TERMS OF PRIVACY

In accordance with the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC) and the Act on Implementation of General Data Protection Regulation (NN 42/2018), the company TOWER CENTER RIJEKA Ltd. (Personal Data Controller) that manages the shopping mall Tower Center Rijeka (Tower Center Rijeka) respects and values the privacy of the visitors of both the Center and its website, and below, in this Privacy Policy, provides the basic information on personal data processing.

This Privacy Policy refers to the data collected through the use of the website www.tower-center-rijeka.hr and other personal data processing activities carried out by Personal Data Controller, within the management activities of Tower Center Rijeka.

The following information is intended to provide you with an overview of the personal data processing and to inform you about the user rights regarding the processing of the personal data. The Personal Data Controller is investing considerable efforts to protect the personal data, guided by the principles of lawful, fair, transparent, limited, reliable, accurate and complete processing of personal data.

The Personal Data Controller takes various measures within the certain processing activities to inform the respondents in the most comprehensive and simplest possible way about what data is being collected, how the data is being used and for how long it remains stored. In order to facilitate communication and informing all interested parties, the contact information of the Personal Data Protection Officer is made publicly available.

Personal Data Controller

Tower Center Rijeka d.o.o., Rijeka, Strossmayerova 16, OIB 84184387126
Phone: +385 51 403 815
e-mail: info@tower-center-rijeka.hr

Personal Data Protection Officer

e-mail: tower.center.sluzbenik.zop@kvadratiupravljanje.hr

1. Cookies

For more information on collecting your personal data through the use of cookies, please see our Cookie policy.

2. Golden Tower Card program

Golden Tower Card program is the Loyalty Program of Tower Center Rijeka, within which registered users have the ability to collect points for acquiring the benefits. More info on the Program is available at https://tower-center-rijeka.hr/o-golden-kartici. In order to carry out the Golden Tower Card loyalty program and for acquiring the benefits offered within the Program, Tower Center Rijeka collects personal data remotely when user registers for an account via mobile app or personally from the participant to whom a loyalty card gets issued, all with the consent of the respondents. The following personal data gets collected: name, surname, date of birth and the data on purchases (made within Tower Center Rijeka, in the stores that participate in the Program) for which the points get awarded to Golden Tower Card user account along with logging the name of the shop, the purchase time, the purchase amount and the number of collected points. The mobile app collects the following info for user safety and for verifying the user account: mobile phone number or e-mail address. If user gives the specific additional consent, the data on user interests could also be collected for adapting the content and the type of promotional messages and the info on benefits that are offered. Upon entering the Program, participants receive the specific, detailed notice on personal data processing.

In order to ensure the fair use of the Program benefits and to verify weather the purchase was actually made, it may be requested from a store to capture a photo of the receipt as a requirement for adding the points to user account. The information from the receipt won’t be used and is visible to authorized persons only.

Tower Center Rijeka Digital coupons: We know you simply adore discount coupons which are one of the benefits that will make you love our app even more! Tower Center Rijeka app offers digital coupons with discounts and gifts which can be redeemed in various Center stores, as well as the Rijeka Tower Center Golden Coupon which fills your Golden Tower Card with extra reward points. Discover excellent benefits and have more fun enjoying affordable shopping experience in just a few clicks. Please activate your preferred coupon in the app and show the QR code at the point of sale that accepts the coupon for verification and you’re done. App also collects data on applied coupons to customize the content and type of promotional messages and offers such as the time of purchase and relevant store. If a user registers to their mobile app via Facebook account, the following data gets transferred from Facebook: name, surname, date of birth, phone number or e-mail address, along with the option of transferring the data on interests, which would all be used to simplify the registration process and to personalize the app content.

The legal basis for collecting the personal data within the Tower Golden Card program is the user agreement. Collection of data related to the use of coupons is based on a legitimate interest of the Data Controller meaning that the Data Controller, when providing a benefit that has economic value, has an interest in obtaining such usage data and benefits for direct marketing purposes.

The data processing can include profiling of the purchases made within Tower Center Rijeka, but not the automated decision making. This type of data processing is, by rule, done automatically in order to send a targeted promotional material and other marketing campaigns, relating only the purchases for which our members have willingly registered the loyalty points to their user accounts, if this functionality has been agreed on.

For sending the promotional material, with the user consent, Personal Data Controller can also collect the home address, e-mail address and phone / mobile phone number.

In case of suspicious transactions (frequent, especially valuable) etc. Tower Center may contact the store to verify that the card has been used in accordance with the rules, whereby the name of the card owner may be disclosed and used to determine if the card owner is a store employee for the purpose of preventing possible misuse.

The collected points are valid until 28th of February each year. Any unused points collected prior to that date will automatically be erased from the user account on 28th of February each year. The first deletion will be put into effect on 28th of February 2013.

3. Newsletter

Data Controller collects an email address of the person who explicitly registered it for the purpose of sending newsletters. Email address is collected based on consent. 

Consent is provided by checking the “I accept the Privacy Policy” and “Sign Up” checkboxes.

Personal data shall be processed until consent has been withdrawn or until newsletters are no longer sent. Consent can be withdrawn by clicking the “Sign Out” or “Unsubscribe” function in the newsletter, sending a written request by email to the Data Protection Officer or Data Controller.

Want to get all the latest news from Tower Center Rijeka?

Sign up for the Tower newsletter and be the first to get all the news, discounts, promotions and benefits offered by Tower Center Rijeka!

 [Enter your email address]  

By clicking the “Sign Up” button you give your consent to receive the newsletter. You have the right to withdraw your consent at any time, i.e. to request that your email address is erased from our newsletter database – either by clicking the 'unsubscribe' link at the bottom of received emails or by sending your request to the following email address: info@tower-center-rijeka.hr. 

I accept the Privacy Policy // SIGN UP

4. Video surveillance

The Data Controller carries out a systematic and full video surveillance of all publicly accessible (both open and closed) areas in Tower Center Rijeka. Personal data processing by video surveillance is carried out to protect individuals and property. The implementation of video surveillance is entrusted to Prosigur usluge Ltd., a specialized company for providing physical and technical protection services. The video surveillance measures are carried out in accordance with the Act on Implementation of General Data Protection Regulation, along with the application of internal rules that ensure the confidentiality of collected data and it being used solely for fulfilling the purpose stated above. The recordings are kept safe within a system that can be accessed only by the authorized persons and for a period not exceeding 6 months, unless a longer retention period is prescribed by law or in a case when the recordings become evidence in a judicial, administrative, arbitral or other equivalent procedure.

The legal basis for personal data processing through video surveillance is the legitimate interest of Tower Center Rijeka.

5. Data collected when sending messages via website

For sending messages through the “Contact” section of the website, Tower Center Rijeka collects at least the following personal data: name, surname, e-mail address and other personal data that user willingly writes in the “Message” field. The purpose of collecting these personal data is to enable customers, visitors of the shopping mall and website visitors to get in touch with Tower Center Rijeka via website, and to make inquiries regarding the Center. By willingly sharing their personal data and by marking the field “I consent to the processing of the personal data I have provided in this form, according to the Privacy Policy”, the user gives a clear consent to Tower Center Rijeka for the processing of personal data in accordance with the provisions of this subsection.

Data is collected on the basis of the user agreement that is given upon sending the message, with a purpose of responding to user inquiries.

6. Giveaways and contests

Data Controller may process the following personal data required for running giveaways and contests: name and surname, address, telephone number, email address, number of the purchase receipt issued in Center stores and other data required by specific giveaway or contest which shall be stated in official giveaway or contest rules. 

Data are collected on the basis of consent which is given when applying for a giveaway or contest – it is not possible to participate in a giveaway or contest without providing consent. 

Name, surname and place of residence may be disclosed in order to ensure compliance with the legal obligations of the Data Controller and transparency of a giveaway or contest. 

Photos of giveaway or contest winners may be published on the Centre's media outlets (official website, Facebook page, newsletter, etc.) based on the legitimate interest for society at large, whereby the interests of data subjects to not have such photos published do not outweigh this legitimate interest. Should a data subject exercise his/her right to restrict processing and request that a photo not be published, Data Controller will comply with such request.

Stopping processing and erasing personal data: at the end of the 5^th year since the end of the giveaway or contest due to objections, and in accordance with the general limitation period.

7. Center customers - lost and found / complaints

Name, surname and at least one contact information – such as telephone number, email address or postal address – are collected when responding to a customer complaint for the purpose of resolving complaints submitted by Center customers. Legal basis for processing is the legitimate interest of the Data Controller in keeping aforementioned data for the purpose of resolving customer complaints. Storage period is 5 years from the end of the year in which the complaint was submitted in accordance with the general limitation period or a special law, where applicable.

For the purpose of returning items lost within the Center, Data Controller receives requests for the return of lost items: name, surname and at least one contact information – such as telephone number, email address or postal address – are collected for found items. Storage period for personal data is 5 years from the end of the year in which the loss of an item has been reported in accordance with the general limitation period.

8. Customers - Wi-Fi

Free Wi-Fi system uses MAC addresses of connected devices. MAC address is stored only during the period when a device is using the Wi-Fi network.

Legal basis for processing MAC addresses is consent provided by data subjects upon entering the system, specifically for the execution of an agreement between the Data Controller and data subject accessing the system because the system cannot function without receiving a MAC.

9. Event photos taken within the Center

Tower Center Rijeka may, for its own archive and for publishing needs (such as posting on the website), take photographs of various organized public events in the Center, like concerts, entertainment programs and similar events that are taking place in the public areas of the Center.

The legal basis for such processing is the legitimate interest of Tower Center Rijeka.

10. The procedure of data processing and involved recipients

Personal data can be made available to certain outsourced partners of Tower Center Rijeka. The management of the Center is entrusted to a specialized company M2 UPRAVLJANJE PLUS Ltd. from Zagreb, Heinzelova 33, OIB 18363637837, to whom all the data may be available depending on particular situations.

The data from the video surveillance system is also available to the company for protection of individuals and property, Prosigur usluge Ltd., Rijeka, Milutina Baraća 21, OIB: 36668906636, and may be made available to legal counselors if needed.

The other data may be available to the contracted partners that work on the information system maintenance, the marketing and IT services, and to the legal advisers of Personal Data Controller.

Data is protected by at least the following measures: the access is enabled strictly to authorized persons, with a passcode and a record of the access, with the application of IT safety measures against any unwanted access and for protection against the loss of data: backup, firewall, SSL certificate. All the contracted partners have accepted the legally binding obligations to protect personal data. Data collected through video surveillance is processed in the area accessible by authorized persons only.

One of the additional security measures of personal data processing is providing the area of discretion around the information desk.

No data is transferred outside the European Union.

11. The period of storage of personal data

Within the Golden Tower Card program, the consent is valid until revoked or 3 years from the last usage date of Golden Tower Card or 3 years from the last communication related to the message sent via the website. The data gets erased immediately after: a) a user’s request for exclusion from the Golden Tower Card program; b) the Golden Tower Card program gets canceled by Tower Center Rijeka; c) the consent on data processing gets revoked; d) the consent ceases to be valid.

Data collected through the website remains stored 5 years from the end of the year in which the sender’s inquiry has been resolved.

The photographs taken during the public events remain published on the website for a period no longer than 3 years after the event happened.

According to the law, the video surveillance recordings remain stored for a period not exceeding 6 months, unless a longer retention period is prescribed by law or in a case when the recordings become evidence in a judicial, administrative, arbitral or other equivalent procedure.

By withdrawing or recalling the consent on data processing, your personal data will no longer be used. However, the withdrawal or recall of the consent is not affecting the legality of data processing that was based on the given consent prior to the annulment.

The consent can be revoked either in full or partly. The revocation can be done by sending the written annulment by mail to TOWER’s address or by email to info@tower-center-rijeka.hr or tower.center.sluzbenik.zop@kvadratiupravljanje.hr. The recall of the consent is not affecting the legality of data processing prior to the annulment.

12. User rights

At any time the user is guaranteed the following rights:

1. The right to access personal data - The user has a right to receive a confirmation from the Personal Data Controller if the data that refers to them is being processed, as well as the information on the purpose of data processing, categories of data that are being processed, the recipients, storage period, and their user rights in terms of correction, erasing, limiting the processing itself or lodging a complaint to processing of personal data.
2. The right to correction - The user has a right to request the correction of inaccurate data or to fill in the incomplete data referring to them.
3. The right to be forgotten - The user has a right to obtain the deletion of their personal data from the Personal Data Controller, under certain conditions, unless a longer retention period is prescribed by law.
4. The right to restrict personal data processing - The user has a right to obtain from the Personal Data Controller a restriction of processing data that refers to them, under certain conditions.
5. The right to lodge a complaint to processing - The user has a right to object to processing of their personal data.
6. The right to data portability - The user has a right to transfer all the personal data that refers to them over to some other processing manager. If it is technically doable, the transfer will be done by automated means.
7. The right to lodge a complaint to the supervisory authority: Personal Data Protection Agency, Martićeva ulica 14, HR - 10 000 Zagreb, Phone: 00385 (0)1 4609-000, Fax. 00385 (0)1 4609-099, E-mail: azop@azop.hr, www.azop.hr