PRIVACY POLICY

This Privacy Policy applies to processing by the Controller of personal data that you (as the other contractual party) provided to the Controller in relation to the execution and performance of the agreement on lease of business premises in the shopping center AUPARK Bratislava, entered into by the Controller as landlord and you as tenant, or another agreement entered into by you as Controller's supplier and the Controller in relation to Controller's business (hereinafter as the "Agreement").

This Privacy Policy also applies to processing by the Controller of personal data of the contact persons of the contractual parties to the Agreement, as further specified in Section 3 below.

1. PERSONAL DATA CONTROLLER

The company AUPARK a. s., with its registered seat at the address Einsteinova 18, 851 01 Bratislava, Business ID. 47 240 377, registered in the commercial register maintained by City Court Bratislava III, section Sa, file No. 5586/B (hereinafter as the "Controller"), as the personal data Controller, hereby informs you about processing of your personal data and about your related rights.

Contact details of the Controller are: AUPARK a. s., Einsteinova 18, 851 01 Bratislava, e-mail address: veronika.kosicka@urw.com. The Controller did not appoint a data protection officer.

2. EXTENT OF PERSONAL DATA PROCESSING

In case you as tenant or supplier, who at the same time is the data subject (natural person) within the meaning of Art. 4(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council from April 27, 2016 (hereinafter as the "GDPR"), have provided the Controller prior to the execution of the Agreement or during its performance with personal data in the extent of name, surname, company, employment position, phone number, e-mail, other information related to your employment, data regarding the performance of the Agreement, and other related data resulting from the Agreement (hereinafter as the "Personal Data"), then the Controller shall process such Personal Data in the extent necessary for the performance of the Agreement and in compliance with the conditions stated in this Privacy Policy.

We have obtained the Personal Data directly from you. In order to ensure that we process only data that are accurate and up-to-date, we may regularly update the data also from public sources (mainly the commercial register, the trade licensing register, ARES, the insolvency register, your web sites, suppliers' web sites).

3. PROCESSING OF PERSONAL DATA IN RELATION TO YOUR CONTACT PERSONS

In case you are not the data subject (natural person) within the meaning of Art. 4 (1) of the GDPR and/or in case you have provided the Controller, prior to the execution of the Agreement or during its performance, with the personal data of the members of your corporate bodies, of your employees and/or other contact persons (hereinafter as the "Contact Persons") in the extent of name, surname, company, employment position, phone number, e-mail, which data are necessary for the performance of the Agreement and for ensuring an effective communication between the contractual parties to the Agreement, you declare and guarantee to the Controller that you have fulfilled all duties and obligations vis-à-vis such persons as provided by the GDPR and that you have, at the same time, fulfilled all information obligations of the Controller on behalf of the Controller (mainly that you have provided to the Contact Persons the information contained in this Privacy Policy, as well as other information as required under legal regulation, especially in the extent required by Articles 13 and 14 of the GDPR) in order to enable the Controller to process the personal data for the bellow stated purposes.

The Controller shall process only the personal data of the Contact Persons that you provide to him. The personal data of the Contact Persons are processed on the basis of the legitimate interest of the Controller in ensuring an effective communication between the contractual parties.

In compliance with the Contract you undertake to provide the Controller upon its request with evidence on fulfilment of the information obligation vis-à-vis the Contact Persons, or to promptly inform the Controller that the conditions for processing the personal data of the Contact Persons are not fulfilled or that the personal data of the Contact Persons have changed. The processing of the personal data of the Contact Persons shall be governed by the conditions stated in this Privacy Policy.

4. PURPOSE, PERIOD AND LEGAL BASIS OF THE PERSONAL DATA PROCESSING

We process your personal data for the purpose of fulfilment of the contractual obligations under the Contract and a more effective communication between the contractual parties. It follows that the personal data are processed mainly for the following purposes:

• Fulfilment of contractual obligations. Personal data are processed for the purpose of performance of lease, purchase and other agreements, and further also for potential warranty claims related to goods and services and for maintaining records of tenants and/or our suppliers. Data are stored for the whole period of effectiveness of the agreement between us and the other contractual party under the Agreement. Providing of personal data in these cases is an indispensable condition for the performance of the Agreement and without the personal data it is impossible for the Controller to enter into the Agreement or to perform it.
• Effective communication. We process your Personal Data and personal data of the Contact Persons also for the purpose of ensuring effective communication between us and the other party to the Agreement, as well as for the purpose of ensuring an undisturbed operation of the shopping center AUPARK Bratislava during its regular opening hours, including weekends and national holidays (mainly resolving accidents and breakdowns in the areas of such shopping center promptly after their detection, ensuring the security of workers and visitors of this shopping center, preventing damage to the property of the tenants, suppliers and other persons and mitigating the damage already incurred, announcing unplanned shutdowns of this shopping center or its parts due to vis mayor, and operative coordination of leisure and other events organized in this shopping center).
• Accounting records. Some personal data may be stated on the accounting records (mainly invoices). According to valid legal regulation in Slovakia (e.g. Accounting Act, VAT Act), we have obligations to keep these records for the period of 10 years. If we have a legal obligation to archive these records, we archive them together with your personal data stated therein.
• Determination, exercise and defence of legal claims. Following termination of the contractual relationship with you we may store for the duration of time bar periods those of your personal data that are necessary for the protection of our rights and for the potential defence against legal claims, including collection of unsettled payments.

The Controller does not perform automated individual decision-making or profiling within the meaning of Article 22 of the GDPR.

5. CATEGORIES OF PERSONAL DATA RECIPIENTS

Recipients of Personal Data are the company Unibail-Rodamco Česká Republika s.r.o., Business Id.: 438 73 464, with its registered seat at the address Na Příkopě 388/1, 110 00 Prague 1 - Staré Město, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague in the File No. C 5217, and the company Unibail Management S.A.S, with its registered seat at the address 7 Place du Chancelier Adenauer, 75016 Paris, France, registered in the Commercial and Company Register in Paris under No. 414878389. The Controller does not intent to transfer the Personal Data outside the European Union.

The personal data may also be accessed by our suppliers of IT systems and connected services, which are in position of processors of personal data.

Some Personal Data may exclusively by accessed by external auditors, tax advisors and legal representatives, if this is necessary for the enforcement or recording of receivables or for the defence of our legitimate interests. If public authorities in the course of execution of their authority request from us information comprising also the Personal Data, we are obliged under applicable laws and regulation to disclose your Personal Data in the necessary extent.

We have entered into contracts on personal data processing that ensure the same level of protection of your Personal Data as this Privacy Policy, or even higher, with the above mentioned recipients, which are in the position of processors of personal data.

6. DATA SECURITY

We have adopted and follow necessary appropriate technical and organizational measures, internal controls and data security processes in compliance with the best market practice corresponding to the potential risk for you as the data subject. At the same time we take into account the state of technological development with the aim to protect your Personal Data against accidental loss, destruction, alternation, unauthorised disclosure or access. These measures may include adoption of appropriate steps aimed at ensuring liability of employees, who have access to the Personal Data, training employees, regular backups, processes for recovery of data and management of accidents, software protection of devices, on which the Personal Data are stored, etc.

7. RIGHTS OF DATA SUBJECTS

You have the right to request from the Controller rectification of inaccurate Personal Data that concern you or completion of incomplete Personal Data, the right to request restriction of processing (especially if you object to the accuracy of the processed Personal Data, if the processing of the Personal Data is illegal, if the Controller no longer needs the Personal Data, if you have objected against the processing), the right to object or complaint against the Personal Data processing, the right to transfer the Personal Data, the right to demand access to the Personal Data, the right to be informed about breaches of Personal Data security, the right to demand erasure of Personal Data and any other rights granted by applicable laws.

The data subjects, i.e. you and/or the Contact Persons, may exercise their rights at the address veronika.kosicka@urw.com via e-mail or, upon prior agreement, at the contact address of the Controller.

Should you exercise your rights, we may ask you to provide some additional personal data, which you have already provided to us. Providing of such data is necessary for verification whether the demand was actually sent by you. We shall respond within one month after receipt of the demand, however, we reserve the right to prolong this term in complicated cases by additional two months.

You can exercise all your rights by sending an e-mail to veronika.kosicka@urw.com, or if agreed in advance, by contacting the Controller at its contact address.

This document can be revised or updated from time to time.

Last modification on May 21, 2018.