Privacy policy

The controller of personal data within the meaning of Article 4 (7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”) is:

(hereinafter the “controller” or the “company”)

The company has not designated a data protection officer under Article 37 of the GDPR, as such designation is not required by the nature of its personal data processing. For any questions regarding the protection of personal data, you may contact us at the email address reality@rewin.sk.

The controller processes personal data on the following legal bases and for the following purposes:

a) Performance of a contract and pre-contractual relations (Article 6 (1) (b) of the GDPR)

• brokerage of the sale, purchase or rental of properties on the basis of a brokerage contract,
• provision of financial advisory services and brokerage of property financing,
• communication with the client in connection with the performance of the contract (viewings, negotiations, preparation of contractual documentation),
• records of prospective buyers, sellers or tenants of properties based on expressed interest (pre-contractual relations).

b) Compliance with legal obligations (Article 6 (1) (c) of the GDPR)

• keeping accounting and tax records (Act No. 431/2002 Coll. on Accounting, Act No. 595/2003 Coll. on Income Tax),
• compliance with obligations under Act No. 297/2008 Coll. on the Prevention of Money Laundering and Terrorist Financing (AML),
• archiving of contractual documentation in accordance with applicable regulations.

c) Legitimate interest of the controller (Article 6 (1) (f) of the GDPR)

• protection of the company’s legal claims (e.g. records of communication for the purpose of a potential dispute),
• ensuring the functionality and security of the website, including prevention of misuse,
• internal analysis of website traffic in order to improve the services provided.

d) Consent of the data subject (Article 6 (1) (a) of the GDPR)

• sending of marketing offers and newsletters (where express consent has been granted),
• processing of photographs and client references for marketing purposes.

Consent may be withdrawn at any time without affecting the lawfulness of processing based on consent prior to its withdrawal. A withdrawal may be sent to the email address reality@rewin.sk.

Depending on the purpose of processing, we process the following categories of personal data:

Identification data:

• first name, surname, maiden name, title,
• date of birth, birth number,
• identity card number or number of another identity document,
• nationality,
• permanent residence, or correspondence address.

Contact data:

• telephone number,
• email address.

Property-related data:

• data from the title deed (LV number, parcels, encumbrances),
• address and description of the property,
• purchase price or amount of rent.

Payment and financial data:

• bank account number (IBAN),
• data on financing (loan amount, bank).

Technical data (website):

• IP address, browser type, operating system,
• data from cookie files (see Article VIII).

Personal data such as the birth number and the number of the identity document are processed solely to the extent necessary to comply with statutory obligations or to conclude and perform contracts relating to the transfer or rental of properties.

The controller may disclose personal data to the following categories of recipients, solely to the extent necessary to achieve the relevant purpose:

• real estate agents — natural persons acting on the basis of a power of attorney and/or a commercial representation contract concluded with the controller, who participate in the provision of real estate brokerage services,
• contractual counterparties — prospective buyers, sellers or tenants of a property, to the extent necessary for the execution of the transaction (e.g. identification data for the purposes of a purchase agreement),
• legal representatives — attorneys and notaries arranging the preparation of contractual documentation and escrow,
• financial intermediaries — cooperating persons arranging financing of the property for the client,
• accounting and tax services — external accountant or accounting firm processing the controller’s accounting agenda,
• IT service providers — hosting, email services, CRM system, cloud storage (processors under Article 28 of the GDPR),
• public authorities — courts, the Land Registry administration, the tax authority, law enforcement authorities, solely on the basis of a statutory obligation.

A personal data processing agreement under Article 28 of the GDPR has been concluded with every processor that processes personal data on behalf of the controller, ensuring an adequate level of personal data protection.

The controller does not intend to transfer personal data to any third country or international organisation outside the European Economic Area (EEA).

Should such a transfer take place (e.g. through the use of cloud services with servers outside the EEA), the controller will provide appropriate safeguards under Article 46 of the GDPR, in particular by means of standard contractual clauses approved by the European Commission or an adequacy decision under Article 45 of the GDPR.

The controller retains personal data only for the time necessary to achieve the purpose for which it was obtained:

• contractual relationship — for the duration of the contract and subsequently 10 years after the termination of the contractual relationship (limitation periods, statutory archiving),
• accounting documents — 10 years from the end of the accounting period in which the document was issued (Section 35 of Act No. 431/2002 Coll.),
• AML obligations — 5 years from the termination of the business relationship (Section 19 of Act No. 297/2008 Coll.),
• pre-contractual relations (enquiry, expressed interest) — 3 years from the last contact, where no contract has been concluded,
• consent-based marketing — until consent is withdrawn by the data subject,
• technical data (cookies) — according to cookie settings (see Article VIII).

Upon expiry of the retention period, personal data is securely erased or anonymised.

In connection with the processing of your personal data, you have the following rights under the GDPR and Act No. 18/2018 Coll.:

a) Right of access (Article 15 of the GDPR)

You have the right to obtain confirmation as to whether your personal data is being processed and, if so, the right to obtain access to that data and to information on the purpose of processing, the categories of data, the recipients, the retention period and your rights.

b) Right to rectification (Article 16 of the GDPR)

You have the right to request the rectification of inaccurate personal data or the completion of incomplete personal data concerning you.

c) Right to erasure (the right “to be forgotten”) (Article 17 of the GDPR)

You have the right to request the erasure of your personal data where it is no longer necessary for the purpose for which it was obtained, you withdraw consent and there is no other legal basis, or it has been processed unlawfully. This right is not absolute — the controller may refuse the request where processing is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

d) Right to restriction of processing (Article 18 of the GDPR)

You have the right to request the restriction of the processing of your personal data where you contest its accuracy (for the period of verification), where processing is unlawful and you request restriction instead of erasure, where the controller no longer needs the data but you require it for the establishment, exercise or defence of legal claims, or where you have objected to processing under Article 21 of the GDPR.

e) Right to data portability (Article 20 of the GDPR)

You have the right to receive the personal data you have provided to the controller in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller, where the processing is based on consent or a contract and is carried out by automated means.

f) Right to object (Article 21 of the GDPR)

You have the right to object to the processing of your personal data which is based on the legitimate interests of the controller (Article 6 (1) (f) of the GDPR). The controller will cease to process your data unless it demonstrates compelling legitimate grounds overriding your interests or grounds for the establishment, exercise or defence of legal claims. You have the right to object at any time and without giving reasons to processing for direct marketing purposes.

g) Right to withdraw consent (Article 7 (3) of the GDPR)

Where processing is based on your consent, you have the right to withdraw that consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

h) Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR)

If you consider that the processing of your personal data infringes the GDPR or Act No. 18/2018 Coll., you have the right to submit a request to initiate proceedings on the protection of personal data with the supervisory authority (see Article IX).

You may exercise your rights in writing to the company’s registered seat, by email at reality@rewin.sk or in person at the premises at Plynárenská 7/C, 821 09 Bratislava. The controller is required to respond to the request without undue delay, and no later than within 30 days of receipt of the request (Article 12 (3) of the GDPR).

The controller’s website uses cookies — small text files stored on your device when you visit the website. Cookies serve to ensure the basic functionality of the website, to analyse traffic and to improve user experience.

Cookie categories:

• necessary (technical) — ensure the basic functionality of the website (e.g. remembering language preferences, security tokens). These cookies cannot be refused as they are necessary for the operation of the website,
• analytical — help us understand how visitors use the website by collecting anonymised statistical data (e.g. number of visits, most visited pages). These are processed only on the basis of your consent,
• marketing — used to display relevant advertisements and to measure the effectiveness of advertising campaigns. These are processed only on the basis of your consent.

You can adjust or withdraw consent for non-essential cookies at any time via the cookie settings on our website. Cookies can also be managed directly in the settings of your web browser.

The legal basis for necessary cookies is the legitimate interest of the controller (Article 6 (1) (f) of the GDPR). For analytical and marketing cookies, the legal basis is the consent of the data subject (Article 6 (1) (a) of the GDPR; Section 55 (5) of Act No. 351/2011 Coll. on Electronic Communications).

The supervisory authority for the protection of personal data in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic. If you consider that your rights in the area of personal data protection have been infringed, you have the right to submit a request to initiate proceedings under Section 100 of Act No. 18/2018 Coll.

The provision of personal data is, to the extent necessary for the conclusion and performance of a contract, a contractual requirement. Without the provision of such data, it is not possible to conclude the contract or to provide the requested services. The provision of personal data for marketing purposes is voluntary and a failure to provide it has no effect on the possibility to conclude the contract.

The controller does not carry out automated individual decision-making or profiling under Article 22 of the GDPR.

The controller has adopted appropriate technical and organisational measures to ensure the protection of personal data in accordance with Article 32 of the GDPR, in particular encryption of communication, control of access rights, regular software updates and training of authorised persons.

This information on the processing of personal data becomes valid and effective on the date of its publication on the controller’s website. The controller reserves the right to update this information in accordance with applicable legal regulations. The current version is at all times available on the website www.rewin.sk/spracovanie-osobnych-udajov.