Safeguarding, Security and Access management Privacy Notice
Last update : June 2019
This notice explains how the data controller [referred to in this notice as the Data Controller (as defined below), we, us or our] collects and uses personal data in our shopping centre Le Carrousel du Louvre, hereinafter referred to as the “Shopping Centre” for security, safeguarding, access management purposes. Safeguarding refers to the management of accidents and incidents occurring in the Shopping Centre. Security relates to the prevention and detection of alleged or actual criminal activity.
This notice covers the following:
1/ Contact details of the Data Controller
2/ How do we collect your personal data?
3/ What is the scope of this privacy policy?
4/ Information about the processing of your personal data
5/ What happens if you do not provide personal data that we request?
6/ How do we share your personal data
7/ How do we keep your personal data secure
8/ Do we transfer your personal data overseas ?
9/ Your rights in relation to your personal data
10/ Automated decision making / profiling
11/ Update of this Privacy Notice
1/ Contact details of the Data Controller
The local data controller :
Espace Expansion
Simplified joint stock company with a capital of 464 910€
Having its registered office at 7 place du Chancelier Adenauer 75016 Paris
Registered within the Paris Register under number 323 998 690
The local data controller will process your personal data in the context set out below.
The group data controller :
Unibail Management
Simplified joint stock company with a capital of 20 000 000€
Having its registered office at 7 place du Chancelier Adenauer 75016 Paris
Registered within the Paris Register under number 414 878 389
The group data controller will process your personal data in order to assist the local data controller and to ensure a general governance at group level.
The local data controller and the group data controller are acting as joint data controllers and will hereinafter be referred to together as “Data Controller”.
2/ How do we collect your personal data?
We collect personal data about you through the following means :
3/ What is the scope of this privacy policy?
This privacy policy deals with personal data we are processing in the framework of the management of security , safety and access management in and around the Shopping Centre, through :
If you are a member of our loyalty program, the processing of your personal data collected in relation with the Loyalty Program will be made in compliance with the Loyalty Program privacy policy that you can find on the Shopping Centre’s website.
4/ Information about the processing of your personal data
You will find in the table below all information in relation with :
Specific purpose |
Personal data involved |
Legal basis |
Retention period* |
Management of accident and injury occurring in the Shopping Centre. Including management of any pursuant legal claim. |
Personal contact details, date of birth, information about the injury and/or accident information about health and medical information, |
Legitimate interest to keep track of accident occurring in the Shopping Centre and to prepare for and defend legal claim.
|
10 years maximum from their collection
|
Management of access in the Shopping Centre in order : to prevent any unauthorized access and to prevent criminal or potential criminal activity including prevention against damages to property, shoplifting, prevention against terror attack as well as drug trafficking;
|
Personal contact details, entry pass, license plate number,
CCTV recording (image and voice) |
Legitimate interest in preventing and detecting unlawful acts. and crimes .
|
Your personal data will remain stored for the duration of 3 (three) years after the last exit of the Shopping Centre.. Retention of CCTV footage is 30 days (in any case, up to a maximum of 30 days).
|
Maintain security within our shopping centre and keep the public safe and notably · comply with health and safety obligations (including fire protection and prevention against foreseeable natural and technological risk). · prevent and detect criminal or potential criminal activity including prevention against damages to property, shoplifting, prevention against terror attack as well as drug trafficking ; |
Personal contact details, license plate number, information about the criminal or alleged criminal activity
CCTV footage (image and voice) Specific for employees of CCTV operator service provider : connexion logs on the IT tool used to manage the CCTV. Specific for any person working within the shopping centre : name – surname – phone number and e-mail address (personal and professional) |
legitimate interest in preventing and detecting unlawful acts and crimes. . |
Ten years maximum from collection
Retention of CCTV footage is 30 days (in any case, up to a maximum of 30 days).
One year
One year from last digital contact |
Management of Parking subscription contract |
Name/surname/ registration plate number / bank details / ID card
|
Execution of a contract |
Duration of the contractual relationship. |
Management of demand(s) made in application of rights related to personal data Including any pursuant legal claim. |
Personal contact details, all information contained in the request |
Legal obligation to answer data subjects requests |
five years from closing of the request.
|
*We may need to retain your personal data beyond these stated retention periods, for example where a law enforcement body or regulatory body are investigating a crime or incident, or in preparation for or in the defence of legal claims.
5/ What happens if you do not provide personal data that we request?
Where we are legally obliged to collect personal data the provision of this information will be mandatory.
Failure to provide personal data which you later rely upon in preparing or making a legal claim could result in your claim being dismissed and/or unsuccessful.
6/ How do we share your personal data ?
We may share personal data in the following ways:
7/ How do we keep your personal data secure?
We take the security of all the personal data we hold very seriously. We are committed to protecting your personal data and implement appropriate technical security measures to protect it.
8/ When do we transfer your personal data overseas?
Your personal data are not transferred outside the European Union.
if your personal data is to be transferred to countries outside the European Economic Area in countries that may not offer an equivalent level of protection for personal data to the laws in the European Union, we will ensure that appropriate safeguards are put in place to protect your personal data, notably by signing the Standard Contractual Clauses of the European Commission.
9/ Your rights in relation to your personal data
Pursuant to all applicable laws, you have the right to ask for access, rectification, deletion, objection, limitation or portability of your Personal data as described below:
9.1 Exercise of your Rights
If you wish to exercise these rights and/or obtain all relevant information, please contact us at the following address: carrousel-du-louvre@majestic-events.fr.
To ensure an effective exercise of your rights, please note that you can send your request at the above mentioned address for your questions and demands in relation with processing to both data controllers (local data controller and group data controller).
You can also exercise these rights directly at the Welcome/info desk of the Shopping Centre.
In order to avoid to infringe third party rights, we reserve the right, in case of reasonable doubt, to proceed to prior verification of your identity.
Please be aware that for CCTV recording, the access right, if applicable, will consist in a viewing of the CCTV footage.
9.2 Complaints
We would request that you first provide us with an opportunity to address any complaints about how we use your personal data, you have the right to make a complaint to the CNIL 3 place de Fontenoy 75007 Paris.
10/ Automated decision making / profiling
There is currently no automated decision making process or profiling made with your personal data.
11 / Update of this Privacy Notice
We may revise or update this Privacy Notice from time to time. Any change to this Privacy Notice will become effective upon online publication on this website.
Appendix 1 – List of service providers
Welcome desk
Company name |
Headquarter |
Company registration |
Country where the personal data are processed and stored |
Majestic |
32 rue de Ponthieu, 75008 Paris |
443 168 463 |
France |
Maintenance – Safety – Security
Company name |
Headquarter |
Company registration |
Country where the personal data are processed and stored |
Vinci |
Cegelec Missenard 67 avenue de Fontainebleau, 94270 Le Kremlin Bicêtre |
RCS Créteil 537 934 002 |
France |
Securitas France SARL |
253 quai de la bataille de Stalingrad, 92130 Issy les Moulineaux |
RCS 304 497 852 |
France |
Parkings
Company name |
Headquarter |
Company registration |
Country where the personal data are processed and stored |
Société INDIGO Infra France |
Tour Voltaire 1 Place des Degrés - TSA 43214, 92919 La Défense CEDEX |
304 646 078 RCS Nanterre |
France |