Personal Data Processing Policy 
Kvarter project

1. General provisions

In this Personal Data Processing Policy we provide you with information on how the companies involved in the preparation and implementation of the Istropolis project process your personal data.

We provide this information pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the “GDPR”).

For the purposes of this Policy:

“Project” means the project for the construction of a complex named Kvarter in the area of Jégého ulica, Bratislava, as further described on the website www.kvarter-living.sk

“Immocap” means Immocap, a.s., with its registered office at Mlynské nivy 55, 821 09 Bratislava – borough Ružinov, Company ID No.: 35 944 536, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sa, File No. 3633/B.

“Companies” means the separate project companies (SPVs) implementing the individual parts/buildings of the Project, the list of which is set out in Annex 1 to this Policy.

The Companies process personal data in the course of the activities described in this Policy either jointly as joint controllers or separately as controllers, always depending on what is stated for the specific purpose of processing in Article 3 of this Policy.

This Policy shall also apply to personal data processing carried out by individual Companies separately as controllers, exclusively, however, to the extent of those processing activities for which this is stated for the specific purpose of processing in Article 3 of this Policy. The Companies do not have separate personal data processing policies for these processing activities; for such processing, this Policy shall apply according to the nature of the specific processing activity.

Information as to which specific Company processes personal data for the individual purposes set out in Article 3 may be obtained through the Project overview available on the website www.istropolis.sk, where a visualisation of the Project is displayed, including the designation of individual parts/buildings and the Company that is the owner or implementer of the relevant part of the Project.

Immocap processes personal data for the Companies as a processor on the basis of an agreement pursuant to Article 28 GDPR and in accordance with the Companies’ instructions. Information on categories of recipients and processors is set out in Article 5 of this Policy.

2. Personal data controller

The Companies process personal data in the course of the activities described in this Policy either jointly as joint controllers or separately as controllers, always depending on what is stated for the specific purpose of processing in Article 3 of this Policy.

Contact point for data subjects
Business name: Immocap, a.s.
Company ID No.: 35 944 536
Contact address: Mlynské nivy 55, 821 09 Bratislava – Ružinov
E-mail: immocap@immocap.sk

If you have any questions regarding this Policy, the use of personal data, or if you wish to exercise your rights described in this Policy, you may contact the contact point by e-mail as well as in writing at the address above. The contact point will receive your request and will ensure its forwarding and coordination of its handling with the relevant Company or Companies, depending on the nature of the processing.

A data subject may also exercise their rights directly vis-à-vis the Company or Companies acting as the controller or joint controllers for the relevant purpose of processing pursuant to Article 3 of this Policy.

The Companies which act as joint controllers for the specific purposes set out in Article 3 have entered into an arrangement pursuant to Article 26 GDPR governing the allocation of responsibilities for joint processing of personal data, in particular as follows:

• Immocap, as the contact point, ensures the fulfilment of information obligations towards data subjects and receives/co-ordinates the handling of data subject requests;
• the individual Companies provide assistance in handling requests, in particular in searching for and making available data concerning offers and communication related to their part of the Project;
• the joint controllers cooperate in ensuring appropriate technical and organisational measures and in addressing any security incidents;
• the rules for access to systems and retention periods are set so as to correspond to the principles of data minimisation and storage limitation.

3. Purpose, lawful basis and retention period

Your personal data are processed by the Companies as controllers or joint controllers on the following lawful bases and for the following purposes, always within the scope and in the capacity stated for the specific purpose of processing.

A) Purposes related to the performance of a contract or to steps taken at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)(b) GDPR:

B) Purposes related to compliance with a legal obligation pursuant to Article 6(1)(c) GDPR:

C) Purposes related to the legitimate interests pursued by the controller or a third party pursuant to Article 6(1)(f) GDPR:

For all processing purposes set out in this point C), the controller is always the Company to which the specific communication, marketing communications or negotiations relate; the Companies do not act as joint controllers for these purposes. The relevant Company can be identified according to the assignment of the relevant part/building of the Project to the respective Company, as set out in the Project overview available on the website www.kvarter-living.sk

4. Data subject rights

When processing personal data, we respect your rights as a data subject. Under applicable law, you as a data subject have several rights in connection with the processing of your personal data, depending on the lawful basis and purpose of the processing:

• the right to information about the processing of your personal data;
• the right to obtain access to the personal data processed and stored about you;
• the right to request rectification of incorrect, inaccurate or incomplete personal data;
• the right to request erasure of personal data when it is no longer necessary, or where the processing is unlawful;
• the right to object to the processing of personal data for marketing purposes or for other purposes based on the lawful basis pursuant to Article 6(1)(f) GDPR;
• the right to request restriction of the processing of your personal data in specific cases;
• the right to receive personal data in a machine-readable format and/or to request its transfer to another controller;
• the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal, where you have given such consent;
• the right to request that decisions based on automated processing which concern you or significantly affect you, based on your personal data, be carried out by natural persons and not by automated technical means, where personal data are processed by the controller in this manner. You have the right to express your view and to object to the controller’s decision;
• the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement, and the right to an effective judicial remedy if you consider that the processing of your personal data is in breach of the legal regulations. The supervisory authority in the territory of the Slovak Republic is: 
  
  Office for Personal Data Protection of the Slovak Republic
  Hraničná 12, 820 07 Bratislava 27, Slovak Republic
  Website: www.dataprotection.gov.sk
  Phone no.: +421 2 3231 3214
  E-mail: statny.dozor@pdp.gov.sk
  
  
• the right to submit a request or complaint to the controller in connection with the protection and processing of your personal data. Any data subject who wishes to submit a request or complaint and exercise their rights may do so in person, by letter or electronically using the contact details set out in Article 2 above.

You may exercise your rights through the contact point set out in Article 2 of this Policy, which will receive your request and ensure its forwarding and coordination of its handling with the relevant Company. You may also exercise your rights directly vis-à-vis the Company that is the controller for the relevant purpose of processing pursuant to Article 3 of this Policy.

If, for a specific purpose of processing pursuant to Article 3, the Companies act as joint controllers, you may exercise your rights also vis-à-vis any of these Companies.

5. Recipients of personal data

Recipients of your personal data include Immocap, service providers for the Companies and external advisers, such as providers of software systems, IT services, postal and courier service providers, translators, accounting and tax advisers, legal advisers, and marketing agencies.

Immocap further, as an investor in the Project, processes your personal data as a controller, to the extent of identification data and the history of concluded contracts and amendments, on the basis of Article 6(1)(f) GDPR, for the purposes of internal records and control of activities within the Immocap group. The legitimate interest is Immocap’s ability within the Project to obtain, verify and analyse data for the purpose of evaluating the efficiency of the use of invested resources, their rate of return and improvements, as well as the ability to require and implement measures to increase such efficiency and rate of return. Immocap will process the data for this purpose for the period necessary to fulfil its legitimate interest, at the latest until completion of the Project (i.e. the sale of all apartments in the Project), or until exit from the Project by way of sale of the entire Project or its share in the Project to a third party.

Your personal data may, where necessary, also be provided to courts and public authorities for the purpose of fulfilling the legal obligations of the Companies and/or Immocap, enabling supervision over the activities of the Companies and/or Immocap, exercising the powers of a court or public authority, resolving disputes and enforcing decisions.

Your personal data may be provided to an acquirer if personal data are transferred as part of the sale or other transfer of all assets of any of the Companies, or part thereof, to the acquirer.

6. Scope and source of processed personal data and the possibility/necessity of providing them

Data subjects are customers and potential customers of the Companies, as well as contact persons of customers and potential customers of the Companies where the customers are legal persons.

We most often obtain personal data directly from you as the data subject. In some cases, however, we must supplement the data provided from public sources (e.g. the Trade Register, the Cadastral Register, the Commercial Bulletin, etc.), or they may be provided to us by a third party (e.g. where, prior to the conclusion of a contract, a business partner provides personal data of its representatives or other contact persons).

The maximum scope of processed personal data is as follows: academic title, first name, surname, birth surname, permanent residence address, correspondence address (if different from the permanent residence address), date of birth, national identification number, marital status, nationality, ID card number or other identity document number, bank details and bank account number, e-mail address, telephone number. This maximum scope of processed personal data relates to the purpose of performance of a contract concluded between you and our company. In relation to the other purposes of processing, the scope of processed data is limited only to the data necessary to achieve the given purpose, or only to data for the processing of which you have given consent, if you have given it.

Prior to entering into a contract with any of the Companies, the provision of your personal data is voluntary. If you enter into negotiations on concluding a contract and subsequently conclude a contract with us regarding the Project, the requirement to provide your personal data arises from the relevant laws, i.e. without providing your data it will not be possible to conclude a valid contract and subsequently fulfil the obligations arising therefrom, as well as the obligations arising from law and related to the existence of such contract.

7. Automated processing and profiling

Your personal data are not processed exclusively by automated means, but are always also processed by our trained staff.

We may also carry out so-called profiling with your personal data, but only to the extent necessary so that we can provide you with individually tailored offers and information and do not burden you with mass general offers and information.

8. Protection of personal data

In accordance with the requirements of applicable legal regulations, we have implemented, perform and maintain all necessary security, technical and organisational measures, internal controls and processes in order to protect your personal data, in line with best business practice corresponding to the potential risk to you as a data subject. At the same time, we take into account the state of technological development in order to protect your personal data against accidental loss, destruction, alteration, unauthorised disclosure or access.

These measures may, inter alia, include taking appropriate steps to ensure the accountability of relevant employees who have access to your data and training employees.

If you would like more information about the security of your personal data, please do not hesitate to contact us. Contact details are set out in Article 2 above.

9. Effective date of the policy

The information that we are required to provide to you in connection with our processing of personal data may change or cease to be current. For this reason, we reserve the right to amend this Policy. If we amend this Policy in a material manner, we will bring this change to your attention. The current wording of this Policy will always be available on the Project website.

Annex 1 – List of Companies Implementing the Project

Immocap Services, a.s., Mlynské nivy 55, 821 09 Bratislava – Ružinov

The document is valid from 27/01/2027.