KORUNA

Personal data processing

INFORMATION ON THE PROCESSING OF PERSONAL DATA BY THE CONTROLLER

provided pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), effective from 25 May 2018 (the "GDPR"), and pursuant to Act No. 18/2018 Coll. on the Protection of Personal Data, effective from 25 May 2018 (the "Personal Data Protection Act").

Personal data controller: KORUNA Finance s.r.o., with its registered office at Mlynské nivy 56, 821 01 Bratislava, Company ID: 35 721 219, registered in the Commercial Register of the Municipal Court Bratislava III, section: Sro, file no.: 14969/B (the "Company" or the "Controller").

I hereby acknowledge that the website operated on behalf of the Company is not directly intended for persons who cannot independently and effectively grant the Controller consent to the processing of their personal data.

1. The Controller

The Controller carries out the construction of several development projects within the territory of the Slovak Republic (the "Projects" or individually a "Project"). Controller contact: E-mail: info@koruna.sk

The Controller processes the personal data of clients, potential clients or data subjects (jointly the "Data Subjects", individually a "Data Subject") to the extent and under the conditions set out in this document and in separate personal data processing information published on the Controller's website or provided to the Data Subject in another way (by e-mail, in writing, etc.), and is responsible for their protection and processing. Unless the law provides otherwise, the Controller is also responsible for the processing of personal data through processors it has engaged for this purpose.

2. Personal data

The Controller records your interest in receiving news and up-to-date information about offers relating to the Projects and other activities carried out by the Controller.

The Controller therefore processes personal data concerning you to the following extent:

  1. First name, surname and title;
  2. e-mail address;
  3. telephone number;
  4. website usage data (IP address, cookies, analytics data);

(the data listed in points 1 to 4 above jointly the "Personal Data").

3. Legal basis and purpose of personal data processing

The Controller processes Personal Data to the extent provided by you as the Data Subject, for the following purposes:

  • Direct marketing — informing clients, as Data Subjects, about news relating to the individual Projects carried out by the Controller and approaching clients with further marketing offers of the Controller, by direct mail, targeted offers or another appropriate form. The legal basis for processing Personal Data is consent, where the client provides an e-mail address, first name and surname and consents to the processing of their Personal Data for the purpose of receiving commercial and marketing information from the Controller (Art. 6(1)(a) GDPR);
  • Fulfilment of the Controller's obligations under applicable legislation, for example tax obligations or obligations relating to consumer protection in the internal market. The legal basis for processing Personal Data is compliance with legal obligations (Art. 6(1)(c) GDPR);
  • Recording requests / contact forms of Data Subjects and their handling by the Controller. The legal basis for processing Personal Data is consent, where the client provides an e-mail address, first name and surname and consents to the processing of their Personal Data (Art. 6(1)(a) GDPR).
  • Protection of the Controller's legitimate interests that are important for the proper conduct of its activities (in particular the protection of rights and legally protected interests, for example client identification under Act No. 297/2008 Coll. on protection against money laundering, protection of the network against harmful conduct or protection against misuse of the websites, the establishment, exercise and proof of legal claims, defence of rights, etc.). The legal basis for processing Personal Data is legitimate interest (Art. 6(1)(f) GDPR).
  • Pre-contractual communication / performance of a contract — the Controller processes personal data within a contractual relationship (e.g. when sending a contract), when concluding, amending and terminating a contract in accordance with the law, in invoicing, handling complaints and other requests of the Data Subject, in delivering standard or above-standard solutions and in communication with the Data Subject. The legal basis for processing Personal Data is the Data Subject's consent / performance of a contract (Art. 6(1)(b) GDPR).

4. Categories of data subjects

The Controller processes Personal Data for the purposes set out in Article 3 concerning in particular:

  • potential clients and/or clients, as Data Subjects, whom the Controller has recorded as having expressed interest in any of the Controller's Projects,
  • Data Subjects who are in a contractual relationship with the Controller or who intend to enter into a contractual relationship with the Controller, or who are interested in a job position at the Company. If a Data Subject expresses interest in leasing or purchasing office, commercial or residential premises within the Projects, in investing in the Projects, or in a job position at the Company through the online form on the Controller's website or in another way (by e-mail, etc.), this constitutes the legal basis for the processing of their Personal Data. If the Data Subject concludes a contract with the Company, the legal basis for processing their Personal Data is the contract itself.

5. Right to object

As a Data Subject you have the right to object to the processing of your Personal Data on grounds relating to your particular situation carried out under Section 13(1)(e) or (f) of the Personal Data Protection Act. If, as a Data Subject, you do not wish to receive news and up-to-date information about advantageous offers relating to the Projects, you may at any time and free of charge exercise the right to object, on grounds relating to your particular situation, to the processing of Personal Data for the purpose of receiving information about the Projects from the Company as Controller, in particular in the following ways:

  • by e-mail: info@koruna.sk; or
  • by post at the Company's registered office at: Mlynské nivy 56, 821 01 Bratislava.

If you object to the processing of Personal Data for the purpose of receiving information / direct marketing, the Controller will no longer process your Personal Data and, as a result, you will not receive any news from the Controller.

In the area of handling Data Subjects' requests, the Controller sees its legitimate interest in the ability to demonstrate that its procedures comply with the requirements of the GDPR.

6. Notice on the voluntary or mandatory nature of consent to the processing of Personal Data

If a Data Subject wishes the Controller to send them news and information about the Projects, the Data Subject must provide the Controller with at least their e-mail address and grant consent to the processing of their Personal Data for marketing purposes; otherwise it is not possible to subscribe to the news and Project information sent by the Controller. Confirmation of consent to the processing of Personal Data for the purpose of receiving information / direct marketing is a legal requirement. However, the Data Subject's decision to provide their Personal Data for the purpose of subscribing to the newsletter and Project information is voluntary.

Where the provision of Personal Data is a contractual or pre-contractual obligation, such provision of Personal Data is mandatory. If the Data Subject does not provide the Personal Data, it will not be possible to conclude a contract or perform contractual obligations. If the Data Subject does not provide an e-mail address and/or other required data through the online form on the Controller's website or in another way (by e-mail, etc.), it will not be possible to contact them in connection with their interest in leasing or purchasing office, commercial or residential premises within the Projects, in investing in the Projects, or in applying for a job position at the Company.

7. Recipients or categories of recipients of Personal Data

It is anticipated that Personal Data processed on behalf of the Controller will be provided to authorised employees and persons of the Controller and to authorised employees and persons belonging to the Controller's group, as well as to companies within the Controller's group that may enter into a contractual relationship with the Data Subject, whereby these entities become recipients of Personal Data in connection with negotiations on the conclusion of the relevant contracts (the "Recipients").

8. Transfer of Personal Data to third countries

The Controller does not transfer personal data to third countries outside the European Union.

9. Retention period of Personal Data and criteria for determining the processing period

Personal Data will be processed for the necessary period, until the purpose for which they were obtained ceases to exist, but at the latest until there is no longer a legal basis for the processing of Personal Data under the GDPR and the Personal Data Protection Act.

In other cases, the processing period follows from the purpose of processing, to which it must be proportionate, or is set by data protection legislation.

The Company processes personal data, according to the purpose of processing, for the periods stated below:

Purpose of processingRetention period
Performance of a contractfor the duration of the contractual relationship and for 10 years after its termination
Compliance with legal obligationsfor the period set by the applicable legislation
Sending commercial communications, offers of services and products and targeted advertising / direct marketingfor the duration of consent to the processing of personal data, or until consent is withdrawn, or in accordance with special legislation
Protection of the Controller's legitimate interestfor a maximum of 3 years from the start of processing, unless special regulations provide otherwise, or unless in a justified case there is a need to retain the data for a longer period in connection with a specific case.
Handling requests sent via electronic formsfor the period necessary to handle the relevant request / until consent is withdrawn by the Data Subject

10. Information on automated individual decision-making

The Controller does not use any automated individual decision-making procedures or profiling when processing Personal Data.

11. Information on the further rights of clients as Data Subjects

Provided the conditions set by the valid and effective data protection legislation under the GDPR and the Personal Data Protection Act are met, you as a Data Subject have the following rights:

The right to request access from the Controller to the Personal Data concerning them:

The Data Subject has the right to obtain confirmation from the Company as to whether Personal Data concerning them are being processed and, if so, the right to access those Personal Data and the following information:

  • the purposes of processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients to whom the Personal Data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged retention period of the Personal Data or, if not possible, the criteria used to determine it;
  • the existence of the right to request from the Controller rectification or erasure of Personal Data concerning the Data Subject or restriction of processing, or the right to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the Personal Data were not obtained from the Data Subject, any available information as to their source;
  • the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, in those cases, at least meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the Data Subject.

The Company will provide a copy of the Personal Data being processed. For any further copies requested by the Data Subject, the Controller may charge a reasonable fee corresponding to administrative costs. If the Data Subject submitted the request by electronic means, the information will be provided in a commonly used electronic form, unless the Data Subject requests otherwise. The right to obtain a copy must not adversely affect the rights and freedoms of others.

The right to rectification of Personal Data:

The Data Subject has the right to have the Company rectify inaccurate Personal Data concerning them without undue delay. Taking into account the purposes of processing, the Data Subject has the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.

The right to erasure (the right "to be forgotten"):

The Data Subject also has the right to obtain from the Controller the erasure of Personal Data concerning them without undue delay, and the Controller is obliged to erase Personal Data without undue delay where one of the following grounds applies:

  • the Personal Data are no longer necessary for the purposes for which they were collected or otherwise processed;
  • the Data Subject withdraws the consent on which the processing is based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing;
  • the Data Subject objects to the processing and there are no overriding legitimate grounds for the processing;
  • the Personal Data have been unlawfully processed;
  • the Personal Data must be erased for compliance with a legal obligation under Union or Member State law to which the Controller is subject;
  • the Personal Data were collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.

Where the controller has made the Personal Data public and is obliged to erase them, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers processing the Personal Data that the Data Subject has requested the erasure of any links to, or copies or replications of, those Personal Data.

The right to erasure does not apply where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation which requires processing under Union or Member State law to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) GDPR; or for the establishment, exercise or defence of legal claims.

The right to restriction of processing:

The Data Subject has the right to obtain from the Controller restriction of processing where one of the following applies:

  • the Data Subject contests the accuracy of the Personal Data, for a period enabling the Controller to verify their accuracy;
  • the processing is unlawful and the Data Subject opposes the erasure of the Personal Data and requests the restriction of their use instead;
  • the Controller no longer needs the Personal Data for the purposes of processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims;
  • the Data Subject has objected to processing, pending verification of whether the legitimate grounds of the Controller override those of the Data Subject.

Where processing has been restricted in accordance with the right to restriction of processing, such Personal Data shall only be processed with the Data Subject's consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

The Controller will inform a Data Subject who has obtained restriction of processing in accordance with the above before the restriction of processing is lifted.

The right to data portability:

The Data Subject has the right to receive the Personal Data concerning them which they provided to the Controller in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller without hindrance from the original Controller, where: the processing is based on consent or on a contract, and the processing is carried out by automated means.

In exercising their right to data portability, the Data Subject has the right to have the Personal Data transmitted directly from one controller to another, where technically feasible.

This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller. The right to data portability must not adversely affect the rights and freedoms of others.

The right to object to processing, including objection to profiling (if carried out):

The Data Subject has the right to object at any time, on grounds relating to their particular situation, to the processing of Personal Data concerning them carried out on the basis of Art. 6(1)(e) or (f) GDPR, including objecting to profiling based on those provisions. The Controller may no longer process the Personal Data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or grounds for the establishment, exercise or defence of legal claims.

Where Personal Data are processed for direct marketing purposes, the Data Subject has the right to object at any time to the processing of Personal Data concerning them for such marketing, including profiling to the extent related to such direct marketing. Where the Data Subject objects to processing for direct marketing purposes, the Personal Data may no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the Data Subject may exercise their right to object by automated means using technical specifications. Where Personal Data are processed for scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, the Data Subject has the right to object, on grounds relating to their particular situation, to the processing of Personal Data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

The right to lodge a complaint with a supervisory authority:

The supervisory authority to which the Data Subject may address a complaint in justified cases is the Office for Personal Data Protection of the Slovak Republic, with its registered office at Námestie 1. mája 18, 811 06 Bratislava.

The right to withdraw consent to processing (if applicable):

Where the legal basis for the processing of Personal Data is the Data Subject's consent, the Data Subject is entitled to withdraw their consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal.

The right to withdraw consent at any time, including before the expiry of the period for which the consent was granted, may be exercised by the Data Subject in particular in the following ways: by e-mail: info@koruna.sk, or by post at the Company's registered office at: Mlynské nivy 56, 821 01 Bratislava.

In addition to the information, communications, responses and measures of the Controller referred to in Articles 15 to 22 GDPR, which are provided free of charge, information, communications, responses and measures of the Controller in connection with the exercise of rights and claims in the area of personal data protection, access to personal data, their collection and processing in accordance with the Personal Data Protection Act or other legislation are also provided free of charge.

Where the Data Subject's requests are manifestly unfounded or excessive, in particular because of their repetitive character, the Controller may nevertheless comply with the request if justified by its content, and may charge the Data Subject reasonable costs. Reasonable costs include only the material costs associated with providing the information, communication, responses or taking the requested action.

The Controller will provide the Data Subject with information on the measures taken on the basis of a request submitted under Articles 15 to 22 GDPR without undue delay, and in any event within one month of receipt of the request. That period may be extended by up to two further months where necessary, taking into account the complexity and number of requests. The Controller will inform the Data Subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the Data Subject submits the request by electronic means, the information will, where possible, be provided by the same means, unless the Data Subject requests otherwise.

12. Changes to the Controller's Personal Data Processing Information

The Controller reserves the right to amend or supplement the provisions of this Personal Data Processing Information at any time and without prior notice. Any changes take effect from the date of their publication on the website. In the event of any conflict between this Personal Data Processing Information and separate personal data processing information published on the Controller's website or provided to the Data Subject in another way (by e-mail, in writing, etc.), the information contained in those separate Personal Data Processing Information of the Controller prevails.

If you have any questions, you may contact the Company at any time via the contact form provided for this purpose on the website.

In addition to the contact form, you may contact us at any time by e-mail at info@koruna.sk or by post at the registered office of KORUNA Finance s.r.o. at: Mlynské nivy 56, 821 01 Bratislava.