HomeConfidentiality Policy

Confidentiality Policy

Version: February 2024


This confidentiality policy (the “Policy”) provides information of general interest about the processing of personal data by Baneasa Developments S.R.L., data belonging to the following data subjects (collectively referred to as the “Customers”):


(i) visitors of the Băneasa Shopping City, a shopping center developed and operated by our company (hereinafter referred to as “Băneasa Shopping City” and/or the “Shopping Center”),

(ii) users who access the www.baneasa.ro website (including the mobile version), operated by our company (hereinafter referred to as the “Băneasa Website”), as well as 

(iii) users of the CITY iLOVE application, developed and operated by our company (hereinafter referred to as “CITY iLOVE” and/or the “Application”),


Customers may have various other interactions with our company, such as those related to access to the parking lot of the Shopping Center, the purchase of Gift Cards, receiving newsletters, direct interactions at the information desks within the Shopping Center, interactions related to our company's accounts on social networks, etc., to which this Policy is also applicable.


Furthermore, the Policy details the rights granted by the legislation on personal data protection, in particular Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR") and Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, derived in connection with the use of the Băneasa Website, the Application or the visit of the Shopping Center. In addition, regarding the use of cookies and other similar technologies, please refer to the Cookies Policy, available here.


In connection with the exercise of the rights of data subjects, as well as for questions or clarifications, please consider the contact details below.


1. THE PERSONAL DATA OPERATOR:

The data operator is BANEASA DEVELOPMENTS S.R.L. (“Băneasa” and/or the “Operator”), as it independently and legitimately establishes the purposes and means of the personal data processing. The operator has the following contact details:

  • postal address: Bucharest, 42D Strada Bucureşti - Ploieşti, 2nd floor, Sector 1, Romania;
  • e-mail address: dpo@baneasa.ro. 


2. PURPOSE OF PROCESSING AND CATEGORIES OF DATA PROCESSED:

Băneasa is constantly trying to develop and improve the relationship it has with its customers. For this reason, multiple communication channels with Customers have been created to offer the best experience within the Shopping Center.


Regarding the categories of data processed by the Operator, they can be identified for each specific purpose, as they are presented in the table below. In order to facilitate the identification of the purposes of the processing performed, they are classified into 4 (four) large categories, as follows:


Purpose of processing


Categories of data processed


Legal grounds of processing


1. Data processing performed during online visits:


Purpose of processing:


  • accessing Băneasa Website and expressing your choices about cookies; for more details, please see the Cookie Policy available here;
  • accessing the contact form available on the Băneasa Website;
  • accessing social networks in which Băneasa has active accounts (e.g. Facebook, Instagram, etc.);
  • receiving news and personalized offers (newsletters) because of accessing the previously mentioned sources;
  • removal of errors and improvement of the functionality of the Băneasa Website.



Categories of data processed:


Identification details:

  • name;
  • first name;
  • photos of the data subjects in so far as they are uploaded by them in the contact forms. 

Contact details:

  • e-mail address;
  • phone number.

Data related to the equipment being accessed as well as data accessed or stored on the device, for example:

  • geo-location data,
  • operating system data,
  • device resolution,
  • data on visits to the platforme such as number of visits, time spent on the platform, how the platform was accessed,
  • the IP.



Legal grounds of processing:


Băneasa processes these categories of data based on the following legal grounds:

(i) customers' consent for the situation of completing the contact form available on the Băneasa Website, for direct marketing activities or for those cookies that are not strictly necessary for the use of Băneasa Website;

(ii) the legitimate interest of the Operator consisting in carrying out the commercial activity and to offer you a pleasant and documented experience.




2. Data processing performed during the physical visits within the Shopping Center:


Purpose of processing:


  • interactions with the Operator through the information offices available within the Shopping Center (including minors over 14 years of age);
  • participation in various events or marketing campaigns within Băneasa Shopping City;


Customers are informed, from the moment of registration as participants in the event or marketing campaign, that relevant photos from that event or campaign will be published on the social networks where Băneasa has accounts.

  • access to the Shopping Center and prevention of unauthorized access by (i) video-surveillance in order to prevent the access of unauthorized persons / vehicles and to prevent certain damages brought to the Shopping Center, acts of terrorism, vandalism, drug dealing, respectively (ii) cards / access tickets.


The processing conditions by means of video-surveillance can be accessed online, using the link indicated in the warning posters that can be found within the Shopping Center and in the underground parking lot (link Video-surveillance policy in the shopping center and in the parking lot).


The information desks within Băneasa Shopping City can provide, upon request, the Video-Surveillance Policy in the shopping center and in the parking lot. 


  • Obtaining access tickets in the parking lot as well as concluding parking subscriptions for both the underground and the above-ground parking spaces, where applicable.



Categories of data processed:


Identification details:

  • name;
  • first name;
  • photos;
  • images captured with video media means;
  • vehicle brand;
  • vehicle model;
  • vehicle registration number;
  • ID number and series;
  • Personal Identification Number (for Gift Cards sales: filling in the form; for the sale of the parking subscription: filling in the agreement; for renting prams for children / disabled people; for handing out prizes exceeding the value of RON 600);
  • signature.

Contact details:

  • e-mail address;
  • postal address;
  • phone number.



Legal grounds of processing:


Băneasa processes these categories of data based on the following legal grounds:

(i) the consent of the Customers in case of close-up shooting at certain events within the Shopping Center and in case of completing a contact / complaint form addressed to our company;

(ii) the legal obligation to video surveille shopping centers established in Law no. 333/2003 on security of objectives, goods, valuables ​​and protection of individuals;

(iii) the legitimate interest of the Operator regarding the photography of the events, data processing that exceed the scope of the legal obligation established by Law no. 333/2003 on the security of objectives, goods, valuables ​​and protection of individuals;

execution of an agreement regarding parking access subscriptions / tickets.



3. Data processing performed in connection with the CITY iLOVE Application:


Purpose of processing:


  • registration on the Application and its use as well as expressing your choices about cookies; for more details, please see the Cookie Policy available here.
  • rewarding customers’ loyalty.
  • transmitting information to Customers about the benefits and discounts specially created for them.
  • the constant improvement of the functionalities of the respective Application, the response to certain specific requests from the Clients regarding the functionalities of its adaptation.
  • performing an internal analysis of the Operator regarding the mentioned activities, to improve any technical non-functionalities of the Application.



Categories of data processed:


Identification details:

  • name;
  • first name;
  • phone number;
  • date of birth;
  • gender;
  • profile photo.

Contact details:

  • e-mail address.

Data related to the equipment being accessed as well as data accessed or stored on the device, for example:

  • geo-location data,
  • operating system data,
  • device resolution,
  • data on visits to the platforme such as number of visits, time spent on the platform, how the platform was accessed,
  • the IP



Legal grounds of processing:


Băneasa processes these categories of data based on the following legal grounds:

(i) Customers’ consent for the registration, use and transmission of newsletters through the Application;

(ii) the legitimate interest of the Operator for the situations of rewarding the loyalty of the Customers and the constant improvement of the Application’s functionalities.


4. Data processing performed in connection with the purchase of a Gift Card:


Purpose of processing:


purchase of the Gift Card directly from the Shopping Center, from Băneasa Website or through the CITY iLOVE Application.


Categories of data processed:


Identification details: 

  • name and first name;
  • place and date of birth; 
  • series and number of the identification document (ID / passport)*; 
  • Personal Identification Number* 
  • signature, for the purchase made directly from the Shopping Center.

Contact details: 

  • e-mail address;
  • phone number.

Transaction data:

  • value of the Gift Card.


* It is mandatory to identify customers when purchasing Gift Cards, in accordance with Law 129/2019 to prevent and combat money laundering and terrorism financing, as well as to amend and supplement certain regulations and Law 209/2019 on payment services and to amend certain normative documents, a copy of an identity document shall be requested and retained.


Legal grounds of processing:


The data are processed under the execution of an agreement, for the situation of purchasing Gift Cards, respectively the legitimate interest of the Operator, for the data processing that exceed the scope of the Gift Card purchase agreement, such as the situation in which the Operator is suing those customers who fraudulently use the Gift Card.



Last but not least, the Operator may process personal data for purposes other than those provided above, as follows:

  • the transmission of these personal data to the authorities, institutions, competent bodies of the state that request them, such processing being based, in general, on the legal obligation of the Operator to cooperate with the competent authorities and/or institutions of the state, respectively on its legitimate interest, in those situations that exceed the scope of the legal obligation;
  • the transmission of these personal data to the Operator's consultants (lawyers, tax consultants, accountants) based on the execution of an assistance agreement or the legitimate interest of the Operator to prevent and/or resolve a complaint, referral, court action, procedure / investigation / inquiry instituted by any authority, institution, state body, etc.
  • for any other exceptional situations that require this processing, the Operator relying both on the legal obligation, insofar as such an obligation is legally established, and on its legitimate interest, in those situations that exceed the scope of the legal obligation.


CATEGORIES OF RECIPIENTS TO WHICH THE PROCESSED DATA ARE TRANSFERRED 

The Operator makes all efforts to ensure that all its commericial partners, Stores, technicians, suppliers or independent third parties undertake through contractual commitments to process the information shared with them in accordance with the Operator's instructions, this Policy and the applicable legislation on personal data protection. We shall not sell, lease, transfer or otherwise disclose personal information of customers for commercial purposes, in breach of the commitments made by this Policy.

In order to fulfill the specific purposes above, Customer data are stored through an EU cloud service provider or in IT infrastructures and systems within our locations in Romania. 



In order to facilitate the activities related to the purposes of the previously detailed processing, we communicate these data to third parties, including their partners, such as:

  • marketing service providers, web analysis, insurance companies;
  • affiliates, respectively companies from the group to which the Operator belongs;
  • operational service providers, such as telecommunications, IT, payments, processing, training, storage, archiving, Customer support services, services for managing the choices made when visiting the City iLove website and/or application; 
  • any business partner, investor, assignee (current or potential) to facilitate transactions with commercial assets (which may include a merger, acquisition, debt or sale of goods);
  • professional advisers, such as auditors or lawyers;
  • regulatory authorities, professional bodies and/or public authorities for compliance with the applicable regulations.


Please note that for certain services related to media intermediation and placement, analysis of traffic and behavior related to the Baneasa Website, consultancy and analysis related to the implemented campaigns, we collaborate with third party companies that are specialized and ensure data processing according to their own competences. In these cases, the activities may involve the direct management of limited categories of personal data by these companies and Baneasa will ensure that the companies chosen for such activities are certified and/or offer adequate guarantees in accordance with the standards established at industry level.


However, we reserve the right to disclose information about you if we are compeled by law or if we are required to do so by administrative authorities (e.g. police or courts of law, etc.).


At the choice of the service providers, the Operator may transfer Customer data outside the borders of the European Economic Area. In such cases, the Operator shall ensure before sending the data that these service providers comply with the minimum security standards set by the European Commission and that they always process the data in accordance with the Operator's instructions. The Operator may have a commercial relationship with them under which the service providers agree to follow the Operator's instructions and to establish the necessary security measures to protect the Users' data.


Customer data shall not be disclosed to a third party unless: (i) they are necessary to provide the requested services when the Operator cooperates with third parties or if the processing is necessary for the fulfilment of the legitimate interests of the Operator; or (ii) the Operator has the express consent and unequivocal authorization of the User; or (iii) they are requested by a competent authority in accordance with its responsabilities (to investigate, prevent or act in connection with illegal actions); or (iv) finally, when required by law.


DATA SHARING WITH GOOGLE IRELAND LTD

For the analysis of the traffic and behaviour related to the Băneasa Website, as well as for marketing and advertising purposes, we use web analytics services that involve sharing limited categories of personal data with Google Ireland Ltd. 


The use of these services by Băneasa involves placing and accessing cookies and similar technologies on your device (laptop, tablet, smartphone or similar) depending on your expressed choices regarding such. This allows the analysis of the Băneasa Website and the evaluation of usage behaviour through the statistics/tracking obtained, in order to obtain a correct understanding of the functionalities and the way of interaction, with the aim of improving the performance of the Băneasa Website and campaigns and implementing more interesting offers. Thus, when you visit the Băneasa Website, your user behaviour is recorded in the form of events (such as page views, interactions with different sections), as well as other data, such as your approximate location (country and city), technical information about your browser and the devices you are using or the referring URL, i.e. through which website/advertising material you accessed Băneasa Website.


Băneasa has implemented the latest technologies and guidelines on obtaining your consent and sharing data. This gives you the opportunity to express your choices directly from your Google account (if applicable) and you can also prevent the collection and transmission of cookie data related to your use of the Băneasa Website to Google (including your IP address) by downloading and installing the browser add-on to disable Google Analytics available here. If you wish to opt-out of interest-based advertising from Google, you can use the opt-out settings and options provided by Google and for more details please see the documents provided by them here.


RIGHTS OF THE DATA SUBJECTS:

According to the conditions provided by the applicable law (GDPR), you have the following rights:

  1. Right to access: You have the right to be informed, upon request, if your personal data are processed, and if so, you have the right to request access to them. The information includes, but is not limited to, the purposes of the processing, the categories of personal data affected and the recipients or categories of recipients to whom your personal data has been or will be disclosed. You have the right to obtain a copy of the personal data processed. For extra copies, we may charge a reasonable fee based on administrative costs.
  2. Right to rectification: You have the right to obtain from us the rectification of your incorrect personal data. Depending on the purpose of the processing, you have the right to complete incomplete personal data, including by means of an additional declaration.
  3. Right to be deleted („right to be forgotten”): You have the right to ask us to delete your personal data. 
  4. Right to restriction: You have the right to request the restriction of the processing of your personal data. In this case, those data will be marked and could be processed by us only for certain purposes.
  5. Right to data portability: You have the right to receive your personal data that you have provided us, in a structured, common and device-readable format, and you have the right to transmit these data to another entity without objection from our side.
  6. Right to object: You have the right to object, for reasons related to your situation, at any time, to the processing of your personal data by us, and we may be asked to no longer process your personal data. If you have the right to object and you exercise this right, we will no longer process your personal data for that purpose. Exercising this right does not involve any cost. This right may be invalidated if the processing of your personal data is necessary for the formalities relating to the conclusion of an agreement or for the performance of an agreement already concluded.
  7. Right not to be subject to a decision based solely on automated processing, including profiling: We will not make automated decisions that produce legal effects on you or affect you in a similar way, unless such processing is necessary for the execution of the agreement or it is permitted by law.
  8. Right to file a complaint with the National Authority for the Supervision of Personal Data Processing (in Romanian: ANSPDCP): if you consider that we have not responded to your requests properly, you have the right to file a complaint to ANSPDCP.


Băneasa may request the identification of the person exercising his/her rights to ensure the confidentiality of the personal data transmitted. We reserve the right to respond to requests received within the term allowed by law, as well as to protect ourselves against malicious or unjustifiably repeated requests.


Except for the right to file a complaint with ANSPDCP, all rights specific to Customers may be exercised by a request sent to dpo@baneasa.ro.


To the extent that the processing of personal data has as legal grounds art. 6 para. (1) letter b) -execution of an agreement or art. 6 para. (1) letter c) - fulfillment of a legal obligation, certain rights provided above are not applicable, as follows:

- the right to be deleated / the right to be forgotten, in accordance with art. 17 para (3) letter b) of the GDPR (regarding the processing based on the fulfillment of a legal obligation); 

- the right to oppose the processing, in accordance with art. 21 para. (1) GDPR (regarding processing based on the execution of an agreement);

- the right to portability, in accordance with preamble 68 and art. 20 of the GDPR.


DATA SECURITY

Băneasa has adopted all the security measures necessary to protect personal data so that, from the moment of their communication, they will be protected both offline and online. We have taken appropriate technical and organizational measures to ensure the security of your data, particularly to protect your personal data against access by third parties and against any intentional modification, loss, or destruction. These measures are regularly reviewed and adapted according to the latest technologies. All personal data shall be processed through secure pages that use the SSL encryption system, marked with a padlock symbol, positioned at the bottom of the browser’s window. For more information on the security standards applied, access the "Contact" section of the Băneasa Website.



STORAGE PERIOD:

In principle, we will keep your personal data for as long as required or permitted by the applicable law, specific to the field of activity or according to the applicable limitation periods or to comply with the archiving obligations imposed by the applicable law (e.g. specific to the financial-accounting field).


For any specific details and terms, please request us more details on our Personal Data Retention Policy.


Subsequently, we will remove/delete your personal data from our systems and records and/or take measures to anonymize them so that you can no longer be identified based on them.


BĂNEASA DEVELOPMENTS S.R.L.