Personal data processing

• Personal Data Processing on Facebook and Messenger
• Personal Data Processing at entering Arena Centar

Notice on Personal Data Processing on Facebook social network and Messenger network service

Arena Center Zagreb Ltd., Company seated at address Vice Vukova 6, 10020 Zagreb, registered at the Zagreb Commercial Court under number (CRN) 080572329, PIN: 83997642580, acting as the processing controller, processes personal data of data subjects who opt for Facebook and Messenger communication with the commercial center – Arena Centar Profile, in the following manner:

Purpose of Processing:

1. handling the notices (communications) provided by you when participanting in various campaigns, events or prize games (including prize contests) organized in the commercial center (Arena Centar or Arena Park), as well to ensure awarding and delivery of prizes won within such campaigns, events or prize games (including prize contests),
2. handling complaints or requests of any type regarding your experience at the commercial center (Arena Centar or Arena Park)
3. archiving, respectively settling disputes, investigations or any other petitions, complaints or other proceedings to which our Company is a party, conducting risk controls related to procedures and proceedings, as well audits or investigations at the Company level.

Processed Categories of Personal Data:

• During implementation of campaigns, events or prize games (including prize contests) the types of processed personal data are stated within the rules of the respective event, whereby the rules will always be available on the website of Arena Centar (arenacentar.hr), or Arena Park (www.arenapark.hr).

• Concerning any kind of complaints or requests regarding your experience in the commercial centre (Arena Centar or Arena Park) we process identification and contact data, as well as any other data that you have provided us with.

Categories of data subjects whose Personal Data is processed:

• visitors and clients of the commercial center (Arena Centar or Arena Park),
• participants in campaigns, events or prize games (including prize contests),
• other persons submitting any requests, complaints or similar.

Legal Grounds of Processing:

We process your Personal Data based either on your consent, or as to undertake actions per your demand or if the processing is necessary due to our legitimate interest, depending what is applicable.

Retention Period:

Personal data that we process is retained for the period necessary to comply with the legal obligations imposed by the regulations specific to our field of activity.

Regarding Personal Data collected during implementation of various campaigns, events or prize games (including prize contests), the conditions of processing (including also the retention period) are always stated within the rules of the event, whereby the rules will always be available on the website of Arena Centar (www.arenacentar.hr), or Arena Park (www.arenapark.hr)

Personal data collected when handling any kind od complaints or requests regarding your experience at the commercial centre (Arena Centar or Arena Park) are retained in accordance with applicable statutes of limitiation (5 years).

Sharing of Personal Data:

Personal data collected during communication with commercial centre profile – Arena Centar via Facebook social network and its Messenger service shall be processed by the company NEPI Croatia Management Ltd., Vice Vukova 6, 10020 Zagreb, PIN: 94739707578, as the Data Processor.

In addition, provided Personal data may be shared with:

• a law office seated in the Republic of Croatia,
• authorised state bodies in accordance with the legislation,
• company 404 Ltd., Radnička 37a, Zagreb, PIN: 95664694376,
• other companies operating within the NEPI Rockcastle group (more details on the mentioned group of companies are available at the following link: https://nepirockcastle.com/portfolio/), for purposes of consolidated management of group activities and for audit purposes or when applicable legislation impose or allow such processing.

Rights of data subjects whose Personal Data is processed:

1. Access Right – you are entitled to receive confirmation if Personal data concerning you is being processed, and if such data is being processed, access to that Personal data and certain information on the processing. Following the receipt of the demand, we shall also issue a copy of the Personal data we process. Requests for additional copies shall be charged per actually incurred costs.
2. Rectification Right – you are entitled to obtain rectification of inaccurate Personal data and to supplement Personal data, inter alia by providing additional data.
3. Data Deletion Right (“the right to be forgotten”) – under circumstances proscribed by the law, you are entitled to obtain deletion of Personal data concerning you. Accordingly, the deletion may be demanded if:

• • Personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed,
  • You withdraw the consent on which the processing is grounded and if there are no other legal grounds for the processing,
  • You object the processing,
  • Personal data is processed unlawfully,
  • Personal data must be deleted due to compliance with a certain legal obligation.

4. Right to Restrict the Processing – you are entitled to obtain restriction of processing if one of the following is met:

• • You challenge the accuracy of Personal data, for the period that enables us to review the accuracy of Personal data,
  • The processing is unlawful, and you oppose the deletion of the Personal data,
  • Personal data is not required from our side for the purpose of processing, yet you demand it in relation to submitting, achieving, or advocating the legal claims,
  • You have objected the processing for a period that enables us to review if our legitimate reasons for processing prevail over your interests or rights and freedoms.

In these circumstances, Personal data shall not be processed, but retained only.

5. Right to Object – you are entitled at any time, based on your particular situation, to file an objection to the processing (including the profiling) of Personal data that is based on our legitimate interest or, if applicable, when the processing is required for completion of duties in the public interest or when exercising public authorities entrusted to us. Promotion materials sent electronically may contain short notices regarding your right to object e Personal data processing for purposes of direct advertising. If you oppose the processing for purposes of direct advertising, your Personal data shall no longer be processed for such purposes.

6. Data Portability Right – you are entitled to receive Personal data concerning you, in a structured, commonly used, and machine-readable format and have the right to transfer such data to another processing controller. This right is applicable in case you have directly provided us with Personal data, the processing is carried out by automated means and is based on consent or required for the implementation of a contract.

7. Right of Complaint to the Authority – you are entitled to file a complaint on the manner of your Personal data processing. The complaint should be submitted to Personal Data Protection Agency, Martićeva 14, Zagreb (more details are available on the link: azop.hr).

8. Consent Withdrawal Right – in cases when the processing is grounded on the consent, you are entitled at any moment to withdraw the consent for Personal data processing. Consent withdrawal shall have effect for the future period only, i.e. the processing done before the withdrawal shall remain lawful.

9. Additional Rights Related to Automated Decision Making used in the delivery of services – if we use automated decision making in relation to your Personal data and such decisions affect you significantly, you are entitled to (a) obtain human intervention with respect to such processing, (b) express your point of view in relation to such processing, (c) obtain an explanation of the decision made and (d) contest such decision.

These rights (with exception of the right of complaint with Personal Data Protection Agency, which is exercised in the manner set by the Agency itself – for more details visit the official website www.azop.hr) are exercised, individually or collectively, by sending a notice or a message in the following manners:

• By postal service to Vice Vukova 6, 10020 Zagreb (to the attention of: Arena Center Zagreb Ltd.) or to Floreasca Business Park, Building A, 5^th floor, 169A Calea Floreasca, Bucharest 1, 014459, Romania (to the attention of: NEPI Rockcastle)
• By emailing to podataka@nepirockcastle.com or to data.protection@nepirockcastle.com.

Additionally, NEPI Rockcastle group has appointed, at the group level, a data protection officer that may be contacted in case of any kind objections or queries in relation to Personal data protection and exercising the rights in relation to Personal data protection. The Personal data protection officer may be contacted by sending a written, dated, and undersigned request, via contact details stated above.

Notice on Personal Data Processing at entering Arena Centar

Arena Center Zagreb Ltd., company seated in Zagreb, Vice Vukova 6, registered under number 080572329, PIN: 83997642580, hereinafter as “the Data Controller”, processes Personal data of data subjects who enter the premises of Arena Centar, as follows:

Purpose of Processing:

1. Fulfilling legal obligations as the building owner for ensuring safety of the property, for which purpose it had decided to use video-surveillance of the public areas by using a surveillance camera system mounted in the premises, on common areas, access routes, parking lot.
2. Resolving requests for obtaining data and information received from authorized bodies.
3. Archiving, resolution of disputes, investigations, and other requests/complaints in which our Company is participating, as well as carrying out a control of risk assessment pertaining to procedures and proceedings, audits or investigations on the Company level.
4. Enabling a free access to a Wi-Fi network.
5. Participation in the commercial centre advertising campaigns and awarding of the prizes won within such campaigns (e.g. signing of the handover minutes, etc.).
6. Resolving of complaints submitted in the commercial centre (e.g. Complaint Forms, etc.).
7. Processing of lost & found requests submitted in the commercial centre (e.g. Lost & Found Forms, etc.).

Categories of Processed Data:

• In terms of using the video-surveillance system: pictures of data subjects
• In terms of accessing free Wi-Fi: device MAC
• In terms of resolution of disputes, investigations, and other requests/complaints – identification data and other data that may be processed depending on the nature of dispute, investigation, or complaint
• In terms of prize contests/prize games of the commercial centre – categories of data which are processed shall be stated within the rules of the prize contest/prize game published on the website of the commercial centre (arenacentar.hr)
• In terms of complaints – identification data you have provided within the Complaint Form
• In terms of lost & found requests – identification data you have provided within the respective form.

Categories of data subjects whose Personal Data is processed:

• Visitors / clients of the commercial centre
• Staff of commercial centre tenants
• Staff of service providers / partners / collaborators of the Data Controller and/or the tenants and/or the Data Processor
• Staff and collaborators of the Data Controller / Data Processor
• Employees of public bodies and other auhorities.

Legal Basis for the Processing:

In respect of the above-mentioned, we process Personal data of data subjects which work in or are just visiting the commercial centre, as applicable, and on the basis of:

• Legal obligations of the Data Controller (e.g. protection of property and other assets, protection of individuals, resolving of requests placed by data subjects and/or the competent authorities)
• Data subject consent (e.g. participation in the campaigns)
• Legitimate interest of the Data Controller (e.g. processing within the group of companies to which the Data Controller belongs).

Retention Period:

Processed Personal data is retained for a time-period which is sufficient for the compliance with the legal obligations imposed by legislation pertaining to our business operation.

Regarding video-recordings, they are usually retained for 15 (fifteen) days, unless the prolongation of their processing period is foreseen under the law or justified by legal proceedings (e.g. because the recording is evidence in judicial, administrative or similar proceeding).

Device MAC is retained only during the period when the device is using the Wi-Fi network.

In respect of commercial centre campaigns (e.g. prize games and prize contests), the conditions of data retention are stipulated within the rules of the respective campaign (e.g. rules of the prize game or rules of the prize contest), as published on the website of the commercial centre.

Third-Party Access:

For ensuring video-surveillance, the owner of the centre cooperates with companies specialised and certified according to the law for carrying out such activities.

Personal data processed in such a manner may also be provided to the competent authorities and institutions, in compliance with the legislation, or processed within NEPI Rockcastle Group, for group management activities, audit purposes and in all other occasions where legislation imposes or allows such processing.

In respect of commercial centre campaigns and events, as well as for resolving complaints and/or Lost & Found demands, if submitted at commercial centre Info-desk, the Data Controller usually cooperates with specialised third parties (e.g. media partners).

The rights of data subjects whose Personal Data are processed, are the following:

1. Access Right – you are entitled to request confirmation if we process your Personal data, and in case we do, you may demand access to them, as well as additional information on the processing. Following the request, we shall issue a copy of processed Personal data. A request for additional copies shall be charged per occurred cost.

2. Rectification Right – you may rectify, or supplement, inaccurate and incomplete Personal data including by providing additional data.

3. Data Deletion Right (“the right to be forgotten”) – Personal data deletion may be requested in situations governed by the law. Hence, the deletion may be demanded if:

• • data is no longer necessary in relation to the purpose for which it was collected or processed,
  • the consent, based on which the processing was done, is be withdrawn and there are no other legal grounds for the processing,
  • the data subject objects the processing,
  • processing of Personal data is prohibited by law,
  • data must be deleted due to compliance with a mandatory obligation that we are subject to.

4. Right to Restrict the Processing –the restriction of Personal data may be demanded situations proscribed under the law, as follows:

• • You challenge the accuracy of the data, for the period that enables us to review the accuracy of the respective data,
  • The processing is unlawful, and you oppose the deletion of the data,
  • You require data to determine, use, or advocate rights before court, and we no longer require the data,
  • You have objected the processing for a period in which we review if our legal interest prevails over interest of your rights and freedoms.

In these situations, except for the data retention, the data shall not longer be processed.

5. Right to Object to Personal Data Processing – you may object ,at any time, for reasons that are concerning you (including the profiling) the processing grounded on our legitimate interest or, where appropriate, on our completion of a public interest duty or one which is a result of exercising authority of a public body, to which we are affiliated.

Promotion materials sent electronically may contain short notices on your possibility to object the Personal data processing for purposes of direct advertising. If you object the processing for purposes of direct advertising, your Personal data shall no longer be processed for this purpose.

The right to object to the activities of direct advertising is possible when Personal data processing for direct advertising purposes is based on (i) our legitimate interest, or (ii) the effective contractual relationship with us and pertaining to products similar to those which are the subject of the contract, in relation to which the consent was not provided.

6. Data Portability Right – you may receive Personal data in a structured, readable format, and may request a transfer of data to another processing controller. This right pertains only to Personal data you have directly provided us, and only if the processing was made automatically and is legally grounded on the contract delivery or the consent provided from the respective data subject.

7. Right of Complaint – you may file a complaint regarding the manner in which we were processing your Personal data. The complaint should be submitted to the Personal Data Protection available on azop.hr.

8. Consent Withdrawal Right – where the processing is based on the consent, you may withdraw your consent for Personal data processing at any time. Consent withdrawal shall have effect for a future period only, whilst the processing done before the withdrawal shall remain valid.

9. Additional Rights Related to Automated Decision Making used in the delivery of services – if we pass automated decisions on Personal data and such decisions affect you significantly, you may (a) request an intervention with respect to referred decision, (b) express your opinion on such processing, (c) receive explanations on decisions made and (d) contest such decision.

These rights (except the right to contact AZOP, which may be realised under conditions determined by the referred institution itself – on this issue visit official website www.azop.hr) may be exercised, individually or collectively, by sending a notice/message in the following manner:

• By postal service to: Vice Vukova 6, 10020 Zagreb, Republic of Croatia (to the attention: Arena Center Zagreb Ltd.),
• By emailing to podataka@nepirockcastle.com.

Additionally, a data protection officer (“DPO”) is appointed at the Group level and may be contacted for any objections or queries with regard to Personal data protection and exercising rights in relation to data protection. The DPO may be contacted in written form, via dated and undersigned notice, using the contact details stated above.

The above-mentioned Personal data is processed by NEPI Croatia Management Ltd., Vice Vukova 6, Zagreb, PIN: 94739707578, acting as Data Processor.