PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA AND YOUR RIGHTS

In case you are providing your personal data, we as a data controller or as a data processor Symbiosy s. r. o., having its registered seat at Mlynské Nivy 16, 821 09 Bratislava, Slovak Republic, ID No.: 52 218 546, registered with the Commercial Register maintained by the District Court Bratislava I, Section: Sro, File No.: 134990/B (hereinafter referred to as the “HB Reavis” or “we”) would like to inform you about the processing of your personal data and of your rights related to the said processing.

The Controller is part of the HB Reavis Group, which consists of all entities consolidated under the group holding HB Reavis Holding S.A. with its headquarters in Luxembourg due to which the reference to HB Reavis Group may be found in the Privacy Notice (hereinafter referred to as the “HB Reavis Group “).

If you are in one of our buildings, in their immediate vicinity (as a visitor, employee or for any other purpose) or visit websites, apps related to our services or are interested in working for us, your personal data may be processed for the following purposes:

  1. Provision of Symbiosy services – in position of a Processor.
  2. Provision of Symbiosy services – in position of a Controller.
  3. Mutual communication
  4. GDPR complaints
  1. Provision of Symbiosy services – in position of a Processor

What is our purpose for and legitimate interest in processing your personal data?

Your personal data is used for the purpose of providing Symbiosy Services as it is stated in the Agreement on Symbiosy Services. This purpose includes mainly the following processing activities:

  • analysis of the interactions of the data subject with other team members or employees in the workplace, information on time spent on focused work (longer periods of time uninterrupted by meetings), activities in the office, etc.;
  • based on the analyses, provide recommendations on how the data subject could work more effectively and use the information to enable the data subject to fulfil his/her role within the organisation while maintaining a healthy work-life balance;
  • providing information on the most suitable working environment for the employee of our client;
  • sending density warnings;
  • displaying enviro status and sending enviro warnings of/related to the premises,
  • providing a universal digital workspace interface to display and interact with all layers of smart building solutions in the 3D workspace model. Symbiosy services are available on the physical kiosks (totems) installed around the workspace and/or can be deployed as a mobile app.
  • providing a quick check of available meeting rooms to see their location or any other details such as photos, capacity, or amenities,
  • providing “desk booking” functionality;
  • other matters necessary for the provision of the Symbiosy service.

What is our legal basis for the processing of your personal data?

Legitimate interest of our client as your employer who would like to better understand the hidden details of the organisation or your consent given directly to your employer (our client).

What kind of personal data do we process?

Title, name, surname, and the business name of your employer, working position e-mail, IP address, indoor positioning data (positioning tag ID, timestamp, indoor position); pseudonymised ID; department; entry card ID; e-mail metadata from Microsoft 365; calendar metadata from Microsoft 365, place of booked desk,

How long do we store your personal data?

For the duration of your contractual relationship with our tenant or the duration of the rental relationship, whichever relationship ends first.

 

  1. Provision of Symbiosy services – in position of a Controller

What is our purpose for and legitimate interest in processing your personal data?

Your personal data are used to ensure the fulfilment of all rights and obligations arising from the contract concluded with us. This includes pre-contractual relationships and the protection and enforcement of Symbiosy rights and interests stemming from our relationship. This purpose includes mainly the following processing activities:

  • efficient communication relating to the provision of Symbiosy Services,
  • ensuring examination of a complaint or claim made by you (recording of the complaint, examination of the complaint, verification whether the person submitting the complaint is entitled to do so, sending a notification about the result of the complaint),
  • ensuring proper performance of Symbiosy Services,
  • carrying out our obligations and enforcing our rights arising from any contracts entered into between you and us in connection with Symbiosy Services, including ensuring invoicing,
  • reporting problems with services or technology,
  • other matters necessary for the provision of the Symbiosy service.

What is our legal basis for the processing of your personal data?

We process your personal data based on the legitimate interests under Article 6 (1) (f) of GDPR to provide Symbiosy services to our tenants and their employees.

What kind of personal data do we process?

Title, name, surname, and the business name of your employer, working position, e-mail

How long do we store your personal data?

For the duration of your contractual relationship with our tenant or the duration of the rental relationship, whichever relationship ends first. We subsequently archive the lease agreement for a period of five (5) years after the end of the contractual relationship.

 

  1. Mutual communication

What is our purpose for and legitimate interest in processing your personal data?

Our philosophy is to always be open and transparent. This includes being open to communication from any person interested in us. To fulfil this goal, we created several types of forms that can be used to contact us on our webpage. However, to ensure effective, flawless, and clear communication, we must process some of your personal data.

Moreover, when providing/offering our services to our (potential) clients we strive to maintain very effective and transparent communication canal. To fulfil this purpose, we use the CRM database filled with contact data (including personal data) of our (potential) clients or their employees. We do this to ensure effective and flawless communication with the (potential) clients and to build a database consisting of all our business partners.

What is our legal basis for the processing of your personal data?

If you contact us or any employee via email or a web-based form, we process your personal data based on the legitimate interests under Article 6 (1) (f) of GDPR.

What kind of personal data do we process?

Name, surname, email address and phone number. For the purposes of the CRM database, in addition to the aforementioned data, we also process job title and employer identification data.

How long do we store your personal data?

We keep your personal data until you unsubscribe from our contact database.

 

  1. GDPR complaints

What are our purposes for the processing of your personal data?

We strive to protect your privacy as much as possible, and therefore we process your personal data in compliance with GDPR and all other relevant laws. However, if you disagree with the way we handle your personal data, you can exercise your rights via our Data Protection Officer. To ensure that your complaint is handled, some of your personal data has to be processed.

What is our legal basis for the processing of your personal data?

Your personal data is processed while handling your complaint in accordance with Article 6 (1) (c) GDPR, i.e., the processing is necessary for compliance with a legal obligation to which our company is subject.

What kind of personal data do we process?

Personal data provided by you when submitting the complaint (such as name, surname, email, phone number, etc.).

How long do we store your personal data?

We store your personal data strictly during the time necessary to deal with the complaint.

Once we no longer need your personal data for the purposes for which we processed it, we will delete your personal data or archive it for the period of time specified by law or the archiving plan.

With whom do we share your personal data?

We may also share your personal data with companies within the HB Reavis Group or with our business partners with whom we have entered a contract due to their status as processor, controller, or joint controller. We may also be obliged to disclose your personal data to state authorities and public authorities, (courts and law enforcement authorities i.e. (police and prosecutor), and only to the extent necessary as required by applicable and effective law to exercise their power.

In addition to the companies listed above, we use the following categories of intermediaries: data centres, hosting – marketing tools – analysis and tracking tools – events, surveys – business operations / management tools – task management and communication tools.

We use analytical and marketing tools (e.g. Google Analytics, Facebook Pixel, LinkedIn Pixel, Hotjar, Luigi´s Box, HubSpot) that collect third-party cookies. The information about your use of websites (including your IP address) generated by the cookies will be transmitted to and stored by the above-mentioned companies also on servers in the United States. We will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. These companies will not associate your IP address with any other data held by them. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do this you may not have full functionality of this website. By using our websites, you acknowledge that the above – mentioned companies may process data in the manner and for the purposes set out above.

From whom do we get the personal data?

We get the personal data from you or your employer.

Do we use automated individual decision-making?

Some functionalities of the Symbiosy products process data in a way that is consistent with profiling (analysis of data, not predicting Data Subjects behaviour) under the Regulation; this is to be able to deliver functionalities such as finding an ideal space and temperature voting. Without such processing, the Symbiosy services would not be able to deliver the full functionality to the employee of our client and would not be able to help them with tools and insights to possibly take a better advantage of the workspace. The collected data within the Symbiosy services is delivered exclusively to the employee of our client. Symbiosy and your employer has adopted solutions to properly secure the employee’s data in line with market standards. Therefore, we do not perceive this processing itself to pose any significant effects on the employee of our client as it is not shared with their employer or independent third parties.

Do we transfer your personal data to third countries?Your personal data are processed within the territory of the Slovak Republic and other states of the European Union. Your personal data can be processed by a country outside of European Union if this third country has been confirmed by the European Commission as a country with adequate level of data protection or if other appropriate data protection safeguards exist (for example, binding corporate privacy rules or EU standard data protection clauses).

What are your rights?

Your rights as a data subject are stated below. Please note that the exact conditions to exercise these rights are set out in detail in Chapter III of GDPR, while in a particular circumstance not all rights may be exercised. You have following rights:

  • Access to personal data we process about you
  • Rectification of incorrect or inaccurate personal data and add incomplete personal data
  • Restriction, i.e., blocking of processing of your personal data
  • The deletion of personal data in case the purpose absence or unauthorized data processing
  • Submission of an objection to the processing of personal data if you believe that our data processing is not justified
  • Be excluded from automated decision-making
  • Listing of personal data in a structured and machine-readable format or for another controller
  • Revocation of consent to the processing of personal data
  • To lodge a complaint with the supervisory authority

 

How can you exercise your rights?

Electronically: dataprivacy@hbreavis.com

In writing to the address: Symbiosy s. r. o., at hands of compliance department Mlynské Nivy 16, 821 09 Bratislava, Slovak Republic

Telephone: +421 918 723 243

We strive to protect your privacy as much as possible and therefore we process your personal data in compliance with GDPR and all other relevant laws. However, if you disagree with the way we handle your personal data, you can exercise your rights via our Data Protection Officer at:

Data Protection Officer’s contact: Erika Wild, contact point at Twin City C, Mlynské Nivy 16, 821 09 Bratislava, Slovak Republic, tel. +421 918 723 243, email: dataprivacy@hbreavis.com

Or you can file a complaint in supervising authority regarding the processing of your personal data. Your local supervisory authority may be found at: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm