Home › Privacy

Privacy notice

How Samla Capital Oy processes personal data: from clients, representatives of corporate clients and partners all the way to the website forms.

Who processes your personal data

Samla Capital Oy ("we")

Hannikaisenkatu 39, 40100 Jyväskylä, Finland

Business ID 2684294-3

What personal data we process and where we collect your data from

We process the following personal data about you if you are a potential client of ours or represent a potential corporate client: name, contact details (telephone numbers, email addresses and addresses), your position in the company you represent, and the information you have provided to us when expressing your interest.

We may receive this information from you, from public sources (such as the website of the company you represent or commercial information service providers), from our partners who are permitted to disclose the information, or from other companies belonging to the same group as us.

The forms on our website

There are three forms on our website that collect personal data. All three store the data in Samla Capital's own database; the data is not shared with third parties in connection with the forms and is not used for advertising. The forms' spam protection does not use cookies and does not store IP addresses.

Contact form

We store the name, the email address, any telephone number, the topic you select and the content of the message. The basis for processing is responding to your enquiry. We retain enquiries for no more than 12 months from the last contact, after which they are deleted.

Market Pulse subscription form

We store your email address and name. For those who subscribed before 30 September 2026, we have also stored the interests selected when subscribing (market reviews and/or news and insights). The basis for processing is your consent, which you give when subscribing; the time the consent was given and the content of the consent text are stored. Every message sent includes a personal unsubscribe link that works immediately; you can cancel your subscription at any time through it, after which no further messages are sent to your address.

The subscriber register is kept in our own environment, and subscriber addresses are not stored in the sending service as a contact list. For the technical sending of the letters we use the European sending service Mailjet, which is part of the Sinch group and whose server environment is in the European Union. Recipient addresses are given to the service for each send, and the service retains a sending log and information on undelivered messages. Withdrawal is carried out in our own register and takes effect immediately. We do not track the opening of messages or the clicking of links.

Apartment application form

On the apartment application form we store the property applied for and the name and contact details of the applicant and any second applicant, the Finnish personal identity code, employment and income details, information on credit record entries, pets and smoking, the reason for moving and any additional information: in practice all the fields filled in on the form. The basis for processing is handling your application and making the tenant selection, that is, pre-contractual steps taken at your request. Submitting the form requires you to confirm that you have read this notice (a checkbox); the time the confirmation was given is stored.

The Finnish personal identity code is processed in order to check credit records and to identify the applicant unambiguously. The field is optional, because not every applicant has a Finnish personal identity code. Under section 29 of the Data Protection Act (1050/2018) a personal identity code may be processed in the granting of credit and in rental activities. The personal identity code and the other details of the application are not sent by email. The confirmation email contains only your first name, the property applied for and the date the application was received.

The application is encrypted as soon as the website receives it and is stored encrypted in our own application register. No application data remains on the website server. You will receive an email confirming that your application has been received. For the confirmation email we use the same sending service as for the Market Pulse letters.

Access to the application data is limited to the persons making the tenant selection. An application is deleted 12 months after its processing has been completed, and an application that has not been processed 12 months after it was received. The data of the selected applicant becomes part of the tenancy records.

We process the following personal data about you if you are a client of ours:

Identification data: name, date of birth, personal identity code, place of birth, nationality, a copy of a passport, driving licence or other acceptable identification document
Contact details: telephone numbers, email addresses and addresses (including postal address and foreign addresses)
Financial information: information on assets and income, credit information
Contract-related information: information concerning the contract, information on investments in the funds we manage
Invoicing and payment details
Information relating to statutory requirements: information we need in order to meet the customer due diligence obligation and to manage risks relating to money laundering and terrorist financing. Such information includes, for example, your principal source of livelihood, information on the origin of funds, and information relating to tax liability in another country, such as a foreign tax identification number and your nationality and the country in which you are liable to tax
Email correspondence, messages in our other digital channels and other documentation of communications with you
Any marketing prohibitions and subscriptions to the newsletter and key information documents
Any other information you have provided relating to the client relationship.

We collect this information from you, with the exception of credit information, which we check from the service of Suomen Asiakastieto Oy or Alma Talent Oy. We may also check and update your information from the Population Information System and the registers of the Tax Administration, and from companies providing information services. We have a statutory obligation to identify our clients, so providing the information is a precondition for establishing a client relationship.

We process the following personal data about you if you are a representative, beneficial owner, owner or member of a governing body of a corporate client of ours:

Identification data: name, date of birth, personal identity code, place of birth, nationality, a copy of a passport, driving licence or other acceptable identification document
Contact details: telephone numbers, email addresses and addresses
Your position in the corporate client
Email correspondence, messages in our other digital channels and other documentation of communications with you
Any marketing prohibitions and subscriptions to the newsletter and key information documents.

We collect the information primarily from you, but we also receive information from the company whose representative, beneficial owner or governing body member you are. We also obtain information from registers maintained by the authorities (for example the Population Information System, the registers of the Tax Administration, business registers and the registers of supervisory authorities) and from commercial information providers who supply information on, for example, beneficial owners and politically exposed persons.

If you are a client of ours or a representative, beneficial owner, owner or governing body member of a corporate client, we carry out sanctions list screening (lists maintained by international organisations, for example the EU or the UN, and by national bodies, for example the Office of Foreign Assets Control (OFAC)).

If you are our partner or a representative of our partner, we process the following information about you

Basic information: name, telephone number, email address and position with the partner
Any marketing prohibitions; and
The cooperation agreement and information relating to the cooperation.

We receive the information regularly from you and from the partner. Information may also be received and updated from registers maintained by the authorities or from other public sources.

If you are our tenant, a contact person of our corporate tenant or a rental applicant, we process the following information about you

Basic information: name, date of birth and personal identity code if you are a private individual tenant; the name and position of the contact person of a corporate tenant
Contact details: telephone numbers, email addresses and addresses
Lease information: the leased premises, the lease term, the rent and other charges, security deposits, and amendments to and termination of the lease
Invoicing and payment information: rent payments, payment reminders and information relating to debt collection
Credit information, which is checked when the tenancy begins
Communication during the tenancy, for example fault reports, maintenance requests, handover of keys and other correspondence

We receive the information primarily from you in connection with the rental application and the lease and during the tenancy. We check credit information from a credit information company, and we may check the information of a corporate tenant from company registers. We may also receive information from a partner that handles letting, property management or maintenance on our behalf.

We process the personal identity code in order to identify the tenant unambiguously and to check credit information. Under section 29 of the Data Protection Act (1050/2018) a personal identity code may be processed in rental activities.

How we use your personal data and on what legal bases

We use your personal data so that we can meet our statutory and contractual obligations and so that we can make offers to you and provide our products and services or enter into contracts with you.

Entering into and administering contracts (performance of a contract)

The principal purpose of processing personal data is to collect, process and verify personal data before an offer and a contract are made, and to document, administer and carry out the tasks set out in the contract.

Examples of tasks relating to the performance of a contract:

the processes needed to make an investment
customer service during the term of the contract

Compliance with the requirements and obligations laid down in law, in regulations or in decisions of the authorities and supervisory authorities (legal obligation)

In addition to performing the contract, compliance with the obligations laid down in law, in regulations and in decisions of the authorities also requires us to process personal data.

Examples of statutory obligations that require the processing of personal data:

customer due diligence (KYC, Know Your Customer)
the prevention, detection and investigation of money laundering, terrorist financing and fraud
sanctions screening
accounting legislation
reporting to tax, police, enforcement and supervisory authorities
obligations relating to risk management
other obligations relating to service- or product-specific legislation, such as legislation on funds

Managing the client relationship and direct marketing (legitimate interest / consent)

Your personal data may be used to manage the client relationship, for example to send client communications. Your personal data may be used for direct marketing unless you have prohibited the use of your data for direct marketing purposes.

Marketing, product and customer analyses (legitimate interest)

Personal data is also processed in connection with marketing, product and customer analyses. Marketing activities and the development of processes, business and systems, including testing, may also be based on the processing of personal data. This allows us to improve our product range and our customer service and to optimise the services offered to clients. This may also involve profiling. We have a legitimate interest in using profiling for, among other things, customer analyses carried out for marketing purposes.

Carrying out cooperation

The information is processed in connection with managing the cooperation, administering the service provided to the partner and instructing and informing representatives.

Managing the tenancy (performance of a contract)

We process tenants' information in order to conclude the lease, to invoice and collect rent, to maintain the leased premises and handle fault reports, and to terminate the tenancy. We also process information on rent payments because of our accounting obligations (legal obligation).

Automated decision-making

We do not make decisions concerning you solely on the basis of automated processing. Tenant selection and client selection decisions are always made by a person.

Use of artificial intelligence

We use artificial intelligence to support our work. AI helps us, for example, in retrieving and structuring material, drafting and translating texts, checking calculations and reporting.

For the purposes of the data protection regulation, an AI service is one processor of personal data and one place of processing alongside our other information systems. Processing means all operations performed on personal data: collection, storage, organisation, use, transfer and erasure. The use of AI is therefore not a separate data protection question but part of the same processing that this notice otherwise describes.

We do not use artificial intelligence to make decisions concerning you. This applies in particular to:

the assessment of credit information and decisions on creditworthiness
the approval or rejection of apartment applications and tenant selection
starting, continuing or ending a client relationship
risk assessment or classification concerning you

In these matters the decision is always made by a person, who is also responsible for it. We do not profile you using artificial intelligence.

Content produced by AI is always checked before it is used.

We do not use your personal data to train AI models.

Consent

Where necessary, we may in certain situations ask for your consent to the processing of your personal data (for example consent to receive electronic direct marketing). The request for consent contains information on the processing of the data in question. If you have given your consent to the processing of personal data, you also have the right to withdraw your consent. You can withdraw your consent by contacting us: samuel.kovanen(at)samla.fi.

To whom we may disclose your personal data

Where the law permits, we may disclose your personal data to other parties, such as the authorities (for example tax, police, enforcement and supervisory authorities in the countries concerned), companies belonging to the same group as us and business partners. Before disclosing information we always ensure that the applicable financial sector confidentiality obligations are observed.

Providing services and complying with contracts may also require the disclosure of your personal data.

Information collected in the registers is not disclosed outside the group for marketing, sales, opinion or market research purposes.

We may disclose tenants' information to the property manager and maintenance company of the leased property and to a partner that handles letting or debt collection on our behalf, to the extent necessary for managing the tenancy.

We use the following processors in the processing of personal data:

IT service providers
mailing and communication service providers
email sending service provider (technical sending of newsletters, market reviews and apartment application confirmations)
the accounting firm
marketing service providers
providers of artificial intelligence services (language model, speech recognition, image generation)
providers of cloud and server services
providers of property management, maintenance, letting and debt collection services

Do we transfer data to third countries

Most of the processing of your personal data takes place within the European Economic Area. Our client and tenant data is stored in a server environment located in Finland, for which a data processing agreement under the data protection regulation has been concluded.

The server environment of the sending service we use for newsletters, market reviews and apartment application confirmations is in the European Union.

Some processing does, however, take place outside the European Economic Area:

The language model used in AI-assisted work and the generation of images: processing takes place in the United States. The transfer is based on the standard contractual clauses approved by the European Commission.
The delivery of our website, domain name services and email routing: processing takes place in the European Union and in the United States. The transfer is based on the European Commission's adequacy decision (the EU–U.S. Data Privacy Framework).

In the other services we use, processing takes place within the European Economic Area.

Before any transfer we always ensure that the transfer has a basis under the data protection regulation and that appropriate safeguards are in place. You may request further information about the transfers and their safeguards from the address given at the end of this notice.

How we protect personal data

Protecting your personal data is very important to us, and we take it and other data protection matters seriously by treating the protection of personal data as the foundation of our business. We have appropriate technical, organisational and administrative security procedures in place to protect all information in our possession against loss, misuse, unauthorised use, disclosure, alteration and destruction.

Your rights relating to privacy

As a data subject you have rights relating to the personal data we hold. You have the following rights:

A) The right to request access to your personal data

You have the right to access the personal data we hold about you. The right of access may, however, be restricted by legislative measures or if access to the data would adversely affect the rights and freedoms of others.

B) The right to request the correction of incorrect or incomplete data

If the data is incorrect or incomplete, you have the right to request that it be corrected, unless legislation restricts this.

C) The right to request the erasure of data

You have the right to request the erasure of your data in the following cases:

you withdraw your consent to the processing and there is no other justified ground for the processing
you object to the processing and there is no acceptable reason to continue it
you object to the processing of the data for direct marketing purposes
the processing of the data is unlawful
the data is no longer needed for the purposes for which it was collected or otherwise processed

Because of financial sector legislation we are in many cases obliged to retain your personal data for the duration of the client relationship and also after it.

D) The right to restrict the processing of personal data

You can ask us to restrict the processing of your personal data to storage only, if

you contest the accuracy of the data we process
you contest the lawfulness of the processing but object to the erasure of your data
you have objected to the processing of your data
we no longer need your data but you need it in connection with a legal claim

E) The right to object to processing

You have the right to object to the processing of your personal data on grounds relating to your particular personal situation, if the processing is based on our legitimate interest and there is no compelling and justified reason for the processing. You always have the right to object to the processing of your personal data for direct marketing purposes or to profiling related to direct marketing.

F) The right to data portability

You have the right to receive the personal data you have provided to us in a machine-readable format. This right applies only to personal data that has been processed automatically and on the basis of your consent or the performance of a contract. The data may also be transferred from us to another controller, if that is secure and technically possible.

If you wish to exercise the rights listed above, please contact us by email at info(at)samla.fi or by post at Samla Capital Oy, Hannikaisenkatu 39, 40100 Jyväskylä, Finland.

The right to lodge a complaint with the data protection authority

You have the right to lodge a complaint with the supervisory authority if you consider that the General Data Protection Regulation has been infringed in the processing of your personal data.

Contact details of the supervisory authority:

Office of the Data Protection Ombudsman

Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland

Postal address: PL 800, 00531 Helsinki, Finland

Switchboard: 029 566 6700

Email: tietosuoja(at)om.fi

Cookies

Our website does not use tracking or marketing cookies (such as Google Analytics, Facebook or Google Ads) or third-party analytics. At the time this notice was written the site sets no cookies in your browser at all. If cookies are later introduced on the site, for example for site functionality, information on the cookies used and their purpose will be added to this section before they are taken into use.

The storage and retention of form submissions from the website is described in more detail above under "The forms on our website". If you give your consent to direct marketing or enter into a client relationship with Samla Capital Oy, we retain client data for the duration of the client relationship or while the marketing consent is in force.

How long we retain your personal data

We retain your data for as long as it is needed for the purpose for which it was collected, or for as long as the law and regulations require. If we retain your data for purposes other than performing a contract, such as the prevention of money laundering, accounting and meeting capital adequacy requirements, we retain the data only if it is necessary for that purpose and/or required by law and regulations.

For clarity, examples of retention periods are set out below:

The prevention, detection and investigation of money laundering, terrorist financing and fraud: at least five years after the end of the business relationship or the execution of an individual transaction
Accounting legislation: up to ten years
Other obligations relating to service- or product-specific legislation, such as legislation on funds: up to seven years
Information on the performance of a contract: up to ten years from the end of the client relationship, for defending against legal claims
Information from the website contact form: no more than 12 months from the last contact
Market Pulse subscription data: for the duration of the subscription. After unsubscribing, we retain the address, the consent and the withdrawal for two years in order to demonstrate that the withdrawal has been carried out.
Apartment applications: 12 months from the completion of processing, applications that have not been processed 12 months from receipt
Information relating to a tenancy: up to ten years from the end of the tenancy, because of accounting regulations and for defence against legal claims

How changes are made to this notice and to the cookie notice

We continuously improve and develop our services, products and websites, so our privacy notices may be amended from time to time. Please read the privacy notice from time to time so that you have up-to-date information.

Contact in data protection matters

If you have questions about the privacy notice, you can contact our staff. The primary contact person in data protection matters is Samuel Kovanen, who can be reached by email at samuel.kovanen(at)samla.fi or by post at Samla Capital Oy, Samuel Kovanen, Hannikaisenkatu 39, 40100 Jyväskylä, Finland.

Updated 30 September 2026.