Specific purpose	Personal data involved	Legal basis	Retention period	Rights The available rights depend on the legal basis
Management of your registration to the Loyalty Program	Directly provided by you: Mandatory : Title, Name, surname, e-mail address, birth date Optional : phone number, License plate, information regarding the fact that the data subject is working in the shopping centre area. Provided to us by a third party : N/A	Execution of a contract (Terms of Use of the Loyalty Program) the GDPR Article 6(1) b	3 years from last digital contact or use of the Services	Access Rectification Deletion Limitation of the processing Portability Instructions regarding the further processing of your personal data after your death.
Management of the participation to events organized by the shopping Centre   Please note that we might send you communication to allow you to participate to the event (example : if the event requires you to have a proof of registration to enter it)	Directly provided by you : e-mail address, name, surname, phone number   Provided to us by a third party : N/A	Legitimate interest of the data controller to offer the opportunity for the members of the Loyalty Program to participate to events organized to their attention and ensure the security of such event the GDPR Article 6(1)f	6 months after the event	Access Rectification Deletion Limitation of the processing Objection to the processing Instructions regarding the further processing of your personal data after your death.
				Access Rectification Deletion Limitation of the processing Portability Instructions regarding the further processing of your personal data after your death.
Loyalty Points Collection See details in article 3.2	Directly provided by you : N/A Provided by Transaction Connect : amount, date and shop of purchase	Execution of a contract (Terms of Use Loyalty Program)	3 years from last digital contact or use of the Services	Access Rectification Deletion Limitation of the processing Portability Instructions regarding the further processing of your personal data after your death.
Management of the offers and benefits of the Loyalty Program free access to services (in conditions detailed in the Terms of Use of the Loyalty Program): parking Boobaloo toilets loan of objects (strollers, umbrella) birthday present	Directly provided by you : Loyalty card number , bar code, name, surname, birthdate Provided to us by a third party : N/A	Execution of a contract (Terms of Use Loyalty Program)   the GDPR Article 6(1) b	No storage for the use of the offers and benefit.   If the Loyalty Card is scanned (never for the use of the toilets) we may retain your date of visit and type of services/offer used	Access Rectification Deletion Limitation of the processing Portability Instructions regarding the further processing of your personal data after your death.
Participation to contests organized for loyalty members	Directly provided by you : Loyalty card number, name, surname, birthdate, Personal information that may be contained in the contest itself (answers to questions)   Provided to us by a third party : N/A	Execution of a contract (Rules of contest)   the GDPR Article 6(1) b	1 month after delivery of the prizes to the winner(s)	Access Rectification Deletion Limitation of the processing Portability Instructions regarding the further processing of your personal data after your death.
Granting of rewards for loyalty members who have activated the Loyalty Point Collection (example : prize granted to a member randomly chosen among the person who have spent at least [amount to be determined] euros during a given time – specific communication to members within the scope would be made)	Provided by Transaction Connect : amount, date and shop of purchase	Legitimate interest of the Data Controller to manage the program in order to increase its database and the amount spent in the shopping center and legitimate interest of the members to win prizes the GDPR Article 6(1) f	No specific data retention as the information are retained in the framework of the Loyalty point collection – see below	Access Rectification Deletion Limitation of the processing Objection to the processing Instructions regarding the further processing of your personal data after your death.
Management of the communication for information purpose in relation with the Loyalty Program (example : information about an event accessible only to the loyalty members)	Directly provided by you : Loyalty card number , title, name, surname, e-mail address Phone number (optional) Provided to us by a third party : N/A	Execution of a contract (Terms of Use Loyalty Program) the GDPR Article 6(1)b	3 years from last digital contact or use of the Services	Access Rectification Deletion Limitation of the processing Portability Instructions regarding the further processing of your personal data after your death.
Management of commercial communication : By e-mail and/or sms if you have provided us with your mobile phone number	Directly provided by you : e-mail address phone number (optional)   Provided to us by a third party : N/A	Consent the GDPR Article 6(1) a	3 years from last digital contact or use of the Services or until withdrawal of the consent, whatever occurs first	Access Rectification Deletion Limitation of the processing Objection to the processing Portability Withdrawal of consent Instructions regarding the further processing of your personal data after your death.
Analysis of your information/use of the services : to provide you with personalized offers; and to improve our understanding of your expectations and needsand develop new features and services Please note in this perspective, we will combine the personal data listed in the relevant column.	Obtained directly from you : all information that may be provided by you. Obtained from your activity : Behaviour on the website (cookies) Participation to events organized by the shopping centre, Your use of the wifi : date of visit of the shopping center Your use of the Loyalty Point Collection When your Loyalty Card is scanned for the use of a services or the participation to an event in the Shopping Center	Legitimate interest of the Data Controller to better understand the customer in order to deliver appropriate services and/or offers and legitimate interest of the loyalty members to receive personalized offers and services. the GDPR Article 6(1) f   please note that : - cookies are collected on the legal basis of your consent only (the GDPR Article 6(1)(a) - information related to your use of the wifi are collected on the legal basis of your consent only (the GDPR Article 6(1)(a) => but the analysis of those information as described here is made on the basis of legitimate interest ( the GDPR Article 6(1)(f)	3 years from last digital contact or use of the Services	Access Rectification Deletion Limitation of the processing Objection to the processing Portability Instructions regarding the further processing of your personal data after your death.
Geolocation (within the shopping center only – via the Shopping center application)	Directly provided by you : Provided by the use of the service : location data inside the shopping centre Provided to us by a third party : N/A	Consent (given via Shopping Center application) the GDPR Article 6(1) a	No storage of your geolocation will be made by Us.	Access Rectification Deletion Limitation of the processing Portability Withdrawal of consent Instructions regarding the further processing of your personal data after your death.
Answer to the loyalty members requests related to personal data	Directly provided by you : Name, surname, e-mail address, number of loyalty member or copy of ID Card, if applicable   Provided to us by a third party : N/A	Legal obligation the GDPR Article 6(1), c	The civil year of reception, plus 5 years   If your ID card is requested, it will be deleted right after the check of your identity	Access Rectification Limitation of the processing Deletion Instructions regarding the further processing of your personal data after your death.
Obtain a feedback from you on our services	Directly provided by you : answers to a questionnaire in respect with the appreciation of the services provided by us.	Legitimate interest of the data controller to better understand the customer and improve the services and deliver appropriate services and/or offers the GDPR Article 6(1) f)	3 years from last digital contact or use of the Services	Access Rectification Deletion Limitation of the processing Objection to the processing Instructions regarding the further processing of your personal data after your death.
Establishment, exercise or defence of legal claims (for example where a law enforcement body or regulatory body are investigating a crime or incident)	Relevant personal data related to the claim or litigation	Legitimate interest of the data controller to ensure its defence; the GDPR Article 6(1), f)	Legal time limit depending on the type of claim/litigation	Access Rectification Deletion Limitation of the processing Objection to the processing Instructions regarding the further processing of your personal data after your death

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

3.2 Specific provisions – Loyalty Points Collection

As part of a special functionality of the Loyalty Program to activate, please note that you have the possibility to subscribe to the Loyalty Points Collection. Under the Loyalty Points Collection, you may be entitled to get cashbacks, depending upon purchases you make in the shopping centre. The activation of the Loyalty Points Collection is optional and you remain completely free to activate this feature of your Loyalty Program or not. For further information, please see the Terms of Use of the Loyalty Program: https://fr.westfield.com/en/lapartdieu/termsofuse

For the purposes of organizing, managing and implementing the cashback payments resulting from your transactions as well as analyzing the payment flows resulting from your use of the Loyalty Points Collection, please note that Transaction Connect (a French company with headquarters at 86, rue du faubourg St Denis 75010 Paris, and registered with the Registry of Commerce and Companies of Paris under number 822 619 185) alone shall be deemed acting as independent data controller with respect to the concerned processing of your personal data. For sake of clarity, both us and Transaction Connect are individually responsible for the processing of your Personal data for the purpose of the Loyalty Points Collection.

You can find additional information about the processing activities implemented by Transaction Connect, including information about your rights as a data subject, by clicking on https://tc-front.transactionconnect.com/resources/4t/fr/POLICY.pdf.

Please note that, in any event, we are not responsible for the processing activities implemented by Transaction Connect acting as data controller. Consequently, any claims or requests relating to the processing carried out by Transaction Connect shall be directed to Transaction Connect directly subject to their respective privacy policy [link] and terms of use [link][AA1], which you will be required to read and accept when subscribing to the Loyalty Points Collection.

Once you have activated the Loyalty Points Collection, the Data Controllers will receive confirmation and the relevant purchases you conduct within the shopping centre as detailed in the table above, so that the Data Controllers can manage and account your Loyalty Points to benefit thereof under the Loyalty Points Collection. Under no circumstances, we will have access to or receive any information related to you bank accounts, credit cards or any Personal data of financial nature.

4/ How do we share your personal data?

We may share your personal data with:

• ·our processors as listed in Appendix 1; The list of our current third-party processors is published in Appendix 1 below. The list is regularly updated and includes company-name, company-address, specific of purpose of processing of service provider.
• any competent authority or legal entity to answer to legal or regulatory requests, court orders, subpoena or legal process, if necessary to comply with applicable laws;
• any transferee, when personal data is transferred as part of the sale or otherwise transfer of all or part of our assets to another company
•   with our insurers, lawyers, other advisers and courts when enforcing claims and/or defending our position;

 

5/ How do we keep your personal data secure?

We take the security of all the personal data we hold very seriously and we are committed to protecting your personal data. We have therefore implemented all the necessary technical and organizational security measures, and have chosen our providers accordingly.

We have entered into specific data processing agreements with each service provider listed in Appendix 1 and have checked their general technical and organizational measures. The service providers are only authorized to process the data, as data processor, in compliance with the provision of this Privacy Policy, only on our behalf and according to our instructions.

 

However, we can't control all the risks related to the use of the Internet, and data security also relies on everyone's vigilance and good use of these technologies, therefore we invite our customers to remain vigilant on potential inherent risks while using Internet services.

 

6/ When do we transfer your personal data outside the European Economic Area ?

 

We use third party service providers that help us provide the Services to you and process your personal data on our behalf. Such third party service providers will always be subject to security and confidentiality obligations consistent with this Privacy Policy and the applicable law.

 Note that some third party service providers are located outside the EEA (European Economic Area) and thus may access and process your Personal data from countries which do not provide an adequate level of data protection. In case of such transfer outside the EEA, we enter into the model clauses adopted by the European Commission to ensure that your personal data benefits from an adequate level of protection when accessed and processed from there. Our processors may also rely on Binding Corporate Rules.

If you need further information on this, please contact us  by e-mail at the address mentioned in article 7.5 below.

 Information on the model clauses can be found here.

Information on the Binding Corporate Rules can be found here.

7/ Your rights in relation to your personal data

7.1 Pursuant to all applicable laws, and in accordance with the provisions of the table of article 3.1 above (column “Rights”) you have the right* :

• to access to your personal data : we will give you detailed information about your personal data being processed.
• to obtain rectification your personal data : if the personal data we are processing are inaccurate;
• to obtain erasure of your personal data : if you want us to erase some or all of your personal data ;
• to object to the processing of your personal information : if you want us  to stop the processing of your personal data until we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
• to obtain the restriction of the processing of your personal information if you contest the accuracy, lawfulness or our need to process your personal data, we will limit the processing of your personal data to the minimum (storage) and, if applicable, will process them only for the establishment, exercise or defence of legal claims or, where necessary, for protection of another natural or legal person, or other limited reason dictated by applicable laws.
•  to receive your personal data in a structured and standard format or to ask for the transmission of such information to other controller (portability)
• to give instructions regarding the further processing of your personal data after your death.

 

Please note that the available rights depend on the legal basis of the processing. See provisions of the table of article 3.1 above (column “Rights”) to see the rights you can exercise specifically by processing activity.

7.2  Withdrawal of your consent(s) When the legal basis of the processing is your consent, as detailed in the table displayed in article 3.1 above (column “Legal basis”), you may withdraw your given consent(s) at any time without any reason.

If you do so, we will stop any further processing based on this consent. Please note that the withdrawal of your consent does not affect lawfulness of any processing done on the understanding that you have given your consent before.

To withdraw your consent to receive commercial communication :

> send an e-mail as described in the section Exercise of your rights below

> directly change the setting in your loyalty account

> click on the unsubscribing link available in all our communication

7.3 Unsubscribing to communication for information purpose in relation with the Loyalty Program

As part of the Loyalty Program and based on the legal basis of the execution of a contract formed between us (the terms of Use of the Loyalty Program) we will send you communication (that will only be about the Loyalty Program and that will not contain any commercial offers).

If you do not want to receive this kind of communication, you can ask us to stop sending them as follows:

>  send an e-mail as described in the section Exercise of your Rights below; or,

> directly change the setting in your Loyalty account or,

> click on the unsubscribing link available in all our communication.

7.4 Deletion of your Loyalty Account

If you want to delete your Loyalty Account, you can either :

               > delete it directly in the setting of your Loyalty Account; or,

>  send an e-mail as described in the section Exercise of your rights below.

 

7.5 Exercise of your Rights

If you wish to exercise these rights and/or obtain all relevant information, please contact us at the following address: LapartDieu.Direction@unibail-rodamco.com

To ensure an effective exercise of your rights, please note that you can send your request at the above mentioned address for your questions and demands in relation

with processing to both data controllers (local Data Controller and group Data Controller).

In order to avoid to infringe third party rights, we reserve the right, in case of reasonable  doubt, to proceed to prior verification of your identity in asking you :

• your number of loyalty member, or, if you do not have it,
• an ID Document

We will respond within 1 month after receipt of your request, but We retain, when necessary due to the complexity of your request,  the right to extend this period by 2 months. We will in any event inform you within 1 month after receipt of your request if We decide to extend the period to respond.

If needed, you can also address any question at the welcome desk of your shopping centre.

1. Complaints

You have the right to make a complaint about the way We process your Personal data to the data protection authority, aka The Commission Nationale de l’Informatique et des Libertés, located 3 place de Fontenoy 75007 in PARIS.

 

 

8/ Geolocation

 

8.1 General principle

Subject to your prior express consent given in the shopping center application, information related to your location within our shopping centre may be collected and processed by Us while you are authenticated on our shopping center Applications for the purposes of measuring the frequency of your visits and your itineraries within our shopping centre and/or providing location related services.

 

Geolocation will only take place if you have activated the additional services/specific function in the settings of your downloaded shopping centre application on your mobile device. You could deactivate those additional services at any time in the settings latter one at any time.

 

Please note that when given, your consent will be effective immediately for any further connections on our shopping center Application and for any further visits in our shopping centre within 12 months from first connection, unless you withdraw your consent.

 

 

 8.2   How to manage your geolocation preferences on your mobile device

 

In order to be located within the shopping centre, you will be required to activate the Bluetooth feature on your mobile device.

 

 If you only want to check out the map the activation of the Bluetooth feature is not required.

 

Please note that we will not locate you outside our shopping centre. The location option is carried out by the Bluetooth beacons which are installed in the common areas of the shopping centre only.

 

You may disable the geolocation of your mobile device through your mobile settings at any time.

 

 

9/ Automated decision making / profiling

 

There is currently no automated decision-making process or profiling which would legally affect you or otherwise significantly affects you. But we will provide you with specific offers based on your individual Personal data and analysis of your user behavior.

Indeed, as we do not want to bother you with information and promotions that may not be relevant to you, we assess your purchase profile, i.e. information such as your earlier purchases and preferences that we collect through your use of our Services as detailed in table (article 3.1), to send you only information and promotions we consider interesting or relevant to you.

 

10/ Transfer in case of change of ownership

 

If Unibail-Rodamco-Westfield  Group is involved in a merger, acquisition, dissolution, or sale all or part of the shopping centre, or its managing company or owner, where you are registered as a Loyalty Program member, we reserve the right to transfer your personal data. You will be notified if such change requires notification or consent under applicable law, you will be notified or given the opportunity to consent.

 

 

11 / Update of this Privacy Policy

 

We may revise or update this Privacy Policy from time to time. Any change to this Privacy Policy will become effective upon online publication on this website.

If such change requires notification or consent under applicable law, you will be notified or given the opportunity to consent.

 

Appendix 1 – List of service providers

Registration Account Manager (Registration)

Company	Address	Company information	Country (localization of personal data)
Gigya Inc.	2513 East Charlestine Road Suite 200 Mountain View, CA 94043, USA	A Delaware corporation	Israel / USA
Cardiweb (card creation)	14 rue auber 75009 Paris, France	RCS Paris n° B 431809 508	France

CRM-Manager (CRM-Management)

Company	Address	Company information	Country (localization of personal data)
Cardiweb	14 rue auber 75009 Paris, France	RCS Paris n° B 431809 508	France
Salesforce EMEA Ltd	Floor 26 Salesforce tower 110 bishopsgate, London EC2N 4AY United Kingdom	English company	USA
IBM Bluewolf	1, place Jean-Baptiste Clément - 93160 Noisy-le-Grand	SIREN 318 292 513 R.C.S Bobigny	France

Data storage

Company	Address	Company information	Country (localization of personal data)
Amazon Web Services Inc.	1200 12th Avenue South Suite 1200 Seattle, WA98144 United States	Delaware corporation	Ireland/ USA

Event Registration

Company	Address	Company information	Country (localization of personal data)
JRNI .	150 Wharfedale Road, Winnersh Triangle, Berkshire, England, RG41 5GB	English company	Ireland UK (for maintenance purpose)

Customer satisfaction survey

Company	Address	Company information	Country(localization of personal data)
Myfeelback .	6 chemin de Limayrac, 31500 TOULOUSE France	French company	France

Card wallet

Company	Address	Company information	Country(localization of personal data)
Carving labs	44 rue Richer 75009 PARIS, France	French company	France

Welcome Desk

Company	Address	Company information	Country(localization of personal data)
Pénélope L’Agence	52 rue Taitbout - 75009 PARIS	Siret : 824 539 183 00015	France

Contest Organisation

Company	Address	Company information	Country(localization of personal data)
Relatia	8 Rue de Choiseul, 75002 Paris	Siret : 52963976700027 / entreprise française	France