GDPR

Félagsbústaðir place an emphasis on processing only the personal information that is necessary in accordance with the purpose behind the collection of the information. Different personal information may be collected depending on whether you are communicating with the company yourself or whether the communication is on behalf of a legal entity. The processing of personal information depends on the nature of the relationship you have with Félagsbústaðir.

Félagsbústaðir process, as applies in each instance, the following personal data in particular:

• identification and contact information, e.g. name and social security number, address, email and phone number,
• information about the relationship of individuals with legal entities that have a business relationship with the company, e.g. job title and place of work,
• communication history, e.g. information from communication channels you choose to use with us, e.g. letters, e-mails, messages via a web interface or other forms of communication,
• payment and financial information about persons who have a rental or business relationship with the company, e.g. information about bank accounts, VAT numbers and dates of works or payments received and, depending on the circumstances, defaults,
• technical information, e.g. IP address,
• digital footprints, e.g. online behavior,
• footage from security cameras in and around our offices as well as at our rental properties and service apartments for the elderly.

Félagsbústaðir process personal data that is classified as sensitive personal data according to the Personal Data Protection Act, e.g. social and health issues of individuals.

Félagsbústaðir process personal data mainly for the purpose of:

• to be able to communicate with individuals who are tenants of the company or are in charge of legal entities that have a business relationship with the company
• check whether criteria are met before an apartment is allocated
• to be able to enter into and execute lease agreements, business agreements and other agreements related to the company's daily operations
• enable the company to provide services and fulfill its contractual obligations
• collect rent
• assess the condition of real estate, e.g. in connection with the assessment of maintenance needs
• fulfill a legal obligation that rests on the company
• respond to inquiries, suggestions and complaints from individuals
• market the company's services and products
• promote and increase transparency in the management of the company
• look out for the interests of the company and other tenants
• ensure security and property surveillance, i.a. with security cameras and surveillance systems

When you use our website, we may collect information about your use, i.e. which website you came from, together with the type of browser and operating system you use, the timing and duration of your visit, and which subpages you visit within the Félagsbústaðir website. Here you can find more information about our use of cookies.

Félagsbústaðir process personal data based on the following according to the Act on Data Protection and Processing of Personal Data:

• on the basis of the consent of individuals, cf. 1. tl. Paragraph 1 Article 9 This applies in particular in relation to the marketing of Félagsbústaðir. In those cases, the company provides the individual with more detailed information about the specific processing of personal data that the consent covers. An individual can at any time withdraw their consent to the processing of their personal data, and the processing to which the consent applies is then terminated. However, the withdrawal of consent does not affect the processing of personal data until the withdrawal, cf. Paragraph 3 Article 10 of the Act on Data Protection and Processing of Personal Data
• to fulfill a contractual obligation, cf. 2. tl. Paragraph 1 Article 9 This permission mainly applies to the processing of personal information for the benefit of the company's business relationship with tenants, e.g. due to a lease on an allocated apartment or due to debt collection where rent is not paid.
• to fulfill a legal obligation, cf. 3. tl. Paragraph 1 Article 9 This applies in particular in relation to data that are covered by Act no. 77/2014 on public archives
• To protect the legitimate interests of the company, cf. 6. tl. Paragraph 1 Article 9 This applies in particular to camera surveillance in our offices, in common areas of our apartment buildings and in our service apartments for security purposes, together with the collection of arrears.

Félagsbústaðir store personal data for as long as necessary according to the laws and regulations that apply to the company's activities, or as long as the company's legitimate interests require and there is a legitimate reason. For example, footage from security cameras is stored for a maximum of 30 days, after which time the footage is automatically deleted unless it is necessary to preserve it in order to establish, maintain and, as the case may be, defend legal claims, especially in a court case.

The company has a delivery obligation based on Act no. 77/2014 on public archives. This means that the company is not allowed to use or dispose of any document that falls under the scope of the law, except with a legal authorization or a special authorization from the National Archives. The data is returned to the City Archives after a certain time has passed according to the rules.

We collect personal information from you directly and in certain cases personal information is obtained automatically, e.g. when using our website. Félagsbústaðir primarily works with personal information provided by the Reykjavík City Welfare Department, which is responsible for the allocation of Félagsbústaðir's apartments. Félagsbústaðir may also receive information from other sources, e.g. lawyers, police, health institutions and individuals.

Félagsbústaðir only communicate personal information to third parties where this is required by law or in the case of a service provider being hired by Félagsbústaðir to perform predetermined work. For example, this may be entities that provide information technology and electronic communications services. In certain cases, such parties can be considered to be processing parties, and Félagsbústaðir then enters into a processing agreement with the relevant party in accordance with the requirements of the Act on Data Protection and Processing of Personal Data.

Félagsbústaðir may also share personal information with third parties when this is necessary to protect the urgent interests of the company, such as in the collection of arrears. 

In the event that the processing party works, incl. hosts, data outside the European Economic Area (EEA area), then Félagsbústaðir ensure that a legitimate basis is in place according to the Act on Data Protection and Processing of Personal Data

Félagsbústaðir advise you that when you access or contact us through our social media pages, the providers of the social media services may be able to access information and we encourage you to familiarize yourself with their privacy statements.

Security in the processing of personal information is important to Félagsbústaðir and we have taken appropriate technical and organizational security measures to ensure the protection of your personal information in line with our policy on security, including by installing appropriate access controls.

In the event of a breach of security concerning your personal information, and such a breach is deemed to result in a high risk to your freedom and rights, we will notify you without undue delay. In this sense, a breach of security is considered an event that results in your personal data being lost or destroyed, altered, disclosed, or accessed by unauthorized persons.

Subject to the conditions detailed in the Act on Data Protection and Processing of Personal Data, you have the right to:

• get information about what personal data the company has registered about you and their origin, as well as information about how your personal data is processed,
• get access to and a copy of all the personal information that is processed about you, if the interests of others do not stand in the way, e.g. due to the rights of others which may prevail, or request that they be sent to a third party,
• get incorrect, misleading or incomplete personal data updated and corrected, as well as blocking their use or deleting them, as per law no. 77/2014 on public archives,
• object if you wish to restrict or prevent the processing of your personal data,
• information about whether automatic decision-making is carried out, and the grounds on which such decision-making is based and a review of automatic decision-making,
• revoke your consent that Félagsbústaðir may collect, record, process or store your personal data, when processing is based on that authorization. Withdrawal of consent shall not affect the legality of processing based on consent until the withdrawal.

If you want to exercise that right, you can send a written request to personuvernd@felagsbustadir.is. We will confirm receipt of the request and normally respond within one month of receiving the request. If it is not possible to respond within a month, we will notify you of a delay in processing within the month. No fee is charged when individuals exercise their right in accordance with the above, except in cases where the request is considered excessive or manifestly unreasonable.

You also have the right to file a complaint with Persónuvernd if you see reason to do so. Information about Persónuvernd can be found on their website, www.personuvernd.is.

Electronic monitoring is carried out with security cameras in and around various residential buildings owned in full by Félagsbústaðir, for security and property protection purposes. The persons who visit monitored residential premises may therefore be recorded on camera. The processing of information collected through video surveillance is based on the legitimate interests of Félagsbústaðir. The authorization for this is in the 6th tl. Paragraph 1 Article 9 in the Act on Data Protection and Processing of Personal Data.

Personal information generated through the use of security cameras will only be used in the event of an incident involving damage of the property or the safety of individuals, e.g. theft, vandalism or accident. Personal information may not be copied or handed over to other parties, except on the basis of a legal authorization, the consent of the registered party or according to the decision of the Persónuvernd in each case. Personally identifiable video recordings are therefore generally not handed over to anyone other than the police, and then in the case of an accident or an alleged criminal act. Video recordings may also be shared for the purpose of Félagsbústadir being able to establish, maintain and, as the case may be, defend legal claims. In cases where footage is used for that purpose, it is permitted, as necessary, to grant access to the footage to the managers, lawyers and insurance company of Félagsbústaðir and other parties, as well as the courts.

Footage created during the use of security cameras is automatically deleted after a maximum of 30 days, unless it is necessary to preserve it in order to establish, maintain and, as the case may be, defend legal claims, in particular in a court case, provided that the law or a court order or the order of a competent authority is available.