Privacy
Privacy Policy
Effective from 15 October 2026
We handle your data as meticulously as we handle our clients’ flats. Here you will find what data we process, why, for how long and what rights you have – in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on the Protection of Personal Data.
1. Who processes your data
The controller operating the bhfre.sk website and providing services under the BHF Real Estate brand is:
BHF Správa a Reality s. r. o.
registered office: Topoľčianska 3202/12, 851 05 Bratislava
Company ID (IČO): 51058642
registered in the Commercial Register of the Bratislava III Municipal Court, Section Sro, Insert No. 123152/B
email: office@bhfre.sk · phone: +421 947 972 307
office: SKY PARK Offices, Bottova 7939/2A, 811 09 Bratislava
We have not appointed a data protection officer (DPO), as we are not required to do so under Art. 37 GDPR. You can contact us with any questions about your personal data at office@bhfre.sk.
2. What data we process
We process only the data that you provide to us or that we need in order to provide our services:
- contact details – first name and surname, email address, phone number,
- data required to conclude a contract – address, date of birth, identity document details, bank account details,
- property data – address, floor area, number of rooms, condition, data from the title deed (list vlastníctva), amount of rent or price,
- property management data – rent and advance payments, meter readings, utility settlements, handover reports,
- content of communications – messages sent via forms, email, phone calls and WhatsApp,
- technical data – IP address and basic server logs when you visit the website.
We do not ask you for special categories of personal data (for example, health data). Please do not send us such data in your messages either.
3. What we use your data for and how long we keep it
| Purpose | Legal basis | Retention period |
|---|---|---|
| Responding to your enquiry (contact form, email, phone, WhatsApp) | Art. 6(1)(b) GDPR – steps taken at your request prior to entering into a contract; where the enquiry does not relate to a contract, Art. 6(1)(f) GDPR – legitimate interest in answering questions | while your enquiry is being handled and then for 12 months from our last communication |
| Free rent estimate | Art. 6(1)(b) GDPR – steps taken at your request prior to entering into a contract | 12 months from sending the estimate, if we do not enter into a contract |
| Provision of services – property management, tenant search, sales, buyer’s agent services, investment analysis, valuation, purchase opportunities, consultations | Art. 6(1)(b) GDPR – performance of a contract | for the duration of the contract and then for 4 years to allow any claims to be asserted |
| Accounting and taxes (invoices, contracts, accounting documents) | Art. 6(1)(c) GDPR – legal obligation under Act No. 431/2002 Coll. on Accounting and tax legislation | 10 years following the year to which they relate |
| Identification and verification of clients when brokering the sale and purchase of property (for lettings, only where the monthly rent is at least EUR 10,000) | Art. 6(1)(c) GDPR – legal obligation under Act No. 297/2008 Coll. on Protection against the Legalisation of Proceeds of Criminal Activity | 5 years from the end of the contractual relationship or from the execution of the occasional transaction |
| Newsletter – notifications of new articles | Art. 6(1)(a) GDPR – your consent | until you unsubscribe; the record of your consent and unsubscription is kept for a further 3 years as proof of consent |
| Website traffic measurement (Google Analytics 4) | Art. 6(1)(a) GDPR – your consent; Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications | 14 months; you may withdraw your consent at any time |
| Exercise and defence of legal claims | Art. 6(1)(f) GDPR – legitimate interest | for the duration of any dispute and the applicable limitation periods |
| Website operation and security (server logs, strictly necessary cookies) | Art. 6(1)(f) GDPR – legitimate interest; for cookies, Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications | short-term only, for as long as necessary to secure the website |
Once the above periods have expired, we delete or anonymise the data. Providing your data is voluntary. However, without your contact details we cannot reply to you, and without the data required for a contract we cannot conclude it. We are required by law to request client identification data under Act No. 297/2008 Coll.
We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.
4. Flat management for owners
Where we manage a flat for its owner, we generally process the personal data of the owner’s tenants on the owner’s behalf as a processor under Art. 28 GDPR. In such cases, the owner of the flat is the controller, and the terms of processing are governed by our contract with the owner. You may exercise your rights with the owner or directly with us – we will pass your request on to the owner.
5. Who we share your data with
We do not sell your data. We disclose it only to the extent strictly necessary:
- to the provider of the website platform, hosting and database (Lovable – Lovable Cloud; the database is stored in the European Union),
- to the provider of the service for sending emails from website forms and the newsletter (Resend),
- to our email service provider (Apple – iCloud),
- to an external accountant, lawyer or tax adviser,
- to the other party to the transaction – the seller, buyer, landlord or tenant – to the extent necessary to conclude the contract,
- to the notary, the bank and the cadastral department of the district office in the case of a property transfer,
- to contractors involved in managing the flat (for example, service technicians) – only the name and phone number needed to arrange a repair,
- to Google (Google Analytics), only if you consent to analytics cookies,
- to Meta, if you contact us via WhatsApp or Instagram,
- to public authorities, where required by law.
6. Transfers of data outside the EU
Some of our providers (for example, Google, Apple, Meta or Resend) may also process data outside the European Union, in particular in the USA. Such transfers take place only on the basis of a European Commission adequacy decision (Art. 45 GDPR) or standard contractual clauses approved by the Commission (Art. 46 GDPR).
7. Newsletter
If you subscribe, we will send you an email whenever a new article is published on our blog. We keep only your email address, the date and time of subscription, your language and the page on which you subscribed. This data is stored in our website’s database. After you subscribe, we will send you a confirmation email containing an unsubscribe link.
You can unsubscribe at any time via the link in every email or by writing to office@bhfre.sk. Withdrawing your consent does not affect the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR).
8. Cookies
Cookies are small files that a website stores in your browser. Under Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications, we may use without your consent only those cookies that are strictly necessary for the website to function. We use other cookies only with your consent, which you give via the cookie banner.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| bhf_cookie_consent | strictly necessary | remembers your choice in the cookie banner | 12 months |
| _ga | analytics – Google Analytics 4 | distinguishes visitors for traffic statistics | 2 years |
| _ga_<ID> | analytics – Google Analytics 4 | maintains the session state | 2 years |
Analytics cookies are loaded only after you give your consent. Google Analytics 4 does not store visitors’ IP addresses, and we retain data in it for 14 months. You can change or withdraw your consent at any time via the Cookie settings link in the website footer.
You can also delete or block cookies in your browser settings. Blocking strictly necessary cookies may limit the functionality of the website.
9. Your rights
In connection with your personal data, you have the right:
- to access your data and obtain a copy of it (Art. 15 GDPR),
- to have inaccurate data rectified (Art. 16 GDPR),
- to have your data erased (Art. 17 GDPR),
- to restriction of processing (Art. 18 GDPR),
- to data portability (Art. 20 GDPR),
- to object to processing based on legitimate interest (Art. 21 GDPR),
- to withdraw your consent at any time where processing is based on it (Art. 7(3) GDPR).
Send your request to office@bhfre.sk or by post to our registered office address. We will respond without undue delay and in any event within one month.
If you believe that we are handling your data in breach of the applicable legislation, you may file a petition to initiate proceedings with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk (Art. 77 GDPR).
10. Security
The website uses an encrypted connection (HTTPS). Only authorised persons bound by confidentiality have access to the data, and we require the same level of protection from our suppliers.
11. Changes to this policy
We update this policy on an ongoing basis. You will always find the current version on this page.