GEM Property

Privacy Policy

Updated 9 November 2026

1. Controller

GEM Property Oy (Business ID 2785218-2)
Aleksanterinkatu 48 A, 00100 Helsinki, Finland
www.gemproperty.fi

This policy also covers the group companies GEM Valuation Oy and GEM Brokerage Oy (together “GEM”). Each GEM company is the controller for the personal data of its own customers.

2. Contact person for privacy matters

Pekka Sirén, pekka.siren@gemproperty.fi, tel. +358 44 281 7554

3. Purposes and legal bases of processing

We process personal data for the following purposes:

  • Managing customer relationships and carrying out assignments (sell-side and buy-side advisory, property valuation, leasing services). Legal basis: contract, or steps taken before entering into a contract.
  • Responding to enquiries and keeping in touch with contact persons of customers, prospective customers and partners. Legal basis: legitimate interest.
  • Meeting legal obligations, such as customer due diligence under the Finnish Anti-Money Laundering Act in real estate brokerage, and bookkeeping. Legal basis: legal obligation.
  • Operating, maintaining and securing the website and measuring its use. Legal basis: legitimate interest, and consent for analytics cookies.

4. Personal data we process

  • Contact details: name, company, position, email address, phone number
  • Information about the customer relationship and assignments, such as correspondence, agreements and billing details
  • Identification data required by the Anti-Money Laundering Act in brokerage assignments
  • Technical website data: IP address, browser details and time of visit in the server logs, and visitor analytics data (pages viewed, device and approximate location)

5. Sources of data

We receive data from the data subjects themselves, from the companies they represent, from public sources (such as the Trade Register) and as technical data generated when the website is used.

6. Disclosures and processors

We do not sell personal data or disclose it for marketing. Data may be disclosed to authorities where required by law.

We use service providers that process data on our behalf: website maintenance and hosting (one.com, EU), visitor analytics (Google Ireland Ltd, Google Analytics), email and office services (Microsoft 365). If data is transferred outside the EU or EEA, for example to the United States in Google’s services, the transfer is made with safeguards required by the GDPR, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

7. Retention

We keep data for as long as the customer relationship or assignment requires, and after that for the period required by law: accounting records for 6–10 years, and data under the Anti-Money Laundering Act for 5 years after the customer relationship ends. Server logs are deleted within 30 days. Google Analytics data is kept for 14 months.

8. Cookies

The website uses the following cookies:

  • pll_language (necessary): remembers your language choice (Finnish or English) for one year.
  • _ga and _ga_ZPFC9CKQB1 (analytics, Google Analytics 4): tell us how the website is used, for example which pages are read and where visitors come from. They are kept for up to two years. Google Analytics does not store IP addresses.

Analytics cookies are used on the basis of your consent. You can delete cookies and block them in your browser settings.

9. Your rights

You have the right to:

  • access your data
  • have inaccurate data corrected
  • have your data erased when there is no longer a basis for processing it
  • restrict processing
  • object to processing based on legitimate interest
  • withdraw your consent
  • receive the data you have provided and transfer it to another service, where processing is based on a contract

Please send requests to the contact person in section 2. We respond within one month.

10. Right to lodge a complaint

If you believe that the processing of your data breaches data protection law, you can lodge a complaint with the Office of the Data Protection Ombudsman (www.tietosuoja.fi).

11. Security

Only GEM employees who need the data for their work can access it. Systems are protected with user accounts and passwords, and the connection to the website is encrypted (HTTPS).

12. Changes

We update this policy when needed. The current version is always available on this page.