Data Controller

The controller of your personal data within the meaning of the General Data Protection Regulation 2016/679 (“GDPR”) is the companies within the Arbol Group (hereinafter collectively referred to as “Arbol” or “we”). Arbol protects all the personal data that is processed as strictly confidential and treats it in accordance with the applicable personal data protection laws and regulations.

The Arbol companies are joint controllers within the meaning of Article 26 of the GDPR, i.e. they jointly determine the purposes and means of the processing, retention and use (and other processing) of your personal data for conducting their business (the individual purposes for which personal data is processed are further defined below).

We mainly process personal data if

• you are our clients,
• you are interested in the real estate, products or services we offer,
• you subscribe to our newsletter,
• you actively communicate with us,
• you are interested in being a part of our team.

The purposes of the processing and the legal basis for it

We mainly process your personal data if:

• We perform a contract or negotiate the execution of a contract.
  Purpose of the processing: provision of services under an existing contract, preparing the offer of products and services, preparing steps at your request prior to entering into a contract (e.g. preparing a quotation, house tour, etc.).
  Legal basis for the processing: Article 6 (1) (b) GDPR; processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract.
• We comply with a legal obligation.
  Purpose of the processing: compliance with legal obligations, in particular, in terms of accounting and tax legislation.
  Legal basis for the processing: Article 6 (1) (c) GDPR; processing is necessary for compliance with our legal obligations.
• We fulfil our legitimate interests.
  Purpose of the processing: protection of our rights and interests protected by law, e.g. protection of our website and network against misuse, direct marketing, i.e. offering our products and services to our clients.
  Legal basis for the processing: Article 6 (1) (f) GDPR; processing is carried out on the basis of our legitimate interest except where such interests are overridden by your fundamental rights and freedoms.
• We handle your requests and inquiries.
  Purpose of the processing: e.g. the processing of your request for a tour, for additional information, and other requests and inquiries received by email, an online form, by telephone, etc.
  Legal basis for the processing: Article 6 (1) (b) GDPR; taking steps at your request prior to entering into a contract, or Article 6 (1) (f) GDPR; the processing is performed on the basis of our legitimate interest in answering your inquiry or processing your request. 
• We send you commercial messages and personalise the advertisements that are displayed.
  Purpose of the processing: targeted advertising and advanced marketing (e.g. sending commercial messages prepared specifically for you on the basis of the evaluation of your preferences).
  Legal basis for the processing: Article 6 (1) (a) GDPR; you have given us your consent to the processing of your personal data for one or more specific purposes.
  
  

Personal data being processed

Processing of personal data on the basis of your consent

If you give us your consent to the processing of your personal data for the purpose of sending commercial messages and targeted advertising, you acknowledge that your consent is voluntary and can be withdrawn at any time, including by email sent to privacy‌‌M‌‌arbolcapital.cz or by sending a written notice to the address of our registered office at U Hellady 697/4, Michle, 140 00 Praha 4., Czech Republic. The consent is given for the period of five years or until withdrawn.

Personal data retention period

We process and retain your personal data for the time necessary to ensure compliance with all the rights and obligations arising from the relevant contractual relationship and for the period for which we as the controller of the personal data are obligated to retain the data in accordance with the law, or for the period for which you have given us your consent. In other cases, the retention period depends on, and must be appropriate to, the purpose of the processing, or is set by the applicable data protection legislation.

Depending on the purpose of the processing, we process the personal data for the following period:

* We are authorised to process your email address within the meaning of Section 7 (3) of Act No. 480/2004 on certain information society services and on amendments to certain other acts (Information Society Services Act), as amended, with a view to disseminating commercial messages concerning our own products or services (e.g. in the form of a newsletter) unless you have declined to be sent such messages.

Third parties’ personal data

The personal data of third parties, meaning the personal data of our employees, business partners, and other individuals involved in cooperating with us, or other data that we receive from our business partner in association with the conclusion or performance of a contract, shall always be processed in accordance with the GDPR. We will use this personal data only for the purpose of performing contracts with the business partners. The business partner hereby acknowledges that we will process the third party’s personal data for the term of the contractual relationship and beyond for the time specified by special laws and regulations, if any. The data will be retained for a longer period if justified reasons arise for the need to retain the data in connection with a specific case. The business partners shall duly inform their employees and other individuals involved in working with us on behalf of the business partner about such processing.

Who we can disclose your personal data to

Your personal data is disclosed only to the authorised employees and associates or to the individual processors of personal data with whom we have a contract, or to other controllers. They include, for example, processors or controllers who participate in providing services or payments or those who provide us with administrative, transport, communication, software or marketing products and services. However, your personal data can only be disclosed to these entities to the extent necessary for the fulfilment of the individual purposes of the processing under the corresponding legal basis for the transfer and processing of the personal data. The current list of the recipients of personal data is available upon request by email at privacy‌‌M‌‌arbolcapital.cz.

In specific cases defined by law, we may, or have to, transmit some of your personal data in accordance with the applicable laws and regulations, e.g. to law enforcement or other public authorities.

Your rights

Subject to the conditions of the GDPR, you, being a data subject, have and can exercise at any time the following rights in connection with the processing of your personal data:

• the right of access to your personal data according to Article 15 of the GDPR: if you wish to know whether we process your personal data, you have the right to obtain information about this and, if so, to access your personal data;
• the right to rectification of your personal data according to Article 16 of the GDPR: if you believe that we process inaccurate or incomplete personal data about you, you have the right to request rectification or completion;
• the right to erasure of your personal data according to Article 17 of the GDPR: if you request erasure, we will erase your personal data if (i) it is no longer necessary in relation to the purposes for which it was processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for the further processing of your personal data, or (iv) the legal obligation to process the data no longer exists;
• the right to restriction of processing according to Article 18 of the GDPR: if you request the restriction of the processing of your personal data, we will make the personal data unavailable, temporarily remove or retain the data or take other measures to comply with the request;
• the right to data portability according to Article 20 of the GDPR: if you want us to transfer the personal data we keep about you in electronic form on the basis of a contract or your consent to a third party, you can exercise your right to data portability; if the exercise of this right adversely affects the rights and obligations of other persons, we will not be able to comply with your request;
• the right to object to processing according to Article 21 of the GDPR: you can object to the processing of your personal data that we process for the purpose of protecting our legitimate interests.

You also have the right to withdraw your consent to the processing of your personal data if you have given us this consent.

You can exercise your rights by email at privacy‌‌M‌‌arbolcapital.cz or by sending a written notice to U Hellady 697/4, Michle, 140 00 Praha 4, Czech Republic. You can also use the contact details provided above if you have any questions or comments regarding the processing of your personal data.

The protection of your privacy and personal data is supervised by the Office for Personal Data Protection.
Address: Pplk. Sochora 27 170 00, Praha 7, Czech Republic
Tel: 234 665 111
web: www.uoou.cz

This Privacy Policy is effective from 31 May 2021 and is regularly updated; last updated in February 2022.