provided in accordance with Regulation 2016/679 of the European Parliament and of the Council of the European Union on the protection of natural persons during processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (General Data Protection Regulation), (hereinafter referred to as the “GDPR Regulation”) and according to Act no. 18/2018 Coll. on the protection of personal data and on amendments to certain laws (hereinafter referred to as the “Personal Data Protection Act”).

The operator on whose behalf the Personal Data are processed is the company D O A S, a.s., with its registered office at Košická 5590/56, 821 08 Bratislava, ID: 31 373 917, registered in the Commercial reg. Bratislava III Municipal Court, Section Sa, Insert No. 622/B. The contact details are: tel. +421 2 50 702 700, e-mail: doas@doas.sk.

The operator processes personal data of potential clients and/or clients, a natural person who is authorized to act on behalf of a legal entity (hereinafter referred to as “data subjects”) to the extent of name, surname, social security number or date of birth, if a social security number has not been assigned, address of permanent residence or other residence, nationality, identification of the type and number of the identity document, e-mail address, telephone number; in the case of a natural person-entrepreneur, also identification of the address of the place of business, the identification number, if assigned, the designation of the official register or other official record in which this entrepreneur is entered, and the number of the entry in this register or record (hereinafter also referred to as “Personal Data”).

DOAS processes Personal Data to the extent that they were provided by you, as the data subject, for the following purposes:

– the purpose of direct marketing, to inform the data subjects as clients or potential clients about news related to individual Projects implemented by DOAS and to address clients with additional marketing offers of DOAS via direct mail, newsletter, direct offers, or in another suitable form. The legal basis for the processing of Personal Data is the legitimate interest of DOAS or the consent, in the event that a client or potential client provides an e-mail address and expresses consent to the processing of their personal data for the purpose of sending business and marketing information by DOAS;

– the purpose of recording and supporting communication during the sale of real estate, the legal basis for the processing of Personal Data is the legitimate interest of DOAS (Article 6, paragraph 1, letter f) of the GDPR Regulation);

– the purpose of fulfilling contractual obligations, DOAS processes your personal data that you provide in connection with the conclusion of a reservation contract, a contract on a future purchase contract or a purchase contract, amendments thereto or any contract or agreement related to them for the purpose of carrying out pre-contractual negotiations, preparing a contractual and other documentation, the performance of the contract and individual obligations, records of contractual relations and accounting, claims and other requirements of yours, and our obligations. In this case, the legal basis for the processing of personal data is the need, based on the request of the data subject, to implement measures before concluding the contract, the performance of the contract to which the data subject is a party, as well as the fulfilment of our legal obligations in connection with accounting;

– the purpose of keeping records of the requests of the data subjects and their processing by DOAS. The legal basis for the processing of Personal Data is the legitimate interest of DOAS (Article 6, paragraph 1, letter f) of the GDPR Regulation);

– the purpose of fulfilling the obligations of DOAS according to the relevant legal regulations, for example tax obligations or obligations related to consumer protection in the internal market. The legal basis for the processing of Personal Data is the fulfilment of legal obligations (Article 6, paragraph 1, letter c) of the GDPR Regulation);

DOAS processes Personal Data for the purposes specified in Art. III regarding clients and potential clients, as data subjects, for whom DOAS records that they have shown interest in any of the Projects.

The legitimate interest of DOAS lies in the possibility of introducing clients and potential clients to advantageous offers related to the Projects. The legal basis for processing Personal Data for the purposes according to Art. III is thus a legitimate interest of DOAS, according to the relevant article of the GDPR Regulation and the relevant provision of the Personal Data Protection Act, provided that in a given case such interest of DOAS is not outweighed by the interests or fundamental rights and freedoms of the data subjects, which require the protection of personal data. If you are not interested in receiving news and current information about advantageous offers related to projects implemented by DOAS, you can exercise the right to object to the processing of Personal Data by DOAS at any time, free of charge, in particular in the following ways:

a) by mail at the address of DOAS registered office,

b) at any time and free of charge by clicking on the relevant link found in each received newsletter;

c) via DOAS e-mail;

(d) via a telephone line.

If you object to the processing of Personal Data, your Personal Data will not be further processed by DOAS, and after delivery of at least one of the expressions of will in accordance with letters a) to d) of this article you will not receive any news information from DOAS.

Giving consent to the processing of personal data for direct marketing purposes is a legal requirement. In the case of the data subject ‘s interest in the DOAS company sending them news, marketing information as well as more detailed information about the Projects, the data subject is obliged to provide the DOAS company, as the operator, with at least their e-mail address and consent to the processing of their Personal Data on purposes of direct marketing, otherwise it is not possible to subscribe to news and marketing information sent by DOAS and to obtain more detailed information about the Projects. Providing consent to the processing of personal data for direct marketing purposes is a legal requirement.

It is assumed that Personal Data processed on behalf of DOAS for the purposes in accordance with Art. III will also be provided to intermediaries who have been authorized to process Personal Data by the Operator in writing. These are mainly delivery companies, courier companies, consulting companies and agencies, IT service providers and other persons whose services we use in the performance of our activities. We carefully select intermediaries in order to ensure all data protection claims (hereinafter referred to as “recipients”).

Personal Data will be processed until the purpose of processing the Personal Data for which they were obtained expires, but at the latest until the legal basis for the processing of Personal Data according to the GDPR Regulation and the Personal Data Protection Act is established.

When processing Personal Data, DOAS does not use any automated individual decision-making procedures or profiling.

Subject to compliance with the conditions established by legal regulations governing the protection of personal data, you, as the data subject, have the following rights:

• The right to request access to the personal data concerning you from the operator: The data subject has the right to obtain confirmation from DOAS as to whether the personal data concerning him/her are being processed and, if so, he/she has the right to obtain access to such personal data and the following information: processing purposes; categories of personal data concerned; recipients or categories of recipients to whom personal data have been or will be provided, in particular recipients in third countries or international organizations; if possible, the expected personal data retention period, or if this is not possible, the criteria for its determination; about the existence of the right to require the operator to correct the personal data relating to the data subject or to erase or restrict the processing, or the right to object to such processing; the right to file a complaint with a supervisory authority; if the personal data have not been obtained from the data subject, any available information as to its source; the existence of automated decision-making, including the profiling referred to in Art. 22 para. 1 and 4 of the GDPR Regulation and, in these cases, comprehensible information about the procedure used, as well as the meaning and expected consequences of such processing for the data subject. DOAS will provide a copy of the personal data being processed. For any additional copies requested by the data subject, they may request a reasonable compensation corresponding to the administrative costs of processing the request.

• The right to correction of personal data: The data subject has the right to have DOAS correct the incorrect personal data concerning him/her without undue delay. With regard to the purposes of processing, the data subject has the right to complete incomplete personal data, also by providing a supplementary statement.

• The right to erasure (“right to be forgotten”): The data subject also has the right to have DOAS erase the personal data concerning them without undue delay, and DOAS is obliged to erase the personal data without undue delay if any of the following reasons are met: a) personal data are no longer necessary for the purposes for which they were obtained or otherwise processed; b) the data subject revokes the consent on the basis of which the processing is carried out, according to Art. 6 para. 1 letter. a) or Art. 9 para. 2 letter. a) of the GDPR Regulation, and if there is no other legal basis for processing; c) the data subject objects to the processing according to Art. 21 para. 1 of the GDPR Regulation and there are no valid reasons for the processing or the data subject objects to the processing according to Art. 21 para. 2 of the GDPR Regulation; d) personal data were processed illegally; e) personal data must be erased in order to comply with a legal obligation under Union law or the law of a Member State to which the operator is subject; f) personal data were obtained in connection with the offer of information society services pursuant to Art. 8 para. 1 of the GDPR Regulations. If DOAS has disclosed personal data and is obliged to erase personal data, taking into account the available technology and the costs of implementing the measures, it will take reasonable measures, including technical measures, to inform the operators who carry out the processing of personal data that the data subject requests them to erase all references to these personal data, their copy or replicas.
The right to erasure does not apply if the processing is necessary: a) to exercise the right to freedom of expression and information; b) to fulfil a legal obligation that requires processing according to Union law or the law of a Member State to which the operator is subject, or to fulfil a task carried out in the public interest or in the exercise of public authority entrusted to the operator; c) for reasons of public interest in the field of public health in accordance with Art. 9 para. 2 letters h) and i), as well as Art. 9 para. 3 of the GDPR Regulation; d) for the purposes of archiving in the public interest, for the purposes of scientific or historical research or for statistical purposes pursuant to Art. 89 para. 1 of the GDPR Regulation, if it is likely that the right mentioned above will make it impossible or seriously difficult to achieve the goals of such processing, or e) to demonstrate, exercise or defend legal claims.

• The right to limit processing: The data subject has the right to have the operator limit processing in any of the following cases: a) the data subject contests the correctness of the personal data, during the period allowing the operator to verify the correctness of the personal data; b) the processing is illegal and the data subject objects to the erasure of personal data and requests a restriction of their use instead; c) the operator no longer needs the personal data for processing purposes, but the data subject needs them to prove, exercise or defend legal claims; d) the data subject objected to the processing according to Art. 21 para. 1 of the GDPR Regulation, until it was verified whether the legitimate reasons on the part of the operator prevail over the legitimate reasons of the data subject. If the processing has been limited in accordance with the limitation above, such personal data, with the exception of retention, is processed only with the consent of the data subject or for proving, exercising or defending legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a member state. The data subject who has achieved the restriction of processing in accordance with the above mentioned shall be informed by DOAS before the limitation of processing is revoked.

• The right to data portability: The data subject has the right to receive the personal data concerning him/her that he/she has provided in a structured, commonly used and machine-readable format and has the right to transfer this data to another operator, without the operator to whom the personal data have been provided preventing, if: a) the processing is based on consent according to Art. 6 para. 1 letter. a) or Art. 9 para. 2 letter. a) of the GDPR Regulation, or on the contract according to Art. 6 para. 1 letter. b) of the GDPR Regulation, and b) if the processing is carried out by automated means. When exercising his/her right to data portability, the data subject has the right to transfer the personal data directly from one operator to another operator, as long as this is technically possible. The application of the right does not affect Art. 17 of the GDPR Regulation. The abovementioned right does not apply to processing necessary to fulfil a task carried out in the public interest or in the exercise of public authority entrusted to the operator. The right to data portability must not have adverse consequences on the rights of others.

• The right to object to processing including objecting to profiling (if carried out):
The data subject has the right to object at any time for reasons related to his/her specific situation against the processing of personal data, which is carried out on the basis of Art. 6 para. 1 letter. e) or f) of the GDPR Regulation, including objection to profiling based on the above-mentioned provisions. The operator may not further process the personal data, unless he proves the necessary legitimate reasons for processing that outweigh the interests, rights and freedoms of the data subject, or reasons for proving, exercising or defending legal claims. If personal data are processed for the purposes of direct marketing, the data subject has the right to object at any time to the processing of personal data concerning him/her for the purposes of such marketing, including profiling to the extent that it is related to such direct marketing. If the data subject objects to processing for direct marketing purposes, personal data may no longer be processed for such purposes.

• The right to file a complaint with a supervisory authority: The supervisory authority to which the data subject addresses his/her complaint in justified cases is the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 12, 820 07 Bratislava 27.

• The right to revoke consent to processing: If the legal basis for processing the personal data is the consent of the data subject, the data subject is entitled to revoke his/her consent at any time without this affecting the legality of the processing based on the consent granted prior to its revoking. The right to revoke consent at any time, even before the expiry of the period for which this consent was granted, can be exercised by the data subject in particular in the following ways: a) by mail at the address of the registered office of DOAS, b) at any time and free of charge by clicking on the relevant link found in each received newsletter; c) via DOAS e-mail; d) via a telephone line.

DOAS is obliged to take appropriate measures and provide the data subject with information pursuant to Sections 19 and 20 of the Personal Data Protection Act and notices pursuant to Sections 21 to 28 and 41 of the Personal Data Protection Act, which relate to the processing of his/her personal data, in a concise, transparent, comprehensive and easily available form. DOAS provides cooperation to the data subject in exercising his/her rights according to Sections 21 to 28 of the Personal Data Protection Act. DOAS is obliged to provide the data subject with information about the measures taken based on his/her request pursuant to Sections 21 to 28 of the Personal Data Protection Act within one month of receiving the request from the data subject. In justified cases, considering the comprehensiveness, complexity and number of requests, DOAS may extend the given deadline by a further two months, even repeatedly. However, DOAS is obliged to inform the data subject of any such extension within one month from the receipt of the request, together with the reasons for the extension of the deadline. If DOAS does not take measures based on the request of the data subject, it is obliged to inform the data subject about the reasons for not taking action and about the possibility to submit a proposal according to Section 100 of the Personal Data Protection Act to the Office for Personal Data Protection of the Slovak Republic within one month from the delivery of the request.