Privacy Policy

Information on the Processing of Personal Data INFINITY REAL ESTATE DEVELOPMENT s.r.o. The company considers your personal data and the protection of your privacy to be important, and therefore we implement our privacy policy to ensure your right to privacy. The company ensures the protection of your privacy through its security measures. Personal data is processed only in accordance with the principles and the law, our privacy policy, and information regarding what personal data we collect and process, as well as the measures we take to keep it safe under our protection. Information on the processing of personal data of data subjects pursuant to Sections 19 and 20 of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts (hereinafter referred to as the “Act”) and Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “Regulation”). The purpose of this notice is to provide you with information about what personal data we process, how we handle it, for what purposes we use it, to whom we may disclose it, where you can obtain information about your personal data, and how you can exercise your rights regarding the processing of personal data. Identification and Contact Information The data controller processing your personal data is the company Contact information for the data protection officer: INFINITY REAL ESTATE DEVELOPMENT s. r. o., Žižkova 22B, Bratislava – Staré Mesto district 811 02, Company ID No.: 52 277 003, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, File No. 161122/B. For supervision of personal data processing: gdpr@infinity-realestate.eu Rights of the Data Subject The data subject has the right to request from the controller access to the personal data being processed about them, the right to rectification of personal data, the right to erasure or restriction of processing of personal data, the right to object to the processing of personal data, the right not to be subject to automated individual decision-making, including profiling, the right to data portability, and the right to lodge a complaint with a supervisory authority. If the controller processes personal data based on the data subject’s consent, the data subject has the right to withdraw their consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of the processing of personal data based on consent prior to its withdrawal. The data subject may exercise their rights by sending an email to: gdpr@infinity-realestate.eu, or in writing to the controller’s address. 1. Electronic Communication Purpose of Personal Data Processing and Legal Basis for Processing The purpose of processing personal data is to facilitate electronic communication with data subjects via email, online chat, or web forms (e.g., handling requests, answering questions, processing inquiries or suggestions). Personal data is processed on the basis of: •the necessity to take steps prior to entering into a contract or to perform a contract pursuant to Article 6(1)(b) of the Regulation, •the controller’s legitimate interest pursuant to Article 6(1)(f) of the Regulation. Identification of the personal data of data subjects being processed Data subjects: clients, potential customers, individuals communicating with the controller. Scope of personal data processed: first name, last name, email address, phone number, content of the message/inquiry. Identification of recipients, categories of recipients The controller may disclose personal data to authorized entities, such as institutions and organizations authorized to process such data under specific legal regulations, or to contractual partners (particularly processors) who have contractually committed to providing adequate safeguards to ensure the protection of the personal data being processed, as follows: Another authorized entity pursuant to a generally binding administrative regulation under Article 6(1)(c) of the Regulation. Contractual partner (based on a contract) under Article 28 of the Regulation; a company providing IT services Transfer of personal data to a third country or international organization: No transfers to third countries or international organizations are made. Identification of the source from which the personal data was obtained: Directly from the data subject (by filling out a form, sending an email, or via an online chat message). Retention period for personal data: The controller processes personal data for the period necessary to fulfill the purpose: •no longer than 1 year after the purpose has been fulfilled, •in the event of a contractual relationship, in accordance with the time limits applicable to contractual documents and related communication. Profiling: The controller does not process personal data through profiling or other automated decision-making. Obligation to Provide Personal Data: The data subject provides their personal data voluntarily. Failure to provide the data may result in the inability to process a request or respond to a message. 2. Clients Purpose of Personal Data Processing and Legal Basis for Processing The purpose of processing personal data is: to process the personal data of data subjects—clients—in accordance with Section 13(1)(b) of the Act, for contractual/pre-contractual relationships, and for handling complaints. Personal data is processed on the basis of: Section 13(1)(b) of the Act and Article 6(1)(b) of the Regulation. Legitimate interests of the controller or a third party: Personal data are not processed for the purposes of the legitimate interests of the controller or a third party. Identification of the personal data of data subjects being processed The data subjects whose personal data are processed are: the controller’s clients. Scope of personal data processed: title, first name, last name, maiden name, date of birth, social security number, permanent address, nationality, phone number, email address, and mailing address. Identification of recipients, categories of recipients The controller may provide personal data to authorized entities, such as institutions and organizations authorized to process such data under specific legal regulations, or to contractual partners (particularly processors) who have contractually committed to implementing appropriate safeguards to ensure the protection of the processed personal data, as follows: Another authorized entity under generally binding legislation pursuant to Section 13(1)(c) of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts. Contractual partner (under a contract) § 34 of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts; a company responsible for fulfilling obligations and handling claims under concluded contracts. With the consent of the data subject or at his or her request, personal data may be provided to other recipients. Transfer of personal data to a third country or international organization: No transfers to third countries or international organizations are made. Identification of the source from which personal data was obtained: Directly from the data subject or his or her legal representative (in person, by email, by phone, or via the controller’s website). Retention period for personal data: The controller processes personal data for the period necessary to fulfill the purpose, but for no longer than 10 years. Profiling: The controller does not process personal data through profiling or any similar method based on automated individual decision-making. Obligation to Provide Personal Data: The provision of personal data is a contractual requirement, or a requirement necessary for the conclusion of a contract. The data subject is obligated to provide personal data; if such data is not provided, the controller will not be able to provide the service to the data subject. 3. Business Partner Records The purpose of processing personal data is to maintain a record of the data subjects who are the controller’s business partners or clients. Personal data is processed pursuant to: Section 13(1)(f) of the Act and Article 6(1)(f) of the Regulation, if the data subject is an employee of the controller’s business partner or client. Personal data is processed pursuant to Section 13(1)(b) of the Act and Article 6(1)(b) of the Regulation if the data subject is a statutory body or a person acting on behalf of the controller’s business partner or client. Legitimate interests of the controller or a third party: Personal data is processed for the purposes of the legitimate interests of the controller or a third party—maintaining records of business partners. Identification of the personal data of data subjects being processed The data subjects whose personal data are processed are: the controller’s business partners. Scope of personal data processed: title, first name, last name, job title, position, functional role, department, place of work, phone number, work email address, and employer identification information. Identification of recipients, categories of recipients The controller may provide personal data to authorized entities, such as institutions and organizations authorized to process such data under specific legal regulations, or to contractual partners (particularly data processors) who have contractually committed to implementing appropriate safeguards to ensure the protection of the processed personal data, as follows: Another authorized entity under generally binding legislation pursuant to Section 13(1)(c) of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts. With the consent of the data subject or at his or her request, personal data may be provided to and other recipients. Transfer of personal data to a third country or international organization: No transfers to third countries or international organizations are made. Identification of the source from which personal data was obtained: Directly from the data subject or the data subject’s employer. Retention period for personal data: The controller processes personal data for the period necessary to fulfill the purpose, but no longer than 10 years from the last completed order. Profiling: The controller does not process personal data through profiling or any similar method based on automated individual decision-making. Obligation to Provide Personal Data: The provision of personal data is a legal requirement; the processing of personal data is mandatory. The data subject is obligated to provide personal data; failure to do so constitutes a violation of the law. 4. Accounting Documents The purpose of processing personal data is: to process the accounting documents of data subjects in connection with the establishment and performance of pre-contractual and contractual relationships. Personal data is processed on the basis of: Section 13(1)(b) of the Act, Article 6(1)(b) of the Regulation, the Civil Code, the Commercial Code, the Value-Added Tax Act No. 222/2004 Coll., as amended (Section 74), and Act No. 431/2002 Coll. on Accounting, as amended. Legitimate interests of the controller or a third party: Personal data are not processed for the purposes of the legitimate interests of the controller or a third party. The data subjects whose personal data are processed are: the controller’s clients and contractual partners. Scope of personal data processed: the first and last name of the taxable person or the name of the taxable person, the address of its registered office, place of business, business premises, residence, or the address of the place where the taxable person usually resides, and its tax identification number under which the goods or services were supplied, or the first and last name of the recipient of the goods or services or the name of the recipient of the goods or services, the address of their registered office, place of business, business premises, residence, or the address of the place where they usually reside, and their tax identification number under which the goods were supplied to them or under which the services were provided to them, business ID number, VAT ID for VAT payers, bank account number, signature. Identification of Recipients, Categories of Recipients The controller may provide personal data to authorized entities, such as institutions and organizations authorized to process such data under specific legal regulations, or to contractual partners (particularly processors) who have contractually committed to implementing appropriate safeguards to ensure the protection of the personal data being processed, as follows: Tax Office: Act No. 595/2003 Coll. on Income Tax, as amended; Act No. 222/2004 Coll. on Value-Added Tax, as amended; Act No. 563/2009 Coll. on Tax Administration (Tax Code) and on Amendments to Certain Acts, as amended Any other authorized entity under a generally binding legal regulation pursuant to Section 13(1)(c) of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts. With the consent of the data subject or at his or her request, personal data may be provided to other recipients. Transfer of personal data to a third country or international organization: No transfers to third countries or international organizations are made. Identification of the source from which the personal data was obtained: Directly from the data subject (in person, by email, or by phone). Retention period for personal data: The controller processes personal data for the period necessary to fulfill the purpose, but for no longer than 10 years. Profiling: The controller does not process personal data through profiling or any similar method based on automated individual decision-making. Obligation to Provide Personal Data: The provision of personal data is a legal requirement, a contractual requirement, or a requirement necessary for the conclusion of a contract. The data subject is obligated to provide personal data; if such data is not provided, the controller cannot guarantee the processing of accounting documents. 5. Marketing Purpose of Personal Data Processing and Legal Basis for Processing The purpose of processing personal data is to carry out marketing activities (providing information about news, discounts, and other marketing offers) related to the service or goods purchased or procured. Personal data is processed on the basis of: the controller’s legitimate interest pursuant to Section 13(1)(f) of the Act and Article 6(1)(f) the Regulation, or the data subject’s voluntary consent pursuant to Section 13(1)(a) of the Act and Article 6(1)(a) of the Regulation. Legitimate interests of the controller or a third party: The processing of personal data is carried out for the purposes of the legitimate interests of the controller or a third party—the conduct of marketing activities. Identification of the personal data of data subjects being processed The data subjects whose personal data are processed are: clients / customers / potential customers. Scope of personal data processed: title, first name, last name, email address, phone number. Identification of recipients and categories of recipients The controller may provide personal data to authorized entities, such as institutions and organizations authorized to process such data under specific legal regulations, or to contractual partners (particularly processors) who have contractually committed to providing adequate safeguards to ensure the protection of the personal data being processed, as follows: Other authorized entities pursuant to a generally binding legal regulation under Section 13(1)(c) of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts. Contractual partner (based on a contract) pursuant to Section 34 of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts; A company providing marketing services. With the consent of the data subject or at his or her request, personal data may be provided to other recipients. Transfer of personal data to a third country or international organization: No transfers to third countries or international organizations are made. Identification of the source from which the personal data was obtained: Directly from the data subject (in person, by email, or by filling out an electronic form). Retention period for personal data: The controller processes personal data for the period necessary to fulfill the purpose: •for a maximum of 5 years from the date of collection, •for a maximum of 5 years from the conclusion of the last contract, •for a maximum of 5 years from the last direct marketing communication. Profiling: The controller does not process personal data through profiling or any similar method based on automated individual decision-making. Obligation to Provide Personal Data: The data subject provides their personal data voluntarily, based on consent (provision is not a legal or contractual requirement); if the data is not provided, the data subject will not be informed of news, discounts, or other marketing offers. 6. Promotion Purpose of Personal Data Processing and Legal Basis for Processing The purpose of processing personal data is: positive promotion of the controller’s activities, as well as documentation and presentation purposes. Personal data is processed on the basis of: the data subject’s voluntary consent pursuant to Section 13(1)(a) of the Act and Article 6(1)(a) of the Regulation, or the legitimate interest of the controller or a third party pursuant to Article 6(1)(f) of the Regulation and Section 13(1)(f) of the Act. Justification: It is in the controller’s interest to build good internal relationships, as well as external relationships with the controller, and to maintain its good reputation. To this end, the controller also organizes events and activities for data subjects, the course of which it documents for its own purposes and uses to promote the controller and its activities. If you have not consented to the processing of personal data for the purpose of positively promoting the controller’s activities, have withdrawn your consent, or have objected to the processing of personal data, your personal data will not be processed. Identification of the personal data of data subjects being processed The data subjects whose personal data is processed are: event participants and promotional campaign participants. Scope of personal data processed: title, first name, last name, photographs, audio-visual recordings, and audio recordings. Identification of recipients and categories of recipients The controller may provide personal data to authorized entities, such as institutions and organizations authorized to process such data under specific legal regulations, or to contractual partners (particularly processors) who have contractually committed to implementing appropriate safeguards to ensure the protection of the personal data being processed, as follows: Other authorized entities under generally binding legislation pursuant to Section 13(1)(c) of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts. Contractual partner (based on a contract): Photographers and marketing companies. With the consent of the data subject or at his or her request, personal data may be provided to other recipients. Transfer of personal data to a third country or international organization: No transfers to third countries or international organizations are made. Identification of the source from which the personal data was obtained: Directly from the data subject or his or her legal representative (in person, by email). Retention period for personal data: The controller processes personal data for the period necessary to fulfill the purpose, but for no longer than 5 years. Profiling: The controller does not process personal data through profiling or any similar method based on automated individual decision-making. Obligation to Provide Personal Data: The data subject (or their legal representative) provides their personal data voluntarily, based on consent (provision is not a legal or contractual requirement ); if such data is not provided, the data subject’s personal data (photographs, video recordings, etc.) will not be processed for documentation, presentation, or positive promotion of the controller. 7. Statistical Data Purpose of Personal Data Processing and Legal Basis for Processing The purpose of processing personal data is to process statistical data in order to improve services for customers and real estate users. Personal data is processed on the basis of: •Section 13(1)(f) of the Act and Article 6(1)(f) – legitimate interest, •Section 13(1)(a) of the Act and Article 6(1)(a)—consent of the data subject. Legitimate interests of the controller or a third party: The processing of personal data is necessary for the purposes of the controller’s legitimate interests. Identification of the personal data of data subjects being processed The data subjects whose personal data are processed are: customers and real estate users. Scope of personal data processed: email address (email). Identification of recipients, categories of recipients The controller may provide personal data to authorized entities, such as institutions and organizations authorized to process such data under specific legal regulations, or to contractual partners (particularly processors) who have contractually committed to implementing appropriate safeguards to ensure the protection of the personal data being processed, as follows: Another authorized entity under generally binding legislation pursuant to Section 13(1)(c) of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts With the consent of the data subject, or at his or her request, personal data may be provided to other recipients. Transfer of personal data to a third country or international organization: No transfers to third countries or international organizations are made. Identification of the source from which the personal data was obtained: Directly from the data subject or his or her legal representative (via email). Retention period for personal data: The controller processes personal data for the period necessary to fulfill the purpose; after the statistics have been compiled, the personal data of the data subjects will be destroyed without delay. Profiling: The controller does not process personal data through profiling or any similar method based on automated individual decision-making. The data subject has the right to object to the processing of personal data. If the controller processes personal data based on the data subject’s consent, the data subject has the right to withdraw their consent to the processing of personal data at any time. Obligation to Provide Personal Data: The data subject provides their personal data voluntarily, based on consent, or provides their personal data voluntarily with the expectation that they will be included in statistical analyses aimed at improving services. 8. Job Applicants The purpose of processing personal data is: to include the applicant in the registry of job seekers for the purpose of assessing suitability for a given job position pursuant to Section 13(1)(b) of the Act, Article 6(1)(b) of the Regulation, and Article 11 of the Labor Code. The controller processes personal data for the period necessary to assess the candidate’s suitability for the given job position. If the data subject has given voluntary consent pursuant to Section 13(1)(a) of the Act and Article 6(1)(a) of the Regulation, the controller retains the job applicant in the database of job seekers for a longer period, for the purpose of participation in future selection procedures, in accordance with the consent granted. Legitimate interests of the controller or a third party: Personal data are not processed for the purposes of the legitimate interests of the controller or a third party. Identification of the personal data of data subjects being processed Personal data of job applicants as contained in the job application, resume, documents, and certificates regarding the applicant’s education or qualifications, or in other materials provided in connection with the job application. Identification of recipients, categories of recipients The data controller may disclose personal data to authorized entities (institutions/organizations) in accordance with specific legal regulations, e.g.: •health insurance companies, •Social Insurance Agency, •tax authority, •the Central Office of Labor, Social Affairs, and Family, •supplementary pension funds, •pension management companies, •state administration and public authority bodies responsible for inspection and supervision (e.g., the Labor Inspectorate), •the court, law enforcement agencies, •bailiffs, or other authorized entities. Transfer of personal data to a third country or international organization: No transfers to third countries or international organizations are made. Identification of the source from which personal data was obtained: Directly from the data subject or their legal representative. Profiling: The controller does not process personal data by means of profiling or any similar method based on automated individual decision-making. Obligation to Provide Personal Data: The provision of personal data in cases where personal data is processed based on consent for the purpose of maintaining a job applicant’s record to enable the data subject’s participation in future recruitment processes is voluntary; if consent is not provided, the controller will not process the personal data for longer than is necessary to assess the job applicant’s suitability for the given position. The provision of personal data processed in accordance with the Labor Code and specific laws is a legal requirement, a contractual requirement, or a requirement necessary for the conclusion of a contract. The data subject is obligated to provide personal data; if such data is not provided, the controller will not be able to ensure the conclusion or performance of the contract. 9. AML Act The purpose of processing personal data is: to fulfill the rights and obligations of legal entities and natural persons in preventing and detecting money laundering and terrorist financing. Personal data is processed on the basis of: Section 13(1)(c) of the Act and Article 6(1)(c) of the Regulation—compliance with a specific legal provision: •Act No. 297/2008 Coll. on Protection Against Money Laundering and on Protection Against Terrorist Financing, and on Amendments to Certain Acts. Legitimate interests of the controller or a third party: Personal data are not processed for the purposes of the legitimate interests of the controller or a third party. Identification of the personal data of data subjects being processed Natural persons covered by Act No. 297/2008 Coll. on the Prevention of Money Laundering and the Prevention of Terrorist Financing, and on Amendments to Certain Acts. Scope of personal data processed: •for a natural person, a person represented by power of attorney, and a natural person authorized to act on behalf of a legal entity or a natural person, the following data: first name, last name, birth number or date of birth (if a birth number has not been assigned), permanent address or other residence address, nationality, type and number of identification document, and copies of official documents, •in the case of a legal entity, the identification details of the natural person authorized to act on behalf of the legal entity, •in the case of a minor who does not have an identity document, determining the minor’s first name, last name, birth number, or date of birth (if a birth number has not been assigned), permanent residence or other place of residence, and the nationality of the minor and his or her legal representative, •in cases where services are provided by third parties, the receipt of data and supporting documents from a bank or financial institution. Identification of Recipients, Categories of Recipients The controller may provide personal data to authorized entities, such as institutions and organizations authorized to process such data under a specific legal regulation, or to contractual partners (in particular, processors) who have contractually committed to providing adequate safeguards to ensure the protection of the personal data being processed, as follows: Another authorized entity pursuant to a generally binding legal regulation under Section 13(1)(c) of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts With the consent of the data subject, or at his or her request, personal data may be provided to other recipients. Transfer of personal data to a third country or international organization: No transfers to third countries or international organizations are made. Identification of the source from which the personal data was obtained: Directly from the data subject or his or her legal representative. Retention period for personal data: The controller processes personal data for the period specified by a specific legal regulation—5 years. Profiling: The controller does not process personal data through profiling or any similar method based on automated individual decision-making. Obligation to Provide Personal Data: The provision of personal data is a legal requirement. The data subject is obligated to provide personal data; failure to do so constitutes a violation of Act No. 297/2008 Coll. on the Prevention of Money Laundering and the Financing of Terrorism and on Amendments to Certain Acts.