In case you are providing your personal data, we as a data controller or processor:

  1. HB Reavis Construction UK Ltd., having its registered seat at Level 7 of 33 King William Street, London, EC4R 9AS, United Kingdom, ID No.: 08917100
  2. HB Reavis UK Ltd., having its registered seat at Level 7 of 33 King William Street, London, EC4R 9AS, United Kingdom, ID No.: 08493236
  3. HubHub UK Ltd., having its registered seat at Level 7 of 33 King William Street, London, EC4R 9AS, United Kingdom, ID No.: 11257204
  4. HB REAVIS INVESTMENTS UK Ltd., having its registered seat at Level 7 of 33 King William Street, London, EC4R 9AS, United Kingdom, ID No.: 13794984 (hereinafter referred to as the “HB Reavis” or “we”)

would like to inform you about the processing of your personal data and of your rights related to the said processing.

The Controller is part of the HB Reavis Group, which consists of all entities consolidated under the group holding HB Reavis Holding S.A. with its headquarters in Luxembourg due to which the reference to HB Reavis Group may be found in the Privacy Notice (hereinafter referred to as the “HB Reavis Group “).

If you are in one of our buildings, in their immediate vicinity (as a visitor, employee or for any other purpose) or visit websites, apps or social media related to our buildings or are interested in working for us, your personal data may be processed for the following purposes:

  1. Selection of potential employees.
  2. Ensuring the safety of visitors and users of the building as well as the protection of the building and property
  3. The acceptance, processing, and handling of complaints
  4. The issuing of entry cards
  5. Mutual communication
  6. The sending of reminders
  7. Promotion of our events
  8. The operation of a “help desk”
  9. The administration of incidents in our buildings
  10. Sending of newsletters
  11. Organization and administration of an event.
  12. Assessing the clients’ experience (Net Promoter Score)
  13. The “More by HB Reavis” application
  14. Performance of customer due diligence (CDD)
  15. GDPR complaints
  1. Selection of potential employees.

Description of our purpose and legitimate interests:

In case of vacant position at HB Reavis, we look for the best fit to fill in this vacancy. When doing that, we collect the CVs from the applicants directly or from third persons recommending the potential applicant. After reviewing the CVs of the applicants, we invite them for personal interviews after which we send them follow-up information. If you are submitting your CV proactively (i.e. not for an open position) or would still like to hear from us after we have completed the recruitment process for an open position, we may, with your consent, store your CV for the purpose of contacting you in the future regarding the job opening.

What is our legal basis for the processing of your personal data?

If you send us your CV regarding the specific vacant position, we process your personal data on the basis of the performance of a contractual relationship and your request prior to entering into a contract under Article 6 (1) (b) of UK GDPR (in case of failure to provide us with the personal data, we cannot enter into a contract with you). If you want us to keep your CV in our database, we process your personal data on the basis of a consent under Article 6 (1) (a) of UK GDPR. By granting the consent you further acknowledge that you can withdraw the consent electronically by clicking on “Privacy Management” on our web page. Here you can withdraw the consent before the lapse of the time you granted it for, i.e., at any time. Withdrawal of the consent is without prejudice to the lawfulness of our processing of your personal data prior to such withdrawal.

What kind of personal data do we process?

Personal data included in the CV (such as name, surname, date of birth, address, e-mail, phone number etc.).

How long do we store your personal data?

In case of applying for particular vacant position, we store your personal data until the end of the recruitment process. If you give us your consent to store your CV for future vacant positions, we store it for 2 years.

  1. Ensuring the safety of visitors and users of the building as well as the protection of the building and property

What is our purpose for and legitimate interest in processing your personal data?

The protection of our buildings and the safety of the people using our buildings are the key elements and the number one priority in our business activities. For us to be able to ensure the proper level of protection and safety, we installed a video monitoring system (CCTV). When entering the buildings or if you are near them, the CCTV might record you. If you enter the building or garage, we will process your personal data in the following ways:

  1. We scan your vehicle licence plate number (LPNo) if you use the intercom system located at the ramp.
  2. We scan your LPNo if the LPNo recognition technology for the automatic opening on the ramp for authorised vehicles is used in conjunction with the vehicle or enter the garage using an entry card.
  3. We scan your LPNo when opening the ramp in order to ensure free parking. Once the free parking period expires, we process this data in order to determine the exact parking fee.
  4. We collect data regarding the entry card upon entry and departure through contact points in the building, i.e., from the public part to the private part of the building, so that we ensure access for authorised persons only.
  5. We produce your visual images by means of an installed CCTV camera system, which records the internal spaces of the building, the parking lot and part of the area outside the building.
  6. In case you are visiting the premises of the building or attending an event organized by one of the tenants at the building we need to register you at the reception for safety and protection purposes. While registering you at the reception, we need to process your personal data as we want to fulfill our purpose and legitimate interests to the fullest.

What is our legal basis for the processing of your personal data?

We process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR for the protection of our rights and interests and for ensuring security in our premises.

What kind of personal data do we process?

  1. A photograph of your LPNo.
  2. A photograph of your LPNo.
  3. A photograph of your LPNo.
  4. Card number, place, and entry time.
  5. A visual image of you.
  6. Name, surname, ID number, identification of the tenant (if attending a tenant’s event) and date and time of the entry.

How long do we store your personal data?

  1. We store your personal data for 7 days.
  2. We store your personal data for the duration of the accounting year
  3. We store your personal data for 6 months.
  4. We store your personal data for 6 months.
  5. We store your personal data captured by cameras located in the building or in the parking lot and on the outside of the building for 15 days.
  6. We store your personal data for 90 days.
 
  1. The acceptance, processing, and handling of complaints

What is our purpose for and legitimate interest in processing your personal data?

In each lift in the building, as well as at the entrance to the garage, there are voice communicators through which it is possible to contact the central security desk of the building in real time should a problem arise. These calls are recorded so that in case of a complaint associated with the handling of a problem, we have an audio recording of the given event available.

What is our legal basis for the processing of your personal data?

In the cases of the acceptance, processing, and handling of complaints, we process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR.

What kind of personal data do we process?

An audio recording of the complaint or call.

How long do we store your personal data?

We store your personal data for 15 days.

  1. The issuing of entry cards

What is our purpose for and legitimate interest in processing your personal data?

For us to permit you to enter the premises of your employer, we will issue you an entry card that grants you access to the restricted premises of the building.

What is our legal basis for the processing of your personal data?

We process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR to issue entry cards.

What kind of personal data do we process?

Name, surname, and the business name of your employer

How long do we store your personal data?

For the duration of your contractual relationship with our tenant or the duration of the rental relationship, whichever relationship ends first.

  1. Mutual communication

What is our purpose for and legitimate interest in processing your personal data?

Our philosophy is to always be open and transparent. This includes being open to communication from any person interested in us. To fulfil this goal, we created several types of contact forms that can be used to contact us. Additionally, we have also published the email addresses of employees working for us so you can contact them at any time with any questions related to our buildings or business activities and the business you may have. However, to ensure effective, flawless, and clear communication, we must process some of your personal data.

Moreover, when executing the sales/leasing process with our (potential) clients we strive to maintain very effective and transparent communication canal. To fulfil this purpose, we use the CRM database filled with contact data (including personal data) of our (potential) clients or their employees. We do this to ensure effective and flawless communication with the (potential) clients and to build a database consisting of all our business partners.

What is our legal basis for the processing of your personal data?

If you contact us or any employee via email or a web-based form, we process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR.

What kind of personal data do we process?

Name, surname, email address and phone number. For the purposes of the CRM database, in addition to the aforementioned data, we also process job title and employer identification data.

How long do we store your personal data?

We keep your personal data until you unsubscribe from our contact database.

  1. The sending of reminders

What is our purpose for and legitimate interest in processing your personal data?

We also process your personal data for the purpose of sending reminders related to unsent webpage forms. Whenever you start filling out any webpage form published on our website, we automatically process the personal data you fill in. In some cases, you might forget to send the form. Therefore, we use the automatically saved personal data to remind you to finish filling out the form or to send the filled-out form.

What is our legal basis for the processing of your personal data?

We process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR to send you reminders related to unsent webpage forms.

What kind of personal data do we process?

Personal data requested by the webpage form (such as name, surname, email, phone number, etc.).

How long do we store your personal data?

We store your personal data for 30 days.

  1. Promotion of our brand, goodwill, services, and events

What is our purpose for and legitimate interest in processing your personal data?

Furthermore, we may process your personal data by taking photographs and audio-visual recordings, which are used for the purpose of and legitimate interest in the promotion of our events and services and to help us improve our brand and goodwill by publishing the photographs (where it is possible that you will appear) and audio-visual recordings on our social media profiles such as YouTube, LinkedIn, Facebook, Twitter and Instagram, as well as via other channels such as our websites.

What is our legal basis for the processing of your personal data?

We process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR.

What kind of personal data do we process?

Photographs or/and audio-visual images of you. In the case of private events, also your name, surname and email address will be processed.

How long do we store your personal data?

We may process your personal data for the entire existence of the HB Reavis Group.

  1. The operation of a “help desk”

What is our purpose for and legitimate interest in processing your personal data?

We process your personal data to ensure that our contractual obligations arising from the contract with a third party (our tenant and the company on whose behalf you are acting), in which you are in the position of the contact person, are effectively fulfilled. Based on the contract with your employer, we provide a help desk application for reporting issues in connection with the building in which the offices of your employer are situated. To properly use the application, you or your employer provided us with your personal data, as you are the designated person for communication in the application. We need to process your personal data to ensure effective, flawless, and clear communication, as well as to ensure the fulfilment of our obligations towards the companies on whose behalf you are acting.

What is our legal basis for the processing of your personal data?

We process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR.

What kind of personal data do we process?

Title, name, surname, position, place of work, signature, email address, phone number, the identification information of your employer.

How long do we store your personal data?

During your contractual relationship with our tenant or the duration of the rental relationship, whichever relationship ends first.

  1. The administration of incidents in our buildings

What is our purpose for and legitimate interest in processing your personal data?

Your personal data is processed for the purpose of the administration of incidents that occur in our buildings, such as car accidents in the parking lot, etc. When such an incident occurs, it is necessary to fill out an incident form for insurance purposes and other legal matters.

What is our legal basis for the processing of your personal data?

Your personal data is processed during the insurance event in accordance with Article 6 (1) (f) UK GDPR, i.e., we process your personal data on the basis of legitimate interests.

What kind of personal data do we process?

The requested data on the insurance form.

How long do we store your personal data?

We store your personal data only during the time that it is strictly necessary to deal with the insurance event.

  1. Sending of newsletters

What is our purpose for processing your personal data?

We also process your personal data for the purpose of direct marketing. To ensure the promotion of our products and services, improving our brand and goodwill we will provide you with our newsletters, invitations to our events, marketing alerts and follow-up marketing materials via the various available channels such as email marketing communication, SMS messages, pop-up windows, online remarketing ads (Google Ads, Facebook ads, native ads…).

Moreover, we will be sending information regarding the ongoing construction of our buildings in your neighborhood. This information will mainly concern the current state of construction, planned progress or associated constraints. Moreover, we will provide you with HB Reavis Group marketing activities related to the above-mentioned construction. When building our projects, we realize that it also affects the neighborhoods around the construction site. Therefore, we strive to have the best possible relationship with the residents living around the construction site. In order to achieve that, we maintain the transparent communication in which we share all the information regarding the construction.

What is our legal basis for the processing of your personal data?

We process your personal data based on consent under Article 6 (1) (a) of UK GDPR.

What kind of personal data do we process?

Name, surname, email, and phone number.

How long do we store your personal data?

If you give us consent to provide you with our marketing content and newsletter, we store your personal data until you unsubscribe from our consent database. By granting the consent you further acknowledge that you can withdraw the consent electronically by clicking on “unsubscribe” in any of our e-mail sent to you or by clicking on “Privacy Management” on our web page. Here you can withdraw the consent before the lapse of the time you granted it for, i.e., at any time. Withdrawal of the consent is without prejudice to the lawfulness of our processing of your personal data prior to such withdrawal.

  1. Assessing the clients’ experience (Net Promoter Score)

What are our purpose and legitimate interests for the processing of your personal data?

After we lease/sell our offices/building we evaluate the clients’ experience and happiness with our business relationship and with the leased/sold offices/building by collecting surveys from the clients or their employees (i.e., Net Promoter Score).

What is our legal basis for the processing of your personal data?

We process your personal data on the basis of the legitimate interests under Article 6 (1) (f) of UK GDPR.

What kind of personal data do we process?

We process name, surname, e-mail address, phone number, position, and identification of the employer.

How long do we store your personal data?

We only process your personal data for the time strictly necessary to carry out the assessment.

  1. Organization and administration of an event.

Description of our purpose and legitimate interests:

Your personal data is processed for the purpose of ensuring your attendance at the event (e.g., processing of your personal data during the ticket purchase or for sending the invitation) and administration of matters regarding the event. This purpose includes mainly efficient communication relating to the event, proper performance of the event, providing you with the notices about the event, collecting feedback, notification about the changes, ensuring the examination of your complaint or claim, carrying out our obligations arising from our mutual contract and for verification process.

What is our legal basis for the processing of your personal data?

We process your personal data on the basis of the performance of a contract or pre-contractual relations in accordance with Article 6 (1) (b) of UK GDPR. The conclusion and the fulfillment of the contract are possible only if we can process your personal data. In case that the personal data is not provided, we will not be able to enter the contract with you and so to provide your attendance at the event.

What kind of personal data do we process?

Name, surname, e-mail, and telephone.

How long do we store your personal data?

We only process your personal data for the time strictly necessary to ensure the organization and administration of our event.

  1. The “More by HB Reavis” application

For more information on how we process your personal data when you use the More by HB Reavis app, please click here.

  1. Performance of customer due diligence (CDD)

Description of our purpose and legitimate interests:

Performance of customer due diligence (CDD) procedures are required to comply with regulation, especially in the area of Anti-money laundering and counter-terrorism financing (AML-CTF), including for example your identification and/or verifying your identity and other data required by law.

What is our legal basis for the processing of your personal data?

Legal basis for processing of your personal data in connection to CDD procedure is legal obligation under Article 6 (1) (c) of UK GDPR.

In case that the personal data are not provided, the transaction / business cannot be completed.

What kind of personal data do we process?

Name, surname, e-mail, date of birth, place of birth, birth number, residential address, citizenship, identification document (such as passport, driving license, utility bill and bank statement), function, signature, financial information (such as taxes, wealth, source of finances etc.)

For how long we will process your data?

Since the statute-barred period applies, HB Reavis is obliged to store your personal data from 5 to 10 years after the termination of the contractual relationship with you or after the completion of the transaction.

  1. GDPR complaints

What are our purposes for the processing of your personal data?

We strive to protect your privacy as much as possible, and therefore we process your personal data in compliance with UK GDPR and all other relevant laws. However, if you disagree with the way we handle your personal data, you can exercise your rights via our Data Protection Officer. To ensure that your complaint is handled, some of your personal data has to be processed.

What is our legal basis for the processing of your personal data?

Your personal data is processed while handling your complaint in accordance with Article 6 (1) (c) UK GDPR, i.e., the processing is necessary for compliance with a legal obligation to which our company is subject.

What kind of personal data do we process?

Personal data provided by you when submitting the complaint (such as name, surname, email, phone number, etc.).

How long do we store your personal data?

We store your personal data strictly during the time necessary to deal with the complaint.

Further information in relation to the processing of personal data

Once we no longer need your personal data for the purposes for which we processed it, we will delete your personal data or archive it for the period of time specified by law or the archiving plan.

With whom do we share your personal data?

We may also share your personal data with companies within the HB Reavis Group or with our business partners with whom we have entered a contract due to their status as processor, controller, or joint controller. We may also be obliged to disclose your personal data to state authorities and public authorities, (courts and law enforcement authorities i.e. (police and prosecutor), and only to the extent necessary as required by applicable and effective law to exercise their power..

In addition to the companies listed above, we use the following categories of intermediaries: data centres, hosting – marketing tools – analysis and tracking tools – events, surveys – business operations / management tools – task management and communication tools.

We use analytical and marketing tools (e.g. Google Analytics, Facebook Pixel, LinkedIn Pixel, Hotjar, Luigi´s Box, HubSpot) that collect third-party cookies. The information about your use of websites (including your IP address) generated by the cookies will be transmitted to and stored by the above-mentioned companies also on servers in the United States. We will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. These companies will not associate your IP address with any other data held by them. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do this you may not have full functionality of this website. By using our websites, you acknowledge that the above-mentioned companies may process data in the manner and for the purposes set out above.

The processing of personal data together with social media platforms

HB Reavis and (i) facebook.com and (ii) instagram.com, (iii) linkedin.com, (iv) youtube.com, (v) pinterest.com, (vi) spotify.com, (vii) apple music, (viii) Amazon music, (ix) SoundCloud.com, (x) Deezer.com, (xi) Tidal.com, (xii) Google play as the controllers of the relevant social media platforms, may in certain cases also process the personal data of data subjects to a limited extent or in the necessary extent as joint controllers. When using the services provided by these operators of social media platforms, HB Reavis accesses the conditions of the operation of this website and has no or only a minimal impact on changing these conditions.

HB Reavis is currently using so-called social plugins from the above-mentioned operators of social networks, which are indicated by their logos on our website. When you visit our website, your browser establishes a direct connection with the servers on which these plugins run. The content of the plugins is transferred directly by these operators of social media platforms to your browser, which then integrates it into our website. The integration of the plugins causes these operators of social media platforms to receive the information that you have accessed on the corresponding page of the HB Reavis website. If you are logged in with your social media platform account, the social media platform providers will be able to assign your visit to your account on these social networks. Please note that an exchange of this information already takes place when you visit our website regardless of whether you interact with the plugin or not. If you do not want these operators of social media platforms to gather data about you via our website, you must log out of them before visiting our website. Various functionalities and tools are made available to the data subject by each social media platform provider so the data subject can manage his/her preferences for displaying advertisements and sending messages with advertising content, or the data subject can exercise his/her right guaranteed by UK GDPR. HB Reavis has no impact on such processing (it may not disable or enable such processing as part of the operation of its sites or media channels) – the creation of site or media channel statistics by the relevant social media platform operators (see above) for HB Reavis. The webpage’s statistics are generally based on personal data collected in connection with the visit or the interaction of the data subject with the site or media channel and its content. Within the functionality of webpages and media channels, HB Reavis can be acquainted with these statistics and deal with them. If you do not want these operators of social media platforms to collect information about you through our website, you must log out of them before visiting the website. For more information about how these social networks process your personal data, please see their privacy policy:

Facebook: https://www.facebook.com/privacy/explanation

Instagram: https://help.instagram.com/155833707900388

LinkedIn: https://cz.linkedin.com/legal/privacy-policy?

Youtube, Google play: https://policies.google.com/privacy?hl=sk#infocollect

Pinterest: https://policy.pinterest.com/en/privacy-policy

Spotify: https://www.spotify.com/us/legal/privacy-policy/

SoundCloud: https://soundcloud.com/pages/privacy

Amazon music: https://www.amazon.com/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ

Apple music: https://www.apple.com/legal/privacy/data/en/apple-music/

Deezer: https://statics-music-analytics.deezer.com/extra/privacypolicy

Tidal: https://tidal.com/privacy

From whom do we get the personal data?

We get the personal data from you, your employer or third party.

Do we use automated individual decision-making?

No, we do not use automated individual decision-making.

Do we transfer your personal data to third countries?Your personal data are processed within the territory of the United Kingdom and within the states of the European Union (which fall under the UK adequacy regulations). Your personal data can be processed by a country outside of the United Kingdom if this third country has been confirmed by the ICO as a country with adequate level of data protection or if other appropriate data protection safeguards exist (for example, binding corporate privacy rules or Standard contractual clauses, approved code of conduct).

What are your rights?

Your rights as a data subject are stated below. Please note that the exact conditions to exercise these rights are set out in detail in Chapter III of UK GDPR, while in a particular circumstance not all rights may be exercised. You have following rights:

  • Access to personal data we process about you
  • Rectification of incorrect or inaccurate personal data and add incomplete personal data
  • Restriction, i.e., blocking of processing of your personal data
  • The deletion of personal data in case the purpose absence or unauthorized data processing
  • Submission of an objection to the processing of personal data if you believe that our data processing is not justified
  • Be excluded from automated decision-making
  • Listing of personal data in a structured and machine-readable format or for another controller
  • Revocation of consent to the processing of personal data
  • To lodge a complaint with the supervisory authority
  

How can you exercise your rights?

Electronically: dataprivacy@hbreavis.com

In writing to the address: Level 7 of 33 King William Street, London, EC4R 9AS, United Kingdom, at hands of: legal department, or to HB Reavis Group s. r. o., at hands of: compliance department Mlynské Nivy 16, 821 09 Bratislava, Slovak Republic

Telephone: +421 918 723 243

We strive to protect your privacy as much as possible and therefore we process your personal data in compliance with UK GDPR and all other relevant laws. However, if you disagree with the way we handle your personal data, you can exercise your rights via our Data Protection Officer at:

Data Protection Officer’s contact: Erika Wild, contact point at Twin City C, Mlynské Nivy 16, 821 09 Bratislava, Slovak Republic, tel. +421 918 723 243, email: dataprivacy@hbreavis.com

Or you can file a complaint in supervising authority regarding the processing of your personal data. Your local supervisory authority may be found at: https://ico.org.uk/