Q: PERSONAL DATA WE COLLECT ABOUT YOU, HOW IT IS USED AND WHY, INCLUDING THE LEGAL BASIS FOR OUR PROCESSING

<div class="root-rte css-0"><style data-emotion="css 1ui6af">.css-1ui6af{margin-bottom:space-16;}</style><p class="chakra-text css-1ui6af">Below you will find an overview of the purposes for which we process personal data about you. It includes which personal data we use for that specific purpose, what the legal basis is for the data processing and how long we retain the personal data.</p></div>

Question 1

Privacy Policy

Accepted Answer

February 2025

Fashion Arena Prague Outlet (the “Centre”) is committed to protecting your privacy. This Privacy Policy explains how the Centre collects and uses personal data about you if you:

join the Fashion Arena Fashion Club;
sign up to receive Fashion Club marketing communications;
consent to geofencing location;
consent to receiving push notifications;
sign up to receive the newsletter for the Centre;
participate in any competitions or contests that we run;
participate in surveys and focus groups;
access and use the website located https://fashion-arena.cz/en/ (the “Site”);
request a VIP Day Pass;
requesting an online Gift Card;
enter an area of the Centre in which we operate security cameras and monitor footfall via CCTV;
use the car parking facilities at the Centre;
use the luggage storage services at the Centre;
suffer an injury or have an incident in the Centre; or
if you want to raise a concern or compliant; or
contact us in relation to any of the above.

Please read this Privacy Policy carefully to find out about:

Who we are
Personal data we collect about you, how it is used and why, including the legal basis for our processing
Who we share your personal data with
How we use cookies
How long we keep your personal data for
Our policy on children’s personal data
Your rights
Links to other websites
Changes to this Privacy Policy
How you can contact us

Question 2

WHO WE ARE

Accepted Answer

The personal data that the Centre collects from you, or that you provide to the Centre, is controlled by one or both of the following companies within the VIA Outlets portfolio:

Via FAOC s.r.o., having its seat at Zamenhofova 440, 108 00 Prague, Štěrboholy, Czech Republic, ID: 022 14 041, registered with the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 216782 (“Centre Propco”); and/or
VIA Outlets B.V., a private company with limited liability under the laws of the Netherlands, having its seat in Amsterdam the Netherlands and its address at WTC Building Schiphol, 4^th floor Tower F, Schiphol Boulevard 153, 1118 BG Schiphol, the Netherlands, registered with the Chamber of Commerce of Amsterdam under number 76586537 (“VIA Outlets B.V.”).

The controller of your personal data depends on the reason for your interaction with us. Please see the section “Personal data we collect about you, how it is used and why, including the legal basis for our processing” to understand which of the companies listed above control the personal data that the Centre collects from you, or that you provide to the Centre, in connection with each type of interaction covered by this Privacy Policy.

References in this Privacy Policy to “we” or “us” are to these companies.

Each of the companies listed are committed to protecting your privacy and are (depending on the reason for your interaction with us, as explained above) joint data controllers of your personal data within the meaning of data protection laws applicable in the European Union (“EU”) and European Economic Area (“EEA”). As joint data controllers, we have arrangements between us to ensure that we handle your personal data correctly and in accordance with data protection laws applicable in the EEA, such as the General Data Protection Regulation (GDPR). These arrangements, which do not affect your rights under data protection law, reflect our respective roles and responsibilities in relation to you, and considers which entity is in the best position to fulfil each obligation to you.

If you have any questions or requests in connection with your personal data, you can also contact VIA Outlet’s group data protection officer, please send an email to: DPO@viaoutlets.com.

Question 3

PERSONAL DATA WE COLLECT ABOUT YOU, HOW IT IS USED AND WHY, INCLUDING THE LEGAL BASIS FOR OUR PROCESSING

Accepted Answer

Below you will find an overview of the purposes for which we process personal data about you. It includes which personal data we use for that specific purpose, what the legal basis is for the data processing and how long we retain the personal data.

Question 4

(A) Fashion Club: Registration

Accepted Answer

Types of personal data we collect:

We collect the information you provide to us when you register for our Fashion Club, via our website, app or at the Centre, and any further information you provide to update your registration details from time to time. This information includes your name (first and last name), email address, country of residence, postal address (including city of residence and postcode), language preferences, gender and date of birth. If you do not want to provide us with your personal data upon sign-up, we are unfortunately not able to let you participate in the Fashion Club.
Refer a friend – on occasion we may offer incentives to reward members of the Fashion Club for referring a friend. In order for us to facilitate this reward we need to create and store links between you and friend(s) you refer within our database. This link will only be created when the new member completes the registration process.

Purpose of processing (how and why we use your personal data):

We process your personal data to administer your Fashion Club membership and to be able to provide you with access to the various benefits of the Fashion Club. These benefits include our newsletter, the ability to make savings at participating retailers’ stores by accruing credits on your purchases and access to special offers, promotions and discounts. We also process your personal data to ensure that the information we hold about you is kept up to date and accurate.

Legal basis for processing:

We process your personal data after obtaining your consent to do so for the purpose of sending you marketing communications, which may include invitations to take part in special events, surveys and/or focus groups, about the benefits of the Fashion Club. Please see the section “Fashion Club: Marketing communications and automated decision-making (including profiling)” to find out more about your choices when it comes to marketing.
In addition, it is in our legitimate interests to collect and use the personal data referred to in the section above so that we can better understand our member base so that we can improve our services and marketing activities (which could also benefit you).

Account deletion:

If you no longer wish to participate in Fashion Club, you can delete your account from the "Settings" section of the Fashion Club mobile application, and select "Delete My Account". Alternatively, you may request that we delete your data (and thereby your account) by submitting a request to Privacy.Prague@viaoutlets.com.

Data retention period:

As a Fashion Club member your data will be kept for as long as you are an active participant of the Fashion Club programme. We define an active Fashion Club member (an “Active Fashion Club Member”) as one that has transacted using their Fashion Club App / Card or Unique Code and/or has opened a Fashion Club email and/or visited our Centre (including our online store). If you are no longer deemed to be an Active Fashion Club Member for a rolling five-year period, then your personal data will be anonymized with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (transaction information and Centre visits or online purchases) for market research and analysis purposes. Prior to deletion, you will be informed that your account will be deleted.
If you request to delete your account, we will anonymize your information. Your personal data will be anonymized in the database with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (transaction information, Centre visits or online purchases and other analytical data) for market research and analysis purposes.

Joint controllers of your personal data:

VIA Outlets B.V.
Centre Propco

Question 5

(B) Fashion Club: Marketing communications and automated decision-making (including profiling)

Accepted Answer

Types of personal data we collect:

As part of the Fashion Club, we also gather information about the purchases you make at the Centre, including the stores you shop in and transaction details. When you use our online platform, we also collect information on purchased items, frequency of purchasing and transaction details (including the date, time and value of the transaction). We gather this information when you scan or enter in your unique code membership email, Fashion Club membership card or Fashion Club app at a Centre store or online when making a purchase (we gather this information in order to offer you all the benefits of the Fashion Club). This helps us to build a profile of your preferred brands and products.

Purpose of processing (how and why we use your personal data):

By interacting with our services, we are able to use the data you have provided to find out what products, brands and styles you are interested in and profiling helps us to build a profile of your preferred brands and products. With this profile, we are able to send you offers that are tailored to your specific preferences, based on your previous transaction activity. It also means that we don’t send the same offers to all members of our Fashion Club, so you may not be made the same offers as another Fashion Club member.
We gather information about the purchases you make at the Centre and your use of our online services and your visits to the Centre (location data) so that we can give you all the benefits of the Fashion Club and to provide you with useful information that corresponds to your needs and interests. When we have information about your purchases, we can tailor our benefits to your preferences, based on your purchasing activities and learn more about your favourite stores so that we can make sure you are sent the kinds of offers that you will be most interested in. We may also use your personal data to analyse the effectiveness of our marketing communications so that we can improve the relevance of the marketing communications we provide to you and other members over time.
We send you such offers by automated means. This means processing using, for example, software code or an algorithm, which does not require human intervention.

Legal basis for processing:

We only send you personalized offers with your consent.
If you want to withdraw your consent and opt out of receiving personalized offers based on profiling and automatic decision-making, you can unsubscribe via the link provided in each newsletter.
If you don’t agree with an automated decision that our technology has made in relation to you, you can contact us and we will look into it for you (see the section “How you can contact us”).
If you opt-out of receiving personalized offers, we will not target and/or profile your data, but we will still collect your information as part of your membership of the Fashion Club and in order to provide our services as mentioned in the section “Fashion Club: Registration” above. Please also see the section “Analytics, surveys and focus groups (market research) and Advertising” which sets out how we use your data for market research and analytic purposes.

Data Retention Period

As a Fashion Club member your data will be kept for as long as you are an Active Fashion Club Member. If you are no longer deemed to be an Active Fashion Club Member for a rolling five-year period, then your personal data will be anonymized with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (transaction information and Centre visits or online purchases) for market research and analysis purposes. Prior to deletion, you will be informed that your account will be deleted.
If you request to delete your account, we will anonymize your information. Your personal data will be anonymized in the database with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (transaction information, Centre visits or online purchases and other analytical data) for market research and analysis purposes.

Joint controllers of your personal data:

VIA Outlets B.V.
Centre Propco

Question 6

(C) Fashion Club: Geo-fencing

Accepted Answer

Types of personal data we collect:

We process location data of Fashion Club members using a geo-fencing service. Geo-fencing is a location-based service which establishes a virtual fence around, or within, our shopping centres. If you are a Fashion Club member (or use the Fashion Club app) and you have consented to location tracking within the Fashion Club app on your mobile device, our geo-fencing service will detect and record when you enter and leave that geo-fenced location within our centres and how long you stay in a specific area of the centre.
Geo-fencing cannot pinpoint your exact location or entry into a particular store.
No personal data is shared with the retail outlets or brands you visit.

Purpose of processing (how and why we use your personal data):

The geo-location data is combined with data from your Fashion Club loyalty scheme card data if you use it in the Centre to collect rewards to determine the spend value and the brand/store. On the basis of this information, we determine which (future) rewards, discounts and/or vouchers to offer to you as a Fashion Club Member.
We can also determine when you visited the Centre without making any transaction or without using your loyalty scheme card in order to send you offers or information about the Centre and/or brands.
We may also use the geo-location data to send Fashion Club members who visited the Centre a survey after their visit.
We may send you the above through push notification during or after your visit to the Centre. For more information on our marketing communications, please read “Fashion Club: Marketing communications and automated decision-making (including profiling)” and “Push Notifications”.

Legal basis for processing:

Geo-location data via a Fashion Club member’s mobile device is automatically collected by the device when you have consented to location tracking services on your device. As such, you remain in full control of location data collection.
You have the right to withdraw your consent at any time with effect for the future by consulting the settings on your device.

Data retention period:

As a Fashion Club member your data will be kept for as long as you are an Active Fashion Club Member.
If you are not registered as a Fashion Club member, we do not store any geo-location of you. All data is stored locally on your device and is not accessible by us. If you enter a geo-fenced area, your device may automatically send you a push notification or in-app message (for more information, please read the section “Push Notification”).

Controller of your personal data:

VIA Outlets B.V.
Centre Propco

Question 7

(D) Fashion Club: Push Notification

Accepted Answer

Types of personal data we collect:

If you have downloaded the Fashion Club App, we use your personal data to send you push notifications on your mobile device to send you the latest offers and news tailored to your preference.
If you are a Fashion Club member we do so based on the geo-fencing data and your transactions and shopping behaviour (please read “Fashion Club: Geo-fencing” and “Fashion Club: Marketing communications and automated decision-making (including profiling)” for more information).
If you are not registered as a Fashion Club member but still use the Fashion Club App, you will only receive push notifications based on geo-fencing data, if you have consented to such location tracking, and analytical data about your use of the Fashion Club App (i.e., what you have clicked on).

Legal basis for processing:

You will only receive push notifications if you have given us your consent.
At any time, you can manage your push notification preferences or deactivate these notifications at any time by turning off the notification settings in the App or in the device settings of your mobile device.

Data retention period:

As a Fashion Club member your data will be kept for as long as you are an Active Fashion Club Member. If you are not registered as a Fashion Club member, we do not store any geo-location of you. All data is stored locally on your device and is not accessible by us.

Controller of your personal data:

VIA Outlets B.V.
Centre Propco

Question 8

(E) Newsletter (formally the VIP Programme)

Accepted Answer

Types of personal data we collect:

We collect the information you provide to us when you sign up to receive our newsletter and any further information you provide to update your registration details from time to time. This information includes your name, email address, gender and date of birth. If you sign-up to receive our trade newsletter the information we collect also includes your company name and telephone number.

Purpose of processing (how and why we use your personal data):

We process your personal data to:

Legal basis for processing:

We process your personal data after obtaining your consent to do so for the purpose of sending you information about the latest news, special events, offers, promotions and other benefits at the Centre. Please see the section “Fashion Club: Marketing communications and automated decision-making (including profiling)” to find out more about your choices when it comes to marketing. You can unsubscribe from and withdraw consent to this service at any time by opting out via the link provided in each newsletter.

Data retention period:

As a Newsletter member, your data will be kept for as long as you are actively opening and reviewing our email communications. If you are deemed to be an inactive member for a rolling three-and-a-half-year period, your personal data will be anonymized in the database with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (analytical data) for market research and analysis purposes. Prior to deletion, you will be informed that your account will be deleted.
If you request to delete your account, we will anonymize information. Your personal data will be anonymized with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (analytical data) for market research and analysis purposes.

Joint controllers of your personal data:

VIA Outlets B.V.
Centre Propco

Question 9

(F) Competitions and contests

Accepted Answer

Types of personal data we collect:

We collect the information you provide to us when you participate in a competition or contest that we run. This may differ depending on the type of competition or contest we are running but is likely to include your name (first and surname), email address, mobile number and postal address.

Purpose of processing (how and why we use your personal data):

We need your personal data in order to operate the competition or contest that you have entered and inform you of its outcome.

Legal basis for processing:

The processing of your personal data is necessary for the performance of the contract with you. In order to perform the competition or contest.

Data retention period:

Your data is retained for the term of the competition and will then be deleted after the winner of a competition has been announced. The data of the competition winner (and any runner-up) may be held until such time that the competition prize has been collected, or used if the prize is a trip or event, following which, data will be deleted.
If you are a Fashion Club member, we will store your data as set out above in the section “Fashion Club: registration / Data retention period”.

Controller of your personal data:

Fashion Club competitions: VIA Outlets B.V.
All local run competitions: Centre Propco

Question 10

(G) Analytics, surveys and focus groups (market research) and Advertising

Accepted Answer

Types of personal data we collect:

We combine the personal data we collect about you through the different channels you use to interact with us (for example, browsing our Site, signing up for the newsletter or Fashion Club, using our online shopping platform and contacting us). In addition, we may combine the information we hold about you with information about you held by our selected partners and/or retail outlets where you have agreed that they can share your information with third parties.
We may also collect your personal data if you choose to participate in a survey or focus groups carried out by us or by a third party on our behalf.

Email analytics: We included email tracking and link tracking features in our emails by embedding a small transparent image pixel in the outgoing email. If the email is opened, we will have access to certain information, such as the name and surname of the recipient; the recipient’s email address; subject of the email; date and time in which the email was sent; confirmation that the recipient received the email; confirmation that the recipient has opened the email after it has been received; timestamp of each email opening; the history of the times (number, date and time) the recipient has opened the received email; IP address from which the email was opened; browser and operating system used by the recipient who opened the email; number of links included in the email; text and URL of such links; number of clicks made on each of them by the recipient; timestamp of each click on the link; IP address from which the link was clicked on and browser and operating system used by the person who has clicked on the link.
If applicable, you may also register for the Fashion Club via International Student Identity Card (ISIC) or use your Fashion Club in combination with your ISIC Card. If you shop at our Centres that accept ISIC Cards, we share statistical data with ISIC that includes the name of the brand where the transaction was made, amount spent, time and date. No additional personal data with which ISIC could identify you, such as your name, address or contact details, will be shared.

Purpose of processing (how and why we use your personal data):

We carry out research and analysis to improve the Fashion Club and other services by evaluating your needs, experiences and wishes. We do so on an aggregated level.
By interacting with our services, we are able to use the data you have provided to find out what products, brands and styles you are interested in and profiling helps us to build a profile our guests’ preferred brands and products.
We gather information about the purchases you make at the Centre and your use of our online services so that we can analyse the effectiveness of our marketing communications so that we can improve the relevance of the communications we provide to you and other guests over time.
We also use your data, for the purpose or market research and data analysis, for the following reasons:

Legal basis for processing:

It is in our legitimate interests to do this so that we can form a clearer picture about our customer base and as a result improve our services and marketing activities (which could also benefit you). Email analytics: The processing of these personal data is necessary for the purposes of the legitimate interests pursued by us, in order to analyse the reach and effectiveness of the mails send by us.
Sharing statistical data with ISIC is also necessary for our legitimate interests in order to partner up with ISIC and offer additional discounts to students.

Data retention period: Data shall be retained depending on the origin according to period foreseen in other sections. If you would like more information or to request details, please contact us by sending your request to Privacy.Prague@viaoutlets.com.

Controller of your personal data:

VIA Outlets B.V.
Centre Propco

Question 11

(H) Website use and access

Accepted Answer

Types of personal data we collect:

We automatically generate and collect information about you when you visit our Site or use our Fashion Club application (App), for example through the use of cookies and similar technologies. Please refer to our Cookie Policy (https://fashion-arena.cz/en/cookie-policy) for more specific information. The information we collect about you includes:

Technical data, such as your internet protocol (IP) address (which is a unique number enabling us to recognize your device) and other identifiers, browser type, version and settings, including the time zone and language settings, global geographic location on a national or city level, browser plug-in types and versions, operating system and platform, and other technologies on the devices you use to access the Site.

Purpose of processing (how and why we use your personal data):

We process your personal data to better understand how you use our Site or App, in order to provide, maintain and improve it. This may for example enable us to correctly display content and to better secure our Site and App.
We process information about you to find out what your preferences are. This helps us to provide you with a personalized and optimized online experience, for example by remembering your settings, such as your preferred language, and by providing you with advertisements tailored to your interests. We are also able to understand the effectiveness of the advertising we serve to you.
We use tools and plug-ins of social media platforms on our Site. These enable you log in to your social media profile and share information about this Site with others. Furthermore, it enables us to obtain the information you have shared on your social media profiles. Please be advised that, although we use different social media platforms and are responsible for the content of this Site that is shared via such platforms, we are not responsible for the management of these platforms. For more information about how your data will be used by these social media platforms, we refer to the information already available on the website of the suppliers of these platforms.
With your consent, we use the so-called Meta Pixel on our Site to make sure that our advertisements on the Meta Apps (including Facebook and Instagram) match the potential interest of users. Accordingly, we use the Meta Pixel to display our ads to Meta users who have shown an interest in our Site or who have specific characteristics (e. g. interests in certain topics or products determined by the Site visited) that we submit to Meta (so-called “custom audiences”).

Legal basis for processing:

We base the use of your personal data on our legitimate interest in offering and securing our Site and App and pursuing the other processing purposes listed above.
In some circumstances, we base the processing of your personal data on your (explicit) consent, such as when we personalize your experience. Although you have the right to refuse to give consent or withdraw it at any time, please be advised that, as a result, the service may not function properly.

Data retention period:

Data controller of your personal data:

Centre Propco

Question 12

(I) VIP Day Pass

Accepted Answer

Types of personal data we collect:

If you want to receive your VIP Day Pass electronically, we will need to collect your name and email address in order to send you your online pass. We also ask you to confirm which country you are travelling from, and which travel company informed you of the VIP Day Pass.

Purpose of processing (how and why we use your personal data):

We process your data (name and email address) in order to send you your electronic VIP Day Pass. In addition, we process information about the country you are travelling from and the travel agency you were informed about the VIP Day Pass by in order to review our guest tourism base and local partner performance.
We may also send you a survey after your visit to the Centre.

Legal basis for processing:

The processing of your name and email address is necessary for the performance of a contract in order to provide you with your electronic VIP Day Pass.
It is in our legitimate interests to analyse information about the country you are travelling from and the travel agency you were informed about the VIP Day Pass
For research and analysis, including inviting you to take part in a survey carried out by us or by third parties on our behalf: We carry out research and analysis to improve the VIP Day Pass programme. Please also see the section “Analytics, surveys and focus groups (market research) and Advertising” which sets out how we use your data for market research and analytic purposes.

Data retention period:

Maximum period of four months from the date the electronic VIP Day Pass is sent to you.

Controller of your personal data:

VIA Outlets B.V.
Centre Propco

Question 13

(J) Online Gift Card

Accepted Answer

Types of personal data:

If you want to purchase your Gift Card electronically on our Site, we will collect the name, telephone number, email address and company name (if applicable) and address of the purchaser of the Gift Card (and the recipient if that is a different person) in order to send the online Gift Card.

Purpose of processing (how and why we use your personal data):

We process the personal data in order to send you (or the recipient) the Gift Card. Any payment details will be uploaded.

Legal basis of processing:

The processing of your/the recipient of the Gift Card’s name, phone number, company details (if applicable), address and email address is necessary for the performance of a contract in order to provide you (or the recipient) with the Gift Card.

Data retention period:

Maximum period of five (5) years from the date the Gift Card is purchased.

Controller of your personal data:

Centre Propco

Question 14

(K) Entering an area of the Centre in which we operate security cameras (excluding in-store CCTV)

Accepted Answer

Types of personal data we collect:

We operate security cameras at the Centre in limited areas where we have identified a need and where other solutions are ineffective to achieve the purposes described in the section below. This means that if you visit the Centre you may be captured on security camera.
There are prominent signs in the areas where the security cameras are operated.

Purpose of processing (how and why we use your personal data):

Security cameras are used at the Centre for monitoring the security of the Centre, safeguarding the safety of visitors and staff at the Centre and preventing and detecting crime. For the avoidance of doubt, our operation of security cameras excludes in-store CCTV. For more information on in-store CCTV please consult the privacy policy of the relevant store.

Legal basis for processing:

It is in our legitimate interests to collect and use the personal data referred to in the section above so that we can provide a safer, more secure environment for visitors and staff at the Centre, and to protect our property and that of VIA Outlets.
Please note that access to the security camera footage is restricted to authorised personnel of VIA Outlets, our insurance companies and our security service provider that need to have access in order to achieve the purposes described in the section above. In addition, access to the footage will be granted to law enforcement agencies in certain circumstances in order to prevent and detect crime.

Data retention period: Data shall be retained within a maximum period of seven (7) days except if such data is necessary to process claims or rights exercise, in which case information shall be kept until its expiration.

Controller of your personal data:

Centre Propco

Question 15

(L) Footfall counter tracking via CCTV

Accepted Answer

Types of personal data we collect and how we use your personal data:

We use technology that tracks multiple features via our CCTVs placed at the entrance of our Centre (including the car park) and in the Centre and stores. This paragraph specifies what personal data about you are processed by us, for which purpose(s) and on which legal grounds we rely for the collection and processing of your personal data.

Through the CCTVs we automatically analyse our guests in real time in order to get statistical insights into the reactions and behaviour of our shopping audience, by estimating the following features:

age (estimation)
gender
dwell time

Based on the estimated features above, we capture aggregated, statistical information about:

the number of visits (entry and exit counts)
guest demographics (gender and age)
guest pathing for different floors
occupancy of guest in specified areas
same-day unique/repeat guests
average time spent in zone
cross-conversion data.

All data collected is stored and used anonymously for statistical and analytical purposes. No images are recorded or stored for this purpose, therefore no uniquely identifiable data can be extracted. Images from the camera sensors undergo real-time conversion into statistical data within a short period of time. This also means that your image is translated into a hash value (a unique numerical value) when the video stream is processed, and only the hash value is stored for 24 hours for repeat visitor processing. This means that the system is able to recognize the guests through the centre for a day. This is necessary to create and obtain a realistic picture of the number of visits to and walking routes in the Centre.

For the first two weeks that the AI system is functional, the video feed will be stored to conduct quality assurance and enhance the accuracy of the system. This is a one-time only procedure. Though facial images will be stored for a period of 14 days, the data processing will only take place for quality assurance and not for the purpose to identify or target you in any way whatsoever.

The processing of your personal data for this short period of time is necessary for the purposes of the legitimate interests pursued by us, namely to create anonymous statistical and analytical data get insight in our shopping audience and to improve the shopping experience of our guests and once for quality assurance. For example, when we get insight on how our guests move through the centre and the average time spent at a certain location, we may improve the brand mix, position stores and facilities a certain way and provide entertainment at a specific location within the centre. With the anonymous statistical and aggregated data we cannot identify you or recreate any images of you. In addition, the data are not used to target you or any of our guests in any way whatsoever. If you wish to receive more information on the balancing test we performed in this context, please contact us.

Do we share your personal data with third parties?

The technology described above is provided to us by Deep North. In addition, we use an external hosting provider for the storage and management of the data. The processing by these service providers is governed by a so called data processing agreement in which we have ensured that that the service provider shall only process the personal data on our instructions.

Deep North’s employees and contractors located outside the European Economic Area (EEA), may need to access raw video footage for quality assurance purposes, in this case the United States and India. To comply with EU data protection laws around international data transfer, we only allow service providers outside the EEA to process your personal data in accordance with a contract entered into between Via Outlets and the service provider, incorporating the European Commission’s Standard Contractual Clauses, which ensure that adequate data protection arrangements are in place (Article 46.1(c) GDPR). For more information on where and how the relevant document may be accessed or obtained, please contact us.

What are your rights?

Under the GDPR, you have a number of rights with regard to your personal data and the processing thereof. Since the data processed by us, is stored and used anonymously and no images are recorded or stored, we will not be able to identify you should you invoke your rights under the GDPR. If the purposes for which a data controller processes personal data do not or do no longer require the identification of a data subject, the data controller is not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with the GDPR (Article 11 GDPR). In such cases, Articles 15 to 20 GDPR with regard to your rights do not apply.

How long do we retain your personal data?

We shall retain personally identifiable information only as long as reasonably necessary to translate them into the anonymous, aggregated, statistical and analytical data. As mentioned above, no images are recorded or stored for longer than that. Therefore no uniquely identifiable data can be extracted afterwards. Images from the camera sensors undergo real-time conversion into statistical data within a short period of time. The video image is discarded within 10 minutes without any storage of your facial images and all hash values are deleted within 24 hours.

Controller of your personal data:

Centre Propco

Question 16

(M) Using the car parking facilities at the Centre

Accepted Answer

Types of personal data we collect:

We operate a vehicle number plate recognition system inside the car park and service road at the Centre where we have identified a need and where other solutions are ineffective to achieve the purposes described in the section below. This means that if you use the car parking facilities at the Centre your vehicle number plate will be captured.
There are prominent signs in the areas where the vehicle number plate recognition system is operated.

Purpose of processing (how and why we use your personal data):

A vehicle number plate recognition system is used inside the car park at the Centre for preventing and detecting crime.
In addition, we aggregate information about the country in which your vehicle is registered to conduct statistical analysis of the geographical attraction of the Centre and build up a clearer picture about our customer base as a group. This helps us to work out how we can improve the Centre and better service visitors to the Centre.

Legal basis for processing:

It is in our legitimate interests to collect and use the personal data referred to in the section above so that we can provide a safer, more secure environment for visitors and staff; and better understand our customer base as a group so that we can improve the Centre.
Please note that access to the vehicle number plate recognition system is restricted to authorised personnel of VIA Outlets and our security service provider that need to have access in order to achieve the purposes described in the bullet points in the section above. In addition, access to the system will be granted to law enforcement agencies in certain circumstances in order to prevent and detect crime.
Other authorised personnel of VIA Outlets have access to aggregated information about the origin of the visitor cars but not to the underlying vehicle number plates.

Data retention period: Data shall be retained within a maximum period of seven (7) days except if such data is necessary to process claims or rights exercise, in which case information shall be kept until its expiration.

Controller of your personal data:

Centre Propco

Question 17

(N)	Using the luggage storage services at the Centre;

Accepted Answer

Types of personal data we collect:

We operate and provide the luggage storage service free of charge to our customers at the Information center to enjoy hands-free shopping during Centre's opening hours. This means that if you use this service, you will be requested to fill in selected personal data on the luggage storage form, i.e., your name and surname, ID document and mobile phone number. While collecting your stored items from the storage room, you will be required to present your identification document in order to evidence your identity and present your storage services ticket received from us.

Purpose of processing (how and why we use your personal data):

The processing of your personal data is necessary for safety reasons, protection of property of our guests and incident management.

Legal basis for processing:

It is in our legitimate interests to collect and use the personal data referred to in the section above so that we can provide a safer, more secure environment for guests and protect the property/items of our guests.

Data retention period: three (3) months

Controller of your personal data:

Centre Propco

Question 18

(O) Health and Safety Management

Accepted Answer

Types of personal data:

If you have an incident at our Centre relating to health or safety, we may collect information about you so that we can support you and to follow up with our insurers if a claim is made. We may also collect information from you if you are a witness to an incident. The data you provide may include the following:

Contact details: first name and last name, email address and telephone number;

Purpose of processing (how and why we use your personal data):

The processing of your personal data is necessary for health and safety reasons and incident management.

Legal basis of processing:

The processing of these personal data is necessary for the purposes of the legitimate interests pursued by us and to process and insurance claims arising from an incident at the Centre. In addition, we may process this data on your request. Where we use cookies or other technologies that might store information on your device and that are not absolutely necessary for our service, we process your personal data after obtaining your consent. For more information, please see our Cookie Policy (https://fashion-arena.cz/en/cookie-policy).

Data retention period:

Information will be deleted after claim has expired under law.

Controller of your personal data:

Centre Propco

Question 19

(P) External Complaints

Accepted Answer

Types of personal data:

If you wish to report any suspected case of grievance, we may collect information about you (the reporter) so that we can support you with the follow up of your report and conduct the necessary investigation. The data we may collect about you includes the following:

Contact details: first name and last name, email address, telephone number and country;

Purpose of processing (how and why we use your personal data):

We use your personal data so that we can respond to your report and perform any necessary investigations according to relevant legislation.

Legal basis of processing:

The processing of your personal data, and the personal data of any affected individuals is necessary for the purposes of legitimate interests pursued by us and to process any claim arising from a suspected wrongdoing at the Centre.

Data retention period:

Relevant data shall be kept until the suspected wrongdoing reported is time-barred and in any case only for a period for as long as we are processing the grievance or required under applicable law or for any legal defence of a claim. Personal data clearly not relevant to the processing of a report shall not be collected or, if collected, shall be deleted as soon as possible.

Joint Controller of your personal data:

Centre Propco
VIA Outlets B.V.

Question 20

(Q) Contact us

Accepted Answer

Types of personal data we collect:

You may contact us in various ways, including via the contact form on the website, our social media channels, by e-mail, WhatsApp, text and by telephone. If you contact us, we may keep a record of that correspondence and any personal data that you provide, such as your name, telephone number and email address.

Purpose of processing (how and why we use your personal data):

We use your personal data so that we can respond to your communications.

Legal basis for processing:

It is in our legitimate interests to collect and use the personal data referred to in the section above so that we can serve our customers’ needs.
Where the contact is related to a contract we have with you, the legal basis for processing your personal data is based on contract.

Data retention period: Your information will be deleted after a period of 6 months from the date that your query/needs have been met.

Controller of your personal data:

Centre Propco

Question 21

WHO WE SHARE YOUR PERSONAL DATA WITH

Accepted Answer

For the purposes set out in the section “Personal data we collect about you, how it is used and why, including the legal basis for our processing”, we sometimes provide your personal data to other companies within the VIA Outlets portfolio and certain service providers who perform certain business operations on our behalf. This includes:

Management company to the Centre Propco that provides management, financial and other operational services;
Database platform service and hosting provider who assist us with:
Customer Service Platform;
Retailers/brands at the Centre who may assist you with signing up to the Fashion Club in their store at the Centre;
Service providers who help us with our information technology systems (including security);
Cloud providers who host the information stored in our customer database;
Service provider who process your data for reporting purposes (see External Complaints, above);
Service provider who process your data for the provision of Gift Card services;
Service providers who help us to operate the security cameras and vehicle number plate recognition system at the Centre; and
Insurers that deal with claims on our behalf.

In addition, we may share your personal data with other organisations in the following circumstances:

if we are required by applicable law or a public authority to share information about you;
if we need to share information about you in order to establish, exercise, defend or protect the rights, property or safety of our business, our customers or others. This includes, in specific cases, exchanging information with other organisations for the purposes of fraud and theft protection; and
to successors in title or replacement operators of all or part of our respective businesses.

Transfer of your personal data outside the European Economic Area and the UK

In some cases, the personal data we collect from you may also be accessed or processed outside the EEA and the UK, including North Macedonia, USA and Canada. See this link for an overview of EEA countries. Such destinations may not have laws which protect your information to the same extent as in the EEA and the UK. We have obligations to ensure that your personal data is only accessed or processed from territories outside the EEA and the UK where the European Commission has decided that the territory in question ensures an adequate level of protection (known as a ‘white listed’ territory) or, in the absence of such decision, there are appropriate safeguards in place to protect your personal data. See this link for an overview of applicable adequacy decisions. If your personal data is accessed or processed from a territory outside the EEA or the UK which is not white listed, the appropriate safeguards may be provided by standard data protection clauses adopted by the European Commission and Information Commissioner (FDPIC) (known as ‘model clauses’).

Please ask us if you would like more information about the safeguards that are used to protect your personal data when it is processed outside the EEA and the UK (see the section “How you can contact us”).

Question 22

HOW WE USE COOKIES

Accepted Answer

We use cookies to enable our systems to recognise your device so that we can personalise and improve your customer experience whilst using our Site and provide you with relevant online advertising. Please see the section “Personal data we collect about you, how it is used and why, including the legal basis for our processing” and our Cookie Policy available at (https://fashion-arena.cz/en/cookie-policy) to find out more.

Question 23

HOW LONG WE KEEP YOUR PERSONAL DATA

Accepted Answer

We retain your personal data for no longer than is necessary for the purposes for which the information is collected (see the section “Personal data we collect about you, how it is used and why, including the legal basis for our processing” for details of the relevant purposes). When determining the relevant retention periods, we will take into account factors including:

legal obligation(s) under applicable law to retain data for a certain period of time, for example, accounting obligations;
statute of limitations under applicable law;
(potential) disputes; and
guidelines issued by relevant national data protection regulators.

Otherwise, we securely erase your information once this is no longer needed for the purposes for which the information is collected.

Question 24

OUR POLICY ON CHILDREN’S PERSONAL DATA

Accepted Answer

We do not knowingly collect the personal data of children under 18 years of age, without the prior consent or authorisation of the holder of parental responsibility over the child.

Question 25

YOUR RIGHTS

Accepted Answer

By law, you have the following rights with regard to your personal data.

Right of access

You have the right to obtain access to your personal data (if we’re processing it) and certain other information (similar to that provided in this Privacy Policy). This is so you’re aware and can check that we’re using your personal data in accordance with data protection law.

Right to rectification

You are entitled to have your personal data corrected if it is inaccurate or incomplete.

Right to erasure

This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data. This is not a general right to erasure; there are exceptions. You have the right to have your personal data erased if the personal data is no longer necessary, you withdraw your previously given consent, you object to the use of your data, and there is no overriding legitimate interest to continue processing, personal data have been unlawfully processed or we have to do it to comply with a legal obligation.

Right to restrict processing

You have the right to restrict the processing of your personal data in certain circumstances. This means that you can limit the way that we use your data when you contest the accuracy of your personal data and we are verifying the accuracy of the data, the data has been unlawfully processed and you oppose erasure and request restriction instead, we no longer need the personal data but we need to keep it in order to establish, exercise or defend a legal claim, or you have objected the processing of your data and we are considering whether our legitimate grounds override yours.

Right to data portability

You have rights to obtain and reuse your personal data for your own purposes across different services. For example, if you decide to switch to a new provider, this enables you to move, copy or transfer your personal data between our IT systems and theirs safely and securely, without affecting its usability.

Right to object to processing

You have the right to object to processing of personal data which is based on our legitimate interests. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you always have the right to object to processing of personal data for such marketing. In that case, we shall no longer process your personal data for such purposes.

Right to withdraw consent

Where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. The withdrawal does not affect the lawfulness of previous processing, but from the time you withdraw your consent we will not process any further personal data.

Right to lodge a complaint

In addition to the above-mentioned rights, you have the right to lodge a complaint about the way we handle or process your personal data with a supervisory authority, in particular in the EU Member State where you normally live, where you work or where an alleged infringement took place.

This webpage gives you an overview of all supervisory authorities in the EU and their contact details.

However, before you approach a supervisory authority, we encourage you to contact us with any issues you may have. We take your concerns very seriously, and would appreciate the chance to assist you personally.

You may send your request to Privacy.Prague@viaoutlets.com. We will respond to your request as soon as reasonably possible and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. We will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.

If we do not take action on your request, we shall inform you without delay and at the latest within one month of receipt of the request of the reasons for not taking action. In that case, you also have the right to lodge a complaint with the supervisory authority and to seek a judicial remedy.

Question 26

LINKS TO OTHER WEBSITES

Accepted Answer

The Site may contain links to other websites operated by unrelated companies and persons (“Third Party Website”). These links are provided for your information only. The inclusion on the Site of any link to a Third Party Website does not mean that we accept any responsibility for that Third Party Website, its content or use, or the use of any features, products and/or services made available through that Third Party Website. We have no control over Third Party Websites or any information or materials contained on them and have not investigated, monitored or checked any Third Party Websites for accuracy, completeness or conformance with applicable laws and regulations. We are not responsible for any damages or injuries caused as a result of your use of, or reliance on, Third Party Websites or any information or materials contained on them. You access and use Third Party Websites at your own risk.

Question 27

CHANGES TO THIS PRIVACY POLICY

Accepted Answer

We reserve the right to make changes to this Privacy Policy at any time, so please check our Site regularly to keep informed of changes. If you are a member of the Fashion Club or have signed up to receive our newsletter, we will also notify you of the changes by email.

Question 28

HOW YOU CAN CONTACT US

Accepted Answer

If you have any questions about this Privacy Policy or you wish to exercise any of your rights in relation to your personal data, please contact us at Privacy.Prague@viaoutlets.com.

If you have any questions or wishes in connection with your personal data, you may also contact our data protection officer: DPO@viaoutlets.com

PRIVACY POLICY

DISCOVER

ABOUT

NEED HELP?