PRIVACY POLICY

PREMIER GIFT CARD 

Date of publication: 29.03.2018

1. Preamble

GE FOC I Ingatlanhasznosító Korlátolt Felelősségű Társaság (registered seat: 1134 Budapest, Váci út 33.; company registration number: 01-09-308903; “the Company”), as the owner of Premier Outlet (2051 Biatorbágy, Budaörsi út 4.; “Premier Outlet”) issues gift vouchers (“Premier Gift Card”) that can only be used to purchase goods and services in Premier Outlet stores participating in the Premier Outlet Premier Gift Card program.

The Premier Gift Card can be claimed and topped up at the information desk at Premier Outlet after pre-registration. After pre-registration the Premier Gift Card can be claimed and topped up in person at the information desk at Premier Outlet.

During the registration preceding the issuance of the Premier Gift Card we record your personal data. The purpose of this privacy policy (the „Policy”) is to inform you as a data subject about every data protection aspect important from a legal perspective regarding the processing of your data collected during the pre-registration process in accordance with the provisions of Regulation 2016/679 of the European Parliament and of the Council („GDPR”) and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information („Data Protection Act”).

2. The data controller

The Company processes your personal data and, as a data controller, is liable for their lawful processing.

You can contact us using the contact details provided below:

Name of the company: GE FOC I Ingatlanhasznosító Korlátolt Felelősségű Társaság

Postal address: H-2051 Biatorbágy, Budaörsi út 4.,

Company register no.: 01-09-308903

E-mail address:ajandekkartya@premier.hu

Website:www.premieroutlet.hu

Phone number: +36 23 449 700

3. Brief introduction of the processing

During the registration process preceding the issuance and topping-up of the Premier Gift Card, we collect personal data from you for the purpose of operating the Premier Gift Card system. If you specifically give your consent, we also collect personal data from you for the purpose of sending you Premier Outlet marketing newsletters.

The Company also gives you the chance during the registration preceding the issuance of the Premier Gift Card to request the card for someone else. If you request the Premier Gift Card for yourself, we collect your data, and if you request it for someone else, we collect the data of the person indicated by you. By providing your data you warrant that the data provided is appropriate, exact and complete, and that, if you provide someone else’s data, you have the appropriate authorisation to do so. Hereinafter the claimant and the user of the Premier Gift Card are uniformly referred to as “Data Subject”.

The recording of data takes place on paper, by filling out a registration form dedicated to this purpose.

4. What kind of personal data we record

• We collect the following data during the registration preceding the issuance and topping-up of the Premier Gift Card:

• name* (for your identification);
• address (for sending the Premier Gift Card); and
• e-mai address (to notify you in advance about the expiry date or if your balance has fallen below a certain threshold );
• the following data in relation to the Premier Gift Card: card number, the amount uploaded, the amount available, date and amount of purchases, expiry date (for settlement purposes).

According to the provisions of the GDPR and the Data Protection Act, the data mentioned above qualify as personal data.

• If the Data Subject specifically gives their consent to the processing of data for marketing purposes by subscribing to the newsletter, we also collect the following data:

• name (for identification and form of address);
• sex (for sending the suitable newsletter);
• date of birth (for sending the suitable newsletter);
• postcode (for sending the suitable newsletter);
• e-mail address (for sending the newsletter).

According to the provisions of the GDPR and the Data Protection Act, the data mentioned above qualify as personal data.

5. For what purpose we collect your personal data

The Company records personal data for the safe operation of the Premier Gift Card system and for the Data Subject to exercise their rights regarding the Premier Gift Card.

The recording of personal data serves the purpose of linking the Data Subject to the requested Premier Gift Card. This link makes it possible for the Company to:

• block the Premier Gift Card upon the request of the Data Subject if the card is lost or stolen;

• carry the balance over to a new Premier Gift Card upon the request of the Data Subject if the previous card becomes unusable;

• make the current balance of the Premier Gift Card available to the Data Subject; or

• notify the Data Subject via e-mail if the Premier Gift Card’s balance has fallen below a certain threshold or if the card’s expiry date is close.

In addition to the above, if the Data Subject also gives their consent to the data processing for marketing purposes during the pre-registration by subscribing to the Premier Outlet newsletter, the purpose of the data processing is also to notify the Data Subject from time to time about the promotions available at Premier Outlet and about information deemed relevant from the customer’s point of view regarding Premier Outlet.

6. Legal basis of the processing

Both in the case of the operation of the Premier Gift Card system and the Premier Outlet newsletter, the lawfulness of processing the personal data specified under section 4 is based on the consent of the Data Subject, in accordance with article 6 (1) a) of the GDPR. The processing is based on freely given consent in each case. You are entitled to withdraw your consent anytime.

The consent to processing is given by the Data Subject on paper during the pre-registration process, by filling out the registration form dedicated to this purpose.  

7. Term of the processing

The recording of personal data takes place during the application for the Premier Gift Card, during pre-registration.

The Premier Gift Card’s period of validity is 12 months from top-up. Following the expiry of the Premier Gift Card, we process the Data Subject’s data for no longer than 5 working days from expiry.

If the Data Subject also gives their consent to the Company to process their data for the purpose of sending newsletters, we process the data until the Data Subject unsubscribes from the newsletter or otherwise requests their personal data to be erased.

8. Data security measures

The data recorded by the Company during the application for the Premier Gift Card is processed at the Company’s and the data processor’s registered seat.

During the operation of the Premier Gift Card system, only the Company’s employees and the employees of its authorised data processors participating in the operation of the Premier Gift Card system can have access to the personal data. The Company and the data processors keep personal data confidential, they do not make them public or grant access to third parties or to employees of the Company or the data processor not participating in the operation of the Premier Gift Card system.

The Company records the personal data collected during the subscription to the newsletter in the MailChimp newsletter sender and database manager service provided by Rocket Science Group, LLC, through which service the Company sends you the newsletter.

Within the organization of the Company only employees participating in the promotion and marketing activities of Premier Outlet have access to your personal data. The Company keeps personal data confidential; we do not make them public or grant access to third parties, with the exception of the data transmitted to Rocket Science Group, LLC, or to employees not participating in the promotion and marketing activities of Premier Outlet.

In both cases mentioned above we store personal data on a server only accessible to certain individuals and in a password-protected database, both of which are protected by the latest firewalls and antivirus software. The database is only accessible by authorized employees and the password enabling access is customized and personal.

Personal data recorded on paper regarding newsletter services is uploaded to the server of the Company by its employees, while in the case of personal data regarding the Premier Gift Card is uploaded by the employees of the Company or its authorised data processor. Personal data collected during online registration is transmitted via private communication network to the server. The storing of personal data is constantly monitored by the Company’s highly skilled system administrators for safety.

9. Data processors

• Operation

The Company engaged ROS Ungarn Management Korlátolt Felelősségű Társaság (address: 2051 Biatorbágy, Budaörsi út 4., Hungary, e-mail address: [***], phone number: +36 23 449 700) to operate Premier Outlet. ROS Ungarn Management Korlátolt Felelősségű Társaság records and stores data related to the operation of the Premier Gift Card system and carries out the administrative tasks in connection with newsletter sending on the instruction of the Company.

• Premier Gift Card

The Company engaged CardMaster On-Line Korlátolt Felelősségű Társaság (address: 1146 Budapest, Thököly út 79. 2. em. 7A., Hungary, e-mail address: kabai.petik@t-online.hu, phone number: +36 30 509 9260) to operate the Premier Gift Card system.

During the operation of the Premier Gift Card system, Card Master On-Line Kft.:

• • operates the accounting system between the Company and the stores accepting the Premier Gift Card;

• • maintains the balance of each Premier Gift Card, as well as debiting them when used;

• • provides you access to your Premier Gift Card balance; and

• • notifies you if the balance of your Premier Gift Card has fallen below a certain threshold or if the expiry date is close

Card Master On-Line Kft. operates the Premier Gift Card system for the entire duration of the data processing, and it does not process data on its own behalf. Accordingly, Card Master On-Line Kft. qualifies as a data processor.

• Newsletter

The Company carries out its newsletter-related marketing activities through the MailChimp newsletter sender and database manager service, provided by Rocket Science Group, LLC (675 Ponce de Leon Ave NE, Suite 5000; Atlanta, GA 30308 USA). The personal data recorded in MailChimp are being transmitted to and stored on the servers of Rocket Science Group, LLC, located in the USA. Accordingly, the Company explicitly draws your attention to the fact that using the MailChimp services entails the transmission of your personal data to a third country (USA) as per the GDPR.

Rocket Science Group, LLC operates the MailChimp newsletter sender services during the whole term of the processing, and it does not process data on its own behalf. Accordingly, Rocket Science Group, LLC qualifies as a data processor.

Rocket Science Group, LLC does not only participate in the Privacy Shield framework regulating the transatlantic commerce of personal data, but also certified its compliance for this purpose (date of certification: 21/11/2016). Consistently, the Company declares that Rocket Science Group, LLC, as a data processor, possesses the adequate and appropriate guarantees for the processing of your personal data.

10. Your rights and your right to remedies

• Your right as a data subject in connection with the processing of your personal data

• Right to information and access to personal data

You are entitled to obtain from the Company confirmation as to whether personal data concerning you are being processed, and, where that is the case, to access to the personal data and the following information:

• the purposes of processing;
• the categories of personal data concerned;
• the recipients or categories of recipient to whom the personal data have been or will be disclosed (in particular the data processors);
• the envisaged period for which the personal data will be restored;
• your rights in relation to the processing of your personal data;
• where the personal data was not collected from you, any available information as to their source;
• information regarding automated decision-making.

Under the applicable legislation we provide the information on the processing of your personal data free of charge. We respond to your request in writing within a month. However, if such request is manifestly unfounded or excessive, in particular because of its repetitive character, the Company may either, taking into account the administrative costs of providing the information or communication or taking the action requested:

• charge a reasonable fee; or
• refuse to act on the request.

If, after paying the fee, it turns out that the processing was unlawful, or upon your request we are obliged to correct your data, we will reimburse you the fees already charged.

If, despite our best efforts to protect your personal data, someone unlawfully gains access to, changes, transmits, publishes, erases, destroys or causes unintended erasure or injury to your personal data or otherwise processes them unlawfully, we, upon your request, will inform you about the conditions of such incident, including the date, the possible effects and our measures to prevent or to mitigate the consequences.

• Right to rectification

If the data we process are not correct, we will rectify them at your request without undue delay. You are also entitled have incomplete personal data completed, including by means of providing a supplementary statement.

• Right to erasure

The Company erases your personal data without delay, if:

• the personal data are no longer necessary in relation to the application for the Premier Gift Card and the use of it;

• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation concerning the Company;
• the person exercising parental authority over a children under 16 has not consented to the processing;
• where the Company has made the personal data public.

You are also entitled to request the erasure of your personal data by withdrawing the consent you previously gave to us. However, in such case we may refuse to further provide you certain services and/or certain services will not be available to you hereinafter. For example, if you request the erasure of your e-mail address, we won’t be able to notify you if your balance has fallen below a certain threshold or if the expiry date is close.

Instead of erasing, we block your personal data if you request so, or it can be assumed that erasure would have an impact on your legitimate interests. We do not process blocked data for the above purposes. We only process blocked data for the purpose that excluded the possibility of erasure.

• Right to restriction of processing

Data processing may be restricted if:

• you contest the accuracy of the personal data, for a period enabling the Company to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and requests the restriction of their use instead;
• the Company no longer needs your personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims;
• you have objected to processing, pending the verification whether the legitimate grounds of the Company override yours.

For the duration of the evaluation of your objection, but not more than for 5 days, the Company suspends the processing, assesses the merits of your objection and makes a decision, about which the Company informs you without delay.

If the objection is justified, the Company restricts your data, i.e. only restoring as a means of processing can be carried out as long as

• • you consent to the processing;
  • your data is necessary for enforcing your legal claims;
  • processing becomes necessary in order to the defend the rights of a natural or a legal person; or
  • processing is ordered by law in the public interest.

If you requested your personal data to be restricted, the Company will notify you prior to the lifting of the restriction.

• Right to data portability

You have the right to receive the personal data concerning you, which you have provided to the Company, in a structured, commonly used and machine-readable format (e.g. .doc or .pdf) and have the right to transmit those data to another controller without hindrance from the Company.

• What happens and what can you do if we reject your request?

If the Company rejects your request for the correction, restriction of erasure of your personal data, within 1 month of receiving your request we will inform you in writing why we could not comply with your request and we will inform you about your possibilities of judicial remedy and that you may submit a notice to the Nemzeti Adatvédelmi és Információszabadság Hatóság (the National Authority for Data Protection and Freedom of Information). If you agree, we will send our reply via e-mail.

• What are your rights if you think the data processing is unlawful?

If you have some concerns regarding the lawfulness of the data processing, you have the right to object to it. Your objection should include a request for us to stop processing your data and to erase them.

If you object to the processing of your data, the Company will examine the reasons of your objection within one month and will make a decision, regarding which the Company notifies you in writing.

If we find your objection to be valid, we stop every data processing operation, block the data concerned and inform about the objection and the following measures taken everyone to whom we transmitted the personal data concerned by the objection. These recipients should also take the necessary actions for your objection to prevail. If you disagree with our decision or if the Company fails to comply with the abovementioned one month deadline, you may turn to the courts within 30 days either from the notification on the decision or from the last day of the deadline[JS1] .

• What are the legal remedies available to you?

If you find that during the processing of your data our Company breaches the provisions of the GDPR, it is your right as a data subject to lodge a complaint before a supervisory authority (i.e. before any public authority set up by any of the EU member states in accordance with section 51 of the GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. In Hungary the supervisory authority set up in accordance with section 51 of the GDPR is the Nemzeti Adatvédelmi és Információszabadság Hatóság (the Hungarian National Authority for Data Protection and Freedom of Information; “NAIH” or “the Authority”).

In accordance with the GDPR, a supervisory authority concerned means a supervisory authority which is concerned by the processing of personal data because:

1. the controller or processor is established on the territory of the Member State of that supervisory authority;
2. data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing; or
3. a complaint has been lodged with that supervisory authority.

In connection with the data processing carried out by the Company, under points a) and b) mentioned above, the supervisory authority concerned is NAIH, given that the Company is established in Hungary and the data subjects affected by the processing are predominantly residing in Hungary. Accordingly, in the sections below we inform you about complaint procedure of NAIH. However, please note that given the reasons mentioned above, you nevertheless have the right to lodge a complaint before any supervisory authority set up by one of the EU member states, not just before the Authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement.

• Notification to the Hungarian National Authority for Data Protection and Freedom of Information

Compliance with data protection legislation is supervised by the Hungarian National Authority for Data Protection and Freedom of Information. If you find that our data processing does not comply with the applicable law, or there is an imminent danger of non-compliance, you can lodge a complaint before the Authority through the following contacts:

Name of the authority: Nemzeti Adatvédelmi és Információszabadság Hatóság

Postal address: H-1125 Budapest, Szilágyi Erzsébet fasor 22/C.

E-mail address:ugyfelszolgalat@naih.hu

Phone number: +36 1 391 1400

Fax number: +36 1 391 1410

For further information regarding data protection go to the website of the Authority: http://naih.hu/

Please note that in the case of a personal data breach (i.e. a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed), the Company shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the Authority. If the personal data breach is likely to result in a high risk to the rights and freedoms of data subjects, the Company shall communicate the personal data breach to you as a data subject without undue delay.

• Judicial proceedings for pursuing claims

If you find that your right to privacy has been infringed by us, or our decision regarding your objection was incorrect or we did not reply to your objection, you have the right to turn to the courts. The appeal falls into the jurisdiction of the regional courts. You may also decide to initiate the proceeding before the regional court of your domicile or habitual residence.

Furthermore, in accordance with conditions laid down in by law, if our unlawful data processing or breach of security requirements caused damages to you, you may enforce your claim for compensation against the Company before courts. In addition, if we violated your rights relating to personality, you shall be entitled to restitution, which is also enforceable before courts.

In this respect, we are responsible for our data processors.

Annexes:

Annex 1: Brief summary of the Company’s processing

Annex 1

Brief summary of the Company’s processing

 [JS1]With the amendment of the Data Protection Act this provision could change. In case this happens, the Policy should be amended as well.