Terms and Conditions
1. GENERAL INFORMATION
Cordia UK Property Limited (the “Company”) processes information in connection with third parties, contact persons of its business partners that work with the Company and other individuals, such as consumers (collectively: “individuals”). This information qualifies as “personal data” as defined in point 1 of Article 4 of the General Data Protection Regulation 2016/679 of the EU (“GDPR”).
This data protection notice (“Notice”) provides information regarding the processing of this personal data and the rights and remedies of the individuals with regard to said data processing.
Contact details of the Company:
The registered seat of the Company: 22a Great Hampton Street, Birmingham, B18 6AH
The registration number of the Company: 12796392
The Company is incorporated in England and Wales
The telephone number of the Company: +44 121 28 58 100
The e-mail address of the Company: [email protected]
The website of the Company: https://cordia.uk/
The representative for the Company and his / her contact details: Brigitta Darida, [email protected]
2. UPDATES AND AVAILABILITY
The Company reserves the right to unilaterally modify this Notice with immediate effect subsequent to such modification, subject to the limitations provided for by law and the requirements of advance notification to the individuals in due time, if necessary. The Company may modify this Notice, particularly when it is required as a result of changes in the laws, the practice of the data protection authority, business needs or employees’ needs, any new activity involving personal data processing or any newly revealed security exposures, or if it is deemed necessary because of individuals’ feedback. When communicating in relation to this Notice or privacy issues, or otherwise keeping in contact with individuals, the Company may use the contact details of individuals available to the Company in order to get or keep in contact with individuals. Upon the request of an individual, the Company will, for example, send a copy of the latest updated version of this Notice to individuals or certify that a certain individual has read the Notice.
3. SPECIFIC DATA PROTECTION TERMS
In certain cases, specific privacy-related terms and conditions may also be applicable to certain individuals; said individuals will be duly notified thereof. Such specific terms and conditions are provided for in connection with the operation of electronic surveillance systems (i.e. cameras), the entry-control systems operated in the offices of the Company, and cookies that are used on the website of the Company.
In each case, individuals are obliged to make the relevant personal data available to the Company in accordance with the applicable laws. Individuals shall especially be in possession of adequate and informed consent, or any other appropriate legal basis, for making personal data available to the Company (for example if the data of contact persons and family members are given). If the Company becomes aware that any personal data of a data subject was disclosed without his/her consent or any other appropriate legal basis, then the Company may immediately delete such personal data, and the data subject is also entitled to exercise the rights and remedies set forth in this Notice. The Company will not be liable for any loss or harm which may arise from any breach of the above undertaking and representation of any individual.
4. SCOPE OF THE DATA AND THE PURPOSE OF ITS PROCESSING
The table below describes the scope of the processed personal data, the purposes, the legal basis, the duration of the processing and the scope of the persons authorised to have access to the data. Where a purpose of processing is required for pursuing a legitimate interest of the Company or any third party, then the Company will perform a balancing test of the underlying interests, which is available upon a request submitted to the Company by means of the contact details listed hereinabove.
The Company expressly wishes to draw the attention of the individuals to their right of objection to the processing of their personal data on grounds relating to their particular situation at any time where the processing is based on a legitimate interest, including cases where the processing takes the form of profiling. In such cases, the Company shall cease to process the personal data unless it can prove that the processing has to be continued due to compelling legitimate reasons which override the interests, rights and freedoms of the individuals, or which relate to the submission, the enforcement or the protection of legal claims. If personal data is processed for the purpose of direct marketing, individuals may at any time object to the processing of their personal data for that purpose. Said grounds for objection include profiling if it is connected to direct marketing.
| Purpose of the processing | Legal basis of the processing | Scope of processed data | Data retention period, access rights, data transfers |
| Getting in touch with individuals to discuss residential and investment opportunities | Article 6 (1) (f) of the GDPR (processing of the data is needed for pursuing the legitimate interests of the Company).The legitimate interest: providing information to individuals (upon their request at the website) on the Company’s activities, in particular, residential and investment opportunities. | Name and email address of the individuals, and their message. Optionally, individuals can also provide their telephone number.The Company can receive the above data directly from the individuals, or from Connells Residential. Connells Residential provides estate agency services and acts as independent data controller which means that it may determine the purpose of data processing independently, and make decisions and implement them, in accordance with its own terms and conditions of data processing.
|
|
| Article 6 (1) (a) of the GDPR – voluntary consent of the individuals.
|
Name, telephone number and email address of possible recipients. | ||
| Sending advertisements and newsletters by email. Newsletters include updates, new information, surveys and similar communications. | Consent may be withdrawn at any time, without limitation and reasoning, free of charge. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Without consent, the Company is not permitted to send out advertisements and newsletters by email. |
The Company can receive the above data directly from the individuals, or from Connells Residential. Connells Residential provides estate agency services and acts as independent data controller which means that it may determine the purpose of data processing independently, and make decisions and implement them, in accordance with its own terms and conditions of data processing.
|
If an individual withdraws consent, then personal data has to be deleted. |
| Processing the personal data of contact persons of contracting partners and/or persons involved in contract performance / verification of performance (i.e. day-to-day implementation of contracts). This includes e.g. the processing of postal addresses of contact persons, their payment instructions, like the payment of registration fees, or the sending official notifications with the use of the contact details and information regarding contractual obligations to be fulfilled. | It depends on whether a contract is concluded with the individual (e.g. a private entrepreneur) or with any other undertaking; it is Article 6 (1) (b) of the GDPR – _ the purpose is directly the performance (implementation) of the contract to which the individual is subject / it is Article 6 (1) (f) of the GDPR – pursuing the legitimate interests of both the Company and the contracting partner: fulfilling the obligations, exercising the contractual rights and synchronising business cooperation between the contracting parties.The exchange of personal data is required under the contract; without them, the Company is unable to conclude the contract and/or implement it.
|
The contact details (i.e. e-mail addresses, telephone numbers, mobile phone numbers, telefax numbers) of the contact persons of the contracting partners and/or persons involved in contract performance and verification of performance, and any other activity of or communication which includes any kind of personal data (e.g. communication received from a contact person or any other person acting on behalf of a contracting partner) in connection with the contract.The personal data are either provided to the Company by the contracting partner, or the individuals themselves. | |
| Processing the personal data of contact persons of contracting partners and/or persons involved in contract performance and verification of performance in connection with compliance issues or any other activity needed to implement the contract including seeking remedies in order to enforce the rights arising from the contracts | The legal basis of processing data is the legitimate interest of the Company (Article 6 (1) (f) of the GDPR). The legitimate interest: handling compliance issues or any other activity needed to implement the contract including seeking remedies in order to enforce the rights arising from the contracts. | The contact details (i.e. e-mail addresses, telephone numbers, mobile phone numbers, telefax numbers) of the contact persons of the contracting partners and/or persons involved in contract performance and verification of performance, and any other activity or communication which includes any kind of personal data (e.g. any communication received from a contact person or any other person acting on behalf of a contracting partner) in connection with the contract.The personal data is provided to the Company either by the contracting partner or the individuals themselves. |
5. DATA PROCESSSORS
The Company engages the following contractual partners for carrying out tasks related to data processing operations in addition to the ones listed above. Such contracting parties act as so-called “data processors” (i.e. they process the personal data defined in this Notice on behalf of the Company).
The Company should only use data processors that provide sufficient safeguards, in particular in terms of expertise, reliability and resources, for the implementation of technical and organisational measures which ensure that the requirements of the GDPR are met. Said safeguards should include the security of processing. The particular tasks and liabilities of the data processor are provided for in the data processing agreement made between the Company and the data processor. After the completion of the processing on behalf of the Company, the processor shall, at the choice of the Company, return or delete the personal data, unless there is a requirement to store the personal data under European Union or Member State law to which the processor is subject.
| Data processor | Tasks |
| Accounting provider | Provides accounting services. |
| Robin Whiting
0121 274 0378 |
Provides IT services. |
6. DATA TRANSFERS TO OTHER DATA CONTROLLERS
The Company transfers personal data to the following companies listed in the table below.
These companies act as independent data controllers which means that they may determine the purpose of data processing independently or jointly with others, make decisions and implement them, or have them implemented by a data processor engaged for that purpose. The recipients of data transfers act as independent data controllers in accordance with their own terms and conditions of data processing; the Company has no control over this. Individuals may obtain more detailed information from these companies about the data processing they carry out.
| Recipient of data transfers
|
Activities
|
| Jobsons Solicitors Limited
|
Provision of legal services |
| 4 North Courtyard
Dunston Business Village |
Legal basis of the data transfer: Article 6 (1) (f) of the GDPR (processing data is needed for pursuing the interests of the Company). The legitimate interest: obtaining legal advice in the course of its day-to-day operations.
|
| Cordia Management Szolgáltató Korlátolt Felelősségű Társaság | Provision of strategic advice on sales operations.
|
| 1082 Budapest, Futó utca 47-53. VII. em. | Legal basis of the data transfer: Article 6 (1) (f) of the GDPR (processing data is needed for pursuing the interests of the Company). The legitimate interest: discussing sales opportunities within the Cordia company group. |
7. DATA PROTECTION RIGHTS AND REMEDIES
7.1 Data protection rights and remedies
The detailed rights and remedies of the individuals are set forth in the applicable provisions of the GDPR (especially in Articles 15, 16, 17, 18, 19, 20, 21, 22, 77, 78, 79, 80, and 82 of the GDPR). The summary set out below describes the most important provisions and the Company provides information for the individuals in accordance with the above articles about their rights and remedies related to the processing of personal data.
The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the individual, information may also be provided orally, provided that the identity of the individual is verified by other means.
The Company will respond without unreasonable delay to the request of an individual in which such person exercises his/her rights about the measures taken upon such request (see Articles 15-22 of the GDPR), with said response by no means to occur later than one month after receipt thereof. This period may, if needed, be extended for a further two months in light of the complexity of the request and the number of requests to be processed. The Company shall notify the individual about the extension and also indicate its grounds therefor within one month of the receipt of the request. Where the request has been submitted by electronic means, the response should likewise be sent electronically, unless the individual requests otherwise.
If the Company does not take any measure upon the individual’s request, it shall so notify the individual without delay, but by no means later than one month after receipt thereof, stating why no measures will be taken. Additionally, the Company shall inform the individual about the individual’s right to lodge a complaint with the data protection authority and to file an action for remedy with the courts.
7.2 The individual’s right of access
The individual has the right to obtain confirmation from the Company with regards to whether or not personal data concerning them is being processed. In such a case, the individual is entitled to have access to the relevant personal data and to the following information:
a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipient to whom the personal data has been or will be disclosed, specifically including recipients in third countries and/or international organisations;
d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
e) the right of the individual to request from the Company rectification or erasure of personal data, or restriction of processing of personal data concerning the individual, or to object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) where the personal data is not collected from the individual, any available information as to its source.
(2) Where personal data is forwarded to a third country, the individual is entitled to obtain information concerning the adequate safeguards of the data transfer.
(3) The Company provides a copy of the personal data undergoing processing to the individual. The Company may charge a reasonable fee based on administrative costs for requested further copies thereof. Where the individual submitted their request by electronic means, the information will be provided to them in a commonly used electronic form unless otherwise requested by the data subject.
7.3 Right to rectification
The individual has the right to request that the Company rectify inaccurate personal data which concerns them without undue delay. In addition, the individual is also entitled to have incomplete personal data completed e.g. by a supplementary statement or otherwise.
7.4 Right to erasure (‘right to be forgotten’)
(1) The individual has the right to request that the Company erase the personal data concerning them without delay where one of the following grounds applies:
(a) the personal data is no longer required for the purposes for which it was collected or otherwise processed by the Company;
(b) the individual withdraws consent on which the processing is based, and there are no other legal grounds for the processing;
(c) the individual objects to the processing and there are no overriding legitimate grounds for the processing;
(d) the personal data has been unlawfully processed;
(e) the personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the Company is subject;
(f) the collection of the personal data occurred in connection with the offering of services regarding the information society.
(2) If the Company has made the personal data public and it is later obliged to delete it as a result of the above stated grounds, it will take reasonable steps to delete it, taking into account the available technology and the costs of implementation. These reasonable steps include technical steps in order to inform processors who carry out processing that the individual has initiated a request for the links leading to the relevant personal data, or the copies or reproductions thereof, be deleted.
(3) Paragraphs (1) and (2) shall not apply to the extent that processing is necessary, among other things, for:
a) exercising the right of freedom of expression and information;
b) compliance with a legal obligation which requires processing by European Union or Member State law to which the Company is subject;
c) archiving purposes in the public interest, scientific or historical research purposes or statistical purposes insofar as the right referred to in paragraph (1) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
d) the establishment, exercise, or defence of legal claims.
7.5 Right to restriction of processing
(1) The individual has the right to obtain a restriction of processing from the Company where one of the following applies:
a) the accuracy of the data is contested by the individual, for a period enabling the Company to verify the accuracy of the personal data;
b) the processing is unlawful, and the individual opposes the erasure of the personal data and requests the restriction of its use instead;
c) the Company no longer needs the personal data for the purposes of the processing, but the individual requires it for the establishment, exercise or defence of legal claims;
d) the individual has objected to processing pending the verification of whether the legitimate grounds of the Company override those of the individual.
(2) Where processing has been restricted under paragraph (1), such personal data shall, with the exception of storage, only be processed with consent of the individual or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
(3) The Company informs the individual whose request has served as grounds for the restriction based on the aforesaid, before the restriction of processing is lifted.
7.6 Notification obligation regarding rectification or erasure of personal data or restriction of processing
The Company will communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The Company shall inform the individual about those recipients if they so request.
7.7 Right to data portability
The individual has the right to receive the personal data concerning them, which they have provided to the Company in a structured, commonly used, and machine-readable format and have the right to transmit that data to another controller without hindrance from the Company, where:
the processing is based on consent or on a contract; and
the processing is carried out by automated means.
In exercising the right to data portability pursuant to paragraph (1), the individual shall have the right to have the personal data transmitted directly from one controller to another (thus from the Company to another controller), where technically feasible.
Exercising the aforesaid right shall be without prejudice to provisions concerning the right to erasure (‘right to be forgotten’) and, further, this right shall not adversely affect the rights and freedoms of others.
7.8 Right to object
(1) The individual has the right to object, on grounds relating to his/her particular situation, at any time to the processing of personal data concerning them for the purposes of legitimate interests. In such a case, the Company will no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the individual, or for the establishment, exercise or defence of legal claims.
(2) Where the processing of personal data serves direct marketing purposes the individual is entitled to object to the processing of personal data regarding them for such purposes, including profiling, in so far as the latter relates to direct marketing.
(3) If the individual objects to the processing of personal data with the aim of direct marketing, then the personal data can no longer be processed for this purpose.
(4) In connection with the use of services related to information society, the individual may resort to their right of objection, with deviation from Directive No 2002/58/EC, by means of automated devices based on technical requirements.
(5) Where personal data is processed for scientific or historical research purposes or statistical purposes, the individual, on grounds relating to their particular situation, has the right to object to the processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
7.9 Right to lodge a complaint with a supervisory authority
The individual has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement if they consider that the processing of personal data relating to them infringes the GDPR. In the UK, the competent supervisory authority is the Information on the Information Commissioner’s Office (ICO) and their contact details is available at https://ico.org.uk/.
