GDPR

Personal data protection

Personal data processing policies

Who processes your personal data?

Your personal data is processed by the company URBAN reality, s.r.o. with its registered office at Vlčie Hrdlo 585/57, 82107 Bratislava, Company ID: 50 190 113, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro , File No.: 109457/B, as the operator of the domain www.urbanreality.co.tz . (hereinafter referred to as the "company URBAN reality sro . " or the "operator"). The company URBAN reality s.r.o. carries out real estate activities and provides real estate services in the territory of the Slovak Republic. Real estate activities and real estate services on behalf of the brand in the territory of the Republic of Tanzania and Zanzibar are provided by the independent " franchising " real estate agency URBAN Reality (Z) Limited, Reg. No.: Z0000232891, registered in Zanzibar

When personal data is processed by the controller, you are in the position of the data subject, i.e. the person about whom personal data relating to them are processed. Your personal data will be processed securely, in accordance with the controller's security policy.

The data subject has, regardless of the legal basis for the processing of personal data, the right to access personal data, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, the right to object to the processing of personal data, the right not to be subject to a decision based solely on automated processing, including profiling, the right to lodge a complaint with the supervisory authority (Office for Personal Data Protection of the Slovak Republic) and the right to withdraw consent to the processing of personal data, if the personal data are processed on the basis of consent.

 

Rights of data subjects under the regulation:

The data subject's right to access data (Article 15 of the Regulation)

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, if so, the right to access the personal data and the following information:

• purposes of processing;
• categories of personal data;
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
• if possible, the expected retention period of personal data, if not possible, the criteria for determining it;
• the existence of the right to request the rectification of personal data concerning the data subject or their erasure or restriction of processing or the right to object to such processing;
• the right to file a complaint with the supervisory authority (Personal Data Protection Office of the Slovak Republic);
• if the personal data were not obtained from the data subject, any available information as to their source;
• the existence of automated decision-making, including profiling, and information about the process used, as well as the significance and foreseeable consequences of such processing for the data subject;
• when transferring personal data to a third country or international organization, information on appropriate safeguards regarding the transfer.

The controller shall provide a copy of the personal data being processed. For any further copies requested by the data subject, the controller may charge a reasonable fee corresponding to the administrative costs. If the data subject has submitted the request by electronic means, the information shall be provided in a commonly used electronic format, unless the data subject has requested otherwise. The right to obtain a copy of the personal data being processed shall not adversely affect the rights and freedoms of others.

Right to rectification (Article 16 of the Regulation)

The data subject shall have the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by providing a supplementary statement.

Right to erasure (right to be “forgotten”, Art. 17 of the Regulation)

The data subject has the right to have personal data concerning him or her erased without undue delay where one of the following grounds applies:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• the data subject withdraws the consent on the basis of which the processing is carried out unless there is another legal basis for the processing;
• the data subject objects to processing which is carried out on the legal basis of public interest or legitimate interest and there are no overriding legitimate grounds for the processing or the data subject objects to processing for direct marketing purposes;
• personal data was processed unlawfully;
• personal data must be erased to comply with a legal obligation under European Union law or the law of the Slovak Republic;
• personal data were collected in connection with the offer of information society services (based on the consent of a child under 16 years of age).

Where the controller has made personal data public and is obliged to erase them, taking into account available technology and the cost of implementation, he shall take reasonable steps, including technological measures, to inform controllers processing the personal data that the data subject has requested the erasure of all links to, copies or replications of, those personal data. The right to erasure shall not apply where processing is necessary:

• to comply with a legal obligation that requires processing under European Union law or the law of the Slovak Republic, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the field of public health;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of such processing;
• to establish, exercise or defend legal claims.

Right to restriction of processing (Article 18 of the Regulation)

The data subject has the right to obtain from the controller restriction of processing where one of the following applies:

• the data subject contests the accuracy of the personal data, during a period allowing the controller to verify the accuracy of the personal data;
• the processing is unlawful and the data subject objects to the erasure of the personal data and requests the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, or the data subject needs them to establish, exercise or defend legal claims;
• the data subject has objected to processing on the legal basis of public interest or legitimate interest, pending verification whether the legitimate reasons on the part of the controller override those of the data subject.

If processing has been restricted, such personal data, with the exception of storage, are processed only with the consent of the data subject or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or the Slovak Republic.

The controller shall inform the data subject who has achieved the restriction of processing before the restriction of processing is lifted.

Notification obligation in connection with the rectification or erasure of personal data or restriction of processing (Article 19 of the Regulation)

The controller shall notify each recipient to whom the personal data have been provided of any rectification or erasure of personal data or restriction of processing, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject of these recipients if the data subject so requests.

Right to data portability (Article 20 of the Regulation)

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided, where:

• the processing is based on the consent of the data subject or on a contract;
• if the processing is carried out by automated means.

When exercising the right to data portability, the data subject shall have the right to have personal data transmitted directly from one controller to another, where technically feasible. This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The right to data portability shall not adversely affect the rights and freedoms of others.

Right to object (Article 21 of the Regulation)

Where the legitimate interest in processing personal data is the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or a legitimate interest, the data subject shall have the right to object to processing of personal data concerning him or her, including profiling. The controller shall not further process personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, including profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. Where personal data are processed for scientific or historical research purposes or for statistical purposes, the data subject shall have the right to object to processing of personal data concerning him or her, except where the processing is necessary for the performance of a task carried out for reasons of public interest.

Automated individual decision-making, including profiling (Article 22 of the Regulation)

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. This right shall not apply if the decision:

• necessary for the conclusion or performance of a contract between the data subject and the controller;
• permitted by European Union law or the law of the Slovak Republic and which also lays down appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject;
• based on the explicit consent of the data subject.

Right to withdraw consent (Article 7 of the Regulation)

If the processing of personal data is based on the consent of the data subject, the data subject has the right to withdraw his or her consent at any time. Consent can be withdrawn in the same way as it was granted. The data subject can also withdraw his or her consent by sending a written request to the address of the controller's registered office with the words "GDPR - withdrawal of consent" on the envelope.

Notification of a personal data breach to the data subject (Article 34 of the Regulation)

In the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. The communication to the data subject shall contain a clear and plain language description of the nature of the personal data breach, the name and contact details of the person responsible or another point of contact where further information can be obtained, a description of the likely consequences of the personal data breach, a description of the measures taken or proposed by the controller to remedy the personal data breach, including, where appropriate, measures to mitigate its potential adverse consequences. Communication to the data subject shall not be required if any of the following conditions are met:

• the operator has taken appropriate technical and organizational protective measures and these
• measures have been applied to the personal data concerned by the personal data breach, in particular those measures which render the personal data unreadable to all persons not authorised to have access to them, such as encryption;
• the controller has taken subsequent measures to ensure that the high risk to the rights and freedoms of data subjects is no longer likely to result in consequences;
• would require a disproportionate effort. In such a case, the public shall be informed instead or a similar measure shall be taken, ensuring that the data subjects are informed in an equally effective manner.

Information obligation towards data subjects Information to be provided when obtaining personal data from a data subject

In cases where personal data concerning the data subject are collected from the data subject, the controller shall provide the data subject with all of the following information when collecting personal data or when intending to process personal data for a purpose other than that for which they were collected:

• the identity and contact details of the operator;
• contact details of any responsible person;
• the purposes of the processing for which the personal data are intended, as well as the legal basis for the processing;
• where the processing is based on the legal basis of legitimate interest, the legitimate interests pursued by the controller or a third party;
• the recipients or categories of recipients of the personal data, if any;
• where applicable, information that the controller intends to transfer personal data to a third country or an international organisation and information on the existence or absence of a Commission decision on adequacy or, in the case of transfers referred to in Articles 46 or 47 or in the second subparagraph of Article 49(1) of the Regulation, a reference to the adequate or suitable safeguards and the means to obtain a copy of them, or where they have been provided;
• the period for which personal data will be retained or, if this is not possible, the criteria for determining it;
• the existence of the right to request from the controller access to personal data concerning the data subject and the right to rectification or erasure or restriction of processing, or the right to object to processing, as well as the right to data portability;
• where the processing is based on the legal basis of the data subject's consent, the existence of the right to withdraw consent at any time without affecting the lawfulness of processing based on consent given before its withdrawal;
• the right to file a complaint with the supervisory authority (Office for Personal Data Protection of the Slovak Republic);
• information on whether the provision of personal data is a legal or contractual requirement, or a requirement that is necessary for the conclusion of a contract, whether the data subject is obliged to provide personal data, as well as the possible consequences of failure to provide such data;
• the existence of automated decision-making, including profiling, and meaningful information about the process involved, as well as the significance and envisaged consequences of such processing for the data subject.
• The information obligation does not apply to the extent that the data subject already has the information.

Information to be provided where personal data has not been obtained from the data subject

If the personal data were not obtained from the data subject or if the intention is to process the personal data for a purpose other than that for which they were obtained, the controller shall provide the data subject with the following information:

• the identity and contact details of the operator;
• contact details of any responsible person;
• the purposes of the processing for which the personal data are intended, as well as the legal basis for the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients of the personal data, if any;
• where applicable, information that the controller intends to transfer the personal data to a recipient in a third country or an international organisation and information on the existence or absence of a Commission decision on adequacy or, in the case of transfers referred to in Articles 46 or 47 or in the second subparagraph of Article 49(1) of the Regulation, a reference to the adequate or suitable safeguards and the means to obtain a copy of them, or where they have been provided;

• the period for which personal data will be stored, or if this is not possible, the criteria for determining it;
• where the processing is based on Article 6(1)(f), the legitimate interests pursued by the controller or by a third party;
• the existence of the right to request from the controller access to personal data concerning the data subject and the right to rectification or erasure or restriction of processing, and the right to object to processing, as well as the right to data portability;
• if the processing is based on the legal basis of the consent of the data subject, the existence of the right to withdraw consent at any time without affecting the lawfulness of processing based on consent given before its withdrawal; the right to lodge a complaint with the supervisory authority (Office for Personal Data Protection of the Slovak Republic);
• the source from which the personal data originates, or information on whether the data originates from publicly accessible sources;
• the existence of automated decision-making, including profiling, and meaningful information about the process involved, as well as the significance and envisaged consequences of such processing for the data subject.

The operator will provide the above information:

• within a reasonable period after obtaining the personal data, but no later than one month, taking into account the specific circumstances in which the personal data are processed;
• if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication with that data subject; or - if the provision of the personal data to another recipient is envisaged, at the latest when the personal data are first provided.

The information obligation does not apply to the extent that:

• the data subject already has the information; the provision of such information proves impossible or would involve a disproportionate effort, in particular in the case of processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to the conditions and safeguards referred to in Article 89(1) of the Regulation, or where the information obligation is likely to render impossible or seriously impair the achievement of the objectives of such processing. In such cases, the controller shall take suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject, including making the information available to the public;
• for the acquisition or provision is expressly provided for in European Union law or in the law of the Slovak Republic, and which lays down appropriate measures to protect the legitimate interests of the data subject; or
• in the event that personal data must remain confidential based on the obligation to maintain professional secrecy regulated by European Union law or the law of the Slovak Republic, including the obligation to maintain confidentiality arising from the statute.

INFORMATION ON THE PROCESSING OF PERSONAL DATA FOR MARKETING PURPOSES

Purpose of processing

Sending a newsletter with current real estate offers and a client satisfaction survey.

Legal basis for processing

The data subject has consented to the processing of his/her personal data pursuant to Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Recipients

Google Ireland Limited , Docusign , Inc. , The Rocket Science Group LLC d/b/a MailChimp .

Transfer of personal data to a third country

USA (companies certified in the EU-US regime Docusign, Inc. , The Rocket Science Group LLC d/b/a MailChimp )

Commission decision on adequacy

COMMISSION IMPLEMENTING DECISION (EU) 2016/1250 of 12 July 2016 pursuant to Directive

Transfer of personal data to a third country

USA (companies certified in the EU-US regime Docusign, Inc. , The Rocket Science Group LLC d/b/a MailChimp )

Commission decision on adequacy

COMMISSION IMPLEMENTING DECISION (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield [notified under document C(2016) 4176].

Retention period 7 years

The requirement to provide personal data and the possible consequences of failure to provide it

The provision of personal data is not a legal or contractual requirement, nor is it a requirement necessary to conclude a contract; the data subject is not obliged to provide personal data.

Automated decision-making, including profiling

It is not being implemented.

Rights of the data subject

The data subject has, regardless of the legal basis for the processing of personal data, the right to access personal data, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, the right to object to the processing of personal data, the right not to be subject to a decision based solely on automated processing, including profiling, the right to complain with the supervisory authority (Office for Personal Data Protection of the Slovak Republic) and the right to withdraw consent to the processing of personal data, if the personal data are processed based on consent.