Information on Personal Data Processing

Prepared in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (hereinafter referred to as „GDPR Regulation“), Sections 19 and 20 of Act No. 18/2018 Coll. on Personal Data Protection, as amended (hereinafter referred to as „Personal Data Protection Act“), as well as the provisions of Section 109 et seq. of Act No. 452/2021 Coll. on Electronic Communications, as amended (hereinafter referred to as „Electronic Communications Act“) (hereinafter referred to as „Information“).

This Information is primarily intended for visitors to the website www.iad-rem.sk, individuals interested in renting properties presented on this website, or natural persons acting on behalf of such interested parties, as well as other persons interested in the Operator’s services based on the website www.iad-rem.sk, whose personal data the Operator processes.

The Controller processing your personal data is Bevix, a. s., with its registered office at Malý trh 2/A, 811 08 Bratislava, Company ID: 47 153 547, registered in the Commercial Register of the City Court Bratislava III, Section: Sa, File No. 7921/B.

For questions regarding personal data protection and when exercising your rights under this Information, you may contact the Controller using the following contact details:

postal address: Bevix, a. s., Malý trh 2/A, 811 08 Bratislava
email address: leasing@iad-rem.sk
phone number: +421 907 391 705

Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as „Data Subject“); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

The Controller obtains only personal data that is adequate, relevant, and necessary for the specific processing purpose. The Controller obtains personal data directly from the Data Subject or from an entity in which the Data Subject operates or performs activities for it based on the relevant legal relationship, or from publicly available sources (e.g., from the Commercial Register, Trade Register, Register of Legal Entities, Entrepreneurs and Public Authorities, Register of Non-Governmental Non-Profit Organizations, etc.).

Purpose: Communication with individuals interested in property rental mediation

Legal basis: Article 6(1)(f) of the GDPR Regulation – processing necessary for the purposes of the legitimate interests pursued by the Controller or by a third party. The legitimate interest is the handling of requests and inquiries received via the website.

Data Subjects: individuals interested in property rental, their legal/contractual/other representatives.

Categories of personal data: common categories of personal data are processed.

Recipients or categories of recipients: real estate companies according to Act No. 203/2011 Coll. on Collective Investment, as amended (with which the Controller has a contractual relationship), IAD Investments, správ. spol., a. s., external IT service providers, providers of legal and other professional services, state authorities (especially supervisory authorities and law enforcement authorities).

Retention period: until your request is processed. Subsequently, the data will be stored for the purpose of „Assertion, substantiation, and defense of legal claims“.

Purpose: Maintaining a database of individuals interested in property rental mediation

Legal basis: Article 6(1)(a) of the GDPR Regulation – processing of personal data based on the consent of the Data Subject.

Data Subjects: individuals interested in property rental, their legal/contractual/other representatives.

Categories of personal data: common categories of personal data are processed.

Recipients or categories of recipients: real estate companies according to Act No. 203/2011 Coll. on Collective Investment, as amended (with which the Controller has a contractual relationship), IAD Investments, správ. spol., a. s., external IT service providers, providers of legal and other professional services, state authorities (especially supervisory authorities and law enforcement authorities)

Retention period: 12 months from the inclusion of the person in the database.

Further information: As a Data Subject, you have the right to withdraw your consent at any time by sending your written withdrawal to the contact details provided in point 2 of this Information. The withdrawal of your consent will not affect the lawfulness of processing based on consent before its withdrawal.

Purpose: Fulfillment of obligations under the Act on Protection against Money Laundering and Terrorist Financing

Legal basis: Article 6(1)(c) and (f) of the GDPR Regulation – processing of data necessary for compliance with a legal obligation and processing necessary for the purposes of the legitimate interests pursued by the Controller. The legitimate interest is the fulfillment of obligations arising from the Act on Protection against Money Laundering and Terrorist Financing, as amended. The provision of such data is your legal obligation.

Data Subjects: individuals interested in property rental and their legal/contractual/other representatives

Categories of personal data: common categories of personal data are processed.

Recipients or categories of recipients: real estate companies according to Act No. 203/2011 Coll. on Collective Investment, as amended (with which the Controller has a contractual relationship), IAD Investments, správ. spol., a. s., Financial Intelligence Unit, law enforcement authorities, other state authorities, legal service providers, accountants, auditors, other service providers or obliged persons.

Retention period: 5 years from the termination of the contractual relationship or the execution of an occasional transaction outside a business relationship, unless the supervisory authority specifies a longer period.

Purpose: Use of cookies on our website

Legal basis: Article 6(1)(a) of the GDPR Regulation and Section 109(8) of the Electronic Communications Act – processing of personal data based on the consent of the Data Subject. Except for essential cookies, which serve to ensure basic website functions and for which consent is not required.

Data Subjects: visitors to the website www.iad-rem.sk.

Categories of personal data: common categories of personal data.

Recipients or categories of recipients: web hosting providers, external IT service providers, external content providers (Google LLC, Meta Platforms, Inc. and their subsidiaries).

Retention period: depending on the individual types of cookies. More information can be found in the „How we use cookies“ information available here.

Further information:

Cookies are small text files that the web server stores on your device when you visit and browse the website. On our site, we use essential, functional, analytical, and marketing cookies. We use functional, analytical, and marketing cookies only if you give us your consent via the cookie banner that appears when you first visit the site. As a Data Subject, you have the right to withdraw your consent to the use of cookies at any time via the cookie settings in the cookie banner available on the site in the bottom left. The withdrawal of your consent will not affect the lawfulness of processing based on consent before its withdrawal. More information about cookies, their purpose, and use can be found in the „How we use cookies“ information available here.

If you have granted us the above consent, your data may be processed when you visit our website for statistical, analytical, and marketing purposes. Your data may be used to personalise the content of the website and the content on the Facebook social network operated by Meta Platforms, Inc. In such a case, we may act together with this company as joint controllers. Basic information about the joint controllers’ arrangement can be found here.

Purpose: Assertion, substantiation, and defense of legal claims

Legal basis: Article 6(1)(f) of the GDPR Regulation – legitimate interest of the Controller in protecting its rights and legal interests.

Data Subjects: individuals interested in property rental mediation, their legal/contractual/other representatives, website visitors, other natural persons depending on the nature of the legal claim asserted.

Categories of personal data: common categories of personal data.

Retention period: at the latest until the final conclusion of enforcement, execution, or insolvency proceedings.

Recipients or categories of recipients: providers of legal and other professional services; courts; law enforcement authorities; bailiffs; notaries; supervisory authorities and other state authorities; insurance companies; accountants, tax advisors, auditors, other persons depending on the nature of the claim asserted.

Purpose: Handling Data Subjects’ requests and other obligations under the GDPR Regulation

Legal basis: Article 6(1)(c) of the GDPR Regulation – processing of personal data necessary for compliance with the Controller’s legal obligations. The obligation to provide data for this purpose arises from applicable regulations.

Data Subjects: applicants, their legal or contractual representatives, other persons depending on the nature of the request or situation.

Categories of personal data: common categories of personal data.

Retention period: until the obligations imposed by the GDPR Regulation are fulfilled. Subsequently, the data will be stored for the purpose of „Assertion, substantiation, and defense of legal claims“.

Recipients or categories of recipients: legal service providers; suppliers, supervisory authority and other state authorities, accountants, tax advisors, auditors.

In connection with the use of third-party cookies on our website, your personal data may be transferred to the United States of America, and thus outside the European Union and the European Economic Area. If personal data is transferred to the United States of America, this occurs in accordance with Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate protection of personal data concerning the EU-U.S. Data Privacy Framework. Google LLC, Meta Platforms, Inc., and their U.S. subsidiaries, as well as their services, are certified and listed on the U.S. Department of Commerce’s „Data Privacy Framework List“ in accordance with the aforementioned Commission Implementing Decision (EU). For data transfers in cases not covered by the adequacy decision, standard contractual clauses approved by the Commission (EU) shall apply: https://eur-lex.europa.eu/legal-content/SK/TXT/HTML/?uri=CELEX:32021D0914&from=SK. For other purposes, personal data is not transferred outside the European Union and the European Economic Area.

The Controller uses profiling for marketing activities to personalize advertisements. This is done based on your granted consent. For other purposes, the Controller, when processing personal data, does not carry out decision-making based solely on automated processing that would produce legal effects concerning the Data Subject or similarly significantly affect them, or profiling for the purpose of such decision-making.

8.1. Right of access

The Data Subject has the right to obtain confirmation as to whether or not personal data concerning him or her are being processed by the Controller, and, where that is the case, access to the personal data and information in accordance with Article 15 of the GDPR Regulation, including the right to obtain a copy of the personal data undergoing processing.

8.2. Right to rectification

The Data Subject has the right to obtain the rectification of inaccurate personal data and to have incomplete personal data completed.

8.3. Right to erasure

The Data Subject may request the erasure of personal data if the conditions of Article 17 of the GDPR Regulation are met, in particular if the data are no longer necessary for the original purpose, the Data Subject has withdrawn consent and there is no other legal basis, has successfully objected to the processing, or the data have been unlawfully processed. The right to erasure shall not apply if processing is still necessary, in particular for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims.

8.4. Right to restriction of processing

The Data Subject has the right to obtain restriction of processing in the cases specified in Article 18 of the GDPR Regulation, in particular during the verification of data accuracy or assessment of an objection, in case of unlawful processing instead of erasure, or if the Controller no longer needs the data but the Data Subject requires them for legal claims.

8.5. Right to data portability

Where processing is based on consent or a contract and is carried out by automated means, the Data Subject has the right to receive the personal data concerning him or her, which he or she has provided to a Controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, if the conditions of Article 20 of the GDPR Regulation are met.

8.6. Right to object

The Data Subject has the right to object, on grounds relating to his or her particular situation, at any time to processing based on legitimate interest. The Controller shall no longer process the personal data unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defense of legal claims. Where personal data are processed for direct marketing purposes, the Data Subject shall have the right to object at any time to processing of personal data for such marketing; after an objection is lodged, the personal data shall no longer be processed for direct marketing purposes.

8.7. Right to withdraw consent

Where processing is based on consent, the Data Subject may withdraw consent at any time via the contacts provided in point 2 of this Information or by adjusting the relevant cookie settings. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

8.8. Exercise of rights and right to lodge a complaint

The Data Subject may exercise his or her rights via the contacts provided in point 2. The Controller may request additional information to verify the identity of the applicant to the necessary extent. The Controller shall handle the request without undue delay, usually within one month; in complex cases, this period may be extended in accordance with the GDPR Regulation. The Data Subject also has the right to lodge a complaint with the supervisory authority, which in the Slovak Republic is:

Office for Personal Data Protection of the Slovak Republic
Galvaniho Business Centrum II
Galvaniho 7/B
821 04 Bratislava
Slovak Republic
www.dataprotection.gov.sk

The Controller may update this Information as appropriate, particularly in the event of changes in processing activities, systems used, recipients, or legal regulations. The current version will be available on the website www.iad-rem.sk.

Version effective from 01.10.2026