Information on the Processing of Personal Data

Prepared in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to asthe “GDPR”), Sections 19 and 20 of Act No. 18/2018 Coll. on the Protection of Personal Data, as amended (hereinafter referred to as the “Personal Data Protection Act”) as well as the provisions of § 109 et seq. of Act No. 452/2021 Coll. on Electronic Communications, as amended (hereinafter referred to as the “Electronic Communications Act”) (hereinafter referred to as the “Information”).

This Information is intended primarily for visitors to the website www.steinerka.sk, individuals interested in renting the properties featured on this website, or to individuals acting on behalf of such interested parties, as well as to other persons who, based on the website www.steinerka.sk, are interested in the Operator’s services and whose personal data the Operator processes.

The controller processing your personal data is Bevix, a. s., with its registered office at Malý trh 2/A, 811 08 Bratislava, Company ID No.: 47 153 547, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sa, File No. 7921/B.

For questions regarding the protection of personal data and when exercising your rights under this Privacy Notice, you may contact the Data Controller using the following contact information:

mailing address: Bevix, a. s., Malý trh 2/A, 811 08 Bratislava
email address: leasing@iad-rem.sk
phone number: +421 907 391 705

Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as the “Data Subject”); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or by reference to one or more factors specific to that natural person’s physiological, genetic, mental, economic, cultural, or social identity.

The Controller collects only personal data that is adequate, relevant, and necessary for the specific purpose of processing. The Controller collects personal data directly from the Data Subject or from the entity where the Data Subject works or performs activities on its behalf based on the relevant legal relationship, or from publicly available sources (e.g., the Commercial Register, the trade license registry, the registry of legal entities, entrepreneurs, and public authorities, the registry of nongovernmental nonprofit organizations, etc.).

Purpose: To communicate with individuals interested in real estate rental brokerage services

Legal basis: Article 6(1)(f) of the GDPR—processing necessary for the purposes of the legitimate interests pursued by the Controller or a third party. The legitimate interest is the handling of requests and inquiries received through the website.

Data subjects: individuals interested in renting real estate, and their legal, contractual, or other representatives.

Categories of personal data: The usual categories of personal data are processed .

Recipients or categories of recipients: real estate companies pursuant to Act No. 203/2011 Coll. on Collective Investment, as amended (with which the Controller has a contractual relationship), IAD Investments, správ. spol., a. s., external IT service providers, providers of legal and other professional services, and government authorities (in particular supervisory authorities and law enforcement agencies).

Retention period: until your request is processed. Thereafter, the data will be retained for the purpose of “Asserting, proving, and defending legal claims.”

Purpose: To maintain a database of individuals interested in real estate rental brokerage services

Legal basis: Article 6(1)(a) of the GDPR—processing of personal data based on the data subject’s consent.

Data subjects: individuals interested in renting real estate, and their legal, contractual, or other representatives.

Categories of personal data: The usual categories of personal data are processed .

Recipients or categories of recipients: real estate companies pursuant to Act No. 203/2011 Coll. on Collective Investment, as amended (with which the Controller has a contractual relationship), IAD Investments, správ. spol., a. s., external IT service providers, providers of legal and other professional services, and government authorities (particularly supervisory authorities and law enforcement agencies)

Retention period: 12 months from the inclusion of the person in the database.

Additional Information: As a Data Subject, you have the right to withdraw your consent at any time by sending your written withdrawal to the contact information provided in Section 2 of this Notice. Withdrawing your consent will not affect the lawfulness of the processing based on your consent prior to its withdrawal.

Purpose: To comply with the obligations under the Act on the Prevention of Money Laundering and the Prevention of Terrorist Financing

Legal basis: Article 6(1)(c) and (f) of the GDPR—data processing necessary to comply with a legal obligation and processing necessary for the purposes of the legitimate interests pursued by the Controller. The legitimate interest is the fulfillment of obligations arising from the Act on the Prevention of Money Laundering and the Prevention of Terrorist Financing, as amended. The provision of such data is your legal obligation.

Data subjects: individuals interested in renting real estate and their legal, contractual, or other representatives

Categories of personal data: The usual categories of personal data are processed .

Recipients or categories of recipients: real estate companies pursuant to Act No. 203/2011 Coll. on Collective Investment, as amended (with which the Controller has a contractual relationship), IAD Investments, správ. spol., a. s., the Financial Intelligence Unit, law enforcement authorities, other government agencies, legal service providers, accountants, auditors, other service providers, or obligated entities.

Retention period: 5 years from the termination of the contractual relationship or the completion of a one-time transaction outside of a business relationship, unless the supervisory authority specifies a longer period.

Purpose: Use of Cookies on Our Website

Legal basis: Article 6(1)(a) of the GDPR and Section 109(8) of the Electronic Communications Act—processing of personal data based on the data subject’s consent. Except for essential cookies, which are used to ensure the basic functionality of the website and for which consent is not required.

Data subjects: visitors to the website www.steinerka.sk.

Categories of personal data: common categories of personal data.

Recipients or categories of recipients: web hosting providers, external IT service providers, external content providers (Google LLC, Meta Platforms, Inc., and their subsidiaries).

Retention period: varies depending on the type of cookie. For more information, see the “How We Use Cookies” section available here.

Additional information:

Cookies are small text files that a web server stores on your device when you visit and browse a website. On our website, we use essential, functional, analytical, and marketing cookies. We use functional, analytical, and marketing cookies only if you give us your consent via the so-called cookie banner, which appears when you first visit the site. As a data subject, you have the right to withdraw your consent to the use of cookies at any time by adjusting the cookie settings in the cookie banner located at the bottom left of the page. Withdrawing your consent will not affect the lawfulness of processing based on consent prior to its withdrawal. For more information about cookies, their purpose, and their use, please see the “How We Use Cookies” section available here.

If you have provided us with the above consent, your data may be processed for statistical, analytical, and marketing purposes when you visit our website. Your data may be used to personalize the content of the website and content on the Facebook social network operated by Meta Platforms, Inc. In such cases, we may act jointly with this company as joint controllers. Basic information about the joint controller agreement can be found here.

Purpose: To assert, prove, and defend legal claims

Legal basis: Article 6(1)(f) of the GDPR—the Controller’s legitimate interest in protecting its rights and legal interests.

Data subjects: individuals interested in real estate rental brokerage services, their legal/contractual/other representatives, website visitors, and other natural persons, depending on the nature of the legal claim being asserted.

Categories of personal data: common categories of personal data.

Retention period: until the final conclusion of enforcement, execution, or bankruptcy proceedings.

Recipients or categories of recipients: providers of legal and other professional services; courts; law enforcement authorities; bailiffs; notaries; regulatory authorities and other government agencies; insurance companies; accountants, tax advisors, auditors, and other persons, depending on the nature of the claim being asserted.

Purpose: Processing requests from Data Subjects and fulfilling other obligations under the GDPR

Legal basis: Article 6(1)(c) of the GDPR—processing of personal data necessary for compliance with the Controller’s legal obligations. The obligation to provide data for this purpose arises from applicable regulations.

Data subjects: applicants , their legal or contractual representatives, and other individuals depending on the nature of the application or the situation.

Categories of personal data: common categories of personal data.

Retention period: until the obligations imposed by the GDPR are fulfilled. Thereafter, the data will be retained for the purpose of “Asserting, proving, and defending legal claims.”

Recipients or categories of recipients: legal service providers ; suppliers, the supervisory authority, and other government agencies; accountants, tax advisors, and auditors.

In connection with the use of third-party cookies on our website, your personal data may be transferred to the United States of America, and thus outside the European Union and the European Economic Area. If personal data is transferred to the United States, this is done in accordance with Commission Implementing Decision (EU) No. 2023/1795 of July 10, 2023, on the adequacy of the protection of personal data under the EU-U.S. Privacy Shield Framework. Google LLC, Meta Platforms, Inc., and their U.S. subsidiaries, as well as their services, are listed as certified on the U.S. Department of Commerce’s “Data Privacy Framework List” in accordance with the aforementioned Commission Implementing Decision (EU). For data transfers in cases not covered by the adequacy decision, the standard contractual clauses approved by the Commission (EU) shall apply: https://eur-lex.europa.eu/legal-content/SK/TXT/HTML/?uri=CELEX:32021D0914&from=SK. For other purposes, there is no transfer of personal data outside the European Union and the European Economic Area.

The Controller uses profiling in the context of marketing activities to tailor advertisements. It does so based on the consent you have provided. For other purposes, when processing personal data, the Controller does not make decisions based solely on automated processing that would have legal effects on the Data Subject or would similarly significantly affect them, nor does it use profiling for the purposes of such decision-making.

8.1. Right of Access

The data subject has the right to obtain confirmation whether the Controller is processing their personal data, and if so, they have the right to access such data and information pursuant to Article 15 of the GDPR, including the right to receive a copy of the personal data being processed.

8.2. Right to Correction

The data subject has the right to have inaccurate personal data corrected and incomplete personal data completed.

8.3. Right to Erasure

The data subject may request the erasure of personal data if the conditions of Article 17 of the GDPR are met, in particular if the data are no longer necessary for the original purpose, the data subject has withdrawn consent and there is no other legal basis, has successfully objected to the processing, or the data has been processed unlawfully. The right to erasure does not apply if processing is still necessary, in particular, to comply with a legal obligation or to establish, exercise, or defend legal claims.

8.4. Right to Restrict Processing

The data subject has the right to request restriction of processing in the cases specified in Article 18 of the GDPR, in particular while the accuracy of the data is being verified or an objection is being assessed, in cases of unlawful processing instead of erasure, or if the Controller no longer needs the data but the Data Subject requires it for legal claims.

8.5. Right to Data Portability

If the processing is based on consent or a contract and is carried out by automated means, the data subject has the right to receive the data that he or she has provided to the controller in a structured, commonly used, and machine-readable format and to transmit it to another controller, provided that the conditions of Article 20 of the GDPR are met.

8.6. Right to Object

The data subject has the right to object at any time, on grounds relating to his or her particular situation, to processing based on a legitimate interest. The controller will not continue the processing unless it demonstrates compelling legitimate grounds for the processing that override the rights and freedoms of the data subject, or grounds related to legal claims. If personal data are processed for direct marketing purposes, the Data Subject has the right to object to such processing at any time; once an objection is raised, the personal data will no longer be processed for direct marketing purposes.

8.7. Right to Withdraw Consent

If the processing is based on consent, the Data Subject may withdraw their consent at any time by using the contact information provided in Section 2 of this Notice or by adjusting the relevant cookie settings. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

8.8. Exercising Rights and the Right to File a Complaint

The data subject may exercise their rights through the contacts listed in section 2. The controller may, to the extent necessary, request additional information to verify the applicant’s identity. The controller will process the request without undue delay, generally within one month; in complex cases, the controller may extend this period in accordance with the GDPR. The data subject also has the right to lodge a complaint with the supervisory authority, which in the Slovak Republic is:

Office for Personal Data Protection of the Slovak Republic
Galvaniho Business Center II
Galvaniho 7/B
821 04 Bratislava
Slovak Republic
www.dataprotection.gov.sk

The controller may update this Information as appropriate, particularly in the event of changes to processing activities, the systems used, recipients, or applicable laws. The current version will be available on the website www.iad-rem.sk.

Version effective as of October 1, 2026