PRIVACY POLICY
Article I.
Introductory provisions
In the processing of personal data, the controller is the person who determines the purpose and means of the processing of personal data. In the case of your personal data, the data controller is LUMIA PROPERTY MANAGEMENT s.r.o. with registered office at Krasovského 3742/13, 851 01 Bratislava, ID No.: 36 803 898, registered in the Commercial Register kept by the Municipal Court of Bratislava III, Section Sro, Insert No. 46903/B (the controller).
the controller is responsible for the processing of personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
the controller has taken all appropriate technical and organisational measures to ensure the protection of personal data. In this document, the controller informs you in detail about the processing of personal data. The data subject has the right to know how the controller processes his or her personal data. Personal data is any information that can directly or indirectly identify you.
The operator mainly provides services related to property management and real estate activities.
A list of the personal data processed which the controller has collected from data subjects is set out in Article II. The controller shall endeavour to process the personal data only to the extent necessary and necessary for the predefined purposes for the necessary period of time.
As the operator actively uses its website in its activities, you will find separate information on the processing of personal data concerning cookies in Article III.
What rights the data subject has and what he or she may request from the controller when processing personal data is set out in Article IV.
Article II.
Purposes of processing, legal bases for processing, categories of data subjects,
retention period of OA, recipients of OA
| Purpose of the processing of OA | Legal basis for processing
|
Categories of data subjects | Category OU | Retention period of OU | Category of beneficiaries OU |
| pre-contractual relations (interest in buying, selling, renting the property, including interest in inspection) | Article 6(1)(b) GDPR the processing of personal data is necessary for the performance of the contract |
Clients interested in providing services | Common personal data | 30 days from the date of their acquisition | None |
| Contractual relations (conclusion of an intermediary contract, a sales contract, a rental contract and any other contract on the basis of which the controller provides its services) | Article 6(1)(b) GDPR processing of personal data is necessary for the performance of the contract | Clients and potential clients |
Common personal data |
5 years from the date of termination of the provision of services | bank, notary, attorney, district office cadastral department, other contracting party |
| Bookkeeping (invoicing) |
Article 6(1)(c) GDPR Act No. 431/2002 Coll. on accounting |
Clients | Common personal data | according to the laws mentioned in the legal basis | company providing accounting services |
| Fulfilling legal obligations (providing care to the client and reporting unusual business operations |
Article 6(1)(c) GDPR Act No. 297/2008 Coll. on the protection against the legalization of proceeds of crime and on the protection against the financing of terrorism and on the amendment and supplementation of certain acts, as amended |
Clients and potential clients | Common personal data | for the period specified by law | financial reporting unit |
| asserting legal claims against debtors |
Article 6(1)(f) GDPR the processing of personal data is necessary for the protection of legitimate interests |
Debtors | Common personal data | during the limitation period, determined according to the type of claim |
third party (lawyer, court, bailiff)
|
| complaint handling | Article 6, paragraph 1. letter c) GDPR Act No. 250/2007 Coll. on Consumer Protection as amended | Person making the complaint | Common personal data | For the period specified by law | court, SOI |
| handling of complaints from data subjects under the GDPR | Article 6(1)(c) GDPR | Affected persons | Common personal data | during the period for the imposition of a sanction by the Office for Personal Data Protection of the Slovak Republic, i.e. after the expiry of 5 years from the exercise of the right of the data subject. | data protection authority, law enforcement authorities |
Article III
Cookies and analytical tools
Cookies and analytical tools
If the data subject visits the website www.lumia.sk, a so-called cookie may be stored on your device (depending on the settings of your internet browser).The controller always processes cookies with the consent of the data subject.
A cookie is a short text file that is sent to your browser by the websites you visit. It allows websites to remember information about your visit, such as your preferred language and other settings. This can make your next visit to the site easier and more productive. Cookies are important for a personalised web browsing experience.
When you visit the website, personal data may be processed for statistical and analytical purposes (Google). This data is used to personalise the content of the website. This data is processed by the controller on the basis of your consent - if you have given it when visiting our website in connection with cookies.
Google Analytics
Google Analytics is a web analytics service provided by Google Inc. This service provides aggregated anonymous statistics about visitors to our website. In addition to generating reports on website usage statistics, Google Analytics can be used to display more relevant ads on Google properties and on the web, as well as to measure interactions with the ads displayed.
Article IV
Rights of the data subject
Right to withdraw consent:
Where the processing of personal data is based on the consent of the data subject, the data subject may withdraw this consent at any time by following the procedures described in the relevant consent form. The controller guarantees that consent may be withdrawn in the same way as it was given. The withdrawal of consent shall not affect the lawfulness of the processing of personal data based on consent prior to its withdrawal. In some cases, withdrawal of consent will result in the inability to use certain services that are based on the processing of your personal data.
Right to correction:
If the data subject suspects that his or her data processed by the controller is incorrect, he or she has the right to ask the controller to correct or supplement your personal data. The controller endeavours to keep the personal data up-to-date from time to time and constantly strives to keep it accurate, complete, up-to-date and relevant, based on the most recent information available to it.
Right to restriction of processing:
The controller may restrict the processing of the data subject's data if:
a/ the data subject contests the accuracy of the personal data for as long as the controller needs to verify the accuracy,
b/ the processing of the personal data is unlawful and the data subject requests restriction of the processing instead of erasure of the personal data,
c/ the personal data are no longer needed by the controller but are required by the data subject for the establishment, exercise or defence of legal claims; or
d/ the data subject objects to the processing while the controller verifies the lawfulness of the request.
Right of access:
The data subject has the right to ask the controller to confirm whether we are processing any of your personal data, including, for example, information about which categories of personal data we are processing, for what purpose the personal data is used, to whom it is transferred, how long it will be kept, where it was obtained - if not directly from you - or to which recipients or categories of recipients the personal data was disclosed, or about the rights of the data subjects in relation to it.
Confirmation of whether the controller processes personal data shall preferably be sent to the data subject electronically.
The controller is also obliged to provide the data subject with the personal data that we process about him or her, if he or she so requests.
The Controller reserves the right to charge a reasonable fee for processing the request. This applies in particular to inadequate and frequently repeated requests or requests that require disproportionate administrative effort. The fee will be charged in the amount of the administrative costs associated with making copies of the data (e.g. the cost of the data carrier - CD, USB key).
Right to portability:
At the request of the data subject, the controller shall transmit all personal data processed in a structured, commonly used and machine-readable format or, if technically feasible, the controller shall transmit them to another controller identified by the data subject. This right may be exercised provided that the controller processes the personal data on the basis of consent or a contract and only if the processing is carried out by automated means. The controller points out that the exercise of the right to data portability does not affect personal data which it processes on the basis of the law.
Right to erasure:
The controller shall erase the personal data without undue delay if:
- the personal data is no longer necessary for the purpose for which it was collected or processed;
- the data subject has raised an objection to the processing of personal data for the purposes of legitimate interests and, at the same time, there are no legitimate interests of the controller overriding the interests of the data subject;
- e processing based on consent, consent has been withdrawn and there is no further legal basis for the processing;
- personal data have been unlawfully processed;
- their erasure is required to comply with a legal obligation imposed by European Union or Member State law to which the controller is subject;
- the personal data collected concerned a person under the age of 16;
and unless the processing was also necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
Right to object to processing:
The data subject may object at any time to processing of his or her personal data on specific grounds, provided that the processing is not based on consent but on the legitimate interests of the controller or the legitimate interests of a third party. In this case, the controller will no longer process your personal data unless it can demonstrate compelling legitimate grounds overriding your rights and freedoms. If the data subject objects to the processing, he or she must specify whether he or she wishes to erase the personal data or restrict processing.
Right to complain:
In the event of an alleged violation of applicable data protection laws, the data subject may lodge a complaint with the data protection supervisory authority in the country in which he or she lives or in the country where the alleged personal data breach occurred. In Slovakia, such authority is the Office for Personal Data Protection of the Slovak Republic.
The time limit for processing your request when exercising your rights:
The operator will attempt to process the request within 30 days of receipt. However, the time limit may be extended by a further 2 months due to the frequency and complexity of the requests. The controller will inform the data subject of this fact within 30 days of receipt of your request at the latest, together with the reason for the extension of the time limit.
Impossible to identify:
The controller anticipates that in some cases it will not be possible to trace all the personal data according to the identifiers provided by the data subject in his or her request. In such cases, where the controller is unable to identify the data subject as the data subject, the controller shall not be able to comply with the request unless the data subject provides further information enabling his or her identification. The controller shall inform the data subject of the reasons for the impossibility to process the request.
Applying for your rights:
For information on the protection of personal data, as well as to exercise your rights as a data subject, please contact the controller at the following email address: info@lumia.sk
The Operator reserves the right to update these terms and conditions. For this reason, he recommends that the data subjects keep them under review. The updated wording can be seen by the date of the last update.
Last update: 18.05.2018