INFORMATION ON PROCESSING PERSONAL DATA

This Policy is drafted in compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter: “GDPR”) and the provisions of the Slovenian Personal Data Protection Act (Official Gazette of the RS, No. 163/22) (hereinafter: "ZVOP-2").

Personal Data Controller:
Vilharia offices I, razvoj nepremičninskih projektov, d.o.o., Dunajska cesta 155, 1000 Ljubljana, reg. no.: 8529302000 and Vilharia offices II, razvoj nepremičninskih projektov, d.o.o., Dunajska cesta 155, 1000 Ljubljana, reg. no.: 8920877000 (hereinafter „VILHARIA” or "Controller")

The companies Vilharia offices I, razvoj nepremičninskih projektov, d.o.o. and Vilharia offices II, razvoj nepremičninskih projektov, d.o.o. are members of the CORWIN SK a.s. group, with registered office at Námestie Mateja Korvína 1, 811 07 Bratislava, company registration No: 45500126 (hereinafter referred to as the CORWIN Group), which is engaged in the development of real estate projects, where the companies act as co-investors in the Vilharia project. More detailed information on the projects carried out by the CORWIN Group is available on its website: www.corwin.sk.

The Controller is constructing the Vilharia Project (hereinafter also referred to as the "Project") and processes personal data of clients and potential clients (hereinafter also referred to as the " Data Subject") to the extent and subject to the conditions set out in this document and is responsible for the protection and processing thereof. Unless otherwise provided by law, the Controller shall also be responsible for the processing of personal data by processors authorised by it for that purpose.

I. Controller identification and contact details

The Controller on whose behalf personal data is processed are companies Vilharia offices I, razvoj nepremičninskih projektov, d.o.o., Dunajska cesta 155, 1000 Ljubljana, reg. no.: 8529302000 and Vilharia offices II, razvoj nepremičninskih projektov, d.o.o., Dunajska cesta 155, 1000 Ljubljana, reg. no.: 8920877000, Contact info: T: +386 (0) 8201 6922, e-pošta: corwin@corwin.si.

II. Establishing the purposes of data processing and determining the legal basis

VILHARIA will only process personal data to the extent that you, as a Data Subject, have provided for the following purposes:

1. direct marketing, informing Data Subjects (customers or potential customers) about news related to individual projects carried out by CORWIN Group and sending additional marketing offers to customers of CORWIN Group via direct mail, e-newsletters, personalised offers or other appropriate formats. The legal basis for personal data processing is the consent of customers or potential customers if they provide an e-mail address and consent to the processing of their personal data for the purpose of receiving business and marketing information sent by CORWIN Group (point (a) of the first paragraph of Article 6 of GDPR);
2. recording and promotional communication in the sale or lease of real estate: the legal basis for personal data processing is legitimate interest in compliance with point (f) of the first paragraph of Article 6 of GDPR and the consent of customers or potential customers if they provide an e-mail address and consent to the processing of their personal data for the purpose of receiving business and marketing information (point (a) of the first paragraph of Article 6 of GDPR);
3. statistical purposes: for the purpose of combining personal data with other parties' data to produce reports that help to improve provision of services, while respecting technical and organisational measures to ensure compliance with the principle of data minimisation. The legal basis for personal data processing is the further processing of personal data in compliance with point (b) of the first paragraph of Article 5 in connection with the first paragraph of Article 89 of GDPR;
4. keeping records of requests sent by Data Subjects and their handling by the Controller. The legal basis for personal data processing is the consent of customers and potential customers, the fulfilment of contracts and the legitimate interest of the Controller in compliance with points (a), (b) and (f) of the first paragraph of Article 6 of GDPR;
5. compliance with the Controller's obligations under applicable legal provisions regarding tax or consumer protection obligations in the internal market. The legal basis for personal data processing is the fulfilment of legal obligations in compliance with point (c) of the first paragraph of Article 6 of GDPR;
6. for the performance of a contract, the Controller processes personal data in the context of the contractual relationship (e.g. for sending the contract), for the conclusion, amendment and termination of the contract in accordance with the law, for invoicing, for dealing with complaints and other requests from the Data Subject, for the implementation of standard or above-standard solutions, and for communicating with the Data Subject, etc. The legal basis for the processing of personal data is the performance of a contract in accordance with Article 6(1)(b) of the GDPR;
7. the protection of the legitimate interests of the Controller which are important for the proper pursuit of the activity (in particular, the establishment, exercise and proof of legal claims, defence of rights, etc.). The legal basis for the processing of personal data is a legitimate interest in accordance with Article 6(1)(f), first indent, of the GDPR.

III. Categories of Data Subjects

VILHARIA processes personal data for the purposes specified in Article II of this Information on Processing Personal Data relating to customers and potential customers as individuals who have shown interest in any of the projects of the CORWIN Group and have demonstrated this by providing their email address and consent to the processing of their personal data.

IV. Personal Data

For the purpose of receiving news and updates on offers related to CORWIN Group projects and other activities we carry out, we process your personal data on the basis of your consent to the following extent:

1. first and last name,
2. email address; and
3. telephone number

(the data referred to in points (a) to (c) hereinafter referred to as "Personal Data").

V. Processing of Personal Data for the purpose of performance of the Contract

In case you conclude a contract with Vilharia offices I, razvoj nepremičninskih projektov, d.o.o., Dunajska cesta 155, 1000 Ljubljana, registration number: 8529302000 and/or Vilharia offices II, razvoj nepremičninskih projektov, d.o.o., Dunajska cesta 155, 1000 Ljubljana, registration number: 8920877000, the contract constitutes the legal basis for the processing of your Personal Data. We process the Personal Data which you provide to us at the time of conclusion, in the process of conclusion or in the course of performance of the contract with the utmost care and only to the extent necessary to achieve the legitimate purposes of the processing of Personal Data.

VI. The right to object

If you do not wish to receive news and current information about our advantageous project offers, you may assert your right to object at any time in the following ways:

1. by post sent to the address of the Controller;
2. at any time and free of charge by clicking on the appropriate link in each individually delivered e-newsletter;
3. by email to corwin@corwin.si;
4. by phone.

In the event of an objection to the processing of your personal data, Controller will thereby stop processing it, and upon receiving at least one of the confirmatory actions specified in points a) to d) of this Article, you will no longer receive news from Controller.

VII. The voluntary nature of the consent to processing of Personal Data

Data Subject who wants to receive news and marketing data must at the minimum provide the Controller with his/her email address and consent to the processing of the Personal Data for direct marketing purposes, otherwise, it’s not possible to subscribe to news and marketing information. Confirmation of consent to Personal Data processing for direct marketing purposes is compulsory by law.

VIII. Recipients or categories of recipients of Personal Data

Personal Data processed on behalf of the Controller for the purposes set out in Article II of this Policy will also be made available to the following recipients who are our data processors:

• CORWIN SK a.s., Námestie Mateja Korvína 1, 811 07 Bratislava, matična številka: 45 500 126,
• Lis Anker, s.r.o., Mýtna 48, 811 07 Bratislava, ID št.: 35 834 889,
• CORWIN SI d.o.o., Dunajska cesta 151, 1000 Ljubljana, reg. no.: 8190356000;
• Lis Anker SI d.o.o., Dunajska cesta 151, 1000 Ljubljana, reg. no.: 8585458000;
• Masarykova rezidence d.o.o., Dunajska cesta 151, 1000 Ljubljana, reg. no.: 8878587000;
• Linhartov kvart, razvoj nepremičninskih projektov, d.o.o. Dunajska cesta 151, 1000 Ljubljana, reg. no.: 8920419000;
• CC Koppa, razvoj nepremičninskih projektov, d.o.o., Dunajska cesta 155, 1000 Ljubljana, mat. številka: 9149961000.

i.e. to processors who have been authorised in writing to process Personal Data transferred to them by the Controller. These particularly include the above-mentioned CORWIN Group companies, delivery companies, courier companies, consulting companies and agencies, IT service providers and other persons whose services are used by CORWIN Group to carry out its activities. The processors are diligently selected to ensure that all data protection requirements are met (hereinafter: "Recipients").

X. Information on Automated Individual Decision-Making

We do not carry out automated decision-making and/or profiling.

XI. Transfer of Personal Data to a third country or an international organisation

We do not transfer Personal Data to third countries or international organizations.

XII. Rights of individuals

In accordance with the legislation governing the protection of personal data, the Data Subject has the following rights:

• The Right of access by the Data Subject:

  The Data Subject has the right to obtain from the Controller confirmation as to whether or not Personal Data concerning him/her are being processed, and, where that is the case, access to the Personal Data and the following information:
  • the purposes of the processing;
  • the categories of Personal Data concerned;
  • the recipients or categories of recipient to whom the Personal Data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from the Controller rectification or erasure of Personal Data or restriction of processing of Personal Data concerning the Data Subject or to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the personal data are not collected from the data subject, any available information as to their source;
  • the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject.

  The Controller shall ensure a copy of the processed Personal Data. For any additional copies requested by the Data Subject, the Controller may charge a reasonable fee based on administrative costs.

• The right to rectification (correction):

  The Data Subject shall have the right to obtain from the Controller without undue delay the rectification of inaccurate Personal Data concerning him/her. Taking into account the purposes of the processing, the Data Subject shall have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.

• The right to erasure ("The right to be forgotten"):

  The Data Subject shall have the right to obtain from the Controller the erasure of Personal Data concerning him/her without undue delay and the Controller shall have the obligation to erase Personal Data without undue delay where one of the following grounds applies:
  • the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • the Data Subject withdraws consent on which the processing is based, and where there is no other legal ground for the processing;
  • the Data Subject objects to the processing and there are no overriding legitimate grounds for the processing,
  • the Personal Data have been unlawfully processed;
  • the Personal Data must be erased in order to comply with a legal obligation under EU and Slovenian law.

  The Controller shall take reasonable steps, including technical measures, taking into account the technology available and the cost of implementing the measures, to inform controllers which are processing the Personal Data that the Data Subject has requested the erasure by such controllers of any links to, or copy or replication of, those Personal Data.

  The erasure shall not be carried out if the processing of the Personal Data is necessary:

  • for exercising the right of freedom of expression and information;
  • for compliance with a legal obligation which requires processing by EU or Slovenian law or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
  • for reasons of public interest in the area of public health;
  • for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
  • for the establishment, exercise or defence of legal claims.

• The Right to restriction of processing:

  The Data Subject shall have the right to obtain from the Controller restriction of processing where one of the following applies:
  • the accuracy of the Personal Data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the Personal Data;
  • the processing is unlawful and the Data Subject opposes the erasure of the Personal Data and requests the restriction of their use instead;
  • the Controller no longer needs the Personal Data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims;
  • the Data Subject has objected to processing pending the verification whether the legitimate grounds of the Controller override those of the Data Subject.

  Where processing has been restricted, such Personal Data shall, with the exception of storage, only be processed:

  • with the Data subject's consent, or
  • for the establishment, exercise or defence of legal claims, or
  • for the protection of the rights of another natural or legal person, or
  • for reasons of important public interest of the EU or of Slovenia.

• The right to data portability:

  The Data Subject shall have the right to receive the Personal Data concerning him/her, which he/she has provided to a Controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Controller to which the Personal Data have been provided, where:
  • the processing is based on consent or on a contract; and
  • the processing is carried out by automated means.

  The right to data portability is only admissible where technically feasible. The exercise of this right is without prejudice to the right to erasure.

  That right shall not apply to processing necessary:

  • for the performance of a task carried out in the public interest, or
  • in the exercise of official authority vested in the Controller.

• The right to object to processing and profiling (if any exists):

  The Data Subject shall have the right to object, on grounds relating to his/her particular situation, at any time to processing of Personal Data concerning him/her which is based on point (e) or (f) of Article 6(1) of GDPR, including profiling based on those provisions. The Controller shall no longer process the Personal Data unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defence of legal claims.

  Where Personal Data are processed for direct marketing purposes, the Data Subject shall have the right to object at any time to processing of Personal Data concerning him/her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the Data Subject objects to processing for direct marketing purposes, the Personal Data shall no longer be processed for such purposes.

• The right to file a complaint with the supervisory authority:

  Without prejudice to any other administrative or judicial remedy, every Data Subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his/her habitual residence, place of work or place of the alleged infringement if the Data Subject considers that the processing of Personal Data relating to him/her infringes this Regulation. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78. of GDPR.

  The supervisory authority to which data subjects shall address their complaint in duly justified cases is:

  • for the Republic of Slovakia: Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov), established at Hraničná 12, 820 07 Bratislava 27, T: +421(0)2 32313214, E: statny.dozor@pdp.gov.sk;
  • for the Republic of Slovenia: Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec Republike Slovenije), established at Dunajska cesta 22, 1000 Ljubljana, T: +386 (0) 1 23 09 730, E: gp.ip@ip-rs.si.

• The right to withdraw consent to processing:

  If the legal basis for the processing of Personal Data is the consent of the Data Subject, the Data Subject may at any time withdraw his/her consent without affecting the lawfulness of processing based on consent before its withdrawal.

  The right to withdraw the consent at any time, even before the expiry of the period for which the consent was granted, may be exercised by the Data Subject in particular in the following ways:

  1. by post to the address of the registered office of the Controller,
  2. at any time and free of charge by clicking on the relevant link in each delivered newsletter;
  3. by e-mail to the Controller;
  4. by phone.

In addition to the information, communications, replies and actions of the Controller referred to in Articles 15 to 22 of the GDPR, which shall be provided free of charge, the information, communications, replies and actions of the Controller with regard to the exercise of rights and claims in the field of personal data protection, access to, acquisition and processing of personal data under the ZVOP-2 or any other law shall also be provided free of charge.

Where the Data Subject's requests are manifestly unfounded or excessive, in particular because they are repetitive, the Controller may nevertheless grant the request if it is substantiated on its merits and charge the Data Subject reasonable costs. Reasonable costs shall include only the material costs of providing the information, communications, replies or taking the action requested.

The Controller shall provide the Data Subject with information on the measures taken upon request pursuant to Articles 15 to 22 of the GDPR without undue delay and in any event within one month of receipt of the request. This period may be extended by up to two additional months, if necessary, taking into account the complexity and number of requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the Data Subject submits the request by electronic means, the information shall, where possible, be provided by electronic means, unless otherwise requested by the Data Subject.

XIII. Changes to the Personal Data Protection Policy

The Controller reserves the right to modify or amend the provisions of the Information on the processing of Personal Data at any time and without prior notice. Any amendments shall take effect from the date of publication on the website.

25 March 2024.
Vilharia offices I d.o.o.
Vilharia offices II d.o.o.