CCTV Policy

Privacy Policy, Security

This privacy policy was last modified on 10/06/2025

This policy explains how we, the data controller (referred to in this policy as the Data Controller (as defined below) and referred to as we, us, our, or ours), collect and use personal data at our shopping center for safety and security purposes. Security refers to the prevention and detection of suspected or actual criminal activity. Security refers to the collection of personal data regarding accidents and incidents occurring at the shopping center.

This policy covers the following:

1/ Contact details of the Data Controller
2/ How do we collect personal data about you?
3/ Scope of this privacy policy
4/ Details of the processing of your personal data
5/ What happens if you do not provide the personal data we request?
6/ How do we share your personal data?
7/ How do we guarantee the security of your personal data?
8/ When do we transfer your personal data abroad?
9/ Your rights regarding your personal data
10/ Automated decision-making / profiling
11/ Update to this privacy policy

1/ Contact details of the Data Controller

Local data controller:
COMUNIDAD DE PROPIETARIOS DEL CENTRO COMERCIAL GLORIAS
Av. Diagonal 208
Barcelona, ​​08018
Spain

2/ How do we collect personal data about you?

We collect personal data about you through the following means:

· Through any security and access control system (especially CCTV, license plate recognition system in parking lots, access rights system)

· Directly from you (or your family members in the case of serious injuries); and/or

· through any application that may be available to anyone working at the shopping center

3/ Scope of this privacy policy

This privacy policy covers the personal data we process within the framework of managing safety and security throughout our shopping center through the following means:

  • CCTV system

  • Injury and/or accident log

  • Incident and/or criminal activity log

  • Access rights management system

4/ Details on the processing of your personal data

In the following table, you will find all the information related to:

  • The purpose for which we process your personal data (Specific Purpose)

  • The personal data that is processed (Personal Data Processed)

  • The legal basis for processing your personal data (Legal Basis)

  • The period of time during which we store your personal data (Retention Period)

Management of accidents and injuries that occur at the shopping center. This includes the handling of any legal claims.

  • Personal data processed: Personal contact details, date of birth, information about the injury and/or accident, health and medical information, and, where applicable, CCTV footage.

  • Legal basis: Legitimate interest to monitor the accident that occurred at the shopping center and to prepare and defend against legal action.

  • Retention period*: Maximum 10 years from data collection.

Images captured via CCTV will be retained for a maximum of 30 days.

Access management within the shopping center to prevent unauthorized access and prevent any criminal or potentially criminal activity, including the prevention of property damage, shoplifting, terrorist attacks, and drug trafficking.

  • Personal data processed: Personal contact details, access card, license plate number, CCTV footage (image).

  • Legal basis: Legitimate interest to prevent and detect unlawful acts and crimes

  • Retention period*: Your personal data will be stored for 3 (three) years from the last entry/exit of the corresponding parking lot.

Images captured through CCTV will be retained for a maximum period of 30 days.

Maintain security within our shopping center, ensure public safety, and in particular, comply with health and safety obligations (including fire protection and the prevention of foreseeable natural and technological risks) and prevent and detect criminal or potentially criminal activity, including the prevention of property damage, shoplifting, terrorist attacks, and drug trafficking;

Personal data processed: Personal contact information, license plate number, information on criminal or suspected criminal activity.

  • CCTV recording (image): Contact personal data, license plate number, information regarding criminal or allegedly criminal activity, and CCTV recordings (image). In the specific case of employees of the CCTV service provider: connection logs in the IT tool used to manage the CCTV system. In the specific case of any person working in the shopping center: first name–last name–phone number and email address (both personal and professional).

  • Legal basis: Legitimate interest to prevent and detect unlawful acts and crimes.

  • Retention period*:Personal data will be retained for a maximum of ten years from the time of collection. In the case of images captured by video surveillance cameras (CCTV), the retention period will be up to 30 days. As for data relating to individuals working in the shopping center, it will be retained for a period of five years.


Management of the request(s) made in the exercise of the rights provided for in section 8, including pursuant to any legal claim.

  • Personal data processed: Personal contact information, information on suspected or actual incidents, CCTV images, automatic license plate recognition images/information.

  • Legal basis: Legal obligation in accordance with the application of Article 6.1(c).

  • Retention period*: Processing period of the request plus an additional five years.


*We may need to retain your personal data beyond the periods indicated above, for example, when required by a legal obligation (e.g., tax obligations), or when a law enforcement or judicial authority is investigating a crime or incident, or for the preparation or defense of legal claims.


5/ What happens if you do not provide us with the personal data we request?

To the extent we are legally required to collect your personal data, you must provide us with that data.

If you do not provide us with your personal data and subsequently rely on that data to prepare or bring a legal claim, that claim may be dismissed and/or unsuccessful.

6/ How do we share your personal data?

We may share your personal data in the following ways:

· To the extent we use service providers who process personal data on our behalf to provide their services to us. You can find a list of our service providers in Appendix 1 below.

For employees working at the shopping center, your personal data may be processed in any application (such as Connect) available to them in accordance with the applicable privacy policy, and may be disclosed

· to supervisory authorities and public administrations for the prevention and detection of crimes;
· with emergency services in the event of accident or illness;
· with our lawyers and judicial authorities in the event of claims and/or to defend our interests; and
· with our insurers for claims relating to accidents/injuries or damage to personal property.

7/ How do we guarantee the security of your personal data?

We take the security of all the personal data we hold very seriously. We are committed to protecting your personal data and adopting appropriate technical security measures to protect it.

8/ When do we transfer your personal data abroad?

Your personal data is not transferred outside the European Union.

If this situation changes, and your personal data is transferred to countries outside the European Economic Area, such transfer will be made to countries that offer a level of personal data protection equivalent to that of the laws of the European Economic Area, or, if not, we will ensure that appropriate safeguards are in place to protect your personal data, in particular by signing the European Commission's Standard Contractual Clauses. You can find more information about these clauses at the following link: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.

In such cases, the privacy policy will be updated.

9/ Your rights regarding your personal data

In accordance with applicable law, you may exercise your rights of access, rectification, objection to processing, restriction of processing, or portability of your personal data as described below:

  • to access your personal data, to request rectification or erasure of your personal data; to object to processing or to request restriction of processing of your personal data;

  • to receive, upon request, all your personal data in a structured and standard format; and to request that such data be transmitted to another data controller;

The aforementioned rights may be limited due to the nature of video surveillance processing, meaning that the data subject cannot request that the shopping center refrain from capturing their image during visits.

  • Exercising Your Rights

If you wish to exercise these rights and/or obtain all relevant information, please contact us at the following address: atencionalclientewestfield@glories.com

To ensure the effective exercise of your rights, you can send your request to the address indicated above to ask questions and make requests related to the processing carried out by both data controllers (the local data controller and the group data controller).

You can also exercise these rights directly at the information/welcome desk in your shopping center.

In order to avoid infringement of third-party rights, we may verify your identity beforehand if we have reasonable doubts.

  • Complaints

If you have any complaints related to our use of your personal data, please contact us first so we can try to resolve them. However, if you are not satisfied, we inform you that you have the right to file a complaint with the Spanish Data Protection Agency.

10 / Automated Decision-Making / Profiling

Currently, no automated decision-making or profiling is carried out with your personal data.

11 / Update to this Privacy Policy

We may modify or update this Privacy Policy from time to time. Any modifications will become effective upon posting on this website.

Annex 1 - Service Provider:

Company Name: SECURITAS SEGURIDAD ESPAÑA S.A.
Registered Office: Calle Entrepeñas, 27, 28051 Madrid
Company Registration Number: A79252219
Country in which the personal data is processed and/or stored: Spain