial period ended |
| Financial statements and accounting records | Ten years from the end of the financial period |
| Marketing permissions and objections | Objections are retained indefinitely so that they can be respected |
| Server and security logs | No more than 12 months |
| Analytics data | No more than 14 months |
10.2AsuntoPulssi reports and uploaded documents
How reports and documents are actually retained
Reports created while signed in are retained for the lifetime of your account and are removed when you delete the report, the property or your account. Documents you upload are stored permanently with the property data so that they remain available later — they are not deleted after analysis.
An analysis carried out without signing in is stored without a user identifier. Because it is not linked to an account, we cannot identify it as yours and cannot delete it through self-service. If you want such an analysis removed, send its share link or identifier to tietosuoja@kotienkoti.fi and we will delete it.
A share link works until you revoke it or it expires. A revoked share link stops working immediately.
10.3What deleting your account means
When you delete your account, your personal data is overwritten with non-identifying values: name, email address and contact details are taken out of use. The user record itself is kept as an identifier so that references from logs, completed transactions and shared properties do not break other users’ data.
Deleting an account does not remove data that must be retained by law (accounting) or that also belongs to another party, such as the other owners of a property or the counterparty to a completed assignment.
11.Cookies and tracking
11.1Which cookies we use
| Category | Purpose | Basis |
|---|---|---|
| Necessary | Signing in, session management, security and remembering cookie choices | Necessary to deliver the service — no consent required |
| Analytics | Google Analytics: page views and events, to develop the service | Consent |
| Functional | Interface choices such as language and view settings | Consent |
Google Analytics is not loaded at all before you have consented to it. If you do not consent, or you withdraw consent, the tracking code is not executed.
Cookieless visit measurement
We also measure visits and page views without cookies (Vercel Web Analytics). It sets no cookies, reads nothing from your device and does not track you across sites, so it does not require consent. The processing is based on legitimate interest: we need to know which pages are used in order to develop the service. You can object to this processing as described in section 13.
11.2Withdrawing consent
You can change or withdraw your cookie consent at any time in cookie settings or in the privacy settings in your profile. Withdrawal does not affect the lawfulness of processing carried out beforehand.
12.Security
We protect personal data with technical and organisational measures. The main measures are:
- Encryption
- Data is encrypted in transit and at rest. Only a hash of a password is stored.
- Access control
- Personal credentials and role-based authorisation. Access is limited to those who need it for their work.
- Authorisation in the application layer
- Every retrieval of a property or document checks the user’s role and their right to that property.
- Logging
- Sign-ins, administrative actions and agent actions are logged so that they can be checked afterwards.
- Processing agreements
- A data processing agreement is in place with every processor, and processors are bound by confidentiality.
- Rate limiting
- Request limits and abuse monitoring protect the service and users’ data.
If a personal data breach is likely to result in a high risk to your rights, we will inform you without undue delay and notify the supervisory authority within the statutory deadline.
13.Your rights
- Right of access
- You can obtain confirmation of whether your data is processed, and access to it.
- GDPR Art. 15
- Right to rectification
- You can correct inaccurate or incomplete data yourself in the service or by asking us.
- GDPR Art. 16
- Right to erasure
- You can request erasure of your data. Erasure is limited by statutory retention obligations and the rights of other parties.
- GDPR Art. 17
- Right to restriction of processing
- You can request restriction, for example while you contest the accuracy of the data.
- GDPR Art. 18
- Right to object
- You can object to processing based on legitimate interest on grounds relating to your particular situation. You can always object to direct marketing without giving reasons.
- GDPR Art. 21
- Right to data portability
- You can receive the data you provided in a machine-readable format. You can download it yourself from the privacy settings in your profile.
- GDPR Art. 20
- Right to withdraw consent
- You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand.
- GDPR Art. 7
- Right to lodge a complaint
- You can lodge a complaint with the Office of the Data Protection Ombudsman.
- GDPR Art. 77
Requests to exercise your rights should be sent to tietosuoja@kotienkoti.fi. We respond within one month. If a request is complex, the deadline may be extended by up to two months, of which we will inform you. We may ask for additional information to verify your identity.
Available immediately as self-service
You can download your own data and manage your cookie choices from the privacy settings in your profile, and delete your account from the security settings, without making a separate request.
14.Children
The service is not intended for children. Creating a KotienKoti account requires you to be 18 years old, because using an account involves entering into commitments. Where processing in an information society service is based on consent, a person who is at least 13 years old may give that consent themselves in Finland.
If we become aware that we have collected data from a minor without a basis for doing so, we will delete it. If you believe this has happened, please contact tietosuoja@kotienkoti.fi.
15.Changes to this policy
We update this policy when the service or our processing activities change. The current version and the date of update are shown at the top of this page.
We inform you in advance of material changes — for example new processing purposes or new categories of recipient — by email or by a notice shown in the service.
Questions?
If anything in this policy is unclear, or you would like to know more about how your data is processed, contact tietosuoja@kotienkoti.fi. We are happy to help.