Real estate brokerage and letting agency register

Personal data is processed in compliance with the statutory obligation laid down in section 7(1) of the Act on Real Estate Brokerage and Letting Agencies (1075/2000, "Brokerage Act") to maintain a register of real estate brokerage and letting agencies ("agency register").

The processing of your personal data is based on Article 6 (1)(c) of the EU General Data Protection Regulation (EU 2016/679), i.e. processing required compliance with the Regional State Administrative Agency’s statutory obligation.

Categories of data subjects

Persons whose information has been entered in the agency register pursuant to section 9 of the Brokerage Act, such as:

• persons entered as private traders in the agency register, registered as agencies;
• persons who have been deemed fit and proper when processing the registration notification (managing director and their deputy, a member and deputy member of the board of directors, a member and deputy member of a supervisory board or equivalent body, a general partner and other member of senior management as well as anyone who directly or indirectly holds more than 25 per cent of the shares or the votes conferred by shares
• in a limited liability company or has equivalent holding or control in another corporation);
• persons in charge of an agency;
• persons prohibited from pursuing agency activities without registration, and
• persons whose identity is indicated in the other information entered in the agency register (e.g. the company name or auxiliary company name of the legal person registered as an agency).

Personal data groups

• full name, personal identity code, date of birth of the private trader;
• company name, auxiliary company name, business ID or other equivalent identifier and the geographical address of each of the places of business from which agency activities are pursued;
• the full name and personal identity code or, in the absence of this, the date of birth of the persons whose fitness and propriety was assessed when processing the registration notification;
• whether the agency is a real estate brokerage agency or a letting agency;
• the full name and personal identity code, or in the absence of this, the date of birth of the person in charge of the agency;
• the liability insurance provider of the agency and the sum insured;
• the registration identifier and the date of registration of the agency;
• any warnings, as well as such requests and prohibitions the compliance with which has been enforced with a conditional fine;
• the reason for and date of removal from the agency register
• details of those issued a prohibition to pursue agency activities without registration, including the full name, personal identity code and any business and organisation ID of a natural person.

Registrations as a real estate brokerage or letting agency, decisions of the Regional State Administrative Agency

Data in the agency register can be disclosed to anyone in accordance with the Act on the Openness of Government Activities (621/1999).

Specifically, data on matters entered in the agency register and extracts from the register may be disclosed to everyone under section 7(1) of the Brokerage Act, however allowing for the restrictions related to the disclosure of personal data.

Persons performing agency registration and agency supervision tasks at other Regional State Administrative Agencies have the right to view the data in the agency register.

Parties processing personal data on behalf of the controller:
The Development and Administration centre for ELY Centres and TE Offices (KEHA Centre), which acts as the service provider for the agency register.

The National Archives determines which documents or data contained in documents will be stored permanently (Archives Act 831/1994). By decision AL/21642/07.01.01.03.01/2016 of the National Archives of Finland, the data in the agency register is retained permanently by entering all the data in the register into permanent electronic storage in years ending with zero (0) and five (5) with the exception of the first sample, which already taken at the end of 2017. Documents assigned permanent storage are transferred to the National Archives for archiving in accordance with Decision KA/26492/03.99/2020.

Personal data are not transferred outside the EU or the EEA.

Data is retained in the register for an indefinite period or until a change concerning data has been processed by the Regional State Administrative Agency and the change has been entered in the register.

By way of derogation from the above, data on any warning issued to an agency and any notice and prohibition that has been enforced with a conditional fine will be removed from the register three years after the end of the year during which the coercive measure in question was imposed.

Processed data in the register has been protected from inappropriate viewing, modification and destruction. The protection is based on user authorisation management, the technical protection of databases and servers, the physical protection of facilities and the backup of data. The right to access and process data is granted based on tasks. Access to the systems is based on personal usernames.

The processing of your personal data also does not involve automatic decision-making or profiling.

Each Regional State Administrative Agency is competent to carry out its tasks in a specific geographical area in Finland unless the national management of a matter has been centralised to a specific Regional State Administrative Agency. Therefore, one of the six Regional State Administrative Agencies usually acts as the controller for the processing of personal data in accordance with this notification, depending on where in Finland you live and which Regional State Administrative Agency has processed your matter.

The controller in accordance with this notification is:

• Regional State Administrative Agency for Southern Finland
  Area of jurisdiction: regions of Uusimaa, Kanta-Häme, Päijät-Häme, Kymenlaakso, South Karelia, Southwest Finland and Satakunta
• Regional State Administrative Agency for Eastern Finland
  Area of jurisdiction: regions of South Savo, North Savo and North Karelia
• Regional State Administrative Agency for Lapland
  Area of jurisdiction: region of Lapland
• Regional State Administrative Agency for Southwestern Finland
  Area of jurisdiction: regions of Southwest Finland and Satakunta
• Regional State Administrative Agency for Western and inland Finland
  Area of jurisdiction: regions of Pirkanmaa, Central Finland, South Ostrobothnia, Ostrobothnia and Central Ostrobothnia
• Regional State Administrative Agency for Northern Finland
  Area of Jurisdiction: regions of North Ostrobothnia, Kainuu and Lapland

Contact information

The Development and Administration centre for ELY Centres and TE Offices (KEHA Centre), which acts as the service provider for the agency register.

Contact information

Right to be informed of the processing of personal data 

You have the right to know what we use your information for and how. 

The aim of this notification is to give you an overall idea of the processing of personal data that is the subject of this notification at the Regional State Administrative Agency. If you feel that this notification does not give you the overall idea we are aiming to provide, we have failed in our goal. In this case and whenever you have questions about the processing of personal data by Regional State Administrative Agencies, you can contact the Data Protection Officer for the Regional State Administrative Agencies (see contact details below).

Right to access to your personal data 

You can request and receive a copy to your personal data that we have in our register by sending a signed information request form by letter or email to the Regional State Administrative Agency's registry. We will implement your request unless we have a legitimate reason to refuse realising your rights.

You have the right to receive information about whether we process your personal data in our activities. If we do not process your personal data, you have the right to be informed about this as well.

Form: Request to access personal data (in Finnish)

Send a written request to the Regional State Administrative Agency’s registry.

Right to request that inaccuracies be corrected and missing information be added 

If you notice any omissions or inaccuracies in your personal data, you have the right to request that we update these. In such a case, we ask that you indicate which information is incorrect and how the information should be changed or which information should be supplemented and how. 

Form: Request for the correction of inaccurate personal data and to restrict the use of personal data (in Finnish)

Send a written request to the Regional State Administrative Agency’s registry.

Restricting the use of your information 

If you believe that the information we are processing that concerns you is incorrect, that it is being processed unlawfully, or you oppose the processing of your information, you may ask us to restrict the processing of your information.  

Form: Request for the correction of inaccurate personal data and to restrict the use of personal data (in Finnish)

In that case, we can only process your data 

• with your consent 
• if we need the data for the purpose of establishing, submitting or defending a legal claim 
• in the public interest 
• to protect the rights of another person. 

If we limit the processing of your data on the basis of your request, we are obligated, as far as possible, to notify all those to whom the data was previously disclosed. 

Send a written data restriction request to the Regional State Administrative Agency’s registry. 

Right to be forgotten

Our policy is to delete all personal data as soon as we no longer have legal grounds to keep it.

In some circumstances, you can write to us and ask us to delete your information. You need to present grounds for erasure under Article 17 of the GDPR. You have the right to be forgotten if we no longer have legal grounds to keep your information or no longer need it for the performance or our duties.

Form: Request for the correction of inaccurate personal data and to restrict the use of personal data (in Finnish)

Right to object to the processing of personal data 

You have the right to object to us processing your personal data. You can do so at any time giving reasons related to your specific personal situation.

In that case, we will no longer be allowed to process your personal data unless there is a significant and substantiated reason that supersedes your interests, rights and freedoms, or if the processing of the data is necessary to establish, present or defend a legal claim. 

Send your written and justified request to the Regional State Administrative Agency's registry. 

If you believe that your personal data has been processed in a manner that is violated to the law, you can file a complaint or complain to the Office of the Data Protection Ombudsman about the processing of your data. However, we recommend that you first contact the Regional State Administrative Agencies' Data Protection Officer (see contact details below).

Contact information for the Data Protection Officer and further information on data protection
Office of the Data Protection Ombudsman