PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA AND YOUR RIGHTS
In case you are considering to provide your personal data to our companies through the website at www.HubHub.hbreavis.com or otherwise (hereinafter referred to as the “Website”) we, as data controller:
- HB REAVIS Slovakia a. s., with its registered address at Mlynské nivy 5, 821 09 Bratislava, Company ID No.: 31 346 065, registered with the Commercial Register of the City Court Bratislava III, Section: Sa, Insert No.: 3429/B; and
- HubHub UK Ltd., with its registered address at Worship Square, 65 Clifton Street, London, England, EC2A 4JE, ID No.: 11257204
(hereinafter together referred to as “HubHub“ or “we”), would like to inform you about how we are processing your personal data in connection with offering, providing and maintaining our services.
HubHub is part of the HB Reavis Group, with its headquarters in Luxembourg (hereinafter referred to as the „HB Reavis Group“) due to which the reference to HB Reavis Group may be found in this Privacy Notice.
This notice applies to current and former employees, tenants, visitors, and contractors. This notice does not form a part of any contract of employment or other contract to provide services. This Privacy Notice may be updated from time to time. We encourage you to periodically review this Privacy Notice for the latest information on our privacy practices. Your continued use of our services after the posting of changes to this Privacy Notice will mean that you accept those changes.
It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using that information and what your rights are under the data protection legislation.
If you are in our premises (as a visitor, employee, business partner or for any other purpose) or visit websites, apps or social media related to HubHub or are interested in working for us, your personal data may be processed for the following purposes:
- Provision of HubHub services
- Selection of potential employees (recruitment process) and creating a CV database
- Ensuring the safety of visitors and users of the building as well as the protection of the building and property
- The issuing of entry cards
- Mutual communication
- Promotion of our brand, good name, services, and events
- The administration of insurance claims in our premises
- The organisation of fire protection and health and safety training
- Contact persons
- Exercise of the data subject's rights under UK GDPR
- WhatsApp group
A more detailed specification of the individual purposes:
1. Provision of HubHub services
What is our purpose for and legitimate interest in processing your personal data?
Your personal data are used for the purpose of providing the HubHub Services / Facilities as it is stated in General Terms and Conditions, Membership Agreement and other contracts including pre-contractual relationships and the protection and enforcement of HubHub rights and interests stemming from our relationship. This purpose includes mainly the following processing activities:
efficient communication relating to the provision of HubHub Services / Facilities,
ensuring examination of a complaint or claim made by you (recording of the complaint, examination of the complaint, to verify whether a person submitting the complaint is entitled to do so, to provide a notification about the result of the complaint),
ensuring proper performance of HubHub Services / Facilities,
simplifying the creation of business relationships within the HubHub community and for the purpose of creating your account on the Office RnD platform. HubHub will create your account automatically in a hidden mode that contains only a minimum of personal information. Subsequently, the amount of personal data published on the platform (photo, personal information, etc.) as well as the mode in which the account is in (public/private) is entirely in your hands. We would like to inform you that the data uploaded to your profile on the platform will be treated for the purpose of providing HubHub services
enabling the use of "Paper Cut" services (document printing)
carrying out our obligations and enforce our rights arising from any contracts entered into between you and us in connection with HubHub Services / Facilities, including for billing and collection,
notifying you about any changes and updates in relation to HubHub Services / Facilities, including news release,
ensuring possibility to book meeting room,
reporting problems with services or technology,
providing feedback,
your e-mail address or phone number can be used by HubHub to communicate with you for verification purposes as well as for other matters related to the HubHub Services / Facilities.
What is our legal basis for the processing of your personal data?
We process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR to provide HubHub services to our tenants and their employees.
What kind of personal data do we process?
Title, name, surname, and the business name of your employer, e-mail, phone number, IP address.
How long do we store your personal data?
For the duration of your contractual relationship with our tenant or the duration of the rental relationship, whichever relationship ends first. We subsequently archive the membership agreement for a period of five (5) years after the end of the contractual relationship.
Selection of potential employees (recruitment process) and creating a CV database
Description of our purpose and legitimate interests:
In case of vacant job roles within HubHub, we will look for the best fit to fill the vacancy. When doing that, we collect CVs from applicants directly or from third party recruiters referring the potential applicant. After reviewing the CVs of the applicants, we invite them for personal interviews after which we send them follow-up information. If you are submitting your CV proactively (i.e. not for an open position) or would still like to hear from us after we have completed the recruitment process for an open position, we may, with your consent, store your CV for the purpose of contacting you in the future regarding the job opening.
What is our legal basis for the processing of your personal data?
If you send us your CV regarding a specific vacant position, we process your personal data on the basis of the performance of a contractual relationship prior to entering into a contract under Article 6 (1) (b) of UK GDPR (in case of failure to provide us with the personal data, we cannot enter into a contract with you). If you want us to keep your CV in our database, we process your personal data on the basis of a consent under Article 6 (1) (a) of UK GDPR. By granting this consent, you further acknowledge that you can withdraw the consent electronically anytime. The withdrawal of consent for personal data processing is handled via the same URL used for granting the initial consent. If you wish to withdraw your consent, you simply need to click on the same link they you used to provide it. Withdrawal of your consent is without prejudice to the lawfulness of our processing of your personal data prior to such withdrawal.
What kind of personal data do we process?
Personal data included in the CV (such as name, surname, date of birth, address, e-mail, phone number etc.).
How long do we store your personal data?
In case of applying for a particular vacant position, we will store your personal data until the end of the recruitment process. If you give us your consent to store your CV for future vacant positions, we will store it for 2 years or until you withdraw your consent, whichever comes first.
Ensuring the safety of visitors and users of the premises as well as the protection of the premises and property
What is our purpose for and legitimate interest in processing your personal data?
The protection of our premises and the safety of the people using our premises are the key elements and the number one priority in our business activities. For us to be able to ensure the proper level of protection and safety, we installed a video monitoring system (CCTV). When entering the premises or if you are near them, the CCTV might record you. If you enter the premises, we will process your personal data in the following ways:
Description of our purpose and legitimate interests
What kind of personal data do we process?
How long do we store your personal data?
We produce your visual images by means of an installed CCTV camera system, which records the internal spaces of the building where HubHub operates.
A visual image of you.
We store your personal data captured by cameras located in the building or in the parking lot and on the outside of the building for 30 days.
In case you are visiting the Worship Square premises or attending an event organised by one of the tenants at the building we need to register you at the reception for safety and protection purposes. Moreover, either we or our tenant will issue you with a temporary entry card in the form of a QR code at the reception or via email, if you are a guest of our tenant. While registering you at the reception or sending out the QR code we need to process your personal data so we can fulfil our purpose and legitimate interests to the fullest.
Name, surname, e-mail, identification of the tenant (if attending a tenant’s event) and date and time of the entry.
We store your personal data for 90 days.
What is our legal basis for the processing of your personal data?
We process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR for the protection of our rights and interests and for ensuring security in our premises.
The issuing of entry cards
What is our purpose for and legitimate interest in processing your personal data?
For us to permit you to enter the premises of your employer, we will issue you an entry card that grants you access to the restricted premises of the building (HubHub Premises and premises of your employer).
What is our legal basis for the processing of your personal data?
We process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR to issue entry cards.
What kind of personal data do we process?
Name, surname, e-mail and the business name of your employer.
How long do we store your personal data?
For the duration of your contractual relationship with our tenant or the duration of the rental relationship, whichever relationship ends first.
Mutual communication
What is our purpose for and legitimate interest in processing your personal data?
Our philosophy is to always be open and transparent. This includes being open to communication from any person interested in us. To fulfil this goal, we created several types of contact forms that can be used to contact us. Additionally, we have also published the email addresses of employees working for us so you can contact them at any time with any questions related to our buildings or business activities and the business you may have. However, to ensure effective, flawless, and clear communication, we must process some of your personal data.
Moreover, when executing the leasing process with our (potential) clients we strive to maintain very effective and transparent communication canal. To fulfil this purpose, we use the CRM database filled with contact data (including personal data) of our (potential) clients or their employees. We do this to ensure effective and flawless communication with the (potential) clients and to build a database consisting of all our business partners.
What is our legal basis for the processing of your personal data?
If you contact us or any employee via email or a web-based form, we process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR.
What kind of personal data do we process?
Name, surname, email address and phone number. For the purposes of the CRM database, in addition to the aforementioned data, we also process job title and employer identification data.
How long do we store your personal data?
We keep your personal data until you unsubscribe from our contact database.
Promotion of our brand, good name, services, and events
What is our purpose for and legitimate interest in processing your personal data?
We may process your personal data by taking photographs and audio-visual recordings, which are used for the purpose of and legitimate interest in the promotion of our events and services and to help us improve our brand and goodwill by publishing the photographs (where it is possible that you will appear) and audio-visual recordings on our social media profiles such as YouTube, LinkedIn, Facebook, X (previously Twitter) and Instagram, as well as via other channels such as our websites.
What is our legal basis for the processing of your personal data?
We process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR.
What kind of personal data do we process?
Photographs or/and audio-visual images of you. In the case of private events, also your name, surname and email address will be processed.
How long do we store your personal data?
We may process your personal data for the entire existence of the HB Reavis Group.
The administration of insurance claims in our premises
What is our purpose for and legitimate interest in processing your personal data?
Your personal data is processed for the purpose of the administration of insurance claims that occur in our premises. When such an insurance claim occurs, it is necessary to fill out an incident form for insurance purposes and other legal matters.
What is our legal basis for the processing of your personal data?
In the case of handling insurance claims, we process your personal data based on legitimate interest in accordance with Article 6 (1) (f) UK GDPR.
What kind of personal data do we process?
The requested data on the insurance form.
How long do we store your personal data?
We store your personal data only during the time that it is strictly necessary to deal with the insurance claim.
The organisation of fire protection and health and safety training
What is our purpose for and legitimate interest in processing your personal data?
In order to be able to provide training on fire protection (FP) and health and safety (HaS) to our members who, with our knowledge, are in HubHub premises, we need to proceed with the processing of personal data.
What is our legal basis for the processing of your personal data?
We process your personal data based on the legitimate interests under Article 6 (1) (f) of UK GDPR to provide FP and HaS training.
What kind of personal data do we process?
Name, surname, e-mail.
How long do we store your personal data?
For the duration of your contractual relationship with our tenant or the duration of the rental relationship, whichever relationship ends first.
Contact persons
What are our purposes and legitimate interest for the processing of your personal data?
In view of the fact, that you or a third party provided us, as a contractual party specified in the agreement (including other relevant legal acts as for example power of attorney) or as an addressee specified in the mail (hereinafter referred to as the “HB Reavis” or “we”), with your personal data, we would like to inform you about the processing of your personal data and of your rights related to the said processing.
Description of our purpose and legitimate interests
What kind of personal data do we process?
How long do we store your personal data?
We process your personal data to ensure that our contractual obligations arising from the contract with you or a third party, of which you are in the position of a contact person or a signatory on behalf of the contractual party, are effectively fulfilled and also to be compliant with legal obligations under local law. Since we conducted the contract with your or the third party, we need to process your personal data to ensure effective, flawless and clear communication as well as to ensure fulfilment of our contractual obligations and legal obligations (tax and accounting) towards you or the third party. This processing also applies to other legal acts than contracts as for example power of attorney.
Title, name, surname, position, department, personal and employee number, business area, place of work, signature, e-mail, phone and fax number and identification information of your employer (incl. identification information of the entity on which behalf you act).
Once we no longer need your personal data for the purposes for which we processed it, we will delete your personal data or archive it for the period of time specified by law or the archiving plan.
We process your personal data for the purpose of incoming and outgoing mail evidence.
Name, surname, address, telephone number and e-mail.
Once we no longer need your personal data for the purposes for which we processed it, we will delete your personal data or archive it for the period of time specified by law or the archiving plan.
We process your personal data on the basis of legitimate interests under Article 6 (1) (f) of UK GDPR. When we handle the tax and accounting matters or we are obliged to conclude an agreement under the applicable law (e.g. Management of Rights of Light/Party Wall Agreements in the United Kingdom), we process your personal data on the basis of a legal obligation under Article 6 (1) (c) of UK GDPR. If you or the third party fail to provide us with your personal data, we cannot fulfil our legal obligations
Exercise of the data subject′s rights under the UK GDPR
What are our purposes for the processing of your personal data?
We strive to protect your privacy as much as possible, and therefore we process your personal data in compliance with UK GDPR and all other relevant laws. However, if you disagree with the way we handle your personal data, you can exercise your rights via our Data Protection Officer. To ensure that your complaint is handled, some of your personal data has to be processed.
What is our legal basis for the processing of your personal data?
Your personal data is processed while handling your complaint in accordance with Article 6 (1) (c) UK GDPR, i.e., the processing is necessary for compliance with a legal obligation to which our company is subject.
What kind of personal data do we process?
Personal data required by the request to ensure effective communication (such as name, surname, email, phone number, etc., at your discretion
How long do we store your personal data?
We store your personal data strictly during the time necessary to deal with your complaint.
WhatsApp group
What are our purposes for the processing of your personal data?
We process your personal data (specifically your name and mobile phone number) for the purpose of creating and maintaining a tenant communication group on WhatsApp. This allows us to facilitate timely sharing of property-related updates, emergency notices, and community information.
Participation is entirely voluntary. Because WhatsApp is a third-party platform that makes your phone number visible to all other group members, your inclusion in this group is based on your explicit consent. You may opt out and leave the group at any time.
What is our legal basis for the processing of your personal data?
Your personal data is processed on the basis of a consent under Article 6 (1) (a) of the UK GDPR.
What kind of personal data do we process?
Name, surname, phone number
How long do we store your personal data?
By granting consent, you acknowledge that you can withdraw it electronically at any time. Withdrawing consent for the processing of your personal data is done via the same tick box on the Office RnD platform that was used to grant initial consent. To withdraw your consent, simply untick the box.
General statement on the processing of personal data
Once we no longer need your personal data for the purposes for which we processed it, we will delete your personal data or archive it for the period of time specified by law or the archiving plan.
To whom your personal data can be passed on?
External service providers: To comply with legal and contractual obligations, we cooperate with external service providers (processors) and transfer your personal data to them to the extent necessary for the performance of the HubHub Services / Facilities. In particular, our service providers include IT service providers and sales agents.
Internal service providers: HubHub is part of the HB Reavis Group, with its headquarters in Luxembourg. To comply with legal and contractual obligations arising from the respective contracts entered into between you and us in connection with HubHub Services / Facilities, we cooperate with other entities within the HB Reavis Group.
Landlord: HubHub as a provider of subleased office spaces, we are required to share a limited amount of your personal data with the primary landlord (the building management). We share your data with them strictly for the following purposes:
Issuance of Access Cards: To generate your personalised entrance badge, which allows you to pass through turnstiles, use elevators, and enter designated office areas.
Building Security: To maintain an accurate and up-to-date registry of authorised personnel on the premises, which is critical for emergency evacuations, fire safety, and preventing unauthorised access.
Before any disclosure of your personal data to the processors, we always enter into a written agreement with processors to stipulate the processing of personal data in compliance with principles and obligation stemmed from UK GDPR.
Courts and Authorities: There are also legal obligations that HubHub can only meet if we provide your personal data in required extent to the relevant state authorities (tax authorities, auditors), courts or law enforcement authorities and only to the extent necessary as required by applicable and effective law to exercise their power.
Other recipients – based on the consent.
We use analytical and marketing tools (e.g. MailChimp, Facebook Pixel, LinkedIn Pixel, HubSpot etc.) that collect third-party cookies. The information about your use of websites (including your IP address) generated by the cookies will be transmitted to and stored by the above-mentioned companies also on servers in the United States. We will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. These companies will not associate your IP address with any other data held by them. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do this you may not have full functionality of this website. By using our websites, you acknowledge that the above – mentioned companies may process data in the manner and for the purposes set out above.
The processing of personal data together with social media platforms
HubHub and (i) facebook.com and (ii) instagram.com, (iii) linkedin.com, (iv) youtube.com (v) X.com as the controllers of the relevant social media platforms, may in certain cases also process the personal data of data subjects to a limited extent or in the necessary extent as joint controllers. When using the services provided by these operators of social media platforms, HubHub accesses the conditions of the operation of this website and has no or only a minimal impact on changing these conditions.
HubHub is currently using so-called social plugins from the above-mentioned operators of social networks, which are indicated by their logos on our website. When you visit our website, your browser establishes a direct connection with the servers on which these plugins run. The content of the plugins is transferred directly by these operators of social media platforms to your browser, which then integrates it into our website. The integration of the plugins causes these operators of social media platforms to receive the information that you have accessed on the corresponding page of the HubHub website. If you are logged in with your social media platform account, the social media platform providers will be able to assign your visit to your account on these social networks. Please note that an exchange of this information already takes place when you visit our website regardless of whether you interact with the plugin or not. If you do not want these operators of social media platforms to gather data about you via our website, you must log out of them before visiting our website. Various functionalities and tools are made available to the data subject by each social media platform provider so the data subject can manage his/her preferences for displaying advertisements and sending messages with advertising content, or the data subject can exercise his/her right guaranteed by UK GDPR. HubHub has no impact on such processing (it may not disable or enable such processing as part of the operation of its sites or media channels) - the creation of site or media channel statistics by the relevant social media platform operators (see above) for HubHub. The webpage’s statistics are generally based on personal data collected in connection with the visit or the interaction of the data subject with the site or media channel and its content. Within the functionality of webpages and media channels, HubHub can be acquainted with these statistics and deal with them. If you do not want these operators of social media platforms to collect information about you through our website, you must log out of them before visiting the website. For more information about how these social networks process your personal data, please see their privacy policy:
Facebook: https://www.facebook.com/privacy/explanation
Instagram: https://help.instagram.com/155833707900388
LinkedIn: https://www.linkedin.com/legal/privacy-policy?
YouTube: https://policies.google.com/privacy?hl=en#infocollect
X: https://privacy.x.com/en
From whom do we get the personal data?
We get the personal data from you, your employer or third party.
Do we use automated individual decision-making?
No, we do not use automated individual decision-making.
Do we transfer your personal data to third countries?
Your personal data are processed within the territory of the United Kingdom and within the states of the European Union. Your personal data can be processed by a country outside of European Union if this third country has been confirmed by the European Commission as a country with adequate level of data protection or if other appropriate data protection safeguards exist (for example, binding corporate privacy rules or EU standard data protection clauses).
What are your rights?
Your rights as a data subject are stated below. Please note that the exact conditions to exercise these rights are set out in detail in Chapter III of UK GDPR, while in a particular circumstance not all rights may be exercised. You have the following rights:
Access to personal data we process about you
Rectification of incorrect or inaccurate personal data and add incomplete personal data
Restriction, i.e., blocking of processing of your personal data
The deletion of personal data in case the purpose absence or unauthorised data processing
Submission of an objection to the processing of personal data if you believe that our data processing is not justified
Be excluded from automated decision-making
Listing of personal data in a structured and machine-readable format or for another controller
Revocation of consent to the processing of personal data
To lodge a complaint with the supervisory authority
How can you exercise your rights?
Electronically: dataprivacy@hbreavis.com
In writing to the address: HB Reavis Slovakia a.s., at hands of compliance department, Mlynské nivy 5, 821 09 Bratislava, Slovak Republic
We strive to protect your privacy as much as possible and therefore we process your personal data in compliance with UK GDPR and all other relevant laws. However, if you disagree with the way we handle your personal data, you can exercise your rights via our Data Protection Officer at:
HB Reavis Slovakia a.s., at hands of DPO, Mlynské nivy 5, 821 09 Bratislava, Slovak Republic, email: dataprivacy@hbreavis.com
Or you can file a complaint in supervising authority regarding the processing of your personal data. Your local supervisory authority may be found at: https://ico.org.uk/
