We recommend that you carefully read these Principles of Personal Data Processing, which govern how we process your personal data provided in connection with your visit to the website www.base4work.com (hereinafter the “Website”), your membership, your visit to and use of the premises within the Base concept located in Jurkovič Heating Plant at Bottova 1, 811 09 Bratislava (hereinafter the “Base Premises”), operated by base4work s.r.o., Company ID No.: 51 654 768, with its registered office at Digital Park II, Einsteinova 25, 851 01 Bratislava (hereinafter the “base4work Company”), and your use of services provided by the base4work Company in the form of serviced office space, supplementary services, and services related to the organization of events and workshops in the premises of Jurkovič Heating Plant (the “Services”).

Your privacy is important to us. Therefore, we strive to ensure a high level of protection of your personal data and transparency of its processing in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”), and Act No. 18/2018 Coll. on the Protection of Personal Data.

In this document, you will find all necessary information on how we process your personal data, for what purposes, what rights you have in connection with their processing, and how you can exercise those rights.

1.      Introductory information on the processing of your personal data

The base4work Company, together with Penta Real Estate, s.r.o., with its registered office at Digital Park II, Einsteinova 25, Bratislava – Petržalka, 851 01, Company ID No.: 51 284 502 (“PRE”), act as joint controllers within the meaning of the legislation governing the protection of personal data, i.e. entities that jointly determine the purposes and means of processing your personal data (the “Joint Controllers”). The Joint Controllers have concluded an agreement pursuant to Article 26 GDPR, in which they have transparently determined their respective responsibilities for compliance with the obligations arising from GDPR. Essential parts of this agreement may be made available to you upon request. The Joint Controllers have not appointed a data protection officer pursuant to Article 37 GDPR. If you have any questions or wish to exercise your rights, please contact us at info@base4work.sk.

This document describes how we process your personal data obtained in connection with your visit to the Website, your membership, your visit to and use of the Base Premises, and your use of the Services.

We process your personal data primarily for the purposes of providing the Services, fulfilling contractual relationships, marketing communication, and operating the Website. More detailed information on individual purposes, categories of processed personal data, scope of processing, legal bases, retention periods, and your rights can be found in the following sections of these Principles.

We obtain your personal data directly from you, in particular when concluding and performing a contract for the provision of the Services; via the form on the Website; by telephone, email, or in person, especially when you express interest in our services or contact us with a request for information or an enquiry; in connection with your registration and use of mobile applications described below; and via a CCTV system installed in the Base Premises for the purpose of protecting persons and property. Personal data relating to employees and representatives of clients are generally obtained from their employer or from the entity that authorized them to use our Services. We do not obtain your personal data from third parties.    

If you have any questions related to the process and conditions of processing your personal data, please do not hesitate to contact us as specified in Section 6 of these Principles.

2.      Basic conditions for processing your personal data

  Purpose of processing  Categories / scope of processed personal data   Data subjects   Legal basis  Retention period
  Provision of Services, membership administration, reservations and invoicing   First name, last name, email, telephone number, reservation data, invoicing data, membership history  Clients (natural persons), representatives of clients (only to the extent necessary for invoicing and communication)  Performance of a contract (Article 6(1)(b) GDPR), legal obligation (accounting)  Duration of the contract + up to 10 years (only data necessary for invoicing and proof of contract performance)
  Digital keys (SALTO KS) and access logs (entries)   Digital keys, first name, last name, email, access logs (date, time)Clients (natural persons), employees/representatives of clients (legal entities), visitors  Performance of a contract (Article 6(1)(b) GDPR), legitimate interest – security (Article 6(1)(f) GDPR)  Duration of membership / contract
  Operation of Wi-Fi network   MAC address, IP address, device name, connection/disconnection time, technical data on potentially risky activity  Wi-Fi users  Legitimate interest – network security (Article 6(1)(f) GDPR)  7 days
Safety of persons and protection of property (CCTV in the Base Premises)Video recordings from CCTV systems installed in the Base PremisesClients (natural persons), employees / representatives of clients (legal entities), visitors of the Base PremisesLegitimate interest – protection of persons and property (Article 6(1)(f) GDPR)  7 days
Client database for registration of prospects, client administration and re-contacting former clientsFirst name, last name, email, telephone number, company name, subject of interest, date of last contactProspective clients, existing clients, former clients  Prospective clients – legitimate interest (Article 6(1)(f) GDPR), Existing clients  - performance of a contract (Article 6(1)(b) GDPR), Former clients – legitimate interest (Article 6(1)(f) GDPR)    Prospective clients: max. 3 years from last contact, Existing clients: duration of contract, Former clients: max. 3 years from termination of contract
  Direct marketing communication (newsletter / invitations by email)  First name, last name, email, data on opens and clicks    Natural persons who have given consent to receive marketing communications  Consent (Article 6(1)(a) GDPR and Section 62 of Act No. 351/2011)  Until withdrawal of consent / max. 3 years
  Marketing based on legitimate interest (promotion of similar own services to existing/former clients)    First name, last name, e-mail  Existing/former clients (natural persons and contact persons of legal entity clients)  Legitimate interest in promoting own services, improving service quality and measuring satisfaction   Until objection / max.  3 years
  Event photographs and video from events and activities organized by base4work  Image and video recordings of event participants  Event participants  Legitimate interest (Article 6(1)(f) GDPR) – documentation and promotion   Active use: max. 2 years; internal archive: max. 3 years (annual audit)
   Portrait photographs (individual shots) from events and activities organized by base4work  Portrait photographs  Participants of events who have provided consent  Consent (Article 6(1)(a) GDPR)  According to consent / max. 2 years
  Website technical logsIP address, date and time of access, URL, browser type (user agent)  Website visitors  Legitimate interest in ensuring the functionality, stability and security of the Website (Article 6(1)(f) GDPR)  Max. 13 months
   Contact form on the   Website  First name, last name, email address, telephone number, message content  Individuals who submit the contact form on the Website  Legitimate interest in handling received enquiries and ensuring effective communication (Article 6(1)(f) GDPR)    Max. 12 months from the closure of communication
   Cookies   See separate Cookies Policy  Website visitors  See separate Cookies Policy  See separate Cookies Policy
  Client zone and electronic delivery of documents   Login name (email address), password (hash), login history, IP address, content of messages/complaints, reservations, issued invoices, notifications of base4work, delivered documents  Clients (natural persons), employees / representatives of clients (legal entities)  Performance of a contract (Article 6(1)(b) GDPR); legal obligation in the field of accounting (Article 6(1)(c) GDPR) – invoices only  Accounting documents: 10 years; communication logs: 3 years from case closure; access logs: 12 months

We process your personal data only to the minimum extent necessary for the purposes specified in these Principles. The processing of personal data for the purpose of providing the Services, including reservations and ensuring access to the Base Premises and the Sky Park Offices garage, is necessary in order to fulfil our obligations arising from concluded contracts or from visits to the Base Premises.

If we process your personal data on the basis of consent, you may withdraw such consent at any time by sending an email to info@base4work.sk. The withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

Our legitimate interests: We process CCTV recordings and technical data (Wi-Fi logs) on the basis of our legitimate interest, which consists in ensuring the safety of persons, the protection of property, and the operation of the Base Premises and the related IT infrastructure. Prior to commencing such processing, we carefully assessed the balance between our interests and your rights. You have the right to object to such processing at any time.

Additional information on the processing of personal data within applications and CCTV systems:

In connection with visits to and use of the Base Premises and the Services, you may also come into contact with applications and technologies that ensure access to the premises, reservations, and other services:

  • SALTO KS Application: A mobile application serving as a digital key for access to selected Base Premises (e.g. offices, workspaces, meeting rooms). Through this application, we process the first name, last name, email address, and telephone number of clients and employees/representatives of clients. These data are necessary to ensure physical access to the Base Premises in accordance with the concluded contract.
  • Office RND Application (base4work Application): This application is used for meeting room reservations, membership management, community communication, and sharing operational information among coworking members. We process only the data necessary to create user access, namely the first name, last name, and email address of clients, their employees, or representatives.
  • Sky Park Offices Application: This application is used to access the Jurkovič Heating Plant building and the Sky Park Offices garages. For this purpose, we process the first name, last name, email address, and, where parking services are used, also the vehicle registration number (license plate). These data are necessary to ensure access to the building and garage in accordance with the concluded contract.
  • CCTV systems in the Jurkovič Heating Plant building and in the Sky Park Offices garages: These CCTV systems are operated independently by the companies specified in Article 3 of these Principles. The base4work Company has no access to CCTV recordings from these systems and has no influence over their processing. To exercise your rights relating to CCTV recordings, please contact the relevant companies directly.
  • CCTV systems in the Base Premises: The CCTV system in the Base Premises is operated exclusively by the Joint Controllers. The CCTV system is used solely for the purpose of ensuring the protection of persons and property.

Within the Base Premises, you may use shared printing services. When using printers, documents that may also contain your personal data (if such data are included in the printed documents) may be temporarily and technically stored in the internal memory of the printer. Such data are automatically deleted immediately after completion of the print job. The Joint Controllers do not have access to the content of printed documents and do not retain or use such personal data for any other purposes.

Your personal data will not be used for automated decision-making or profiling.

3.      Who may have access to your personal data?

Your personal data may be accessed by persons authorized by the Joint Controllers and by the following third parties:

  • IT support provider;
  • providers of mobile applications (SALTO KS, base4work Application);
  • web hosting provider;
  • provider of the Microsoft SharePoint platform (internal document management);
  • external accountants, legal advisors, tax advisors, and auditors;
  • marketing agency and photographer.

In addition to the above entities, your personal data may also be processed by companies within the Alto Real Estate group that own and manage the Jurkovič Heating Plant building and the adjacent Sky Park Offices garage. These companies act as independent – or, where applicable, joint – controllers and process only the necessary technical data related to the operation of the premises:

  • CCTV recordings (for the protection of persons and property);
  • vehicle registration numbers (license plates) and short access logs required to open the access ramp;
  • basic user data from the Sky Park Offices mobile application (email address, digital key), enabling access to the building at times when the base4work Company’s reception is not available.

In addition to the companies within the Alto Real Estate group, other co-owners or the authorized property manager of the Sky Park Offices building may also have access to technical data (CCTV recordings, access logs, vehicle registration numbers upon entry to the garage). Such data are processed exclusively for the purposes of protecting persons and property and ensuring the smooth operation of the building. More detailed information on the processing of personal data within the building can be found in the personal data processing policies of the companies within the Alto Real Estate group.

We do not disclose personal data to any other entities unless required by law.

4.      Transfer of personal data to third countries

We primarily do not transfer your personal data outside the European Economic Area (EEA).

In processing your personal data, we use the services of certain verified providers of SaaS software solutions (“Software as a Service”), through which we ensure our internal processes as well as the provision of services to clients. All such providers act as our processors and contractually guarantee an adequate level of protection of personal data in accordance with GDPR and applicable legislation. These SaaS services include in particular:

  • base4work applications (see above)
    • SALTO KS (see above)
    • Microsoft 365 (SharePoint, Outlook) – internal communication and document management.

Personal data processed within these platforms are stored predominantly within the EU. If data are stored outside the EU (for example, by global providers such as Microsoft), the transfer is safeguarded by standard contractual clauses (SCCs) approved by the European Commission, which ensure an adequate level of protection in accordance with GDPR.  

5.      What are your rights?

GDPR grants you a broad range of rights, which we respect and enable you to exercise in full. In particular, you are entitled to:

  • the right to information and notifications relating to theprocessing, provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and provided in writing or by other means, including, where appropriate, by electronic means;
  • the right of access to your personal data;
  • the right to rectification of your personal data;
  • the right to erasure of your personal data;
  • the right to restriction of processing of your personal data;
  • the right to be informed that your personal data have been rectified, erased, or that the processing thereof has been restricted;
  • the right to object to the processing of your personal data where such processing is based on legitimate interest.

You also have the right to data portability in respect of personal data that you have provided to us and that we process on the basis of your consent or on the basis of a contract. Upon your request, we will provide such data to you in a commonly used and machine-readable format or transfer them directly to another controller, if this is technically feasible.

If you exercise your right to object to the processing of your personal data, we are entitled to assess the validity of your objection, in particular with regard to the existence and continuation of the legal basis for the processing of personal data.

6.      Where can you exercise your rights?

In matters relating to the processing of personal data and the exercise of your rights under GDPR, you may contact any of the Joint Controllers at any time, for example:

  1. by sending an email to: info@base4work.sk; or
  2. by sending a letter to the postal address: Digital Park II, Einsteinova 25, Bratislava - Petržalka 851 01.

Our aim is to respond to any of your questions and to resolve any complaint related to the processing of your personal data. However, if you believe that we have not adequately addressed your complaint, please note that you have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, with its registered office at Námestie 1. mája, 811 06 Bratislava, website: www.dataprotection.gov.sk/uoou/, or with the supervisory authority in the Member State of your habitual residence or place of work.

These Principles of Personal Data Processing may be unilaterally supplemented or amended at any time. We will inform you of any changes in writing or by electronic means.

Date 17.7.2025

base4work s.r.o.

Penta Real Estate, s.r.o.