Information obligation of a company drawn up pursuant to the Act on the Protection of Personal Data

Operator:

The Company CEE Real Estate Group s.r.o., Gorkeho 5, Bratislava, 81101, Slovak Republic, ID: 51 773 074 (hereinafter referred to as "the Company") performs the processing of personal data of its employees, clients, customers or business partners ") As an information system operator (IS).

Legal basis for the processing of personal data of the persons concerned:

When processing personal data, the company proceeds in accordance with Act no. 18/2018 Z. z. on the Protection of Personal Data and on Amendments to Certain Rules (the "Personal Data Protection Act"). The legal basis for the processing of personal data is the Personal Data Protection Act, special legal regulations and consent to the processing of personal data, depending on the purpose of the processing of personal data.

If the purpose of the processing of personal data, the circle of persons concerned and the list of personal data provides for a directly enforceable act of the European Union, an international treaty to which the Slovak Republic is bound, a law on the protection of personal data or a special law, a company under the Act on the Protection of Personal Data processing personal data without the consent of the person concerned.

The company processes personal data without the consent of the person concerned, if the purpose of the processing of personal data, the range of persons concerned and the list of personal data or their scope provides for a directly binding legal act of the European Union, an international treaty binding on the Slovak Republic or this law. If the list or scope of personal data is not established, the company may process personal data only in the extent and manner necessary to achieve the intended purpose of processing in compliance with the fundamental obligations under the Personal Data Protection Act.

The company further processes personal data without the consent of the data subject, if the purpose of the processing of personal data, the circle of persons concerned and the list of personal data is provided by a special law, and only in the scope and manner stipulated by a special law. Personal data processed can only be provided, disclosed or disclosed from the information system if a specific law provides for the purpose of providing, making available or disclosing, a list of personal data that can be provided, made available or disclosed, as well as third parties providing personal data the circle of recipients to make personal data available unless otherwise provided by the Personal Data Protection Act.

The company processes personal data without the consent of the person concerned even if:

• (a) the processing of personal data is necessary for the performance of the contract in which the person concerned is acting as one of the parties, or in pre-contractual relations with the person concerned or in the negotiation of a change of the contract made at the request of the person concerned,
• (b) the processing of personal data is necessary to protect the life, health or property of the person concerned,
• (c) the subject matter of the processing is solely the title, the name, the surname and the address of the person concerned, without the possibility of assigning any other personal data to them, and their use is exclusively intended for the needs of the operator in the postal communication with the person concerned,
• (d) processing of personal data which has already been made public in accordance with the law and the operator appropriately identified them as published; the person who claims to process the personal data disclosed will, on request, prove to the Office that the processed personal data have already been legally disclosed,
• (e) the processing of personal data is necessary for the protection of the rights and the rights of the protected interests of the operator or of a third party, unless such processing of personal data predominates the fundamental rights and freedoms of the person concerned who are subject to protection under this Act.

If, in view of the purpose of the processing of personal data provided for in the directly binding legal act of the European Union, the international treaty to which the Slovak Republic is bound, in the law on the protection of personal data and the specific law, the list of personal data can be replaced by the scope of personal data.

The company is required to process such personal data in accordance with the Personal Data Protection Act, except for the operators who process personal data for the purposes of and in connection with the court proceedings.

If the Personal Data Protection Act does not apply to the processing of personal data, the company as an operator is authorized to process personal data only with the consent of the data subject.

The company obtains the consent of the person concerned without any coercion and enforcement, as well as without the threat of denial of a contractual relationship, provided services or obligations arising for the operator from legally binding acts of the European Union, an international treaty to which the Slovak Republic is bound or the law.

In the case of a refusal to provide the company's personal data for purposes necessary for the provision of services or the fulfillment of legal obligations, the company is entitled to alert the person concerned to the possible consequences of the non-disclosure of personal data.

The persons concerned agree that the processing of personal data by the company shall be entrusted by such processing to an intermediary processing personal data on behalf of the company. After the end of the purpose of the processing of personal data, the company will process these legally acquired personal data of the persons concerned within the time limit set by the applicable legislation and in accordance with the company's internal regulations.

Purpose of the processing of personal data of the persons concerned:

The company respects your privacy and treats personal data as confidential.

For the quality of its services, the company needs to know some of the personal data of the people concerned and needs them to provide additional recipients to fulfill their legal obligations and to provide the highest quality services.

The company processes the personal data provided for multiple purposes.

On the one hand, the personal data of jobseekers and the personal data of their employees for personal and payroll purposes and the related statutory obligations resulting from specific legislation.

The company further processes personal data of its clients, customers and business partners in order to secure its business activities, taking into account the interests of its clients, customers and business partners.

The processing of personal data for other purposes in the company does not occur, which means that the company collects, stores and processes only the personal data of the persons concerned that it needs in order to fulfill its services. The personal data provided are strictly protected against misuse by third party unauthorized entities by the means documented in the adopted security project and the security directive under the Personal Data Protection Act.

When processing the personal data of the persons concerned, the company respects the basic obligations of the controller under the Act on the Protection of Personal Data, which includes the following obligations.

The personal data provided by the company always use a predetermined purpose of processing that is clear, clearly defined and concrete, in accordance with the Constitution of the Slovak Republic, the constitutional laws, laws and international treaties to which the Slovak Republic is bound.

The company always defines the conditions for the processing of personal data so as not to limit the rights of the person concerned established by law.

The company acquires only the personal data of the persons concerned, which, by their scope and content, correspond to the purpose of the processing and are indispensable for achieving it.

The company ensures that the personal data of the persons concerned are processed exclusively in a way that corresponds to the purpose for which they were collected in advance.

The Company as an operator is obliged to process only correct, complete and, as necessary, updated personal data in relation to the purpose of the processing. Incorrect and incomplete personal data must be blocked by the operator and corrected or supplemented without undue delay, if they can not be corrected or added in order to be correct, the company will clearly mark these personal data and destroy it unnecessarily.

The company ensures that the personal data of the persons concerned are processed in a form which makes it possible to identify individual persons concerned for no longer than is necessary to achieve the purpose of the processing.

The company will, in the prescribed manner, liquidate those personal data whose purpose of processing has ended. At the end of the defined purpose, the company is authorized to process personal data to the extent necessary for research or statistical purposes in an anonymous form. The personal data thus processed can not be used by the operator to support measures or decisions taken against the person concerned to restrict his or her fundamental rights and freedoms.

Mediators:

The Company does not disclose your personal data to third parties in violation of the Personal Data Protection Act and in order to collect them in violation of your interests or instructions and is provided to a third party only for the above purpose.

In its business activities, the company cooperates with a number of intermediaries to provide quality services, while in the performance of their contractual activities for the company they process the personal data of the persons concerned.

The Company honestly declares that, when selecting individual intermediaries, it has taken due account of their professional, technical, organizational and personnel capabilities and their ability to guarantee the security of the processed personal data by the adoption of security measures under the Personal Data Protection Act.

At the same time, the company has chosen to select a suitable broker so as not to endanger the rights and legitimate interests of the persons concerned.

The Company as an Operator concluded with the intermediaries pursuant to the Personal Data Protection Act written contracts for the protection of personal data processed by intermediaries, which they authorized to process the personal data of the affected persons only to the extent, under the terms and for the purpose stipulated in the contract and in accordance with the Act on Personal Data Protection.

Scope and list of processed personal data:

The company processes in its information systems the personal data of the persons concerned to the extent necessary to achieve the intended purpose. This is the scope of personal data provided by specific legislation or within the scope of the consent of the data subject to process his / her personal data.

The company processes only personal data that has been provided to it voluntarily and to the extent necessary by the person concerned. Providing the company's personal data beyond the framework of specific laws is voluntary.

Terms and method of processing the personal data of the persons concerned:

The company processes the personal data of the affected persons in its information systems by automated and non-automated means of processing.

The company does not disclose personal data processed unless it is required by a specific law or by a court or other state authority.

The Company will not process your personal information without your explicit consent or other legal legal basis for any other purpose or to a greater extent than is stated in this information and records of the individual information systems of the operator.

Rights of the data subject related to the processing of his personal data:

The person concerned has the right, upon written request from the company, to require:

• (a) confirmation of whether personal data are processed or processed,
• (b) in a generally understandable form, information on the processing of personal data in the information system in the scope of the Act on Personal Data Protection; when issuing a decision under the Act on the Protection of Personal Data, the person concerned is entitled to become acquainted with the procedure for the processing and evaluation of operations,
• (c) in a generally understandable form, precise information on the source from which it obtained its personal data for the processing,
• (d) in a generally comprehensible form, a list of its personal data which is the subject of processing,
• (e) correcting or liquidating any incorrect, incomplete or outdated personal data that is being processed,
• (f) the liquidation of its personal data whose purpose of processing has ended; if they are the subject of processing, official documents containing personal data, they may request their return,
• (g) the liquidation of its personal data that is being processed, if there has been a violation of the law,
• (h) blocking its personal data by reason of withdrawal of consent prior to expiry of its period of validity if the company processes personal data subject to the consent of the person concerned.

The aforementioned rights of the person concerned pursuant to subparagraphs (e) and (f) may be limited only if such a restriction results from a separate law or its application would undermine the protection of the person concerned or violate the rights and freedoms of others.

Pursuant to the Personal Data Protection Act, the person concerned has the right to object, on written request to the company addressed, against:

• (a) the processing of personal data which it considers to be or will be processed for the purposes of direct marketing without its consent, and to request their liquidation,
• (b) the use of personal data specified in the Personal Data Protection Act for the purpose of direct marketing in postal communications, or
• (c) the provision of personal data specified in the Personal Data Protection Act for the purposes of direct marketing.

According to the Personal Data Protection Act, the person concerned may, at the written request of the company addressed, or personally, if the case does not delay, at any time object to the processing of personal data in cases under the Personal Data Protection Act, by stating reasons or providing evidence of unauthorized interference with its rights and the rights of interest which are or may be impaired in such a case by such processing of personal data; if the legal grounds do not prevent it and it is proved that the objection of the person concerned is legitimate, the company is obliged to block and destroy the personal data the processing of which the person concerned has complained without undue delay as soon as circumstances allow.

Under the Personal Data Protection Act, the person concerned may, at the written request of the company addressed, or in person, if the case does not delay, at any time challenge and refuse to take a decision of a company that would have legal or significant effects on it, based on the automated processing of its personal data. The person concerned is also entitled to request the company to review the decision issued by a method different from the automated form of processing, the company being obliged to comply with the request of the person concerned, in such a way that the decision-maker will have a decisive role in reviewing the decision; on the method of review and the result of the finding, the operator informs the person concerned within the time limit under the Act on the Protection of Personal Data. The person concerned has no right to do so only if a specific law provides for measures to safeguard the legitimate interests of the person concerned or if, in the framework of pre-contractual relationships or during the existence of contractual relationships, the operator has issued a decision to the satisfaction of the person concerned or the operator has taken other appropriate measures under the contract to safeguard the legitimate interests of the person concerned.

Where the person concerned exercises his right:

• (a) in writing and from the content of its application that it exercises its right, the application shall be deemed to have been filed under the Personal Data Protection Act; a request made by electronic mail or fax shall be delivered by the person concerned in writing no later than three days after the date of dispatch,
• (b) in person, by oral proceedings, a record of who is entitled to the right to claim, what is claimed and when and who has drawn up the minutes, his signature and the signature of the person concerned; a copy of the minutes is the company obliged to hand over to the person concerned,
• (c) in the case of an intermediary referred to in (a) or (b), he shall be obliged to hand over such request or minutes to the company without undue delay.

If the person concerned suspects that his personal data is being unduly processed, he may file a petition to initiate the procedure for the protection of personal data at the Office for Personal Data Protection of the Slovak Republic, based in Hraničná 12, 820 07 Bratislava 27, Slovak Republic or contact the Office through its web- http://www.dataprotection.gov.sk.

If the person concerned is not fully entitled to legal action, his / her rights may be exercised by a legal representative.

If the person concerned does not live, his or her rights under this Act may be exercised by a close person.

The request of the person concerned under the Privacy Act is provided by the company free of charge.

The request of the data subject in accordance with the Personal Data Protection Act shall provide the Company, free of charge, in addition to payment of a sum that can not exceed the amount of expense actually incurred in connection with the making of copies, with the incorporation of technical media and the forwarding of information to the person concerned, unless otherwise provided in a special law.

The company is obliged to provide a written request to the person concerned in accordance with the Personal Data Protection Act no later than 30 days after the date of receipt of the application.

Limiting the rights of the data subject under the Personal Data Protection Act, the Company shall notify the data subject and the Personal Data Protection Office of the Slovak Republic in writing without undue delay.

The Company, as the person concerned, has informed you about the protection of your personal data and has informed you of your rights in relation to the protection of personal data within the scope of this written information obligation.