Privacy Policy and Legal Notices

Privacy Policy at www.arenapark.hr and www.arenacentar.hr

Introduction

Privacy policy describes the manner in which the company Arena Center Zagreb Ltd., with its registered seat in Zagreb, Vice Vukova 6, PIN: 83997642580 (hereinafter: the Company) manages personal data which you have provided us while using www.arenapark.hr and/or www.arenacentar.hr website, and in other cases such as applying to a prize competition or a prize game. For the avoidance of any doubt, when the Company receives personal data which you have provided while using the Company’s website, it is deemed to be the controller of that personal data, unless defined differently in a particular case. The Privacy Policy applies irrespective of the device used (personal computer, mobile phone, tablet, or other device) to access the Internet site www.arenapark.hr and www.arenacentar.hr. It is important that you carefully read this Privacy Policy because every time you use our services (described below) you accept the terms described in this Policy. If you do not accept the terms described in this Policy, i.e. you do not provide consent on processing of personal data (if it is required in a particular case), you will not be able to use our services. However, we would like to point out that you are not obliged to provide personal data to the Company, i.e. there are no consequences if such data is not provided. The Company may amend or supplement this Policy at any moment and the last version of the Privacy Policy will always be uploaded on the Company’s website. Please check the effective date published on top to see when was the Privacy policy most recently updated.

Principles of Personal Data Processing

The Company is processing personal data in accordance with the following principles:

Personal data pertaining to the users is processed in lawful, righteous, and transparent manner,

Personal data is collected only for specific, explicit, and legit purposes and is not processed in manner incompatible with such objectives, personal data must be adequate, relevant and not in excess in relation to purpose for which it is collected and/or further processed, personal data must be accurate, and if necessary, updated; all reasonable measures must be undertaken for deletion or correction of incorrect, incomplete data, with regard to purposes for which it is collected or for which it is further processed, personal data shall not be retained longer than required for purposes for which they are collected or for which they are processed, personal data shall be processed safely, ensuring protection from unlawful or unauthorised access, loss, destruction and damage. For purposes of verifying the compliance with the principles stipulated in above sections, the Company shall document the rules and the terms for personal data processing.

Scope of Personal Data Collecting and the Purpose of Processing

Personal data is deemed to be personal data which you have provided to us. The Company collects Personal data in the following cases:

When applying for periodic newsletter
When receiving the order for issuing Arena Centar Gift Card
When applying for prize games and competitions
When visiting the website www.arenacentar.hr and www.arenapark.hr

Depending on the circumstances, the Company may collect all or some of the following categories of Personal data:

Name and surname,
Age,
Email address,
Home address
Telephone number,
Your current location data,
Bank card data, such as IBAN,
Photographs of the face,
Personal data obtained during your visit to website www.arenapark.hr and www.arenacentar.hr

The Company collects the above-mentioned Personal data based on your consent because the processing is required due to our legit interests or necessary for implementation of the contracts. Legit interests manifest themselves in improving our services and overall operation and advertising of Arena Centar and/or Arena Park. We point out that you may withdraw your consent at any moment, however from the time of the withdrawal onwards you will not be able to use available services at website www.arenacentar.hr and www.arenapark.hr. The consent may be withdrawn by giving notice to the Company, pursuant to Section 10 of this Policy, i.e. by clicking the “Unsubscribe” link in our newsletter.

The Company collects and processes Personal data for the following purposes:

for providing the service you have requested, such as receiving newsletter, providing navigation service from your current location to Arena Centar, service of issuing Arena Centar Gift Card and service of accessibility to Arena Centar wireless network (Wi-Fi),
due to application for prize game or contest, for handover of the prize and publishing the information on the prize-winner,
for understanding the way you are using our services, so that we may improve your customer experience,

in order to offer you customised content and marketing.

The Company shall not use the collected data for automated decision-making, which includes the use of Personal data for evaluation of certain personal aspects relating to a natural person.

We particularly emphasize that you must be at least 16 years old to use our services in relation to which we collect Personal data. If you are under the age of 16, you cannot use our services. Exceptionally, for participants in prize games or contests, at the application we may request them to be at least 18 years old.

Sharing of Personal Data you have provided to us

The Company may share all or some of the collected Personal data with the following receivers:

company NEPI Croatia Management Ltd, seated in Zagreb, Vice Vukova 6, PIN: 94739707578, and with other companies operating within NEPI Rockcastle group, with Company’s business partners (companies that provide IT services and companies engaged for cooperation in the marketing field ,which are seated in Republic of Croatia), whereby the IT service providers (so called Cloud Software Services) may be seated outside European Union, with judicial authorities of Republic of Croatia, pursuant to applicable legislation.

In the case your Personal data would be shared with receivers seated outside the European Union, all measures for ensuring legally sound transfer thereof will be undertaken.

Compliance Statement of NEPI Rockcastle Group

Read the Compliance Statement of NEPI Rockcastle Group

The period of collection of the Personal Data you have provided to us

We shall collect and process your Personal data depending on the purpose for which you have provided the respective Personal data. Namely, Personal data shall be retained for the following periods:

Data which we use for issuing newsletters: as long as there is a valid and lawful consent for Personal data processing,
Data which we use for delivery of services on your demand (e.g. Arena Centar Gift Card issuance): as long as the service is delivered,
Data which we collect for the purpose of application in a prize game or contest: as long as the respective prize game or contest is ongoing. However, bear in mind that we shall process Personal data of all winners even after the completion of the respective prize game or contest, yet longest for a period of 5 years calculating from the respective prize game or contest completion date and due to advocacy in potential legal proceedings.

In any event, your data shall be processed only while a lawful purpose for Personal data processing exists.

Particulars on Personal Data Processing for the purpose of newsletter delivery

Our newsletter is a form of direct marketing messages via which we inform you on discounts, events and generally on news in Arena Centar. In order to receive it , files on the website www.arencentar.hr and/or www.arenapark.hr need to me marked whereby you are providing consent for receiving the newsletter and for the processing of your Personal data. At the registration, your email address must be entered, while entering your name and surname is optional.

You may withdraw the provided consent at any moment, by clicking the button “Unsubscribe” (positioned at the bottom of each message) or by unsubscribing on the website.

For managing the base of subscribers we use the Mailchimp marketing platform which is operated by the company The Rocket Science Group LLC, seated in the United States of America. In this case the mentioned company acts as the Data Processor, whereat it has an obligation to undertake all measures required for Personal data protection, in accordance with European-American regime on privacy protection (so called Privacy Shield). You may learn more on the Privacy Shield on the webpage of the Personal Data Protection Agency, accessible through the following link: https://azop.hr/aktualno/detaljnije/vodic-za-gradane-eu-sad-stit-privatnosti.

Particulars on applications for prize games and contests

We periodically organize prize games and contests, in cooperation with our media partners. The scope of Personal data that we collect depends on the conditions of the respective prize game or contest, whereby all information pertaining to Personal data processing will always be published within rules of the prize game or the contest. When applying for the prize game or contest, the possibility to subscribe to our newsletter shall always be offered, wherefore the policy on Personal data processing shall be then applicable to the data provided for the purpose of receiving the newsletter.

Bear in mind that we also request your Personal data (for identification purpose) at the prize handover, and it is possible that we publish the photograph of the face of the prize-winner on our website and on social network profiles.

Particulars on the cookies and other technologies

Cookies are small-size files which are temporary stored on your device, with the purpose to record your preferences and selections for the following visits to the website www.arenapark.hr. There are several categories of cookies used, namely there are cookies necessary for proper loading of the website, cookies that enable better efficiency of the website, cookies that collect information on how you are using the website (later used for deriving analytic and statistical data), and so called third-party cookies with primary purpose of additions integration (plugins) which allow sharing of content from our website with, for example, social networks.

More information on cookies and other technologies that we use, you may learn on our webpage dedicated for collection and use of cookies and other technologies.

Particulars on Arena Centar Gift Card issuance

You may request issuance of Arena Centar Gift Card on-line (via our form), by sending an email to the address poklonkartice@arenacentar.hr or by calling the telephone number +385 1 666 1411. We shall irrecoverably delete all Personal data we have received from you for the Gift Card issuance after Gift Card issuance and taking over procedure will be completed.

Your Rights

Based on the applicable legislation, your rights are as follows:

you may request from us access to your Personal data, i.e. you have the right to receive information whether we process your Personal data,
if your Personal data is inaccurate, you have the right (without undue delay) to obtain rectification of that data, as well as the right to supplement it if it is incomplete,
you have the right to obtain deletion of your Personal data (without undue delay) if one of the following conditions is met:
Personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed,
if you withdraw the consent on which the processing is based and if there is no other legal grounds for the processing,
if you object to the processing (more on this below),
if Personal data has been unlawfully processed,
if Personal data must be deleted due to compliance with a legal obligation arising from European Union law or Croatian law,
Personal data has been collected in relation to the offer of society services information (such as e-commerce)
you have the right to obtain restriction of Personal data processing if one of the following conditions is met:
if you contest the accuracy of part of the Personal data, for a period enabling us to verify the accuracy of the respective Personal data,
if the processing is unlawful and you oppose the deletion of the Personal data and request restriction of its use instead,
if we no longer need the Personal data for the purposes of the processing, but you require it for the establishing, exercising, or defending of a legal claim,
if you have objected to processing, and the verification whether our legitimate grounds for processing override your interests, rights and freedoms is pending,
you have the right to data transferability, i.e. you have the right to receive the Personal data which you have provided to us, in a structured, commonly used and machine-readable format and to transmit that data to another controller without hindrance from our side. In other words, you have the right of direct transfer of data which we process in a manner where the Personal data is transferred from us (i.e. from our database) to another controller, under the condition that this is technically feasible,
you have the right to object at any time to processing of Personal data you have provided us with,
you have the right to lodge a complaint with the Personal Data Protection Agency, to the email address azop@azop.hr or to the address Martićeva 14, 10000 Zagreb.

Third Parties

Our website contains links which lead to some other websites, such as Company’s profiles on social networks, websites of public transportation via which you can reach Arena Centar etc. We bear no liability for security or privacy of any data collected by those websites while using them. We kindly ask of you to carefully read privacy statements applicable on those websites.

Contact Details

For any questions in relation to this Privacy Policy application, you may contact us via email address: zastita.podataka@nepirockcastle.com or on the address: Calea Floreasca No. 169A, Floreasca 169, Cladirea A, etajul 5, Sector 1, Bucharest, Romania (to the attention of: NEPI Rockcastle).

Legal Notices and Conditions of Use

Intellectual Property

Any use of www.arenacentar.hr and/or www.arenapark.hr website (hereinafter: website) is subject to conditions stated below. Data provided on this website may be copied for non-commercial purposes only and only for an individual use, provided that copyrights, other intellectual property rights and all the applicable limitations are observed. In all other events data may not be copied, reproduced, or somehow distributed without prior explicit written consent of Arena Center Zagreb Ltd. In relation to the foregoing, the website users are particularly forbidden to:

Publish the website content on other Internet sites,
Sell, lease or provide licence or alike of any website content,
Publicly display any content from the website,
Reproduce, copy, and generally use any content from the website for commercial purposes.

In addition, by using or surfing the website, users or third parties do not acquire any rights over the website content, neither over the trademarks, copyrights and similar of which Arena Center Zagreb Ltd. is the right-holder.

Accessibility of the website and accuracy of information on the website

Arena Center Zagreb Ltd. shall undertake reasonable efforts so that the website contains accurate and up-to-date data; however, it cannot be responsible for its accuracy and completeness. All users who access the website use the content thereof at their own liability. Arena Center Zagreb Ltd. shall not be liable for any direct, indirect or any other damages arising from access, use or the inability to use the website or due to any error or incompleteness of content thereof. Likewise, Arena Center Ltd. shall endeavour to enable the access to the website at all times, yet it does not guarantee that the website or any part thereof will be accessible at any moment, nor may it be held liable for any damage caused due to website inaccessibility.

Other Websites

The website contains third party information and links to other websites over which Arena Center Zagreb Ltd. does not have control. Whenever possible, such information shall be designated accordingly. Arena Center Zagreb Ltd. is not liable for the accuracy or any other aspect of such information and does not assume any responsibility for such information. It is recommended to investigate the conditions of use at the referred websites.

Permitted Use

The users (website visitors) may not:

Use the website in a manner that causes or may cause any kind of damage,
Use the website in an unlawful manner,
Carry out automatic data-gathering from the website (so called data mining),
Use any kind of information from the website for marketing services (e.g. for direct contacting of the consumer),
Send or transfer to the website malicious and/or harmful software,
Carry out attacks by overburdening the website (so called Denial-of-Service attacks).

Breach of these Legal Notices and Conditions of Use

Without prejudice to other rights held by Arena Center Zagreb Ltd. pursuant to applicable legislation, in the event of breach of the conditions of use set herein, or Arena Center Zagreb Ltd. has reasonable grounds to suspect occurrence of breach, Arena Center Zagreb Ltd. may:

send one or more warnings to the user,
Temporarily or permanently block the access of the user to the website,
Block the IP address of the personal computer or other device accessing the website,
Initiate judicial and other proceedings against the user.

If Arena Center Zagreb Ltd. does not exercise any of its above-mentioned rights, this shall not be interpreted as a waiver of such rights by Arena Center Zagreb Ltd.

Final Provisions

The applicable law for the interpretation of these Legal Notices and Conditions of Use shall be the law of the Republic of Croatia. Arena Center Zagreb Ltd. reserves the right to amend the content of these Legal Notices and Conditions of Use, as well as the website, in any way, at all times and for any reason, and shall not be liable for any kind of possible consequences resulting from such alternations.

Cookie Policy

The website www.arenacentar.hr and www.arenapark.hr uses cookies and other technologies in order to provide you with best customer experience.

Indispensable cookies are necessary for navigation on the website www.arenacentar.hr and/or www.arenapark.hr, and they manage the main features of the webpage, such as distribution of anonymous session identifiers (session ID) for integration of several related demands towards the network server.

How to disable cookies?

If you want, you may disable saving of the cookies to your personal computer, however blocking of all cookies may have an adverse effect on using numerous webpages, including our website. Cookies settings may be controlled and configurated within your Internet browser. If you wish to delete or disable the cookies on your personal computer, you need to harmonize the settings of your Internet browser (information on deleting and disabling of the cookies may be found on your browser by selecting Help menu).

Cookie-Settings Management

Currently, there are several webpages for disabling cookies of various network services.

Internet Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies
Mozilla Firefox: http://support.mozilla.com/en-US/kb/Cookies
Google Chrome: http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95647
Safari: http://support.apple.com/kb/PH5042
Opera: http://www.opera.com/help/tutorials/security/privacy/
Adobe (locally distributed objects (flash cookies)): https://www.adobe.com/support/flash/downloads.html

To block Google Analytics cookies only, you may install “Browser Addition for Cease of Google Analytics Service” provided by Google.

Notice on Personal Data Processing on Facebook social network and Messenger network service

Arena Center Zagreb Ltd., Company seated at address Vice Vukova 6, 10020 Zagreb, registered at the Zagreb Commercial Court under number (CRN) 080572329, PIN: 83997642580, acting as the processing controller, processes personal data of data subjects who opt for Facebook and Messenger communication with the commercial center – Arena Centar or Arena Park Profile, in the following manner:

Purposes of Processing:

handling the notices (communications) provided by you when participanting in various campaigns, events or prize games (including prize contests) organized in the commercial center (Arena Centar or Arena Park), as well to ensure awarding and delivery of prizes won within such campaigns, events or prize games (including prize contests),

handling complaints or requests of any type regarding your experience at the commercial center (Arena Centar or Arena Park)
archiving, respectively settling disputes, investigations or any other petitions, complaints or other proceedings to which our Company is a party, conducting risk controls related to procedures and proceedings, as well audits or investigations at the Company level.

Processed Categories of Personal Data:

During implementation of campaigns, events or prize games (including prize contests) the types of processed personal data are stated within the rules of the respective event, whereby the rules will always be available on the website of Arena Centar (arenacentar.hr), or Arena Park (www.arenapark.hr).

Concerning any kind of complaints or requests regarding your experience in the commercial centre (Arena Centar or Arena Park) we process identification and contact data, as well as any other data that you have provided us with.

Categories of data subjects whose Personal Data is processed:

visitors and clients of the commercial center (Arena Centar or Arena Park),
participants in campaigns, events or prize games (including prize contests),
other persons submitting any requests, complaints or similar.

Legal Grounds of Processing:

We process your Personal Data based either on your consent, or as to undertake actions per your demand or if the processing is necessary due to our legitimate interest, depending what is applicable.

Retention Period:

Personal data that we process is retained for the period necessary to comply with the legal obligations imposed by the regulations specific to our field of activity.

Regarding Personal Data collected during implementation of various campaigns, events or prize games (including prize contests), the conditions of processing (including also the retention period) are always stated within the rules of the event, whereby the rules will always be available on the website of Arena Centar (www.arenacentar.hr), or Arena Park (www.arenapark.hr)

Personal data collected when handling any kind od complaints or requests regarding your experience at the commercial centre (Arena Centar or Arena Park) are retained in accordance with applicable statutes of limitiation (5 years).

Sharing of Personal Data:

Personal data collected during communication with commercial centre profile – Arena Centar and Arena Park via Facebook social network and its Messenger service shall be processed by the company NEPI Croatia Management Ltd., Vice Vukova 6, 10020 Zagreb, PIN: 94739707578, as the Data Processor.

In addition, provided Personal data may be shared with:

a law office seated in the Republic of Croatia,
authorised state bodies in accordance with the legislation,
company 404 Ltd., Radnička 37a, Zagreb, PIN: 95664694376,
other companies operating within the NEPI Rockcastle group (more details on the mentioned group of companies are available at the following link: https://nepirockcastle.com/portfolio/), for purposes of consolidated management of group activities and for audit purposes or when applicable legislation impose or allow such processing.

Rights of data subjects whose Personal Data is processed:

Access Right – you are entitled to receive confirmation if Personal data concerning you is being processed, and if such data is being processed, access to that Personal data and certain information on the processing. Following the receipt of the demand, we shall also issue a copy of the Personal data we process. Requests for additional copies shall be charged per actually incurred costs.

Rectification Right – you are entitled to obtain rectification of inaccurate Personal data and to supplement Personal data, inter alia by providing additional data.

Data Deletion Right (“the right to be forgotten”) – under circumstances proscribed by the law, you are entitled to obtain deletion of Personal data concerning you. Accordingly, the deletion may be demanded if:

Personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed,
You withdraw the consent on which the processing is grounded and if there are no other legal grounds for the processing,
You object the processing,
Personal data is processed unlawfully,
Personal data must be deleted due to compliance with a certain legal obligation.

Right to Restrict the Processing – you are entitled to obtain restriction of processing if one of the following is met:

You challenge the accuracy of Personal data, for the period that enables us to review the accuracy of Personal data,
The processing is unlawful, and you oppose the deletion of the Personal data,
Personal data is not required from our side for the purpose of processing, yet you demand it in relation to submitting, achieving, or advocating the legal claims,
You have objected the processing for a period that enables us to review if our legitimate reasons for processing prevail over your interests or rights and freedoms.

In these circumstances, Personal data shall not be processed, but retained only.

Right to Object – you are entitled at any time, based on your particular situation, to file an objection to the processing (including the profiling) of Personal data that is based on our legitimate interest or, if applicable, when the processing is required for completion of duties in the public interest or when exercising public authorities entrusted to us. Promotion materials sent electronically may contain short notices regarding your right to object e Personal data processing for purposes of direct advertising. If you oppose the processing for purposes of direct advertising, your Personal data shall no longer be processed for such purposes.

Data Portability Right – you are entitled to receive Personal data concerning you, in a structured, commonly used, and machine-readable format and have the right to transfer such data to another processing controller. This right is applicable in case you have directly provided us with Personal data, the processing is carried out by automated means and is based on consent or required for the implementation of a contract.

Right of Complaint to the Authority – you are entitled to file a complaint on the manner of your Personal data processing. The complaint should be submitted to Personal Data Protection Agency, Martićeva 14, Zagreb (more details are available on the link: azop.hr).

Consent Withdrawal Right – in cases when the processing is grounded on the consent, you are entitled at any moment to withdraw the consent for Personal data processing. Consent withdrawal shall have effect for the future period only, i.e. the processing done before the withdrawal shall remain lawful.

Additional Rights Related to Automated Decision Making used in the delivery of services – if we use automated decision making in relation to your Personal data and such decisions affect you significantly, you are entitled to (a) obtain human intervention with respect to such processing, (b) express your point of view in relation to such processing, (c) obtain an explanation of the decision made and (d) contest such decision.

These rights (with exception of the right of complaint with Personal Data Protection Agency, which is exercised in the manner set by the Agency itself – for more details visit the official website www.azop.hr) are exercised, individually or collectively, by sending a notice or a message in the following manners:

By postal service to Vice Vukova 6, 10020 Zagreb (to the attention of: Arena Center Zagreb Ltd.) or to Floreasca Business Park, Building A, 5^th floor, 169A Calea Floreasca, Bucharest 1, 014459, Romania (to the attention of: NEPI Rockcastle)
By emailing to podataka@nepirockcastle.com or to data.protection@nepirockcastle.com.

Additionally, NEPI Rockcastle group has appointed, at the group level, a data protection officer that may be contacted in case of any kind objections or queries in relation to Personal data protection and exercising the rights in relation to Personal data protection. The Personal data protection officer may be contacted by sending a written, dated, and undersigned request, via contact details stated above.

Notice on Personal Data Processing at entering Arena Centar

Arena Center Zagreb Ltd., company seated in Zagreb, Vice Vukova 6, registered under number 080572329, PIN: 83997642580, hereinafter as “the Data Controller”, processes Personal data of data subjects who enter the premises of Arena Centar, as follows:

Purpose of Processing:

Fulfilling legal obligations as the building owner for ensuring safety of the property, for which purpose it had decided to use video-surveillance of the public areas by using a surveillance camera system mounted in the premises, on common areas, access routes, parking lot.
Resolving requests for obtaining data and information received from authorized bodies.
Archiving, resolution of disputes, investigations, and other requests/complaints in which our Company is participating, as well as carrying out a control of risk assessment pertaining to procedures and proceedings, audits or investigations on the Company level.
Enabling a free access to a Wi-Fi network.
Participation in the commercial centre advertising campaigns and awarding of the prizes won within such campaigns (e.g. signing of the handover minutes, etc.).
Resolving of complaints submitted in the commercial centre (e.g. Complaint Forms, etc.).
Processing of lost & found requests submitted in the commercial centre (e.g. Lost & Found Forms, etc.).

Categories of Processed Data:

In terms of using the video-surveillance system: pictures of data subjects
In terms of accessing free Wi-Fi: device MAC
In terms of resolution of disputes, investigations, and other requests/complaints – identification data and other data that may be processed depending on the nature of dispute, investigation, or complaint
In terms of prize contests/prize games of the commercial centre – categories of data which are processed shall be stated within the rules of the prize contest/prize game published on the website of the commercial centre (arenacentar.hr and arenapark.hr)

In terms of complaints – identification data you have provided within the Complaint Form
In terms of lost & found requests – identification data you have provided within the respective form.

Categories of data subjects whose Personal Data is processed:

Visitors / clients of the commercial centre
Staff of commercial centre tenants
Staff of service providers / partners / collaborators of the Data Controller and/or the tenants and/or the Data Processor
Staff and collaborators of the Data Controller / Data Processor
Employees of public bodies and other auhorities.

Legal Basis for the Processing:

In respect of the above-mentioned, we process Personal data of data subjects which work in or are just visiting the commercial centre, as applicable, and on the basis of:

Legal obligations of the Data Controller (e.g. protection of property and other assets, protection of individuals, resolving of requests placed by data subjects and/or the competent authorities)
Data subject consent (e.g. participation in the campaigns)
Legitimate interest of the Data Controller (e.g. processing within the group of companies to which the Data Controller belongs).

Retention Period:

Processed Personal data is retained for a time-period which is sufficient for the compliance with the legal obligations imposed by legislation pertaining to our business operation.

Regarding video-recordings, they are usually retained for 15 (fifteen) days, unless the prolongation of their processing period is foreseen under the law or justified by legal proceedings (e.g. because the recording is evidence in judicial, administrative or similar proceeding).

Device MAC is retained only during the period when the device is using the Wi-Fi network.

In respect of commercial centre campaigns (e.g. prize games and prize contests), the conditions of data retention are stipulated within the rules of the respective campaign (e.g. rules of the prize game or rules of the prize contest), as published on the website of the commercial centre.

Third-Party Access:

For ensuring video-surveillance, the owner of the centre cooperates with companies specialised and certified according to the law for carrying out such activities.

Personal data processed in such a manner may also be provided to the competent authorities and institutions, in compliance with the legislation, or processed within NEPI Rockcastle Group, for group management activities, audit purposes and in all other occasions where legislation imposes or allows such processing.

In respect of commercial centre campaigns and events, as well as for resolving complaints and/or Lost & Found demands, if submitted at commercial centre Info-desk, the Data Controller usually cooperates with specialised third parties (e.g. media partners).

The rights of data subjects whose Personal Data are processed, are the following:

Access Right – you are entitled to request confirmation if we process your Personal data, and in case we do, you may demand access to them, as well as additional information on the processing. Following the request, we shall issue a copy of processed Personal data. A request for additional copies shall be charged per occurred cost.

Rectification Right – you may rectify, or supplement, inaccurate and incomplete Personal data including by providing additional data.

Data Deletion Right (“the right to be forgotten”) – Personal data deletion may be requested in situations governed by the law. Hence, the deletion may be demanded if:

data is no longer necessary in relation to the purpose for which it was collected or processed,
the consent, based on which the processing was done, is be withdrawn and there are no other legal grounds for the processing,
the data subject objects the processing,
processing of Personal data is prohibited by law,
data must be deleted due to compliance with a mandatory obligation that we are subject to.

Right to Restrict the Processing –the restriction of Personal data may be demanded situations proscribed under the law, as follows:

You challenge the accuracy of the data, for the period that enables us to review the accuracy of the respective data,
The processing is unlawful, and you oppose the deletion of the data,
You require data to determine, use, or advocate rights before court, and we no longer require the data,
You have objected the processing for a period in which we review if our legal interest prevails over interest of your rights and freedoms.

In these situations, except for the data retention, the data shall not longer be processed.

Right to Object to Personal Data Processing – you may object ,at any time, for reasons that are concerning you (including the profiling) the processing grounded on our legitimate interest or, where appropriate, on our completion of a public interest duty or one which is a result of exercising authority of a public body, to which we are affiliated.

Promotion materials sent electronically may contain short notices on your possibility to object the Personal data processing for purposes of direct advertising. If you object the processing for purposes of direct advertising, your Personal data shall no longer be processed for this purpose.

The right to object to the activities of direct advertising is possible when Personal data processing for direct advertising purposes is based on (i) our legitimate interest, or (ii) the effective contractual relationship with us and pertaining to products similar to those which are the subject of the contract, in relation to which the consent was not provided.

Data Portability Right – you may receive Personal data in a structured, readable format, and may request a transfer of data to another processing controller. This right pertains only to Personal data you have directly provided us, and only if the processing was made automatically and is legally grounded on the contract delivery or the consent provided from the respective data subject.

Right of Complaint – you may file a complaint regarding the manner in which we were processing your Personal data. The complaint should be submitted to the Personal Data Protection available on azop.hr.

Consent Withdrawal Right – where the processing is based on the consent, you may withdraw your consent for Personal data processing at any time. Consent withdrawal shall have effect for a future period only, whilst the processing done before the withdrawal shall remain valid.

Additional Rights Related to Automated Decision Making used in the delivery of services – if we pass automated decisions on Personal data and such decisions affect you significantly, you may (a) request an intervention with respect to referred decision, (b) express your opinion on such processing, (c) receive explanations on decisions made and (d) contest such decision.

These rights (except the right to contact AZOP, which may be realised under conditions determined by the referred institution itself – on this issue visit official website www.azop.hr) may be exercised, individually or collectively, by sending a notice/message in the following manner:

By postal service to: Vice Vukova 6, 10020 Zagreb, Republic of Croatia (to the attention: Arena Center Zagreb Ltd.),
By emailing to podataka@nepirockcastle.com.

Additionally, a data protection officer (“DPO”) is appointed at the Group level and may be contacted for any objections or queries with regard to Personal data protection and exercising rights in relation to data protection. The DPO may be contacted in written form, via dated and undersigned notice, using the contact details stated above.

The above-mentioned Personal data is processed by NEPI Croatia Management Ltd., Vice Vukova 6, Zagreb, PIN: 94739707578, acting as Data Processor.

MAC – (Media Access Control) is the unique identifier assigned to network devices