PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA AND YOUR RIGHTS

In the case that you provide your personal data in connection with visiting the Nivy polyfunctional building or websites, applications, and social networks related to the Nivy polyfunctional building, we (according to the GDPR) as the data controller Stanica Nivy s. r. o., having its registered seat at Mlynské nivy 5, 821 09 Bratislava, the Slovak Republic, ID No.: 50 861 930, registered with the Commercial Register maintained by the City Court Bratislava III, Section: Sro, File No.: 120152/B (hereinafter referred to as “Nivy” or “we”) would like to inform you about the processing of your personal data and of your rights related to the said processing.

Nivy is part of the HB Reavis Group, which consists of all the entities consolidated under the group holding HB Reavis Holding S.A. with its headquarters in Luxembourg, due to which the reference to HB Reavis Group may be found in the Privacy Notice (hereinafter referred to as the “HB Reavis Group”).

 If you are in the Nivy polyfunctional building or its immediate vicinity (as a visitor, employee, or for any other purpose) or visit websites, applications, or social networks related to the Nivy polyfunctional building, your personal data may be processed in the context of the following purposes: 

1. Ensuring the safety of visitors and users of the polyfunctional building Nivy as well as the protection of the polyfunctional building Nivy and property

2. The acceptance, processing and handling of emergency calls

3. The issuing of entry cards

4. Mutual communication

5. Preference analysis and the provision of personalized marketing content

6. Promotion of our brand, good name, services and events

7. The operation of the “help desk” platform

8. The issuing of cards for waste disposal

9. The administration of insurance claims in the Nivy polyfunctional building

10. Invoice issuance for individuals who rent parking spaces

11. The provision of WiFi

12. The “Ahoj Nivy” application

13. Nivy Grill

14. Wheelchair rental

15. Finding your car in the parking lot

16. Nivy gift card

17. Exercise of the data subject's rights under the GDPR

A further description of our purposes:

1.  Ensuring the safety of visitors and users of the polyfunctional building Nivy as well as the protection of the polyfunctional building Nivy and property 

 What is our purpose for and legitimate interest in processing your personal data? 

The protection of the polyfunctional buildings Nivy and the safety of the people using the polyfunctional building Nivy are the key elements and the number one priority in our business activities. For us to be able to ensure the proper level of protection and safety, we installed a video monitoring system (CCTV). Whenever entering the Nivy polyfunctional building or if you are near them, whether as a visitor or an employee, the CCTV might record you. If you enter the building or garage, we will record you in the following ways:

 What is our legal basis for the processing of your personal data? 

We process your personal data based on the legitimate interests under Article 6 (1) (f) of GDPR in all cases of processing for the purpose of ensuring the safety of visitors and users of the Nivy polyfunctional building and the protection of the premises and property.

2.  The acceptance, processing, and handling of emergency calls 

 What is our purpose for and legitimate interest in processing your personal data? 

In each lift in the building, there are voice communicators through which it is possible to contact the central security desk of the building in real time should a problem arise. These calls are not recorded. However, we may process your personal data during the call if it is necessary to protect your life, physical safety, or the life or physical safety of another person.

 What is our legal basis and legitimate interest for the processing of your personal data? 

During the handling of emergency calls, the legal basis is justified under your or another individual's ‘vital interest’, we process your personal data under Article 6 (1) (d) of GDPR.

What kind of personal data do we process?

Personal data provided during an emergency call.

How long do we store your personal data?

We process your personal data during the call.

3. The issuing of entry cards

 What is our purpose for and legitimate interest in processing your personal data? 

For us to permit you to enter the premises of your employer, we will issue you an entry card that allows you access to the restricted premises of the building.

 What is our legal basis for the processing of your personal data? 

We process your personal data based on the legitimate interests under Article 6 (1) (f) of GDPR to issue entry cards.

What kind of personal data do we process?

Name, surname and the business name of your employer.

How long do we store your personal data?

For the duration of your contractual relationship with our tenant or the duration of the rental relationship, whichever relationship ends first.

4. Mutual communication

 What is our purpose for and legitimate interest in processing your personal data? 

Our philosophy is to always be open and transparent. This includes being open to communication from any person interested in the polyfunctional building Nivy. To fulfil this goal, we created several types of contact forms that can be used for direct contact with the team of people who ensure the operation of the Nivy polyfunctional building. Additionally, we have also published the email addresses of employees working for us so you can contact them at any time with any questions related to Nivy and the business you may have. However, to ensure effective, flawless and clear communication, we must process some of your personal data.

When we rent our building to our (potential) clients, our priority is to create an effective and transparent communication channel between us. To achieve this, we use a CRM database consisting of contact details (including personal data) of our (potential) clients or their employees. We create this database to ensure effective and error-free communication with our (potential) clients and also to build a database consisting of all our business partners.

 What is our legal basis for the processing of your personal data? 

If you contact us or any employee via email or a web-based form, we process your personal data based on the legitimate interests under Article 6 (1) (f) of GDPR.

What kind of personal data do we process?

Name, surname, email address and phone number. For the purposes of the CRM database, in addition to the aforementioned data, we also process job title and employer identification data.

How long do we store your personal data?

We keep your personal data until you unsubscribe from our contact database.

5.  Preference analysis and the provision of personalised marketing content 

What is our purpose for  in processing your personal data? 

We also process your personal data for the purpose of targeted marketing. We will analyse your personal data to build your individual profile. The profile is used to predict your future interests and display targeted (online) advertisements. If we identify you by cookies or email, you will see the content on the website that is relevant to your segment or profile. The aim is to provide you with offers that are relevant and interesting for you. The analysis is based on your (surfing) behaviour on the Internet (website and application "Ahoj Nivy"). We conduct such preference analyses solely for the purpose of providing you with more attractive offers for the purchasing of goods and/or services and customising the content of websites according to your preferences. Moreover, it is to ensure the promotion of our products and services, improving our brand and good name by providing you with our personalised newsletters, invitations to our events, marketing alerts and follow-up marketing materials via the various available channels such as email marketing communication, SMS messages, pop-up windows, online remarketing ads (Google Ads, Facebook ads, native ads…).

 What is our legal basis for the processing of your personal data? 

In the case of creating and sending personalized marketing content for you we process your personal data based on consent under Article 6 (1) (a) of GDPR.

What kind of personal data do we process?

Name, surname, email and phone number, gender, login information, time zone setting, operating system and platform, information about visits including the URL, the search terms, information about what you viewed or searched on our website, page response times, download errors, the length of visits to certain pages, page interaction information, (such as scrolling, clicks and mouse-overs) and the methods used to browse away from the page, the activities of users, the browsed web pages and the version of the “Ahoj Nivy” application installed on your device.

How long do we store your personal data?

If you give us consent to provide you with our personalised marketing content and newsletter, we store your personal data until you unsubscribe from our consent database.

6.  Promotion of our brand, good name, services and events 

 What is our purpose for and legitimate interest in processing your personal data? 

Furthermore, we may process your personal data by taking photographs and audio-visual recordings, which are used for the purpose of and legitimate interest in the promotion of our events and services and to help us improve our brand and good name by publishing the photographs (where it is possible that you will appear) and audio-visual recordings on our social media profiles such as YouTube, LinkedIn, Facebook, X (previously Twitter) and Instagram, as well as via other channels such as our websites.

 What is our legal basis for the processing of your personal data? 

In the case of promoting our events and services that we provide, we process your personal data based on the legitimate interests under Article 6 (1) (f) of GDPR.

What kind of personal data do we process?

Photographs or/and audio-visual images of you. In the case of private events, also your name, surname and email address will be processed.

How long do we store your personal data?

We may process your personal data for the entire existence of the HB Reavis Group.

7.  The operation of the “help desk” platform 

 What is our purpose for and legitimate interest in processing your personal data? 

We process your personal data to ensure that our contractual obligations arising from the contract with a third party (our tenant and the company on whose behalf you are acting), in which you are in the position of the contact person, are effectively fulfilled. Based on the contract with your employer, we provide a help desk application for reporting issues in connection with the building in which the offices of your employer are situated. To properly use the application, you or your employer provided us with your personal data, as you are the designated person for communication in the application. We need to process your personal data to ensure effective, flawless and clear communication, as well as to ensure the fulfilment of our obligations towards the companies on whose behalf you are acting.

 What is our legal basis for the processing of your personal data? 

We process your personal data based on the legitimate interests under Article 6 (1) (f) of GDPR to ensure the smooth operation of the "help desk" application for our tenants.

What kind of personal data do we process?

Title, name, surname, position, place of work, signature, email address, phone number, the identification information of your employer or companies that have listed you as a contact person.

How long do we store your personal data?

During your contractual relationship with our tenant or the duration of the rental relationship, or until a change in your job classification, whichever relationship ends first.

8.  The issuing of cards for waste disposal 

 What is our purpose for and legitimate interest in processing your personal data? 

As you may know, each rental unit generates waste. To enable efficient and fair waste collection, we issue a card to each tenant that records exactly how much waste per month the rental unit produces. Because the waste will be exported by tenant employees, personal data may be processed during this activity.

 What is our legal basis for the processing of your personal data? 

We process your personal data based on the legitimate interests under Article 6 (1) (f) of GDPR to issue cards for waste disposal.

What kind of personal data do we process?

The rental unit and the unique identifier of the tenant.

How long do we store your personal data?

During your contractual relationship with our tenant or the duration of the rental relationship, whichever relationship ends first.

9.  The administration of insurance claims in the Nivy polyfunctional building 

 What is our purpose for and legitimate interest in processing your personal data? 

Your personal data is processed for the purpose of the administration of insurance incidents that occur at Nivy polyfunctional building, such as car accidents in the parking lot, etc. When such an incident occurs, it is necessary to fill out an incident form for insurance purposes and other legal matters.

 What is our legal basis for the processing of your personal data? 

Your personal data is processed during the insurance event in accordance with Article 6 (1) (f) GDPR, i.e. we process your personal data on the basis of legitimate interests.

What kind of personal data do we process?

The requested data on the insurance form.

How long do we store your personal data?

We store your personal data only during the time that it is strictly necessary to deal with the insurance event.

10.  Invoice issuance for individuals who rent parking spaces 

What is our purpose for processing your personal data?

For us to issue VAT invoices for using the parking lots at Nivy polyfunctional building, we have to process some personal data.

 What is our legal basis for the processing of your personal data? 

Your personal data is processed during the issuance of invoices in accordance with Article 6 (1) (c) GDPR, i.e. the processing is necessary for compliance with a legal obligation to which Nivy polyfunctional building is subject to.

What kind of personal data do we process?

Name and surname, the address of residence or address of the place where he/she usually resides, tax identification number.

How long do we store your personal data?

Your personal data will be processed during the period set by the applicable legal obligation or in line with it.

11. The provision of WiFi

What is our purpose for processing your personal data?

The provision of the public WiFi network is as defined in the document PRINCIPLES AND CONDITIONS OF USE OF THE PUBLIC WIFI NETWORK (hereinafter referred to as the "Conditions"). The link to the document is here:  https://nivy.com/en/wifi-terms-and-conditions  .

 What is our legal basis for the processing of your personal data? 

To ensure the provision of WiFi, your personal data is processed in accordance with Article 6 (1) (b) GDPR.

What kind of personal data do we process?

If you log in via the form, we will process your email address. In the case of logging in via social networks: your name, surname, email, phone number, gender, age and date of birth.

How long do we store your personal data?

We process your personal data for the duration of our contractual relationship.

12. The “Ahoj Nivy” application

 What is our purpose for and legitimate interest in processing your personal data? 

The “Ahoj Nivy” application unlocks a range of special offers, prices and limited campaigns to all registered members. It enables them to discover and follow stores, events and news, as well as see the map. The content of the app and advertisements is personalised in real time based on members’ preferences, which are gathered from their activity in the app and in the mall thanks to iBeacons, the Bluetooth devices used for location tracking. You can use some of the above-mentioned benefits even if you only download it and do not register in the "Ahoj Nivy" application.

If you download our mobile application without registration, we may perform the following processing operations for the following purposes:

a) We process your personal data that you provided to us when downloading, installing and using the "Ahoj Nivy" application in order to send customised marketing content without your identification;

b) We generate anonymous aggregated statistics regarding the effect of relevant marketing campaigns.

If you have downloaded the “Ahoj Nivy” application and you have registered and given your consent (in the case of point c) you give your consent directly to your phone's operating system and not to the "Ahoj Nivy" application), we may perform the following processing operations for the following purposes:

c) If the data subject is in or near Nivy or staying in one of the following buildings: Nivy Tower, Apollo 3, Apollo 5 and Nové Apollo, located in the Nivy zone (the application does not collect location data on other movements), we check the location of the data subject’s mobile device (via Bluetooth (in each building) or WiFi (only in Nivy)) to provide him/her with relevant marketing content at the relevant time and place using “push notifications”;

d) the processing of the personal data of the data subject when downloading, installing and using the “Ahoj Nivy” application, to send customised marketing content based on his/her preferences and to provide 1 extra free hour of parking in addition to the usual amount of two hours of free parking.

 What is our legal basis for the processing of your personal data? 

For the processing activities listed under points c) and d), we process your personal data on the basis of consent in accordance with Article 6 (1) (a) of GDPR. For the processing activities listed under a) and b), we process your personal data on the basis of legitimate interests within the meaning of Article 6 (1) (f) of GDPR.

What kind of personal data do we process?

a) If you are not a registered user of the "Ahoj Nivy" application, we will process the emplate ID, which is a unique identifier of the application installed on your device;

b) sex (if applicable), age (if applicable), date of birth (if applicable), postal code (if applicable), name, surname (if applicable), telephone number (if applicable);

c) localisation data on the respective mobile device, the controller can process information on entering the Nivy centre and on the exact location of the data subject in the proximity of the Nivy centre. Moreover, the Controller can process information on entering and leaving the following buildings: Nivy Tower, Apollo 3, Apollo 5 and Nové Apollo,;

d) In addition to the emplate ID, we will process the following personal data in the case that the data subject registers an account manually: email address, telephone number, salutation, first name, last name (if provided), date of birth (if provided), ZIP code (if provided); The data subject can also sign in with his/her Apple account. In that case, we will process the email address, first name, last name (if provided), date of birth (if provided), ZIP code (if provided) and gender (if provided). If the data subject registers using a Facebook account, the following information will be collected: email address, full name, profile picture, Facebook user ID, device name, the operating system version, the “Ahoj Nivy” application version, event tracking information including the information that the application was started, consent was given, a screen was viewed in the application, marketing material was viewed in the application, bonus points were obtained, a button was clicked, a notification was received (if notifications were consented to and enabled for the application), product/brand/services and other preferences of the data subject substantial for tailoring marketing content to the preferences of the data subject and to share this information with third parties to prepare targeted advertisements, customised marketing and personalised newsletters to the data subject.

How long do we store your personal data?

a) Your personal data will be processed as long as you have the "Ahoj Nivy" application installed;

b) We store your personal data in an aggregate form for 2 years;

c) We retain your personal data for as long as you allow us to when installing the application and we retain data from iBeacons for 90 days. You can withdraw your consent anytime directly in your phone's operating system;

d) We store your personal data for the period of validity of the consent. You can revoke your consent at any time by using the consent management icon directly in the application.

13. Nivy Grill

 What is our purpose for and legitimate interest in processing your personal data? 

We process your personal data to ensure the efficient use of the Grill located on the green roof of Nivy by those interested in barbecuing.

 What is our legal basis for the processing of your personal data? 

To ensure the provision of Nivy Grill services, your personal data is processed in accordance with Article 6 (1) (b) GDPR.

What kind of personal data do we process?

Name, surname, email, phone number.

How long do we store your personal data?

We process your personal data for the duration of our contractual relationship.

14. Wheelchair rental

What is our purpose for processing your personal data?

We process your personal data for the purpose of renting a wheelchair, which is available at the information desk at Nivy polyfunctional building. Without such processing we would not be able to lend the wheelchair to the requester.

 What is our legal basis for the processing of your personal data? 

To ensure the provision of wheelchair rental, we process your personal data in accordance with 6 (1) (f) of the GDPR.

What kind of personal data do we process?

Name, surname, residence address and phone number.

How long do we keep your personal data?

We keep your personal data for the duration of one month from the time you return the wheelchair.

15.  Finding your car in the parking lot 

 What is our purpose for and legitimate interest in processing your personal data? 

Each parking space in our parking lot is captured by a camera that takes a photo of your vehicle and stores it in a database until you leave the parking space. We may process your personal data if at the payment terminal you enter your LPNo, i.e. the LPNo of your car, and the terminal will show you exactly where the vehicle in question is located. Such processing is necessary so that we can provide you with a search service for your vehicle.

 What is our legal basis for the processing of your personal data? 

Your personal data is processed during the provision of “Find your car” services in accordance with Article 6 (1) (f) GDPR, i.e. we process your personal data on the basis of legitimate interests.

What kind of personal data do we process?

Photo of the vehicle taken from CCTV footage.

How long do we store your personal data?

We store your personal data until your car leaves the parking space.

16.Nivy Gift card   

 What is our purpose for and legitimate interest in processing your personal data? 

We process your personal data or the personal data of a third (gifted) person when ensuring the provision of a Nivy gift card. The processing of personal data is necessary to ensure the handover process to an authorised person. Without such processing, we would not be able to hand over the card to the card recipient.

 What is our legal basis for the processing of your personal data? 

To ensure the provision of Nivy gift card services, your personal data or the personal data of third parties is processed in accordance with Article 6 (1) (f) GDPR, i.e. we process your personal data on the basis of legitimate interests.

What kind of personal data do we process?

Name, surname, email address, residence address.

How long do we store your personal data?

We process your personal data for the duration of our contractual relationship.

17.Exercise of the data subject's rights under the GDPR

What are our purpose for processing your personal data?

We strive to protect your privacy as much as possible, and therefore we process your personal data in compliance with GDPR and all other relevant laws. However, if you disagree with the way we handle your personal data, you can exercise your rights via our Data Protection Officer, among other by filling out the application form for exercising rights, which can be found at the information desks.

 What is our legal basis for the processing of your personal data? 

Your personal data is processed while handling your complaint in accordance with Article 6 (1) (c) GDPR, i.e. the processing is necessary for compliance with a legal obligation to which Nivy polyfunctional building is subject to.

What kind of personal data do we process?

Personal data required by the request to ensure effective communication (such as name, surname, email address, phone number, etc., at your discretion).

How long do we store your personal data?

We store your personal data strictly during the time necessary to handle the request.

General provision on the retention period

Once we no longer need your personal data for the purposes for which we processed it, we will delete your personal data or archive it for the period of time specified by law or the archiving plan.

With whom do we share your personal data?

We may also share your personal data with companies within the HB Reavis Group. We may also be obliged to disclose your personal data to state authorities and public authorities, (courts and law enforcement authorities i.e. (police and prosecutor), and only to the extent necessary as required by applicable and effective law to exercise their power.

Based on several agreements with third parties, which act as our intermediaries or independent operators, we may provide your personal data, in particular to these companies, to the extent necessary to ensure the provision of services specified for individual companies:

• WALL & Partners a. s., with its registered office at Prievozská 4, 821 09 Bratislava, the Slovak Republic, IČO: 36 869 813, entered in the Commercial Register of the City Court Bratislava III, section: Sro, file no.: 5121 / B; the company as a processor operates a CCTV system;
• HB REAVIS Slovakia a. s., a company organized and existing under the laws of Slovak Republic with its registered seat at Mlynské nivy 5, Bratislava, 821 09, Identification No. 31 346 065, registered with the commercial register maintained by the City Court Bratislava III under Section Sa, file No. 3429/B; the company as a processor provides marketing services;
• HB Reavis Group a. s., a company organized and existing under the laws of Slovak Republic with its registered seat at Mlynské nivy 5, Bratislava, 821 09, Identification No. 50 588 427, registered with the commercial register maintained by the City Court Bratislava III under Section Sa, file No. 7791/B; the company as a processor provides marketing services;
• HB Reavis Investments Slovakia s. r. o., having its registered seat at Mlynské nivy 5, 821 09 Bratislava, Slovak Republic, ID No.: 44 489 650, registered with the Commercial Register maintained by the City Court Bratislava I, Section: Sro, File No.: 55375/B; the company as a processor provides facility management services “Concierge“;
• ISTROCENTRUM s. r. o., a company organized and existing under the laws of Slovak Republic with its registered seat at Mlynské nivy 5, 821 09 Bratislava, Identification No. 31 396 224, registered with the commercial register maintained by the City Court Bratislava III under Section Sro, file No.141730/B; the company as a processor provides various services for the administrator of the building (e.g., reception);
• Yardi Systems, Inc., located at 430 South Fairview Avenue Santa Barbara, CA 93117 United States of America, Registration Authority Entity Identifier: 1315897, LEI (Legal Entity Identifier) Number: 549300ON1GNGUQR55L60, the company providing services as a processor in the field of Contactless Door Opening Services and Visitor Management Software (VMS);
• ELIMER a.s. a company organized and existing under the laws of Slovak Republic with its registered seat at Srnianska 19, Nové Mesto nad Váhom 915 01, Identification No. 36 306 941, registered with the commercial register maintained by the District Court Trenčín under Section Sro, file No. 10592/R; the company as a processor provides various services in the field of CCTV maintenance;
• SAYTECH s.r.o., a company organized and existing under the laws of Slovak Republic with its registered seat at Hrachova 14/B, 821 05 Bratislava, IČO: 46 795 049, Identification No. 31 396 224, registered with the commercial register maintained by the City Court Bratislava III under Section Sro, file No. číslo 83499/B; the company as a processor provides various services in the field of parking systems maintenance;
• KONE s.r.o., a company organized and existing under the laws of Slovak Republic with its registered seat at Galvániho 7/B, 821 04 Bratislava, Identification No. 31 359 884, registered with the commercial register maintained by the City Court Bratislava III under Section Sro, file No. 5894/B; the company as a processor provides various services in the field of elevator maintenance;
• PosAm, spol. s r.o., having its registered seat at Pribinova 40, 811 09 Bratislava, the Slovak Republic, ID No.: 31 365 078, registered with the Commercial Register maintained by the City Court Bratislava III, Section: Sro, File No.: 6342/B; the company as an independent controller ensures the payment of parking fees;
• Bloomreach SK s.r.o., with its registered office at Staromestská 3, Bratislava - mestská časť Staré Mesto 811 03, the Slovak Republic, IČO: 50 017 560, entered in the Commercial Register of the City Court Bratislava III, section: Sro, file no.: 107011 / B; the company as a processor ensures the generation of personalised marketing content;
• Emplate ApS, based at Søren Frichs Vej 42R 8230 Aarhus, Denmark, the company as an independent controller provides the development and functionality of the “Ahoj Nivy” application;
• AVSYSTEM SŁAWOMIR WOLF SPÓŁKA JAWNA, a company incorporated under the law of the Republic of Poland, with its registered office at ul. Radzikowskiego 47 D, 31‐315 Kraków, Republic of Poland, registered in the Commercial Register of the District Court of Kraków, Eleventh Commercial Department of the National Court Register, under the number KRS 0000268200, tax identification number (NIP) 677‐228‐04‐51, statistical number ( REGON) 120362919, the company as an independent controller provides WiFi;
• LOYALTEK S.A., having its registered office at B-1000 Brussels, Cantersteen 47, Belgium, registered under the number BE 0820.246.648, the company as a processor provides services related to Nivy gift cards.

In addition to the companies listed above, we use the following categories of intermediaries: data centres, hosting - marketing tools - analysis and tracking tools - events, surveys - business operations / management tools - task management and communication tools.

We use analytical and marketing tools (e.g. Google Analytics, Facebook Pixel, LinkedIn Pixel, Hotjar, Luigi´s Box, HubSpot) that collect third-party cookies. The information about your use of websites (including your IP address) generated by the cookies will be transmitted to and stored by the above-mentioned companies also on servers in the United States. We will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. These companies will not associate your IP address with any other data held by them. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do this you may not have full functionality of this website. By using our websites, you acknowledge that the above – mentioned companies may process data in the manner and for the purposes set out above.

 The processing of personal data together with social media platforms 

Nivy polyfunctional building and (i) facebook.com and (ii) instagram.com, as the controllers of the relevant social media platforms, may in certain cases also process the personal data of data subjects to a limited extent or in the necessary extent as joint controllers. When using the services provided by these operators of social media platforms, the polyfunctional building Nivy accesses the conditions of the operation of this website and has no or only a minimal impact on changing these conditions.

Nivy is currently using so-called social plugins from the above-mentioned operators of social networks, which are indicated by their logos on our website. When you visit our website, your browser establishes a direct connection with the servers on which these plugins run. The content of the plugins is transferred directly by Facebook/Instagram to your browser, which then integrates it into our website. The integration of the plugins causes Facebook/Instagram to receive the information that you have accessed on the corresponding page of the Nivy website. If you are logged in with Facebook/Instagram, it will be able to assign your visit to your account on these social networks. Please note that an exchange of this information already takes place when you visit our website regardless of whether you interact with the plugin or not. If you do not want Facebook/Instagram to gather data about you via our website, you must log out of them before visiting our website. Various functionalities and tools are made available to the data subject by each social media platform provider so the data subject can manage his/her preferences for displaying advertisements and sending messages with advertising content, or the data subject can exercise his/her right guaranteed by GDPR. Nivy has no impact on such processing (it may not disable or enable such processing as part of the operation of its sites or media channels) - the creation of site or media channel statistics by the relevant social media platform operators (see above) for Nivy. The webpage’s statistics are generally based on personal data collected in connection with the visit or the interaction of the data subject with the site or media channel and its content. Within the functionality of webpages and media channels, Nivy can be acquainted with these statistics and deal with them. If you do not want Facebook/ Instagram to collect information about you through our website, you must log out of them before visiting the website. For more information about how these social networks process your personal data, please see their privacy policy:

Facebook:  https://www.facebook.com/privacy/explanation 

Instagram:  https://help.instagram.com/155833707900388 

From whom do we get personal data?

We get personal data from you, from third parties and from our tenants.

Do we use automated individual decision making?  

Yes, we use automated individual decision making to provide personalised content on our website and application. However, we do not make any decisions based solely on automated processing that have legal effects on you or that significantly affect you. We analyse your behaviour on our website or in the "Ahoj Nivy" application solely to provide more attractive offers for the purchasing of goods and/or services and to adapt the content of the website to your preferences.

    Do we transfer your personal data to third countries?
    

Your personal data is processed within the territory of the Slovak Republic and other states of the European Union. Your personal data can be processed by a country outside of the European Union if this third country has been confirmed by the European Commission as a country with an adequate level of data protection or if other appropriate data protection safeguards exist (for example, binding corporate privacy rules or EU standard data protection clauses).

What are your rights?

Your rights as a data subject are stated below. Please note that the exact conditions to exercise these rights are set out in detail in Chapter III of GDPR, while in particular circumstances not all rights may be exercised.

You have the following rights:

• Access to the personal data we process about you
• Rectification of incorrect or inaccurate personal data and adding incomplete personal data
• Restriction, i.e. blocking of the processing of your personal data
• The deletion of personal data in case of an absence of purpose or unauthorised data processing
• Submission of an objection to the processing of personal data if you believe that our data processing is not justified
• To be excluded from automated decision making
• Listing of personal data in a structured and machine-readable format or for another controller
• Revocation of consent to the processing of personal data
• To lodge a complaint with the supervisory authority

How can you exercise your rights?

Electronically: dataprivacy@hbreavis.com

In writing to the address: Stanica Nivy s. r. o., at hands of legal department,Mlynské nivy 5, 821 09 Bratislava, Slovak Republic or at HB Reavis Group a. s., compliance department, Mlynské nivy 5, 821 09 Bratislava, Slovakia.

We strive to protect your privacy as much as possible and therefore we process your personal data in compliance with GDPR and all other relevant laws. However, if you disagree with the way we handle your personal data, you can exercise your rights via our Data Protection Officer at:

HB Reavis Group a. s., at hands of DPO, Mlynské nivy 5, 821 09 Bratislava, Slovak Republic, email: dataprivacy@hbreavis.com.

Or you can file a complaint in supervising authority regarding the processing of your personal data. Your local supervisory authority may be found at:  https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm  .