DATA PROTECTION INFORMATION

www.premieroutletcenter.hu

 

Date of publication: 17. 05. 2018

 

1. Introduction

 

The purpose of this information document (“Privacy Policy”) is to lay down the data protection and data processing principles of GE FOC I Ingatlanhasznosító Korlátolt Felelősségű Társaság (address: 2051 Biatorbágy, Budaörsi út 4., registry number: 01-09-308903; the “Company”) as the owner of the website www.premieroutlet.hu (“Website”) and the Company’s data protection and data processing policy that the Company, acting as data controller, acknowledges as binding.

 

This Privacy Policy contains the principles for the processing of personal data provided by users on the Website and provides information to the data subjects on the processing of their personal data.

 

In drawing up the provisions of the Privacy Policy, the Company has, in particular, taken into account the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”), Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information for the Purpose of Approximation (“Info Act”), Act V of 2013 on the Civil Code (“Civil Code”), and Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (“CAA”).

 

1. Data controller’s particulars

 

From the point of view of the processing of your personal data, the Company functions as the data controller, that is to say the Company is responsible for the lawful processing of your personal data.

 

The Company may be contacted at:

 

Name: GE FOC I Ingatlanhasznosító Korlátolt Felelősségű Társaság

Postal address: 2051 Biatorbágy, Budaörsi út 4.

Registry number: 01-09-308903

E-mail address: info@premieroutlets.hu

Website: www.premieroutlet.hu

Telephone number: +36 23 449 700

 

1. Brief introduction of data processing at the level of individual data processing operations

• VIP Club Newsletter

 

The VIP Club may be joined by subscribing to the Company’s newsletter, which allows club members to apply for a VIP Club coupon book. In order to provide the newsletter service, the Company will collect personal data from you. The coupon book is not personalised, therefore it does not contain personal data.

 

Personal data is recorded electronically by the user filling in the appropriate panels and clicking on the sign-up confirmation button.

 

• Cookies

 

The Company places small data packets (“cookies”) on the user’s computer in order to provide customised services. The purpose of the cookies is to ensure that the site runs at the highest quality, to provide personalised services and to enhance user experience. The user can delete the cookies from his own computer or set his browser to disable the use of cookies. By disabling the use of cookies, the user acknowledges that without the cookies, the page in question will not run fully operational.

 

Cookies may have the following features:

 

• session cookies are necessary for browsing the Website and for using features, such as remembering the operations performed by a visitor on a particular page, feature, or service. Without the use of session cookies, smooth use of the Website cannot be guaranteed;
• persistent cookies are designed to allow the Website to remember what mode of operation you have chosen. This is to avoid having to re-enter this information at the next visit;
• third-party cookies are installed for the purpose of enabling our Company to select advertisements in which our visitors are most interested or which are most relevant or important to our visitors, so as to display such advertisements on the Website;
• performance enhancement cookies are designed to collect information about how the Website is used by our visitors (for example, which pages were visited, how many pages the visitor searched, which part of the page he clicked on, how long each session was, what error messages were received, etc.). This enables us to develop the Website (available services, features, etc.) to best accommodate our visitors’ needs, thus providing them with a high quality, user-friendly experience.

 

The Website uses the Google Analytics web analytics service. Google Analytics uses performance enhancement cookies to help analyse how the Website is used.

 

1. What type of personal data is recorded

• VIP Club Newsletter

 

When signing up for the VIP Club newsletter, we will record the following information:

 

• name* (for the purpose of identification);
• e-mail address* (for newsletter delivery);
• date of birth (for target group formation).

 

Data marked with an asterisk is mandatory for subscribing to the newsletter. The above data are treated as personal data in accordance with both the GDPR and the Info Act.

 

• Cookies

 

The Website runs software for analysing attendance data, which receives automatically generated information about the visitors, such as:

 

• the Internet protocol address (IP address) of the visitor;
• the date of visit;
• details of the pages viewed;
• name of the browser used;
• visitor preferences.

 

The Website records these details of visits. According to the provisions of GDPR, the visitor’s IP address is considered personal data.

 

1. For what purpose do we collect personal data

• VIP Club Newsletter

 

The purpose of handling personal data in connection with the provision of the VIP Club newsletter service is to provide you with periodic information about promotions currently available in Premier Outlet (2051 Biatorbágy, Budaörsi út 4), and information relevant to customers regarding Premier Outlet.

 

• Cookies

 

Purpose of cookies:

 

• to facilitate the provision of customised services and advertisements to the users of the Website, and to offer convenience features

;

• to produce statistics and analyses of website attendance and visitor preferences.

 

The Google Analytics Provider uses the information above to evaluate, analyse how the Website is used by you and other data subjects, to make reports on activities on the Website and provide other services related to the activities and internet use of the Website.

 

1. Legal basis of data processing

 

The legal basis for the processing of personal data as defined in point 4 is your, the data subject’s consent as defined in Article 6(1)(a) of the GDPR, both for the VIP Club newsletter service and for the use of cookies. Data processing is always voluntary. You may withdraw your consent at any time.

 

Consent to the processing of personal data is given by ticking the checkbox of confirmation of subscription (giving consent as stated in the Privacy Policy) in the process of subscription for the VIP Club newsletter electronically, while in respect of cookies it may be given by visiting the Website or by accessing the contents of the Website. You may withdraw your such consent given by implicit conduct by deleting the cookies from your computer at any time, or by setting your browser to disable cookies.

 

1. Duration of data processing

• VIP Club Newsletter

 

The Company processes your personal data for the purpose of sending advertisement newsletters until you unsubscribe from the VIP Club Advertising Newsletter, or if you do not otherwise request the deletion or do not restrict or prohibit the processing of your personal data.

 

• Cookies

 

Session cookies are automatically deleted by closing the browser. In all other cases, the Company processes your personal data until reaching the goal of using the specific type of cookie in question.

 

1. Data security measures

• VIP Club Newsletter

 

The Company records the personal data received in the process of subscription for the newsletter in the MailChimp newsletter and database administrator service provided by Rocket Science Group LLC, through which the Company sends newsletters to you.

 

Within the Company’s organisation, your personal data can be accessed only by those employees of the Company who are involved in the promotion and marketing activities of Premier Outlet. The Company handles all personal data as strictly confidential, and it is not disclosed or made accessible to third parties, not including the transfer of data to Rocket Science Group LLC, or to any employee of the Company who is not involved in the promotion and marketing activities of Premier Outlet.

 

In both of the above cases, recorded personal data is stored in a password-protected database, which is only accessible to certain specific persons and is protected by the most sophisticated firewalls and antivirus software. The database is only accessible to authorised employees with personalised, unique access password.

 

1. Data controller

• Operation

 

The Company entrusted ROS Ungarn Management Korlátolt Felelősségű Társaság (address: 2051 Biatorbágy, Budaörsi út 4, Hungary, e-mail address office@ros-management.com, phone number: +36 23 449 700) with the operation of Premier Outlet. In doing so, the ROS Ungarn Management Korlátolt Felelősségű Társaság handles, on behalf of the Company, the collection and storage of data related to the www.premieroutlet.hu website and perform the administrative tasks related to newsletters.

 

• IT tasks related to the Website

 

The Company contracted Dinamic Orange Tech Kft. (KREATiO.hu Stratégiai Online Ügynökség, address: H-1152 Budapest, Szentmihályi út 171. 3. em., Hungary, e-mail address:hello@kreatio.hu, phone number: +3620345-0393) to perform the IT tasks relevant to the www.premieroutlet.hu website, including the maintenance and development of the website.

 

• Newsletter

 

The Company conducts the marketing of newsletters through the MailChimp newsletter and database administration service provided by Rocket Science Group LLC (675 Ponce de Leon Ave NE, Suite 5000; Atlanta, GA 30308 USA). The personal data recorded in MailChimp will be sent to and stored on the servers of Rocket Science Group LLC in the USA. Accordingly, the Company expressly draws your attention to the fact that your personal data is forwarded to a third country (USA) under the GDPR when using the MailChimp service.

 

Rocket Science Group LLC operates MailChimp’s newsletter system for the entire duration of data processing and does not process the data on its own behalf. As Rocket Science Group LLC does not process any data for its own benefit, hence it is considered a data processor.

 

The Rocket Science Group LLC participates in Privacy Shield, the general framework for governing the transatlantic exchange of personal data, and has completed its compliance with Privacy Shield (date of certification: 21 November 2016). Accordingly, the Company declares that Rocket Science Group LLC, as data processor, has appropriate and suitable safeguards for the processing of your personal data.

 

• Cookies

 

The Company conducts site visit analysis through Google Analytics provided by Google LLC (Google Privacy Centre: 1600 Amphitheatre Pkwy, Mountain View, California 94043). The information generated by the cookies on the use of the Website (the IP address of the web visitor) is transmitted to and stored by the Website on Google LLC USA servers. Accordingly, the Company expressly draws your attention to the fact that your personal data is forwarded to a third country (USA) under the GDPR when using the Google Analytics service. As Google LLC does not process any data for its own benefit, it is considered a data processor.

 

The Google LLC participates in Privacy Shield, the general framework for governing the transatlantic exchange of personal data, and has completed its compliance with Privacy Shield (date of certification: 25 November 2017). Accordingly, the Company declares that Google LLC, as data processor, has appropriate and suitable safeguards for the processing of your personal data.

 

1. Your rights and remedies

• What are your rights, as data subject, relating to your data

• Right to information and right of access

 

You are entitled to receive, upon request, information from the Company as to whether your personal data is being processed and, if such data processing is in progress, to have access to such personal data and the following information:

 

• purposes of data processing;
• the categories of personal data involved;
• the recipients to whom the personal data is or will be disclosed (including in particular the data processors);
• planned duration of storage of personal data;
• your rights relevant to the processing of personal data;
• the source of the data, if not collected from you;
• information relating to automated decision-making.

 

Pursuant to the relevant legislation, we provide information relating to your personal data free of charge. We will respond to your request in writing within one month.  However, where the request is manifestly unfounded or excessive, in particular because of its repetitive character, the Company may, taking into account the administrative costs of providing the information or communication or taking the action requested, either:

 

• charge you a reasonable fee, or
• refuse to act on the request.

 

If you have already paid the costs as charged, but the data has been processed illegally or we are liable to correct your data as a result of your request, we will refund this fee.

 

If, despite our efforts to introduce advanced data security measures to protect personal data, anyone gains unauthorised access to personal data, changes, transmits, discloses, deletes, or destroys, or accidentally destroys or causes damage to, or otherwise processes your data unlawfully, upon request we will inform you of the circumstances of such incident, including when it happened, what effects it may have, and what we did to prevent or mitigate the consequences.

 

• Right to rectification

 

If the personal data we process is not accurate, we will correct it at your request without undue delay. You also have the right to request that your incomplete personal data be supplemented by a statement to this effect.

 

• Right to erasure

 

The Company shall delete your personal data without delay if:

 

• personal data is no longer required in connection with an application for or use of a Premier Gift Card, or for sending a marketing newsletter;
• the processing of personal data is unlawful;
• it is necessary to delete the data due to the fulfilment of a legal obligation of the Company;
• where the child is below the age of 16 years, consent is not given or authorised by the holder of parental responsibility over the child for processing the child’s personal data;
• if the Company has publicly disclosed the personal data.

 

You may also request us to delete your personal data by withdrawing your consent granted previously for data processing. In this case, however, we may refuse to provide services from that point, or certain services will no longer be available to you. For example, if you request the deletion of your e-mail address, we will not be able to notify you if your balance falls below a certain level or when your expiration date approaches.

 

Personal data will be blocked instead of deletion if you so request, or if it is assumed that the deletion may affect your legitimate interests. We do not process blocked data for the above purposes. We process such data only for the purpose that excluded deletion.

 

• Right of restriction

 

Restriction of data processing may occur if:

 

• you dispute the accuracy of your data; in this case, the Company restricts the processing of your personal data for the period of time until the accuracy of the data is established;
• data processing is unlawful and you requested restriction of use instead of deletion;
• the Company no longer needs the data, but you require them to bring legal claims;
• you have objected to the processing of your personal data, to the extent of consideration relevant to the objection.

 

For the duration of assessing your complaint relating to the processing of your personal data – not exceeding 5 days – the Company will suspend the data processing, examine the merits of the objection and make a decision, and shall immediately inform you of such decision.

 

If the objection is justified, the data will be restricted by the Company, i.e. only storage, as data processing, is allowed unless

 

• you give consent to data processing;
• the processing of your personal data is necessary to enforce legal claims;
• the processing of personal data is necessary to protect the rights of other natural or legal persons; or
• data processing is prescribed by law in the public interest.

 

If you have requested the restriction of data processing, the Company informs you in advance when such restriction is lifted.

 

• Right to data portability

 

You have the right to receive your personal data, which you have provided to the Company, in a structured, commonly used and machine-readable format (i.e. .doc or .pdf) and have the right to transmit those data to another data controller without any obstruction from the Company.

 

• What happens and what can you do when your request is refused?

 

If the Company refuses your request for rectification, restriction or erasure, we will inform you in writing within one month of receiving the request, of the reason why we were unable to comply with your request, and inform you of the judicial remedies available to you and also that you have the right to file a notice with the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information). We will respond by e-mail, subject to your agreement.

 

• What are your rights when you consider that data processing is unlawful

 

If you have concerns about the legality of data processing, you are entitled to object to data processing. The objection shall contain a request to terminate the processing of your data and to delete your data.

 

If you object to the processing of your personal data, the Company will investigate the reasons for the objection within one month, make a substantive decision, and notify you of its decision in writing.

 

If your objection is found well founded, all data processing operations will be terminated, the affected data will be blocked, and all persons to whom the personal data affected by the objection were previously forwarded shall be notified of the objection, including the ensuing measures. Those recipients are also required to take action to ensure that your objection is enforced. If you do not agree with our decision, or if the Company does not comply with the above-specified one month time limit, you may bring action in court within 30 days of the date of notification of the decision or the last day of the time limit.

 

• What remedies are available to you

 

If, in your opinion, the Company is in breach of the provisions of the GDPR in the processing of your personal data, you, as the data subject, have the right to file a complaint with a supervisory authority (i.e. any public authority established under Article 51 of the GDPR in any EU Member State) – in particular in the Member State where your habitual residence, place of work is situated or where the alleged infringement took place. In Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information) (hereinafter referred to as “NAIH” or “Authority”) functions as the supervisory body established in accordance with the criteria of Article 51 of the GDPR.

 

According to the GDPR, the supervisory authority concerned is the supervisory authority that is affected by the processing of personal data for one of the following reasons:

 

1. the controller or processor is established in the territory of the Member State of that supervisory authority;
2. data subjects residing in the Member State of that supervisory authority are substantially affected or are likely to be substantially affected by the processing; or
3. a complaint has been lodged with that supervisory authority.

 

As regards the data processing operations of the Company, the NAIH functions as the competent supervisory authority in accordance with subparagraphs (a) and (b) above, given that the Company authorised to operate in the territory of Hungary, and that data processing principally concerns data subjects residing in Hungary. Accordingly, the following section details the possibility of lodging complaints with NAIH. Nevertheless, please note that, regardless of the above, you are entitled to lodge a complaint not only with the Authority, but with any supervisory authority established in an EU Member State.

 

• Notification to the National Authority for Data Protection and Freedom of Information

 

Compliance with data protection laws is monitored by the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information). If you are of the opinion that our data processing operation is not in compliance with the applicable laws, or if you believe that there is an immediate risk thereof, you may notify the Authority at the following contact details.

 

Name of authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information)

Postal address: H-1125 Budapest, Szilágyi Erzsébet fasor 22/C.

E-mail address: ugyfelszolgalat@naih.hu

Phone number: +36 1 391 1400

Fax number: +36 1 391 1410

 

For more information on questions of data protection, please visit the Authority’s website: http://naih.hu/

 

Furthermore, we wish to point out that the Company is required to report any personal data breach (accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data) related to the Website without undue delay and, if possible, at the latest 72 hours after the personal data breach has come to our attention, to the Authority. When the personal data breach is likely to result in a high risk to the rights and freedoms of data subjects the Company shall communicate the personal data breach to you, as data subject, without undue delay.

 

• Judicial remedy

 

If you consider that we have violated your right to privacy or that our decision relating to the objection was wrong or we have not responded, you may bring action in court. You may also decide to initiate a lawsuit before the court of your domicile or place of residence.

 

Moreover, in the event of suffering any loss as a result of the Company’s unlawful data processing or breach of data security requirements, you may lodge a claim for compensation against the Company in court under the conditions laid down in the relevant legislation. If we have violated your rights relating to personality, you may receive restitution, which may also be enforced in court.

 

In this context we are responsible for our data processor.

 

 

Annexes:

 

Annex 1: Brief summary of the Company’s data processing operations

 

 

Annex 1

 

Brief summary of the Company’s data processing operations

	Subscribe to VIP Club Advertising Newsletter	Cookies
Scope of personal data processed	Data subject’s name; e-mail address; e-mail address; date of birth.	Data subject’s IP address.
Purposes of data processing	Sending advertisement newsletters related to information about Premier Outlet, and about promotional campaigns available in Premier Outlet.	Enabling or facilitating sessions, improving user experience, customising, collecting statistical data.
Legal basis of data processing	Data subject’s consent in accordance with Article 6(1)(a) of the GDPR.	Data subject’s consent in accordance with Article 6(1)(a) of the GDPR.
Duration of data processing	Until the data subject unsubscribe from the advertisement newsletter sent by Premier Outlet. The data subject may unsubscribe from the advertisement newsletter sent by the Premier Outlet at any time.	In the case of session cookies, until leaving the Website, otherwise for the time strictly necessary to achieve the purpose of using the cookie.