Privacy Statement
Table of contents:
Introduction
- Controller and contact information
- Processing of personal data and the legal basis for processing
- Automated decision-making
- Disclosure and transfer of data
- Your data protection rights and how to exercise them
- Data retention
- Changes to this privacy statement
Introduction
Updated on 8.4.2025
Your privacy and the protection of your personal data are important to us. Forenom Group (hereinafter ”Forenom” or ”we”) is committed to protecting your privacy in the best possible way and to processing your personal data transparently in accordance with applicable data protection laws and good privacy practices.
This privacy statement provides information on how we collect, process and protect your personal data in all our operations.
1. Controller and contact information
The data controller of your personal data is the entity within Forenom Group* whose services you have been using or with whom you have interacted in some other context, e.g., as a job applicant or as a representative of our customer organization. If you wish to exercise your data subject rights or have any questions regarding data protection, please contact privacy@forenom.com
To ensure efficient processing of your request, please specify the country of destination in your message.
*Forenom Group companies: Forenom Group Oy, Forenom Holding Oy, Forenom Oy, Forenom Corporate Apartments Oy, Logitjänst Forenom AB, Forenom AS, Forenom ApS, Forenom Eesti Oü, Forenom Apartments AB, StayAt Hotelpart AB
2. Processing of personal data and the legal basis for processing
We collect and process personal data only to such extent that is necessary for our business operations, and for providing and developing our services and products. Personal data is primarily collected from you directly. In certain situations, we also collect personal data from other external sources with your consent or to the extent permitted or required by law, for example when we receive guest data from our customer, when we purchase marketing lists, or when your data is transferred to us from external sales channels (such as Booking.com).
The type of personal data we choose to collect in various situations and for different reasons will depend on the purpose of the processing. We process your personal data for the purposes defined below.
Purpose of personal data processing and categories of personal data processed
Provision of services
When you use our accommodation, subletting, and additional services or create a user account on our online service, we process your personal data to provide our service. The processing is based on the execution of the contract made with you.
We process the following categories of personal data for the aforementioned purposes:
- contact details, such as name, address, email, phone number
- booking details, such as accommodation, date, special requests, additional services
- information related to subletting, such as bank account
- registration details, such as username
Forenom processes special categories of personal data as defined in the GDPR (the EU General Data Protection Regulation) only with your explicit consent and only if the processing of special personal data is necessary to provide the services as agreed in the accommodation contract.
Creation of traveller registration form
We process your personal data in connection with our accommodation services to complete the traveller registration. We also need to verify your identity during your stay. The processing is based on compliance with a legal obligation.
The following information is processed in the guest registration:
- the traveler’s full name, date of birth and nationality
- the full names and dates of birth of the traveler’s accompanying spouse and minor children
- the traveler’s address
- the country from which the traveler is arriving
- travel document number
- check-in and check-out dates at the accommodation, if known
To comply with a legal obligation, Forenom processes the information contained in the customer’s passport or identity card, and in some cases, the customer may be asked to use strong electronic identification or provide a photo and other personal data to Forenom’s partner. Please note that in such cases banks, for example, are independent data controllers that process personal data in accordance with their own privacy policies.
Customer relationship management
We process your personal data to provide you with customer service and respond to inquiries you have made through our communication channels. This includes, among other things, pre-arrival instructions and collecting customer feedback after the end of the stay. When you contact us, we save the content of the call or message to carry out customer service. The processing is based on our legitimate interest in ensuring the quality of our services and maintaining the customer relationship.
We process the following categories of personal data for the aforementioned purposes:
- contact details, such as name, email and phone number
- customer feedback and complaint information, such as the content of messages and call recordings
Product and service development
We process your personal data to improve our services to better meet your needs. This includes, among other things, customer feedback and information derived from the use of our services. The processing is based on our legitimate interest in developing our services and business.
We process the following categories of personal data for the aforementioned purposes:
- customer feedback and complaint information
- purchase behavior related information, such as canceled or incomplete orders
Marketing, sales, and related analytics
We process your personal data for marketing and sales purposes, both for traditional and electronic direct marketing. Data is processed based on consent when required by law, such as when you subscribe to our newsletter from our website. Based on your consent, we also process personal data generated when using our website, such as setting marketing cookies on your device. When processing is based on consent, we will ask for your consent before starting the processing. In other cases, processing for marketing and sales purposes is based on our legitimate interest in promoting our services.
If you are a consumer customer, we will send you information about offers and current matters related to our service. If you are a representative of a corporate customer, such as an employee or business partner of our current and potential customer companies, or belong to another stakeholder group, we will send you offers and information about products, services, and promotional events related to your professional role. We also manage our stakeholder relationships by communicating relevant topics and advertising various events to you.
We occasionally organize lotteries and competitions, during which personal data is processed. Your personal data may also be used for market research and customer analysis. We can target marketing and advertising in various media by using and combining data collected during the customer relationship, data collected from customer surveys, online behavior data, and derived data about which of our services might interest you. Using the collected personal data, we create marketing target audiences to whom we offer targeted marketing content. We also share data with marketing partners to implement targeted advertising.
You have the right to opt out of marketing communications at any time. If the marketing and advertising are based on your consent, you can withdraw your consent at any time, for example, via the unsubscribe link in the newsletter or through the cookie notice.
We process the following categories of personal data for the aforementioned purposes:
- contact details, such as name, email
- device information, such as IP address
- direct marketing opt-outs and consents
Organizing events
We occasionally organize various events for our customers and potential customers. If you register, participate or are invited to such an event, we process your personal data to organize the event. The processing is based on our legitimate interest in marketing our activities and meeting our customers and potential customers.
We process the following categories of personal data for the aforementioned purposes:
- contact details, such as name, email and organization
- event-specific information, such as special dietary information
Invoicing, debt collection, and credit management
We process your personal data to manage and ensure payment transactions and invoicing. The processing is necessary for the performance of the contract and to comply with obligations under accounting legislation.
We process the following categories of personal data for the aforementioned purposes:
- payment information, such as payment method, credit card information and invoicing information
We also process your credit rating information with your consent to ensure efficient invoicing.
Ensuring safety and investigating misconduct
We process your personal data to maintain order and safety, as well as to prevent and investigate misconduct and other violations. This includes, among other things, recording camera surveillance in the common areas of our accommodation facilities, such as hallways and entrances. The processing is based on our legitimate interest in ensuring the safety of our staff, customers and premises, as well as preventing misconduct.
We process the following categories of personal data for the aforementioned purposes:
- information collected through security systems, camera surveillance recordings, logs of code locks
- information of the guests
Website visits and use of cookies
We use cookies on our website to enhance user experience, analyze the use of our site, and provide targeted advertising. When you visit our website, we may collect information about you and your preferences through cookies and other similar technologies based on your consent. You have the right to block the use of cookies, but this may affect the functionality of our services.
Read more about the use of cookies on our website and how to block their use by visiting our cookie policy.
Recruitment
If you apply for a job with us, we process standard job application information based on our legitimate interest to the extent necessary and appropriate to assess the applicant’s suitability for the role in question. The personal data processed depends primarily on the information provided by the applicant.
We process the following categories of personal data for the aforementioned purposes:
- contact details, such as name and email
- information related to the job application and CV, such as completed studies, work experience, language skills, IT skills, information about the applicant’s personal website, application and cover letter
We also collect information from third parties with your consent, for example, to conduct security checks or personal and suitability assessments.
3. Automated decision-making
Automated decision-making refers to a decision made entirely automatically without human involvement, which could have legal effects or other similarly significant impacts on you. Forenom does not perform automated decision-making at this time.
4. Disclosure and transfer of data
We process your personal data confidentially and do not disclose the data to third parties except as stated below:
- Within the group: We may disclose personal data to companies within the group to the extent necessary to achieve the purposes described in this statement
- Authorities: we may have to disclose some data to authorities or judicial administrators when required by law. We will do so only on the grounds of a valid decision of a court of law, upon the order of an authority or on the basis of a subpoena
- Company acquisitions: the acquiring party may gain access to relevant customer data in case of an acquisition or other corporate reorganisation
- Consent: we may disclose your personal data to third parties upon your consent
In some cases, such as in the context of marketing and product and service development, the service providers and partners we use may also collect your personal data for their own purposes. For example, there may be links on our website and in the messages sent to you to third-party websites, plugins, and applications. Following the links or contacting through them may give third parties permission to collect or share information about you. Forenom does not control these third-party services, and we are not responsible for the third parties' practices in processing your personal data when they act as independent data controllers. Please check the third party's practices in processing personal data from their own privacy documentation.
We also use subcontractors and external service providers for the processing of personal data, who are authorized to process your personal data only to the extent permitted by us and in accordance with the agreed services they are providing to us. This means that the third-party subcontractors and service providers cannot use your personal data for their own purposes. Any service provider we use is under contractual obligation to ensure an adequate level of data protection in all processing of your personal data. Service providers processing personal data on behalf of Forenom include, for example, the following:
- technical maintenance service providers
- campaign and direct marketing service providers
- cleaning and maintenance service providers for accommodation facilities
- customer service support service providers
- security and surveillance service providers
- providers of other additional services such as meal services
In addition to external service providers, Forenom Group Oy centrally provides IT services to other group companies.
Your personal data is stored and processed outside the European Economic Area, for example, when the service provider we use is located or stores data outside the European Economic Area. We only use partners whose data protection processes are properly organized and who guarantee adequate protection mechanisms for both the processing and transfer of personal data (for example, the standard contractual clauses approved by the European Commission).
5. Your data protection rights and how to exercise them
Under the GDPR, you have the following rights as a data subject:
- The right to withdraw consent
When the processing of personal data is based on your consent, you have the right to withdraw your consent at any time. For example, you can withdraw your consent to electronic direct marketing at any time.
- The right of access and right to rectification
You have the right to access the personal data we have collected about you at any time and receive confirmation of whether we process your personal data. If your personal data is inaccurate or incomplete, you have the right to make a request for rectification or completion of your personal data.
- Right to restrict or object to processing
In certain circumstances, for example if your personal data is inaccurate, you have the right to restriction of the processing until we have verified the accuracy of your personal data. Further, in certain situations you also have the right to object to the processing of your personal data completely. You can, for example, object to the processing for direct marketing purposes at any time (including profiling).
- Right to be forgotten
In some cases, you have the right to have your personal data erased. We will erase all personal data we have collected if they no longer are needed for the purposes they were originally collected for. We will also erase personal data if the processing was based on consent and you decide to withdraw your consent, or if you request us to restrict the processing and there is no legitimate ground for us to continue the processing.
- Right to transfer data from one system to another
You have the right to request the transfer of your personal data. This is possible only in cases when we process your electronic personal data based on your consent or agreement and applies only to such personal data you have provided us yourself. We will provide your personal data in machine-readable format so that you can store them yourself or transfer them to another controller. Upon your request, we will transfer the data to another controller directly if it is technically feasible.
If you want to use your above-mentioned rights, you can do it by sending your request to: privacy@forenom.com
We may ask you to clarify your request in writing or, if necessary, to provide additional information about your identity before processing your request.
In addition to the above-mentioned rights, you have the right to file a complaint about your personal data processing to the national supervisory authority.
If you have any questions regarding your rights, please contact us: privacy@forenom.com
6. Data retention
We retain your data only as long as necessary to fulfill the purposes described in this privacy statement within the limits set by applicable law. The retention period of your personal data depends on the obligations contained in any contract between you and Forenom, the requirements in national legislation (e.g., accommodation and accounting laws), the withdrawal of consent, and the necessity of the data for providing or ensuring our services. When the processing of personal data is no longer necessary, the data will either be destroyed or anonymized by irreversibly altering it into a form in which an individual can no longer be identified.
Key retention periods for your personal data:
- information related to the traveler registration is retained for one year after the end of the accommodation
- customer feedback and complaint data are retained for two years from the date of collection
- user accounts for the online service are retained for two years from the last login
- camera recordings are retained for up to three months from the date of recording
- documents related to invoicing are retained for the period required by accounting legislation
- information related to apartment rentals is retained for the duration of the rental and for three years after its termination
- for the retention periods of cookies, please check our cookie policy for more details
If you have any questions regarding the retention periods of your personal data, please contact us: privacy@forenom.com
7. Changes to this privacy statement
We continuously develop our privacy practices, which is why we may update this privacy statement from time to time. Changes may also be based on changes in legislation. We recommend that you review the privacy statement regularly to stay informed about how we process your data. If necessary, we will also notify you directly of any changes.