PRIVACY POLICY
Last Updated: September 15, 2026
At BHM parks, we give the utmost attention to the protection of personal data. This document explains what personal data we collect, the purposes for which we process it, how long we retain it and what rights you have under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 18/2018 Coll. on Personal Data Protection.
Re-est Services SK, s. r. o.
Miletičova 21
821 098 Bratislava, Slovakia
Email: bhmparks@bhmgroup.eu
Data Protection Officer (DPO):
Contact details of the Data Protection Officer responsible for overseeing the processing of personal data: dpo7@proenergy.sk
1. Overview of processing activities
We may process your personal data as part of the following processing activities:
| Processing activity – purpose and legal basis | Categories of data subjects | Categories of personal data | Erasure period | Categories of recipients (external) |
|---|---|---|---|---|
|
CCTV system – if you enter monitored areas, you
will be recorded on CCTV for the purpose of maintaining security
(including detecting crime), protecting life, health, property
and the financial interests of the controller.
Legal basis: the legitimate interests of the controller or a third party. |
Persons present in the monitored area. | Personal data (ordinary – captured in CCTV footage). | 7 days. | Police Force, other authorised entity; private security service; industrial park manager. |
| Access control – authorised persons – if we have granted you regular access to our premises, we verify your authorisation to enter and keep records on the basis of legitimate interests. | Employees, former employees (including agency workers), employees of business partners, authorised external partners. | Personal data (ordinary – identification data, including a photograph). | Access and electronic card management – duration of the relationship; entry records – 1 year. | Police Force, other authorised entity; private security service; industrial park manager. |
| Access control – visitors – for one-off visits, we record your entry and verify your identity and authorisation to enter on the basis of legitimate interests. | Visitors entering the controller’s premises. | Personal data (ordinary – identification data). | 3 years. | Police Force, other authorised entity; private security service; industrial park manager. |
|
Business partner records – we process
identification and contact details if you are our business partner
(or a contact person designated by that partner) and we need these
details to conduct our business relationships.
Legal basis: legitimate interests. |
The controller’s business partners and employees of business partners. | Personal data (ordinary – identification and contact details typically found on a business card). | 1 year. | Other authorised entity; industrial park manager. |
| Legal matters – we process personal data for the establishment, exercise or defence of legal claims of the controller or a third party in litigation, enforcement proceedings and debt recovery, on the basis of a legal obligation and/or legitimate interests. | Natural persons associated with the controller and the processor, authorised persons, other natural persons who are parties to proceedings. | Personal data (in particular identification, contact, economic/asset-related and other data established during litigation and enforcement proceedings). | 10 years from the final conclusion of the proceedings. | Courts; enforcement officers; law enforcement authorities; Slovak Trade Inspection; other authorised entity; industrial park manager. |
| Clients – we process personal data in connection with the performance of the contract between you and us and compliance with related legal obligations. | Clients. | Personal data (ordinary – identification, contact, payment and behavioural data). | For the duration of the contractual relationship / 10 years. | Slovak Trade Inspection; other authorised entity; processor; industrial park manager. |
| Accounting documents – we process personal data in connection with the performance of a contract in order to comply with accounting and tax obligations under specific legislation. | The controller’s clients/contractual partners, the controller’s taxpayers. | Personal data (identification, contact, financial/payment and other data relating to the performance of a contract and compliance with accounting and tax obligations). | 10 years. | Tax authority; auditors; other authorised entity; accounting service provider; industrial park manager. |
| Cookies – if you browse the content of our website, we process personal data to provide and improve services, develop new services, protect users and ensure effective search and advertising. Details can be found in the Cookies section below. | Users of the controller’s website. | Personal data (ordinary – enabling direct or indirect identification, location data). | Upon expiry of the consent period (unless the data subject renews their consent). | Other authorised entity. |
| Technical and organisational measures – we process records containing personal data as part of the implementation of technical and organisational measures adopted to ensure an appropriate level of security and compliance with the GDPR. | Employees, the Data Protection Officer, persons requesting to exercise their rights, persons affected by a security incident, processors, other external entities. | Personal data of various kinds (identification, contact, login/logout data, data necessary to verify the identity of a person exercising a right, etc.). | In accordance with the personal data record-keeping and security policy (generally 3 years, with certain records retained for 5 years or permanently). | Data Protection Officer; Office for Personal Data Protection of the Slovak Republic; police; prosecution authorities of the Slovak Republic; courts of the Slovak Republic; other authorised entity. |
2. Cookies
We use cookies and similar tracking technologies on our website to measure traffic, improve the user experience and evaluate marketing campaigns through Google Analytics 4 (GA4), Google Tag Manager and Google Ads. The legal basis for processing this tracking data is your explicit and active consent under Article 6(1)(a) of the GDPR. No analytics or marketing cookies will be stored on your device until you voluntarily provide this consent.
Consent to the use of cookies (CookieFirst)
To obtain your valid consent to the use and storage of cookies in your browser and to properly document it, we use the CookieFirst consent management platform. This technology is provided by Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH, Amsterdam, the Netherlands. Website: https://cookiefirst.com
When you access our website, a connection is established with the CookieFirst server, enabling us to obtain valid consent from you. CookieFirst then stores a cookie in your browser so that only the cookies you have consented to can be activated and this process can be properly documented. The processed data is retained until the predefined retention period expires or until you request its erasure. The legal basis for operating this technology is Article 6(1)(c) of the GDPR (compliance with a legal obligation).
Data Processing Agreement
We have entered into a data processing agreement with CookieFirst. This agreement is required by data protection legislation and ensures that the data of visitors to our website is processed solely in accordance with our instructions and in strict compliance with the GDPR.
Server Log Files
Our website and CookieFirst automatically collect and store information in server logs, which your browser transmits automatically. The following data is processed:
- Your consent status or the withdrawal of consent
- Your anonymised IP address
- Information about your browser and device type
- The date and time you visited our website
- The URL of the website on which you saved or updated your consent preferences
- The approximate location of the user who saved their consent settings
- The universally unique identifier (UUID) of the website visitor who clicked on the cookie banner
You have the right to withdraw or change your consent at any time. To adjust your settings or view a complete, continuously updated list of active cookies, use the interactive CookieFirst widget below or click the “Cookie settings” (or “Privacy Policy”) link in the footer of our website.
3. Google reCAPTCHA
We use Google reCAPTCHA v3 to protect the contact form against spam.
This service may process your IP address and data about your device, browser and behaviour on the website in order to distinguish humans from automated systems. The legal basis is the controller’s legitimate interest under Article 6(1)(f) of the GDPR in protecting the website against abuse and spam.
Google’s processing of data is governed by:
4. Processing specifics
No personal data is transferred to a third country/international organisation.
No profiling is carried out.
The obligation to provide personal data varies for the individual processing activities listed in Section 1.
Where processing is based on your voluntary consent (e.g. cookies), you are not obliged to provide personal data. However, if you do not provide it, you may, for example, be unable to use a service that relies on consent or benefit from that service.
Where processing is a statutory or contractual requirement (e.g. performance of a contract with a client, accounting and tax obligations), you are obliged to provide us with personal data. Failure to provide it may prevent you from using our services, as we will be unable to fulfil our statutory/contractual obligations.
Providing personal data that we process on the basis of legitimate interests (e.g. business partner records, CCTV system) is mandatory, but you have the right to object to such processing. We will always duly assess your request; however, in certain cases we may be unable to grant it, and providing personal data will remain mandatory.
5. Your rights under the GDPR
Under the GDPR, you have the right to:
- to access your personal data,
- to rectification of inaccurate data,
- to erasure of data,
- to restriction of processing,
- to object to processing,
- to data portability,
- to object to automated individual decision-making, including profiling,
- to withdraw consent where processing is based on consent.
To exercise your rights, contact us at bhmparks@bhmgroup.eu, alebo zodpovednú osobu na dpo7@proenergy.sk.
6. Right to lodge a complaint
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority:
Office for Personal Data Protection of the Slovak Republic
Galvaniho Business Centrum II
Galvaniho 7/B
820 04 Bratislava
Slovakia
https://dataprotection.gov.sk
7. Data Security
We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access or disclosure. Communication between your device and our server is protected by SSL/TLS encryption.