PERSONAL DATA PROTECTION, PROCESSING, AND CONSENT TO PROCESSING

This Policy is drafted in compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter: “GDPR”) and the provisions of the Slovenian Personal Data Protection Act (Official Gazette of the RS, No. 94/07 – official consolidated text and 177/20) (hereinafter: "ZVOP-1").

Personal Data Controller: CORWIN SK a.s., headquartered at: Námestie Mateja Korvína 1, 811 07 Bratislava, reg. no.: 45500126 (hereinafter: "CORWIN" or "Controller")

CORWIN engages in the construction of various real estate development projects. Detailed information on projects carried out by CORWIN is available at: https://www.corwin.sk/si/projekti/ (hereinafter: "Projects"). For the purpose of informing you about news and current offers relating to our projects and other activities that we carry out, your personal data will only be processed to the following extent based on your consent: a) name and surname, b) email address and c) phone number (data specified in points (a) to (c) hereinafter: "Personal Data").

CORWIN will only transfer your personal data to CORWIN Group companies (for more info on CORWIN Group companies that cover individual projects, please see: http://blumental.eu/, http://blumentaloffices.sk/, https://www.einpark.sk/, https://dubravy.eu/, http://www.einparkoffices.sk/, http://www.guthaus.sk/, https://www.kvartet.si, and www.vilharia.si).

I. Controller identification and contact details

The Controller on whose behalf personal data is processed is CORWIN, headquartered at Námestie Mateja Korvína 1, 811 07 Bratislava – Municipality of Staré Mesto, registration no.: 45 500 126, registered with the Bratislava District Court I, division: Sa, file no. 5015/B. Contact info: T: +421 2 5441 6009, +421 2 5441 6007, F: +421 2 5441 6011, E: corwin@corwin.sk.

II. Establishing the purposes of data processing and determining the legal basis

CORWIN will only process personal data to the extent that you, as a data subject, have provided for the following purposes:

  • direct marketing, informing data subjects (customers or potential customers) about news related to individual projects carried out by CORWIN and sending additional marketing offers to CORWIN's customers via direct mail, e-newsletters, personalised offers or other appropriate formats. The legal basis for personal data processing is the consent of customers or potential customers if they provide an e-mail address and consent to the processing of their personal data for the purpose of receiving business and marketing information sent by CORWIN (point (a) of the first paragraph of Article 6 of GDPR);
  • recording and promotional communication in the sale of real estate: the legal basis for personal data processing is CORWIN's legitimate interest in compliance with point (f) of the first paragraph of Article 6 of GDPR and the consent of customers or potential customers if they provide an e-mail address and consent to the processing of their personal data for the purpose of receiving business and marketing information sent by CORWIN (point (a) of the first paragraph of Article 6 of GDPR);
  • statistical purposes: for the purpose of combining personal data with other parties' data to produce reports that help to improve CORWIN's provision of services, while respecting technical and organisational measures to ensure compliance with the principle of data minimisation. The legal basis for personal data processing is the further processing of personal data in compliance with point (b) of the first paragraph of Article 5 in conjunction with the first paragraph of Article 89 of GDPR;
  • keeping records of requests sent by data subjects and their handling by CORWIN. The legal basis for personal data processing is the consent of customers and potential customers, the fulfilment of contracts and the legitimate interest of CORWIN in compliance with points (a), (b) and (f) of the first paragraph of Article 6 of GDPR;
  • • fulfilment of obligations: by CORWIN in compliance with applicable legal provisions regarding tax or consumer protection obligations in the internal market. The legal basis for personal data processing is the fulfilment of legal obligations in compliance with point (c) of the first paragraph of Article 6 of GDPR.

III. Categories of Data Subjects

CORWIN processes personal data for the purposes specified in Article II of this Privacy Policy relating to customers and potential customers as individuals who have shown interest in any of the projects and have demonstrated this by providing their email address and consent to the processing of their personal data.

IV. CORWIN's legitimate interests

CORWIN's legitimate interest lies in the possibility to inform customers and potential customers of advantageous offers linked to its projects. The legal basis for the processing of personal data for the purposes specified in Article II of this Privacy Policy is thus CORWIN's legitimate interest based on the applicable provisions of GDPR and the applicable provisions of ZVOP-1, except where such interests are overridden by the data subject's interests and fundamental rights and freedoms that require the protection of personal data.

V. The right to object

If you do not wish to receive news and current information about our advantageous project offers, you may assert your right to object at any time in the following ways:

  1. by post sent to the address of CORWIN's headquarters;
  2. at any time and free of charge by clicking on the appropriate link in each individually delivered e-newsletter;
  3. by email to CORWIN's email address;
  4. by phone.

In the event of an objection to the processing of your personal data, CORWIN will thereby stop processing it, and upon receiving at least one of the confirmatory actions specified in points a) to d) of this Article, you will no longer receive news from CORWIN.

VI. Guidance on the voluntary or compulsory provision of consent

Data subjects who want to receive CORWIN news and marketing data must at the minimum provide CORWIN, as the Controller, with their email address and consent to the processing of their personal data for direct marketing purposes, otherwise, it’s not possible to subscribe to CORWIN news and marketing information. Confirmation of consent to personal data processing for direct marketing purposes is compulsory by law.

VII. Recipients or categories of recipients of personal data

Personal data processed on behalf of CORWIN for the purposes set out in Article II of this Policy will also be made available to the following recipients who are our data processors:

  • CORWIN SI d.o.o., Dunajska cesta 151, 1000 Ljubljana, reg. no.: 8190356000;
  • Lis Anker SI d.o.o., Dunajska cesta 151, 1000 Ljubljana, reg. no.: 8585458000;
  • Vilharia offices I d.o.o., Dunajska cesta 151, 1000 Ljubljana, reg. no.: 8529302000;
  • Vilharia offices II d.o.o., Dunajska cesta 151, 1000 Ljubljana, reg. no.: 920877000;
  • Masarykova rezidence d.o.o., Dunajska cesta 151, 1000 Ljubljana, reg. no.: 8878587000;
  • Linhartov kvart, razvoj nepremičninskih projektov, d.o.o. Dunajska cesta 151, 1000 Ljubljana, reg. no.: 8920419000;

Our processors have been authorised in writing to process personal data transferred to them by the Controller. These particularly include the above-mentioned CORWIN Group companies, delivery companies, courier companies, consulting companies and agencies, IT service providers and other persons whose services we use to carry out our activities. Our processors are diligently selected to ensure that all data protection requirements are met (hereinafter: "recipients").

VIII. Duration of data storage

Personal data will be processed until the purpose for which they were collected ceases to exist, but no longer than the legal basis for processing personal data under the GDPR and ZVOP-1 is provided.

IX. Information on automated individual decisions

We do not carry out automated decision-making and/or profiling.

X. Transfer of personal data to a third country or an international organisation

We do not transfer personal data to third countries or international organizations.

XI. Rights of individuals

Subject to the conditions laid down by the legal regulations on the protection of personal data, as a data subject, you have the following rights:

  • The right to request access to your personal data from the Controller:

    Data subjects are entitled to obtain from CORWIN confirmation as to whether or not the personal data concerning him or her are being processed and, if so, access to the personal data and the following information:

    • the purpose of its processing;
    • the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly recipients in third countries or international organisations;
    • where this is possible, the anticipated duration for which the personal data will be stored, or if this isn't possible, the criteria used to determine that duration;
    • the existence of the right to request the correction or erasure of personal data or the restriction of processing of personal data related to the data subject, or to object to such processing by the Controller;
    • the right to file a complaint with the supervisory authority; where personal data is not collected from the data subject, any available information about their source;
    • the existence of automated decision-making, including profiling, as specified in the first and fourth paragraphs of Article 22 of GDPR and, at least in such cases, relevant information about the logic, as well as about the significance and anticipated consequences of such processing for the data subject.

    CORWIN shall ensure a copy of the processed personal data. For any additional copies requested by the data subject, the processor may request appropriate compensation fees corresponding to the administrative costs of processing the application.
  • The right to rectification (correction):
    Data subjects are entitled to obtain the correction of inaccurate personal data concerning them from CORWIN without undue delay. Taking into account the purposes of the processing, data subjects are entitled to complete incomplete personal data with a supplementary statement.
  • The right to erasure ("The right to be forgotten")

    Data subjects are entitled to request that CORWIN delete the related personal data without undue delay and CORWIN shall delete the personal data without undue delay if one of the following reasons applies:

    • the personal data is no longer necessary, considering the purposes for which it was collected or otherwise processed;
    • a data subject withdraws the consent on which the processing is based in compliance with point (a) of the first paragraph of Article 6 of GDPR and when there is no other legal basis for the data processing;
    • a data subject objects to the processing in compliance with the first paragraph of Article 21 of GDPR and there are no overriding legitimate reasons for their processing or a data subject objects to the processing in compliance with the second paragraph of Article 21 of GDPR;
    • the data has been unlawfully processed;
    • personal data must be deleted for the purpose of compliance with a legal obligation under European Union law or the law of the Member State where the controller is established;
    • personal data has been collected in connection with the offer of information society services specified in the first paragraph of Article 8 of GDPR.

    If CORWIN has made personal data publicly available and is obliged to erase it, Corwin shall, taking into account the available technology and performance costs, take reasonable measures, including technical measures, to inform the data processors that a data subject has requested the erasure of any copies of personal data or links to the personal data. The right to erasure shall not apply if the processing is necessary:

    • to exercise the right to freedom of expression and information;
    • to fulfil a legal obligation requiring the processing of data in compliance with the legislation of the European Union or of the Member State where the Controller is established, or to carry out a task carried out in the public interest, or to exercise official powers conferred upon the Controller.
    • for reasons of public interest in the area of public health in compliance with points h) and i) of the second paragraph of Article 9 and the third paragraph of Article 9 of GDPR;
    • for archiving purposes in the public interest, for scientific or historical research or for statistical purposes in compliance with the first paragraph of Article 89 of GDPR if the right specified in paragraph 1 is likely to prevent or seriously jeopardise the achievement of the objectives of data processing; or
    • to establish, implement or defend legitimate claims.
  • The right to restriction of processing:

    Data subjects are entitled to request the restriction of processing by the Controller when one of the following applies:

    • if the data subject disputes the accuracy of personal data at a time when the Controller can verify the accuracy of the personal data;
    • the processing is unlawful and the data subject objects to the erasure of the personal data and requests the restriction of its use instead;
    • the Controller no longer needs the personal data for processing purposes, but they are required by the data subject for the establishment, exercise or defence of legal claims;
    • the data subject objects to the processing in compliance with the first paragraph of Article 21 of GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

    In cases when processing is restricted under the above provisions, such personal data (except for storage) shall only be processed with the data subject’s consent or to establish, exercise or protect legitimate claims or to defend the rights of another natural person or legal entity or for reasons of significant public interest of the European Union or of a Member State. A data subject who has received a processing restriction in compliance with the above shall inform CORWIN before the processing restriction is lifted.

  • The right to data portability:

    Data subjects are entitled to obtain personal data relating to them, in a structured, frequently used and machine-readable format, and have the right to transmit those data to another controller without being obstructed by the controller to whom the personal data has been provided when:

    • o processing is based on consent in compliance with point a) of the first paragraph of Article 6 or point a) of the second paragraph of Article 9 of GDPR or based on the contract in compliance with point b) of the first paragraph of Article 6 of GDPR;
    • processing is carried out by automated means.

    Upon asserting the right to data portability, data subjects are entitled to transfer their personal data directly from one controller to another, when this is technically feasible. The exercise of the right may not constitute a breach of Article 17 of GDPR. This right shall not affect the processing necessary to perform a task carried out in the public interest or to exercise official powers conferred upon the controller. The right to data portability of personal persons shall not adversely affect the rights of others.

  • The right to object to processing and profiling (if any exists):

    Data subjects are entitled, for reasons related to their particular situation, to object at any time to the processing of personal data concerning them and based on points (e) and (f) of the first paragraph of Article 6 of GDPR including profiling under these provisions. The Controller may no longer process the personal data unless the Controller demonstrates compelling legitimate reasons for processing that outweigh the data subject's interests, rights and freedoms or for the establishment, exercise or defence of legitimate claims. When personal data are processed for direct marketing purposes, data subjects are entitled at any time to oppose the processing of personal data concerning them for such marketing, including profiling, if it is linked to such direct marketing. When a data subject objects to processing for direct marketing purposes, their personal data may no longer be processed for those purposes.

  • The right to file a complaint with the supervisory authority:

    The supervisory authority to which data subjects shall address their complaint in duly justified cases is:

    • for the Republic of Slovakia: Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov), established at Hraničná 12, 820 07 Bratislava 27, T: +421(0)2 32313214, E: statny.dozor@pdp.gov.sk;
    • for the Republic of Slovenia: Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec Republike Slovenije), established at Dunajska cesta 22, 1000 Ljubljana, T: +386 (0) 1 23 09 730, E: gp.ip@ip-rs.si.
  • The right to withdraw consent to processing:

    If the legal basis for personal data processing is the data subject's consent, data subjects may withdraw their consent at any time, without prejudice to the lawfulness of the processing based on consent given before its withdrawal. Data subjects are entitled to withdraw consent at any time before the expiry of the period for which consent has been granted, particularly by the following means:

  • by post to CORWIN's registered office,
  • at any time and free of charge by clicking on the appropriate link in each individually delivered e-newsletter;
  • by email to CORWIN's email address;
  • by phone.
  • CORWIN is obliged to take appropriate measures and to provide the data subject with the information specified in Articles 19 and 20 of ZVOP-1 and from Articles 21 to 28 of ZVOP-1 relating to the processing of his or her personal data in a concise, transparent, comprehensible and easily accessible manner. CORWIN will cooperate with data subjects in the exercise of their rights under Articles 21 to 28 of ZVOP-1.

    CORWIN must provide data subjects with information on measures taken on the basis of their request within one month of receipt of the request in compliance with Articles 21 to 28 of ZVOP-1. CORWIN may, in duly justified cases, taking into account the complexity, exhaustiveness and number of requests, extend this period by a further two months, including several consecutive times. However, CORWIN is obliged to inform the data subject of any such extension within one month of receipt of the request, stating the reasons for the extension. If CORWIN takes no action upon the data subject’s request, the Controller shall immediately (no later than one month after receipt of the request for clarification) inform the data subject of the reasons for inaction and of the possibility to file a complaint according to Article 32 of ZVOP-1 with the Office for the Protection of Personal Data of the Republic of Slovakia or with the Information Commissioner of the Republic of Slovenia.

By using the Website and providing my data, I expressly give CORWIN my consent for the processing of my personal data and confirm that I’ve been informed of everything specified above.


In Bratislava, 23 September 2022


CORWIN SK a.s

Continue to

Home

Take a look around Vilharia
Explore VR