General Data Protection Regulation
real estate agency
Rhea R&T agency, s.r.o.
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “GDPR Regulation”) and the provisions of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments and Additions to Certain Acts, as amended (hereinafter referred to as the “Personal Data Protection Act”)
A. Introduction and basic concepts
1.
The purpose of this document is to inform the data subjects about the basic information on the processing of their personal data by our real estate agency RHEA R&T agency, s.r.o. as the controller and their rights.
2.
Personal data is any information relating to a natural person on the basis of which he or she can be directly or indirectly identified. Personal data are in particular first name, surname, type and address of residence, date of birth, birth number, email, telephone number, signature, as well as location data or online identifier. Personal data is any data specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
3.
Processing of personal data means any operation, activity or set of operations with personal data or sets of personal data. Processing of personal data includes, for example, obtaining, recording, recording, organising, structuring, storing, processing or altering, retrieving, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processing is any such operation on personal data, regardless of the means by which it is carried out.
B. Information on the processing of personal data and the rights of data subjects
4.
Controller:
Rhea R&T agency s. r. o.
Registered office: Matúškova 27, 831 01 Bratislava
ID: 55 744 389
Registered in the Commercial Register of the District Court Bratislava, Section: Sro, Evidence No. 173100/B
(hereinafter referred to as ‘the operator’)
5.
Contact details of the operator:
e-mail: info@rheaproperty.com
address for written correspondence: Rhea R&T agency, s. r. o., Matúškova 27, 831 01 Bratislava
6.
The data subject is the natural person whose personal data are processed. This policy applies to the following data subjects whose personal data may be processed by the controller:
- Client of the controller, including potential clients, who are interested in buying, selling or renting real estate;
- A person acting under or on behalf of a client of the controller, including a potential client (e.g. an employee, a member of their body or another natural person);
- A person who wishes to enter into a contractual relationship with a client of the operator for the purpose of buying, selling or renting a property and a person acting under or on behalf of that person (e.g. their employee, member of their body, contractual agent or other natural person);
- A person in the process of the real estate activity of the operator (e.g. employees of a bank);
- A supplier of the operator, including a potential supplier, who supplies goods and services to the operator;
- A person acting under or on behalf of a supplier of the controller, including a potential supplier (e.g. an employee, member of the controller’s body or other natural person)
(hereinafter also referred to as “data subject”)
7.
The controller processes the personal data of data subjects to the following extent:
- Basic identification data: title, first name, surname, maiden name, date of birth, birth number, address of permanent or temporary residence, nationality,
- nationality, signature, employer/company identification data, job position or function, place of work, place of business and ID number if you are a sole trader.
- Contact details: telephone number, e-mail address, fax number, address for service of documents.
- Transaction details: name of bank, bank account number.
- Socio-demographic data: age, sex (NB: this is only processed indirectly).
8.
The controller processes the personal data of the data subject or may process his/her personal data for the following purposes:
a)
Real estate activity – processing of personal data of the data subject by the controller for the purpose of providing services to clients by the controller, namely (1) to handle enquiries from potential clients interested in the services of the controller and for the purpose of contacting them (in the case of contacting the data subject via the form on the website of the controller www.rheaproperty.com, where he/she expresses his/her consent to the processing of his/her personal data by ticking the appropriate box), (2) for the preparation, negotiation, conclusion, amendment, registration of the contractual relationship with the client, (3) for the purpose of fulfilling the contractual relationship concluded with the client in the form of searching for interested parties resp. (4) for the purpose of drawing up a record of the inspection of the property, (5) for archiving all documents, including communications related to the contractual case with the client, in order to protect the rights and claims of the operator as well as to fulfil the legal obligations in the field of registry, which is a specific purpose listed below.
b)
Real estate activity – advertising – processing of personal data of the data subject, which in this case is exclusively the owner of the property, by the controller, for the purpose of advertising via Internet real estate portals in the form of offering properties for sale or lease to a third party. In the respective real estate CRM software, the personal data of the data subject as the owner of the real estate are also provided for the individual properties for the purpose of easier identification for the operator, but are not visible to third parties.
c)
Bookkeeping – processing of the data subject’s personal data by the controller for the purpose of keeping the controller’s accounts in accordance with local legislation.
d)
Registry management / Records of received and sent mail – processing of personal data of the data subject by the controller in order to ensure the management of the registry as a proper record of records (keeping a complete and accurate record of records in the registry log, keeping registers and indexes of records), proper decommissioning of records, ensuring the planned decommissioning of records that are not needed for further activities and their storage periods have expired, records of incoming and outgoing mail, records of electronic mail.
e)
Advertising and marketing – processing of personal data of the data subject by the controller for the purpose of sending newsletters by the controller about current properties and services of the controller.
f)
Enforcement of claims / defence of rights – processing of personal data of the data subject by the controller for the purpose of, (1) out-of-court enforcement of the controller’s claim, including the subsequent archiving of documentation in order to protect the rights and exercise of the controller’s claims, (2) conducting judicial or other proceedings and the subsequent archiving of documentation in order to protect the rights and exercise of the controller’s claims.
g)
Data subjects – processing of personal data of a data subject by the controller exercising rights under the GDPR and the Personal Data Protection Act for the purpose of processing (requests). The processing relates to ordinary personal data. It concerns a data subject exercising his or her rights under the GDPR and the Data Protection Act.
h)
Supply of goods and services to the controller – processing of the data subject’s personal data for the purpose of the supply of goods and services by suppliers to the controller, namely (1) for the preparation, negotiation, conclusion, amendment, registration of the contractual relationship with the supplier, (2) for the performance of that contractual relationship concluded with the supplier, (3) for the archiving of all documents, including communications related to the contractual case with the contractor, in order to protect the rights and claims of the controller as well as in order to fulfil the legal obligations in the field of registry, which is the specific purpose referred to above.
9.
The legal basis for the processing of personal data of the data subject by the controller for the individual purposes is:
a)
Real estate activity – (1) in the case of a client, it is the performance by the controller of a contract concluded between the controller and the data subject (client), including the performance of pre-contractual relations pursuant to Article 6(1)(b) of the GDPR (Section 13(1)(b) of the Personal Data Protection Act) and the legitimate interests of the controller pursued pursuant to Article 6(1)(b) of the GDPR. 1 lit. f) of the GDPR (§ 13 para. 1 lit. f/ of the Data Protection Act), which are the protection of the rights and the exercise of the claims of the controller and the consent of the data subject (contacting via the form on the website) to the processing of personal data pursuant to Art. 6 para. 1 lit. f) of the GDPR. (a) of the GDPR (Art. 13 para. 1 lit. a/ of the Data Protection Act) (2) in the case of a person acting under or on behalf of a client and a person who wishes to enter into a contractual relationship with a client, a person acting under or on behalf of a person who wishes to enter into a contractual relationship with a client, and a person in the process of the real estate activities of the controller, these are the legitimate interests of the controller pursued pursuant to Art. 6 para. 1 lit. f) of the GDPR Regulation (§ 13 par. 1 lit. f/ of the Personal Data Protection Act), which are the proper conduct of the business activity of the controller in the form of entering into and performance of the relationship with the client / protection of the rights and exercise of the claims of the controller.
b)
Real estate business – advertising – consent of the data subject (property owner) to the processing of personal data pursuant to Article 6(1)(a) of the GDPR (Section 13(1)(a/) of the Personal Data Protection Act).
c)
Bookkeeping – fulfillment of legal obligations by the controller pursuant to Article 6(1)(c) of the GDPR Regulation (Section 13(1)(c)/ of the Personal Data Protection Act) on the basis of local legislation in the field of bookkeeping, and in particular pursuant to Act No. 431/2002 Coll. on Accounting, as amended.
d)
Registry management / Records of incoming and outgoing mail – fulfilment of legal obligations by the operator pursuant to Article 6(1)(c) of the GDPR Regulation (Section 13(1)(c) of the Personal Data Protection Act) on the basis of local legislation in the area of registry management, namely pursuant to Act No. 395/2002 Coll. on Archives and Registers and on Amendments and Additions to Certain Acts, as amended.
e)
Advertising and marketing – consent of the data subject to the processing of personal data pursuant to Article 6(1)(a) of the GDPR Regulation (Section 13(1)(a/) of the Personal Data Protection Act).
f)
Enforcement of claims / defence of rights – the legitimate interests of the controller pursuant to Article 6(1)(f) of the GDPR Regulation (§ 13(1)(f/ of the Data Protection Act), which are the protection of the rights and the exercise of the claims of the controller and the fulfilment by the controller of its legal obligations pursuant to Article 6(1)(c) of the GDPR Regulation (§ 13(1)(c/ of the Data Protection Act) on the basis of local legislation, namely, pursuant to Act no. 160/2015 Coll., the Civil Procedure Code, as amended, Act No. 300/2005 Coll., the Criminal Code, as amended, Act No. 301/2005 Coll., the Criminal Procedure Code, as amended, Act No. 71/1967 Coll., the Administrative Procedure Code, as amended, Act No. 233/1995 Coll., the Act on Bailiffs and Enforcement Activity (the Enforcement Code) and on Amendments and Additions to Certain Acts, as amended.
g)
Affected persons – fulfillment of legal obligations by the controller in accordance with EU legislation (GDPR Regulation) and local legislation (Act No. 18/2018 Coll. on the Protection of Personal Data) pursuant to Article 6(1)(c) of the GDPR Regulation (Section 13(1)(c) of the Personal Data Protection Act).
h)
Supply of goods and services to the controller – (1) in the case of a supplier, this is the performance by the controller of the contract concluded between the controller and the data subject (the supplier), including the performance of pre-contractual relations pursuant to Article 6(1)(b) of the GDPR Regulation (Section 13(1)(b/) of the Personal Data Protection Act) and the legitimate interests of the controller pursued by the controller pursuant to Article 6(1)(f) of the GDPR Regulation (Section 13(1)(f) of the Personal Data Protection Act), and the legitimate interests of the controller pursued by the controller pursuant to Article 6(1)(f) of the GDPR Regulation (Section 13(1)(f) of the Personal Data Protection Act), and (2) in the case of a supplier. f/ of the Personal Data Protection Act), which are the protection of the rights and the exercise of claims of the controller (2) in the case of a person acting under a supplier or on behalf of a supplier, these are the legitimate interests of the controller pursued pursuant to Article 6(1)(f) of the GDPR (Section 13(1)(f/ of the Personal Data Protection Act), which are the proper conduct of the controller’s business in the form of the conclusion and performance of the relationship with the supplier / the protection of the rights and the exercise of the claims of the controller.
10.
The maximum retention period of personal data for individual purposes is determined in the following scope:
- Real estate activity – 10 years from the end of the contractual relationship, unless another purpose would imply a longer retention period.
- Real estate activity – advertising – the period for which the data subject has consented to the processing of personal data, or for a shorter period until the consent is withdrawn or the purpose ends.
- Bookkeeping – personal data shall be retained for 10 years in the documentation falling under this purpose, unless another purpose would imply a longer retention period.
- Registry Management / Records of incoming and outgoing mail – Personal data shall be retained for the periods specified in the other processing purposes defined by the controller, except for personal data in the mail records which shall be retained for 10 years.
- Advertising and marketing – The period for which the data subject has consented to the processing of personal data, or for a shorter period until such consent is withdrawn.
- Enforcement of claims / defence of rights – 10 years from the end of the enforcement action or proceeding.
- Affected persons – 1 year from the processing of the request.
- Supply of goods and services to the controller -10 years from the end of the contractual relationship unless another purpose would require a longer retention period.
11.
The potential recipients of personal data according to the individual purposes are:
- Real estate activities – State and public administration and public authorities, Suppliers of standard software or technical support, Suppliers of web hosting or cloud services, Suppliers of professional services (Legal advisors, Accountants, Tax advisors), Banks, Mail carriers, Couriers, Other Suppliers.
- Real estate activities – advertising – Operators of internet real estate portal.
- Bookkeeping – Tax authorities, Government and public authorities and public authorities, Suppliers of standard software or technical support, Suppliers of web hosting or cloud services, Suppliers of professional services (Legal Advisors, Accountants, Tax Advisors) Banks, Couriers, Postal carriers.
- Advertising and marketing of the services and products of the Operator – none.
- Registry management / Records of received and sent mail – Government and public administration and public authorities, Suppliers of standard software and technical support, Suppliers of web hosting or cloud services, Couriers, Mail carriers.
- Enforcement of claims / defence of rights – Courts, Arbitration Courts, Bailiffs, Criminal or offence law enforcement authorities, State and public administration and public authorities, Parties to proceedings including witnesses, experts, interpreters and others, Suppliers of standard software equipment or technical support, Suppliers of web hosting or cloud services, Suppliers of professional services (Legal advisors, Accountants, Tax advisors), Banks Mail carriers, Couriers.
- Affected Persons – Government and public administration and public authorities, Suppliers of standard software or technical support, Suppliers of web hosting or cloud services, Couriers, Postal carriers.
- Supply of goods and services to the operator – State and public administration and public authorities, Suppliers of standard software equipment or technical support, Suppliers of web hosting or cloud services, Suppliers of professional services (Legal advisors, Accountants, Tax advisors), Banks, Postal carriers, Couriers.
12.
The controller obtains personal data directly from the data subjects when concluding and executing a contract or when obtaining consent for the processing of the data subject’s personal data, from proceedings before public authorities, or from publicly available registers, lists and records.
13.
If the legal basis for the processing of the data subject’s personal data is the fulfilment of a legal obligation of the controller and the data subject refuses to provide him or her with personal data, this may lead, for example, to the occurrence of damages, the compensation for which may be claimed against the data subject (e.g. if a sanction would be imposed as a causal link to the failure to comply with the obligation). In such a case, the provision of the data subject’s personal data is a legal requirement and the data subject is obliged to provide it. In another case, the data subject’s failure to provide personal data as required by law may result in the conclusion of a contractual relationship with the data subject, in which case the provision of personal data is voluntary.
14.
If the legal basis for the processing of the data subject’s personal data is the conclusion or performance of a contractual relationship with the controller and the data subject refuses to provide the controller with personal data, it will not be possible to enter into a contractual relationship with the controller. The provision of personal data by the data subject is voluntary.
15.
If the legal basis for the processing of the data subject’s personal data is the legitimate interest of the controller in accordance with Article 6(1)(f) of the GDPR (Section 13(1)(f) of the Data Protection Act), the data subject shall be obliged to tolerate such processing, but shall have the right to object to it.
16.
If the legal basis for the processing of the data subject’s personal data is his or her consent to the processing of personal data and the data subject refuses to grant this consent to the controller, it will not be possible to process the data subject’s personal data for the intended purpose and for the controller to act accordingly. However, the provision of the data subject’s personal data is voluntary.
17.
Where the legal basis for the processing of personal data is the data subject’s consent granted to the controller, the data subject may withdraw it at any time by delivering a notice to the controller at the contact details provided above. The content of the notification must be the revocation of the consent given. However, the lawfulness of the processing of personal data on the basis of the consent given shall not be affected by its withdrawal.
18.
The data subject shall have the right of access to his or her data. At the request of the data subject, the controller shall issue a confirmation as to whether the personal data relating to the data subject are being processed. If the controller processes such data, it shall, upon request, issue a copy of those personal data to the data subject. The issue of the first copy shall be free of charge. For any further copies requested by the data subject, the controller shall charge a fee corresponding to the administrative costs incurred in issuing the copy. The controller shall inform the data subject in advance of these costs. If the person requests the information by electronic means, it shall be provided to him or her in a commonly used electronic form, by e-mail, unless he or she requests otherwise.
19.
The data subject shall have the right to rectification of personal data if the controller has recorded inaccurate personal data concerning him or her. At the same time, the data subject shall have the right to have incomplete personal data completed.
20.
The data subject shall have the right to erasure of personal data concerning him or her, provided that:
- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
- the data subject withdraws the consent on the basis of which the processing is carried out,
- the data subject objects to the processing of personal data pursuant to paragraph XXVI,
- the personal data have been unlawfully processed,
- the ground for erasure is the fulfilment of an obligation imposed by law, by a special regulation or by an international treaty to which the Slovak Republic is bound; or
- the personal data were collected in connection with the offer of information society services to a person under 16 years of age.
21.
The data subject shall not have the right to erasure of the personal data provided that the processing is necessary:
- To exercise the right to freedom of expression and information;
- for the performance of an obligation under a law, a special regulation or an international treaty by which the Slovak Republic is bound, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- for reasons of public interest in the field of public health;
- for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, unless the right to erasure is likely to render impossible or seriously impede the achievement of the purposes of such processing;
- for the establishment, exercise or defence of legal claims.
22.
The data subject shall have the right to restrict the processing of personal data where:
- Contests the accuracy of the personal data by means of an objection pursuant to paragraph XXVI, during a period allowing the controller to verify the accuracy of the personal data;
- the processing is unlawful and the data subject requests a restriction on the use of the personal data instead of erasure;
- the controller no longer needs the personal data for the purposes of the processing but the data subject needs them to establish, exercise or defend legal claims;
- the data subject has objected to the processing of the personal data on the basis of a legitimate claim by the controller, pending verification that the legitimate grounds on the part of the controller override those of the data subject.
23.
Where the data subject requests the restriction of the processing of his or her personal data, the controller shall not carry out any processing operations, other than storage, on the personal data without the data subject’s consent.
24.
The data subject shall be informed by the controller if the restriction on the processing of the data is lifted.
25.
The data subject shall have the right to data portability, which means obtaining the personal data which he or she has provided to the controller, while having the right to transmit those data to another controller in a commonly usable and machine-readable format, provided that the personal data have been obtained on the basis of the data subject’s consent or on the basis of a contract and that the processing is carried out by automated means.
26.
The data subject shall have the right to object at any time to processing of his or her personal data on grounds relating to his or her particular situation. The data subject may object to the processing of his or her personal data on the basis of:
- The performance of a task carried out in the public interest or in the exercise of official authority, or the legitimate interest of the controller,
- the processing of personal data for direct marketing purposes,
- processing for scientific or historical research purposes or statistical purposes.
27.
If the data subject objects to the processing of personal data for direct marketing purposes pursuant to point XXVI(b), his or her personal data may no longer be processed by the controller.
28.
The controller may not further process the personal data unless it demonstrates compelling legitimate interests for the processing of the personal data which override the rights or interests of the data subject or grounds for exercising a legal claim.
29.
The data subject shall have the right to bring an action before the Office for Personal Data Protection of the Slovak Republic if he or she considers that his or her rights in the field of personal data protection have been violated.
30.
Personal data is not subject to profiling (§ 5 letter g/ of the Personal Data Protection Act) or automated decision-making (§ 28 of the Personal Data Protection Act).
31.
The controller does not intend the cross-border transfer of the data subject’s personal data to third countries outside the European Economic Area (EU, Iceland, Norway, and Liechtenstein).
32.
The controller is a company established in a member state of the European Union (the Slovak Republic) and is therefore not obliged to elect a representative pursuant to Article 27 of the GDPR (or pursuant to Section 35(1) of the Personal Data Protection Act). The controller is also not obliged under Article 37 of the GDPR (or Article 44 et seq. of the Personal Data Protection Act) to appoint a responsible person.