PERSONAL DATA PROTECTION STATEMENT
We take care of the privacy of our website visitors and City Center one shopping mall visitors, and in our business operation, we act in accordance with the legislation on data protection and in particular with the General data protection regulations applied from 25th May 2018.
This statement aims to inform you about why and how we process your personal data in the context of using our website or visiting our shopping malls, about the grounds on which we process your personal information and how we handle it, as well as the rights you can exercise in this context.
Who are we?
CC REAL d.o.o., Jankomir 33, Zagreb (“CC Real”), as the owner of citycenterone.hr website and the managing company of shopping malls City Center one in Zagreb and Split stands as a data processing representative and is responsible for processing your personal data. CC Real acts as an independent data processing representative in web analytics and cookies as well as prize contests and competitions (unless a certain prize contest or competition states otherwise). In other situations (described hereinafter), along with CC Real the companies acting as joint representatives that are taking responsibility for processing your data are the following:
- MANTA d.o.o., Jankomir 33, Zagreb, as the owner of shopping malls City Center one in Zagreb; and
- KAUFMANN and HOFMANN d.o.o., Jankomir 33, Zagreb, as the owner of shopping mall City Center one in Split.
In all cases, and pursuant to the agreement with other joint representative, CC Real is a contact point for any issues n connection of processing your personal data:
CC Real d.o.o.
Jankomir 33
HR-10000, Zagreb
Telephone number: 01 5494 054
Email: d.ozimec@cc-real.com
How, when and why do we process your personal data?
Who are the recipients of personal data?
In the framework permitted by law and depending on the processing activity, your details are delivered or disclosed to the following associates:
- IT service providers as part of software support and maintenance (e.g. BLINK d.o.o.);
- Providers of cloud software services(including the providers in the USA, e.g.The Rocket Science Group LLC);
- Billing service providers (AGENT CASH LTD) and banks;
- Security service providers in the Centres (Securitas Hrvatska d.o.o.) and support services in centre management (REIWAG Facility Services d.o.o.);
- Companies that own the centres and managing companies (Manta d.o.o. for Zagreb and Kaufmann and Hofman d.o.o. for Split);
- Business partners listed in this statement under the appropriate processing purpose.
In some cases, the recipients of personal data are located outside of the EU. As explained on case by case basis, in the section “Purposes for which we collect data and legal grounds for data collection“, in all cases of transferring personal data in such countries, adequate level of protecting personal data is ensured according to the law (e.g. recipient’s membership in “the Privacy Shield” programme in case of recipients in the USA, by signing standard contract clause with the recipient). Also, at any given moment you can request additional information on personal data transfer outside of the EU and safety measures which are applied when using our contact details.
How long do we keep your data?
Your data is kept only until there is a purpose for data storing and processing.
- Bookkeeping records (such as receipts and proof of collecting gift vouchers/prizes): 11 years (accounting regulations);
- Data obtained based on consent (such as e-mail address for newsletter): only until there is a valid consent;
- Database of potential lessees/business associates: up to 12 months;
- Visitors’ messages (positive comments, complaints, suggestions and so on): within the time needed to consider and reply to your message, depending on the content and our capacities (approximately 2 weeks). Records of consumer complaints is kept 1 year after the receipt of the written complaint (consumer protection legislation);
- Processed data that maybe subject to claims: in accordance with statutory limitations(up to 5 years);
- Prize contests and competitions: until there is a need to resolve complaints (depending on the time defined by the rules of prize contests/competitions), that is, longer in exceptional cases due to inspection or possible legal proceedings, in line with statutory limitations (up to 4-5 years);
- Video surveillance recordings: usually up to 15 days after being recorded. In case of incidents recorded on the video which was reported, a longer period can be required based on the need to carry out the legal proceedings;
- Legal proceedings: If legal proceedings occur, personal data necessary for enforcement is kept until the date of the final decision of the proceedings. Accepted claims are kept 10 years after the finality of the decision or a settlement (statutory limitations).
If there is a tax liability for particular type of data, required for the execution of the contract, the period of keeping the records is extended to 10 years in accordance with the tax regulations and processing of such data is limited in that particular period.
If the same data is used for several different purposes, we will keep it until the expiration of later retention period; however we will stop using it for other purposes for which (the shorter) retention period has expired.
After the data retention period expires, your data that is no longer needed is either irreversibly anonymized (and anonymized data can be kept) or deleted/destroyed in a safe way.
Your rights and how to exercise them
All our responders have the rights granted by personal data protection regulations.
You are granted the following rights:
- Right to withdraw a consent (when processing is based on consent)
- Right to access
- Right to delete (“right to be forgotten”)
- Right to make a correction
- Right to object
- Right to limit processing
- Right to transfer data
- Right to complain to competent authority
The enquiries and requests you send us will be processed without delay, in accordance with legal obligations, and you will be informed about the measures we have taken.
CC Real contact to exercise your rights: d.ozimec@cc-real.com
| Right to withdraw a consent | Newsletter recipients have the right to withdraw their consent at any moment free of charge:
|
| Right to access | You have the right to receive from us a confirmation on processing your personal data (including the copy of the data) as well as access to information regarding data processing (such as the purpose of processing, categories of personal data, recipients, period of keeping the data). In the case of transferring your personal data outside of the EU, you have the right to access information regarding appropriate safety measures. |
| Right to delete | You have the right to obtain from us personal data deletion, without delay, if there is no legitimate reason for further data processing (e.g. if the data is no longer necessary for the purposes it was previously processed for). If such a legitimate reason still exists, we will inform you in detail as part of our response to your request. |
| Right to make a correction | You have the right to obtain from us a correction in case your personal details are inaccurate, and we are obliged to correct it without delay. Taking into consideration the purpose of processing, you have the right to supplement incomplete personal data, by providing an additional statement. |
| Right to object | If data processing is based on realising our legitimate interests, you have the right to object in any given moment to such processing to the extent it relates to your personal data. In this event, we will not continue processing the data for the purposes relating to the objection, unless we prove that there are convincing legitimate reasons beyond your interests, rights and freedoms or if this is necessary to realize or defend our legal requirements. |
| Right to limit processing | You have the right to obtain from us certain restrictions regarding your personal data processing if: you dispute accuracy; processing is not legal, and you oppose deletion; you are asking for restrictions as to set up, realise or defend your legal requirements, and we no longer need your details for data processing; you have made an objection with regard to processing your personal data and you are expecting confirmation. |
| Right to transfer data | You have the right to receive your data that you provided to us, in a structured, commonly used and easy to read format, and you can transfer it to a different service provider. By doing so you have the right to direct data transfer from us to a different processing representative if this is technically possible. |
| CONTACT TO EXERCISE RIGHTS: | Specified rights can be exercised in the following way: d.ozimec@cc-real.com |
| COMPLAINT TO COMPETENT AUTHORITY | You can also exercise your rights by way of complaint to a supervising authority regarding the processing of your personal data. Croatian Personal Data Protection Agency, Martićeva ulica 14, 10 000 Zagreb, is the competent authority in the Republic of Croatia; find additional information on how to contact them on Agency’s website (http://azop.hr ). |
Amendments
With regard to our continued care regarding the protection of your data, it may happen that over the course of time we need to make some changes in this statement in order to align it with the actual situation or legal provisions. In case of significant changes, we will take appropriate measures to inform you in a timely manner of all such amendments.