Arena Center Zagreb Ltd., a company with its registered office at Vice Vukova Street 6, 10 020 Zagreb, registered with the Commercial Court in Zagreb under registration number (MBS) 080572329, OIB: 83997642580, as the data controller, processes the personal data of respondents who choose to communicate with the profile of the Arena Center shopping center via the social network Facebook and its Messenger service in the following manner:

Processing Purposes:

1. handling notifications (communications) that you have provided to us when participating in various campaigns, events, or prize games (or prize competitions) organized at the shopping center (Arena Center or Arena Park), as well as ensuring the allocation and delivery of prizes that you have won in those campaigns, events, or prize games (or prize competitions); handling any complaints or requests related to your experience at the shopping center (Arena Center or Arena Park); archiving or resolving disputes, investigations, or any other requests, complaints, or proceedings in which our company is a party, conducting risk controls related to procedures and processes, as well as conducting audits or investigations at the company level. Categories of Personal Data Processed:

2. during the conduct of various campaigns, events, or prize games (or prize competitions), personal data specified in the rules of the respective event are processed, with the rules always being available on the Arena Center website (www.arenacentar.hr) or the Arena Park website (www.arenapark.hr); regarding any complaints or requests related to your experience at the shopping center (Arena Center or Arena Park), we process identification and contact information, as well as any other personal data you provide to us. Categories of Respondents Whose Personal Data is Processed:

3. visitors and clients of the shopping center (Arena Center or Arena Park); participants in campaigns, events, or prize games (or prize competitions); other individuals submitting any requests, complaints, or similar. Legal Bases for Processing:

We process your personal data based on your consent, or to take action at your request, or because processing is necessary for our legitimate interests, depending on what is applicable.

Categories of personal data processed:

• during various campaigns, events or prize games (or prize competitions), personal data specified in the rules of the respective event are processed, with the rules always available on Arena Centar website (www.arenacentar.hr), or Arena Park website (www.arenapark.hr);

• regarding any complaints or inquiries related to your experience at the shopping center (Arena Centar or Arena Park), we process identification and contact information, as well as any other personal data you provide to us.

Categories of data subjects whose personal data are processed:

• visitors and clients of the shopping center (Arena Centar or Arena Park);

• participants of campaigns, events, prize games (or prize competitions);

• other individuals submitting any requests, complaints, or the like.

Legal bases for processing:

We process your personal data based on consent, or to take actions at your request, or because processing is necessary for the purposes of our legitimate interests, depending on what is applicable.

Retention Period:

The personal data we process are stored for the period necessary to comply with legal obligations imposed by regulations relevant to our business activity.

Regarding personal data collected during the conduct of various campaigns, events, or prize games (or prize competitions), the processing terms (including the retention period) are always stated in the event rules, with the rules always being available on the Arena Center website (www.arenacentar.hr) or the Arena Park website (www.arenapark.hr).

Personal data collected when handling any complaints or requests related to your experience at the shopping center (Arena Center or Arena Park) are retained in accordance with applicable statutes of limitations (5 years).

Sharing of Personal Data:

Personal data received when communicating with the profile of the Arena Center shopping center via the social network Facebook and its Messenger service will be processed by NEPI Croatia Management Ltd., Vice Vukova Street 6, 10 020 Zagreb, OIB: 94739707578, as the data processor.

Additionally, provided personal data may be shared with:

• a law firm based in the Republic of Croatia;

• competent state authorities in accordance with the law;

• Drap Ltd., Vukovar Street 271, Zagreb, OIB: 41437879613;

• other companies operating within the NEPI Rockcastle group (more information about this group is available at the following link: https://nepirockcastle.com/portfolio/), for the purposes of consolidated group activity management and for audit purposes or when applicable regulations impose or permit such processing.

Rights of the data subjects with regards to the processing of personal data:

(a)  Right of access - the right to request confirmation that the personal data are processed or not by us, and if so, the data subject may request access to the data, as well as certain information about such data. Upon request in this respect, we will also issue a copy of the processed personal data. Request for additional copies will be charged on the basis of the costs actually incurred.

(b)  Right to rectification - the right to get the inaccurate personal data rectified, as well as to supplement incomplete data, including by providing additional information.

(c)   Right to delete data ("the right to be forgotten") - in situations expressly regulated by law, the right to obtain from us the deletion of the data. Thus, the deletion of personal data can be requested if:

• the data are no longer necessary for the purposes for which they were collected or processed;

• withdrawal of the consent on the basis of which processing is carried out;

• the data subject opposes to the processing under the right of opposition;

• processing of personal data is illegal;

• the data must be deleted for the purpose of complying with a legal obligation incumbent on us.

(d)  Right to restrict processing - the right to request the restriction of processing of personal data in certain circumstances expressly regulated by the law, as follows:

•     the accuracy of the data is contested, for the period when the accuracy of the concerned data is checked;

•     the processing is unlawful and the data subject opposes to the deletion of data;

•    the data subject needs these data to establish, exercise or defend certain rights in court, and our company no longer needs such data;

•   the data subject opposes to the processing of personal data for the period in which we check if our legitimate interests prevail over their interests, rights and freedoms.

In these circumstances, except for storage, the data will not be processed anymore.

(e)  Right to object to the processing of personal data - the right to object at any time, for reasons related to the particular situation of the data subject, to the processing (including the creation of profiles) based on our legitimate interest.

(f)    Right to data portability - the right to receive the personal data provided in a structured, automated readable format, and the right to request that the data be passed to another controller. This right applies only to personal data provided directly by the data subject to the controller, and only if the processing of personal data is done by automated means and is legally based on either the execution of a contract or the consent of that person,

(g)  The right to lodge a complaint - the right to lodge a complaint in relation to the methods of personal data processing. The complaint will be submitted to the Personal Data Protection Agency („AZOP“) – details available at https://azop.hr/zahtjev-za-utvrdivanje-povrede-prava/

(h)  Right of withdrawal of consent - the right to withdraw, at any time, the consent to the processing of personal data in cases where processing is based on consent. Withdrawal of the consent will only have effect for the future, and processing prior to the withdrawal remains valid.

(i)    Additional rights related to automated decisions used in the delivery of services - if automated decisions are made about personal data and these decisions significantly affect the data subject, the data subject can (a) obtain human intervention with respect to said processing, (b) express their point of views on such processing, (c) obtain explanations regarding the decision made and (d) contest such decision.

These rights (except the right to contact AZOP, which can be exercised under the conditions established by this authority – in this regard you can see the official website https://azop.hr/) may be exercised, anytime, either individually or by aggregation, sending a letter/message in the following ways:

•  by mail, at: Calea Floreasca nr. 169A, Floreasca 169, Cladirea A, etajul 5, Sector 1, București/Bucharest, Romania      

• by email, at: Protection@nepirockcastle.com

You can exercise the right to withdraw your consent for the transmission of direct marketing messages (newsletter) by e-mail, by accessing the dedicated unsubscribe link (unsubscribe), included in each message of this kind.