DATA PROTECTION INFORMATION
www.premieroutletcenter.hu
Date of publication: 17. 05. 2018
The purpose of this information document (“Privacy Policy”) is to lay down the data protection and data processing principles of GE FOC I Ingatlanhasznosító Korlátolt Felelősségű Társaság (address: 2051 Biatorbágy, Budaörsi út 4., registry number: 01-09-308903; the “Company”) as the owner of the website www.premieroutlet.hu (“Website”) and the Company’s data protection and data processing policy that the Company, acting as data controller, acknowledges as binding.
This Privacy Policy contains the principles for the processing of personal data provided by users on the Website and provides information to the data subjects on the processing of their personal data.
In drawing up the provisions of the Privacy Policy, the Company has, in particular, taken into account the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”), Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information for the Purpose of Approximation (“Info Act”), Act V of 2013 on the Civil Code (“Civil Code”), and Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (“CAA”).
From the point of view of the processing of your personal data, the Company functions as the data controller, that is to say the Company is responsible for the lawful processing of your personal data.
The Company may be contacted at:
Name: GE FOC I Ingatlanhasznosító Korlátolt Felelősségű Társaság
Postal address: 2051 Biatorbágy, Budaörsi út 4.
Registry number: 01-09-308903
E-mail address: info@premieroutlets.hu
Website: www.premieroutlet.hu
Telephone number: +36 23 449 700
The VIP Club may be joined by subscribing to the Company’s newsletter, which allows club members to apply for a VIP Club coupon book. In order to provide the newsletter service, the Company will collect personal data from you. The coupon book is not personalised, therefore it does not contain personal data.
Personal data is recorded electronically by the user filling in the appropriate panels and clicking on the sign-up confirmation button.
The Company places small data packets (“cookies”) on the user’s computer in order to provide customised services. The purpose of the cookies is to ensure that the site runs at the highest quality, to provide personalised services and to enhance user experience. The user can delete the cookies from his own computer or set his browser to disable the use of cookies. By disabling the use of cookies, the user acknowledges that without the cookies, the page in question will not run fully operational.
Cookies may have the following features:
The Website uses the Google Analytics web analytics service. Google Analytics uses performance enhancement cookies to help analyse how the Website is used.
When signing up for the VIP Club newsletter, we will record the following information:
Data marked with an asterisk is mandatory for subscribing to the newsletter. The above data are treated as personal data in accordance with both the GDPR and the Info Act.
The Website runs software for analysing attendance data, which receives automatically generated information about the visitors, such as:
The Website records these details of visits. According to the provisions of GDPR, the visitor’s IP address is considered personal data.
The purpose of handling personal data in connection with the provision of the VIP Club newsletter service is to provide you with periodic information about promotions currently available in Premier Outlet (2051 Biatorbágy, Budaörsi út 4), and information relevant to customers regarding Premier Outlet.
Purpose of cookies:
;
The Google Analytics Provider uses the information above to evaluate, analyse how the Website is used by you and other data subjects, to make reports on activities on the Website and provide other services related to the activities and internet use of the Website.
The legal basis for the processing of personal data as defined in point 4 is your, the data subject’s consent as defined in Article 6(1)(a) of the GDPR, both for the VIP Club newsletter service and for the use of cookies. Data processing is always voluntary. You may withdraw your consent at any time.
Consent to the processing of personal data is given by ticking the checkbox of confirmation of subscription (giving consent as stated in the Privacy Policy) in the process of subscription for the VIP Club newsletter electronically, while in respect of cookies it may be given by visiting the Website or by accessing the contents of the Website. You may withdraw your such consent given by implicit conduct by deleting the cookies from your computer at any time, or by setting your browser to disable cookies.
The Company processes your personal data for the purpose of sending advertisement newsletters until you unsubscribe from the VIP Club Advertising Newsletter, or if you do not otherwise request the deletion or do not restrict or prohibit the processing of your personal data.
Session cookies are automatically deleted by closing the browser. In all other cases, the Company processes your personal data until reaching the goal of using the specific type of cookie in question.
The Company records the personal data received in the process of subscription for the newsletter in the MailChimp newsletter and database administrator service provided by Rocket Science Group LLC, through which the Company sends newsletters to you.
Within the Company’s organisation, your personal data can be accessed only by those employees of the Company who are involved in the promotion and marketing activities of Premier Outlet. The Company handles all personal data as strictly confidential, and it is not disclosed or made accessible to third parties, not including the transfer of data to Rocket Science Group LLC, or to any employee of the Company who is not involved in the promotion and marketing activities of Premier Outlet.
In both of the above cases, recorded personal data is stored in a password-protected database, which is only accessible to certain specific persons and is protected by the most sophisticated firewalls and antivirus software. The database is only accessible to authorised employees with personalised, unique access password.
The Company entrusted ROS Ungarn Management Korlátolt Felelősségű Társaság (address: 2051 Biatorbágy, Budaörsi út 4, Hungary, e-mail address office@ros-management.com, phone number: +36 23 449 700) with the operation of Premier Outlet. In doing so, the ROS Ungarn Management Korlátolt Felelősségű Társaság handles, on behalf of the Company, the collection and storage of data related to the www.premieroutlet.hu website and perform the administrative tasks related to newsletters.
The Company contracted Dinamic Orange Tech Kft. (KREATiO.hu Stratégiai Online Ügynökség, address: H-1152 Budapest, Szentmihályi út 171. 3. em., Hungary, e-mail address:hello@kreatio.hu, phone number: +3620345-0393) to perform the IT tasks relevant to the www.premieroutlet.hu website, including the maintenance and development of the website.
The Company conducts the marketing of newsletters through the MailChimp newsletter and database administration service provided by Rocket Science Group LLC (675 Ponce de Leon Ave NE, Suite 5000; Atlanta, GA 30308 USA). The personal data recorded in MailChimp will be sent to and stored on the servers of Rocket Science Group LLC in the USA. Accordingly, the Company expressly draws your attention to the fact that your personal data is forwarded to a third country (USA) under the GDPR when using the MailChimp service.
Rocket Science Group LLC operates MailChimp’s newsletter system for the entire duration of data processing and does not process the data on its own behalf. As Rocket Science Group LLC does not process any data for its own benefit, hence it is considered a data processor.
The Rocket Science Group LLC participates in Privacy Shield, the general framework for governing the transatlantic exchange of personal data, and has completed its compliance with Privacy Shield (date of certification: 21 November 2016). Accordingly, the Company declares that Rocket Science Group LLC, as data processor, has appropriate and suitable safeguards for the processing of your personal data.
The Company conducts site visit analysis through Google Analytics provided by Google LLC (Google Privacy Centre: 1600 Amphitheatre Pkwy, Mountain View, California 94043). The information generated by the cookies on the use of the Website (the IP address of the web visitor) is transmitted to and stored by the Website on Google LLC USA servers. Accordingly, the Company expressly draws your attention to the fact that your personal data is forwarded to a third country (USA) under the GDPR when using the Google Analytics service. As Google LLC does not process any data for its own benefit, it is considered a data processor.
The Google LLC participates in Privacy Shield, the general framework for governing the transatlantic exchange of personal data, and has completed its compliance with Privacy Shield (date of certification: 25 November 2017). Accordingly, the Company declares that Google LLC, as data processor, has appropriate and suitable safeguards for the processing of your personal data.
You are entitled to receive, upon request, information from the Company as to whether your personal data is being processed and, if such data processing is in progress, to have access to such personal data and the following information:
Pursuant to the relevant legislation, we provide information relating to your personal data free of charge. We will respond to your request in writing within one month. However, where the request is manifestly unfounded or excessive, in particular because of its repetitive character, the Company may, taking into account the administrative costs of providing the information or communication or taking the action requested, either:
If you have already paid the costs as charged, but the data has been processed illegally or we are liable to correct your data as a result of your request, we will refund this fee.
If, despite our efforts to introduce advanced data security measures to protect personal data, anyone gains unauthorised access to personal data, changes, transmits, discloses, deletes, or destroys, or accidentally destroys or causes damage to, or otherwise processes your data unlawfully, upon request we will inform you of the circumstances of such incident, including when it happened, what effects it may have, and what we did to prevent or mitigate the consequences.
If the personal data we process is not accurate, we will correct it at your request without undue delay. You also have the right to request that your incomplete personal data be supplemented by a statement to this effect.
The Company shall delete your personal data without delay if:
You may also request us to delete your personal data by withdrawing your consent granted previously for data processing. In this case, however, we may refuse to provide services from that point, or certain services will no longer be available to you. For example, if you request the deletion of your e-mail address, we will not be able to notify you if your balance falls below a certain level or when your expiration date approaches.
Personal data will be blocked instead of deletion if you so request, or if it is assumed that the deletion may affect your legitimate interests. We do not process blocked data for the above purposes. We process such data only for the purpose that excluded deletion.
Restriction of data processing may occur if:
For the duration of assessing your complaint relating to the processing of your personal data – not exceeding 5 days – the Company will suspend the data processing, examine the merits of the objection and make a decision, and shall immediately inform you of such decision.
If the objection is justified, the data will be restricted by the Company, i.e. only storage, as data processing, is allowed unless
If you have requested the restriction of data processing, the Company informs you in advance when such restriction is lifted.
You have the right to receive your personal data, which you have provided to the Company, in a structured, commonly used and machine-readable format (i.e. .doc or .pdf) and have the right to transmit those data to another data controller without any obstruction from the Company.
If the Company refuses your request for rectification, restriction or erasure, we will inform you in writing within one month of receiving the request, of the reason why we were unable to comply with your request, and inform you of the judicial remedies available to you and also that you have the right to file a notice with the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information). We will respond by e-mail, subject to your agreement.
If you have concerns about the legality of data processing, you are entitled to object to data processing. The objection shall contain a request to terminate the processing of your data and to delete your data.
If you object to the processing of your personal data, the Company will investigate the reasons for the objection within one month, make a substantive decision, and notify you of its decision in writing.
If your objection is found well founded, all data processing operations will be terminated, the affected data will be blocked, and all persons to whom the personal data affected by the objection were previously forwarded shall be notified of the objection, including the ensuing measures. Those recipients are also required to take action to ensure that your objection is enforced. If you do not agree with our decision, or if the Company does not comply with the above-specified one month time limit, you may bring action in court within 30 days of the date of notification of the decision or the last day of the time limit.
If, in your opinion, the Company is in breach of the provisions of the GDPR in the processing of your personal data, you, as the data subject, have the right to file a complaint with a supervisory authority (i.e. any public authority established under Article 51 of the GDPR in any EU Member State) – in particular in the Member State where your habitual residence, place of work is situated or where the alleged infringement took place. In Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information) (hereinafter referred to as “NAIH” or “Authority”) functions as the supervisory body established in accordance with the criteria of Article 51 of the GDPR.
According to the GDPR, the supervisory authority concerned is the supervisory authority that is affected by the processing of personal data for one of the following reasons:
As regards the data processing operations of the Company, the NAIH functions as the competent supervisory authority in accordance with subparagraphs (a) and (b) above, given that the Company authorised to operate in the territory of Hungary, and that data processing principally concerns data subjects residing in Hungary. Accordingly, the following section details the possibility of lodging complaints with NAIH. Nevertheless, please note that, regardless of the above, you are entitled to lodge a complaint not only with the Authority, but with any supervisory authority established in an EU Member State.
Compliance with data protection laws is monitored by the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information). If you are of the opinion that our data processing operation is not in compliance with the applicable laws, or if you believe that there is an immediate risk thereof, you may notify the Authority at the following contact details.
Name of authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information)
Postal address: H-1125 Budapest, Szilágyi Erzsébet fasor 22/C.
E-mail address: ugyfelszolgalat@naih.hu
Phone number: +36 1 391 1400
Fax number: +36 1 391 1410
For more information on questions of data protection, please visit the Authority’s website: http://naih.hu/
Furthermore, we wish to point out that the Company is required to report any personal data breach (accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data) related to the Website without undue delay and, if possible, at the latest 72 hours after the personal data breach has come to our attention, to the Authority. When the personal data breach is likely to result in a high risk to the rights and freedoms of data subjects the Company shall communicate the personal data breach to you, as data subject, without undue delay.
If you consider that we have violated your right to privacy or that our decision relating to the objection was wrong or we have not responded, you may bring action in court. You may also decide to initiate a lawsuit before the court of your domicile or place of residence.
Moreover, in the event of suffering any loss as a result of the Company’s unlawful data processing or breach of data security requirements, you may lodge a claim for compensation against the Company in court under the conditions laid down in the relevant legislation. If we have violated your rights relating to personality, you may receive restitution, which may also be enforced in court.
In this context we are responsible for our data processor.
Annexes:
Annex 1: Brief summary of the Company’s data processing operations
Annex 1
Brief summary of the Company’s data processing operations
| Subscribe to VIP Club Advertising Newsletter
| Cookies
|
Scope of personal data processed | Data subject’s
| Data subject’s IP address.
|
Purposes of data processing | Sending advertisement newsletters related to information about Premier Outlet, and about promotional campaigns available in Premier Outlet.
| Enabling or facilitating sessions, improving user experience, customising, collecting statistical data.
|
Legal basis of data processing | Data subject’s consent in accordance with Article 6(1)(a) of the GDPR. | Data subject’s consent in accordance with Article 6(1)(a) of the GDPR.
|
Duration of data processing | Until the data subject unsubscribe from the advertisement newsletter sent by Premier Outlet. The data subject may unsubscribe from the advertisement newsletter sent by the Premier Outlet at any time. | In the case of session cookies, until leaving the Website, otherwise for the time strictly necessary to achieve the purpose of using the cookie. |
Your wishlist is empty