Privacy Policy

Instruction on the rights of the data subject

in accordance with the Regulation of the European parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (the “Regulation”) and in accordance with Act no. 18/2018 Coll. on the protection of personal data (the “Act”)

I.

Right to information (Art. 13, Art. 14 of the Regulation)

With the aim of meeting the information obligation of the controller, which represents the right of the data subject to information, in line with Art. 13 and Art. 14 of the Regulation and Art. 19 and Art. 20 of the Act, the controller hereby provides the data subject with the following information:

(i)           Identification data and contact data of the controller:

Business name:     Carlton Property, s. r. o.

Seat:     Hviezdoslavovo nám. 3, 811 02 Bratislava

Id. No.:      36 860 492

Registration:     Commercial Register of the District Court Bratislava I, Section: Sro,  File no.: 54960/B

Tel.:     +421 2 3266 1280

E-mail:      dataprivacy@carlton.sk

(ii)          Contact data of the data protection officer:

Name and surname:     Karmen Haulíková

Tel. :      +421 907 700 555

E-mail:      kh@carlton.sk

(iii)        List of processed personal data:

–     name and surname,

–     No. of ID card,

–     employer / name of the company,

–     position at the employer / in the company,

–     manifestation of character,

–     phone number,

–     e-mail address.

(iv)         The purposes of the processing of the personal data of the data subject by the controller:

–        conclusion and fulfilling of the lease agreement concluded between the data subject, resp. company as a lessee and controller as a lessor, including pre-contractual relations

The legal basis for the processing of your personal data for this purpose is Art. 6, para. 1, letter b), c) of the Regulation, i. e. performance of the lease agreement and compliance with our legal obligations, stemming above all from:

·          Act No. 116/1990 Coll. on lease and sublease of non-residential premises as amended,

·          Act No. 513/1991 Coll. Commercial Code as amended,

·          Act No. 40/1964 Coll. Civil Code as amended,

·          Act. No. 431/2002 Coll. on accounting as amended.

If you are a statutory body or an employee of a company (contact person of the lessee), which is a party to the lease agreement, the legal basis for the processing of your personal data for this purpose is Art. 6 par. 1 letter f) of the Regulation, i. e. our legitimate interest, which is the conclusion, resp. performance of the lease agreement, when communication between us and the lessee is necessary.

–         the record of the mails and registry management, i. e. registration and administration of mailings, mails delivered and sent from and to the electronic mailbox and registration and archiving of agreements, accounting-, tax- and other relevant documents in the controller’s internal systems

The legal basis for the processing of your personal data for this purpose is Art. 6, para. 1, letter c) of the Regulation, i. e. compliance with our legal obligations, stemming above all from:

·          Act. No. 431/2002 Coll. on accounting as amended,

·          Act. No. 395/2002 Coll. on archives and registries and on amendment of other acts as amended.

–         the record and restriction of entry of persons in the premises owned by our company (issuing of the access cards to the building and the lease premises)

The legal basis for the processing of your personal data for this purpose is Art. 6, para. 1, letter f) of the Regulation, i. e. our legitimate interest. Our legitimate interest is the protection of the property of our company, property and health of persons moving within the premises owned by our company and the restriction of the entry of unauthorized persons in our public premises and premises owned by our company used by the lessees (contrary to the concluded lease agreement).

–         monitoring of the public premises of our company through the camera system

The legal basis for the processing of your personal data for this purpose is Art. 6, para. 1, letter f) of the Regulation, i. e. our legitimate interest. Our legitimate interest is the protection of the property of our company, property and health of persons moving within the public premises of our company, as well as the protection of the property of our lessees and the restriction of the entry of unauthorized persons in our premises.

–         sending of info newsletters of Carlton complex, in particular with regard to the events organized in the premises of the Controller, daily menu and other events of the Savoy restaurant, traffic constraints, fire training courses etc.

The legal basis for the processing of your personal data for this purpose is Art. 6, para. 1, letter a) of the Regulation, i. e. your explicit consent with the processing of your personal data.

–         assertion and enforcement of claims arising from breach of contractual provisions, commercial and civil law against the data subject or third party in court or administrative proceedings, litigation, out-of-court negotiations and settlements, enforcement of the controller’s claims by execution (purpose of processing compatible with the abovementioned original purposes of the processing of personal data)

The legal basis for the processing of your personal data for this purpose is Art. 6, para. 1, letter f) of the Regulation, i. e. our legitimate interest, which is assertion of legal rights and claims in the event of non-fulfillment or breach of the obligations of the data subject arising from the lease agreement, general terms and conditions and relevant legal provisions, as well as the assertion and enforcement of rights arising from other actions of the data subject, which caused us damage or which otherwise affected our rights and legitimate interests.

–         reporting of criminal offenses and cooperation with law enforcement authorities (purpose of processing compatible with the abovementioned original purposes of the processing of personal data)

The legal basis for the processing of your personal data for this purpose is Art. 6, para. 1, letter c) of the Regulation, i. e. compliance with our legal obligations and assertion of legal rights, stemming above all from:

·          Act. No. 300/2005 Coll. Criminal Code as amended,

·          Act. No. 301/2005 Coll. Code of Criminal procedure as amended.

–         processing of applications of the data subjects exercising the rights arising from the Regulation and the Act (purpose of processing compatible with the abovementioned original purposes of the processing of personal data)

The legal basis for the processing of your personal data for this purpose is Art. 6, para. 1, letter c) of the Regulation, i. e. compliance with our legal obligations, stemming from the Regulation and the Act.

(v)              We shall process your personal data collected for the purpose of conclusion and fulfilling of the lease agreement for the duration of this agreement and 10 years following the termination of the agreement.

We shall process your personal data collected for the purpose of the record and restriction of entry of persons in our premises (issuing of the access cards) for the duration of your employment relationship or other relationship with the lessee, resp. for the duration of the lease agreement, whichever occurs earlier.

We shall process your personal data (manifestation of character) collected by the camera system for the period of 7 calendar days. After the lapse of this period the records will be automatically deleted if they are not used for the purpose of criminal proceedings.

We shall process your personal data collected for the purpose of sending of info newsletters for the duration of the lease between the company you work for or perform any other activity for and us, resp. for the duration of your employment relationship or other relationship with the lessee, resp. until you withdraw your consent, whichever occurs earlier.

In the event that we assert legal claims against you and conduct judicial or administrative proceedings, or we file a criminal complaint against you on reasonable suspicion of you or third party having committed a criminal offense, or if you assert claims against our company and conduct judicial or administrative proceedings against us, we shall process your personal the data until the valid conclusion of such proceedings, resp. until the enforcement of claims arising therefrom.

After the lapse of mentioned periods, your personal data will only be archived, unless needed for another, still lasting, processing purpose.

(vi)            In the case of concluding a lease agreement, as a party (in the case of self-employed persons) you are obliged to provide us with your personal data to the extent necessary for concluding the agreement so that you can be considered a sufficiently identified person for the purposes of fulfilling rights and obligations arising from the contractual relationship.

Failure to provide personal data necessary for concluding a lease agreement (in the case of self-employed person) may lead to the prevention of the achievement of the purpose of personal data processing, to the impossibility of fulfilling the legal obligations of one of the parties, and thus to the impossibility of concluding the agreement.

If you have not provided us with your personal data by yourselves, e.g. when concluding the agreement, we obtained them from your employer (or the company for which you perform another activity) as a contact information for the purpose of fulfilling the rights and obligations under the contract.

(vii)          Any of your personal data shall be archived in our internal systems and shall not be further provided or made accessible by us to the third persons unless it is necessary for the achievement of some of the mentioned purposes. In that case shall your personal data be provided and made accessible to the recipients in the following extent:

–        attorneys-at-law, auditors, tax advisors, processors who secure the processing of personal data according to the contract concluded with us as a controller,

–        third parties, to whom the personal data shall be provided in relation to the fulfillment of our obligations in line with specific laws, such as tax authority, authorized public administration authorities to exercise control and supervision (such as the labor inspectorate), Statistical office of the Slovak Republic, courts, law enforcement authorities, judicial executors.

We approach the selection of recipients of your personal data with due care and in the event that these recipients are not bound by a legal duty of confidentiality in relation to the personal data provided, we will bind them to this obligation through a separate written contract.

II.

Further rights of the data subject

(i)       Right to withdraw the consent (art. 7 par. 3 of the Regulation)

You shall have the right to withdraw your consent with processing your personal data at any time, the same mean it was granted to us. However, the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

(ii)     Right of access (art. 15 of the Regulation)

You shall have the right to obtain the confirmation as to whether or not your personal data are being processed and where that is the case, you shall have the right to obtain access to the personal data (copies thereof), as well as any additional information in the extent prescribed by Article 15 of the Regulation.

In the majority of cases, these copies of your personal data and any additional information shall be provided in written document form, unless you ask for a different form of provision. Shall you make the request by electronic means, the data shall be provided electronically, if technically possible.

(iii)   Right to rectification of personal data (art. 16 of the Regulation)

We take appropriate actions to secure accuracy, completeness and relevance of your personal data provided to us. This right entitles you to request the rectification of inaccurate personal data and complete your personal data, if incorrect, incomplete or irrelevant without undue delay.

(iv)    Right to erasure of personal data (right to “be forgotten”) (art. 17 of the Regulation)

You shall have the right to request the erasure of your personal data without undue delay after such request, for example in case your personal data are no longer necessary in relation to the purpose for which we collected and processed them, if you withdraw the consent on which the processing is based, if you object to the processing of such personal data pursuant to art. 21 para. 1 of the Regulation or if your personal data have been processed unlawfully. It is necessary to evaluate this right with the relevant circumstances. For example, we could have certain legal and regulation obligations, meaning we could not comply with such a request.

(v)     Right to restriction of processing of personal data (art. 18 of the Regulation) 

In certain cases, as specified by the law, you shall have the right to request from us to stop processing your personal data, e.g. if you object the accuracy of the personal data we have on you (albeit only during the period allowing us to verify  the accuracy of your personal data), in case processing of your personal data is unlawful and you oppose the erasure of your personal data, while instead request the restriction of their use or you object the erasure  of your personal data, which we as controller do not need anymore and want to erase them but they are required by you for the establishment, exercise or defence of legal claims.

(vi)    Right to data portability (art. 20 of the Regulation)

You shall have the right to receive your personal data from us, as they were previously provided to us, in a structured, commonly used and machine-readable format and you have the right to request for us to transmit your personal data to another controller while fulfilling the lawful conditions; the exercise of this right shall be without prejudice to the right to erasure of your personal data.

The right to data portability shall however only pertain to personal data, which were received by us from you on the basis of your consent or on the basis of a contract, to which you are a contractual party.

(vii)  Right to object the processing of the personal data (art. 21 of the Regulation)

In case the processing of your personal data is based on our legitimate interest, you have the right to object such processing of your personal data.

In case you object and we fail to prove a convincing, legitimate interest to processing of your personal data, we shall no longer process your personal data for these purposes.

(viii)       Right to inefficiency of automated individual decision-making including profiling (art. 22 of the Regulation)

By processing of your personal data by us does not come to an automated decision-making or profiling.

(ix)        Right to lodge a complaint to start proceedings on the protection of personal data (para. 100 of the Act; Art. 77 and 79 of the Regulation)

In case you suspect, that the processing of your data infringes the Act or the Regulation, you shall have the right to lodge a complaint and a petition to start proceedings on the protection of personal data with the Office for personal data protection, with registered office at Hraničná 12, 820 07 Bratislava, the Slovak Republic, Id. No.: 36 064 220 (hereinafter referred to as “Office”) or other respective authority mostly in other Member State of your respective habitual residence, place of work or place of the alleged infringement.

The petition to start proceedings (hereinafter referred to as the “petition”) must contain

a)      name, surname, correspondence address and the signature of the petitioner,

b)     description of the person against whom the petition is directed, while specifying the name and surname, place of habitual residence or business name, registered office and identification number, if they were granted,

c)      the subject of the petition, with the designation of rights which were allegedly infringed during the processing of personal data,

d)     any evidence to support the claims of the petition,

e)      the copy of a document or other evidence demonstrating the assertion of a right, in accordance with the second part of the second chapter of the Act or the Regulation, if such a right was asserted by the data subject, or the statement of reasons worthy of special consideration about the renouncement of the assertion of the right, if the petition was filed by the data subject.

The draft version of the petition to start proceedings with the Office is published on the web domain of the Office.

Without affecting your right to demand the protection of your rights through the petition to start proceedings with the Office, you shall also have the right to demand your rights at the court of the Slovak Republic having jurisdiction, if you suspect, that as a result of the processing of your personal data in breach of the Regulation we breached your rights as stated in the Regulation.

This document becomes effective on 25th May 2018.