1. Data controller

Data controller: User Community of the Vialia Estación Leisure and Shopping Centre (Vialia Malaga Shopping Centre)
Postal address: Avenida Explanada de la Estación s/n, 29002, Malaga
Tel.: 952 040 915
Email: spain.vialia@cbre.com

2. Data processing

The User Community of the Vialia Estación Leisure and Shopping Centre (Vialia Malaga Shopping Centre) will only process the personal data shown below:

A. Data collected by the website

Purpose: To answer information and contact requests sent by means of the email addresses and contact forms on the website.

Retention: The personal data of the data subject will be retained until the deletion thereof is requested by the latter and in any event for a maximum period of five years.

Authority: Consent of the data subject

Recipients: It is not anticipated that any personal data will be disclosed except in cases where there is a legal obligation to do so.

Methods of data collection: The personal data that we process have been collected from the data subject.

The data categories processed are as follows:
– Identifying information
– Contact details

No sensitive data are processed.

B. Coordination of business activities

Purpose: Coordination of business activities and management of the Shopping Centre

Retention: The data will be retained for the limitation periods established by the Act on Employment Infringements and Penalties (4 years)

Authority: Compliance with a legal obligation: Article 24 of the Health and Safety at Work Act 31/1995 and Royal Decree 171/2004

Recipients: It is not anticipated that any personal data will be disclosed except in cases where there is a legal obligation to do so.

Methods of data collection: The personal data that we process have been collected from the data subject or the person legally responsible for the company.

The data categories processed are as follows:
– Identifying information
– Contact details

No sensitive data are processed.

C. Lease agreements

Purpose: Management and implementation of lease agreements over business units and communal areas

Retention: The data will be retained for the term of the lease agreement and the following fifteen years in accordance with the limitation periods established in the Urban Leasing Act

Authority: Implementation of the lease agreement signed by both parties

Recipients: It is not anticipated that any personal data will be disclosed except in cases where there is a legal obligation to do so.

Methods of data collection: The personal data that we process have been collected from the data subject or the person legally responsible for the lessee company

The data categories processed are as follows:
– Identifying information
– Contact details
– Income information and banking details

No sensitive data are processed.

D. Provision of services

Purpose: Provision of services to Shopping Centre users (e.g. loan of trolleys, wheelchairs, highchairs, etc.)

Retention: The data will be retained for 1 year.

Authority: Implementation of the agreement for the provision of the services requested by the data subject.

Recipients: It is not anticipated that any personal data will be disclosed except in cases where there is a legal obligation to do so.

Methods of data collection: The personal data that we process have been collected from the data subject

The data categories processed are as follows:
– Identifying information
– Contact details

No sensitive data are processed.

E. Suggestions and claims

Purpose: The data provided through suggestion and claim forms will be processed in order to deal with any suggestions or claims made by the data subject.

Retention: The data will be retained for 1 year (in accordance with Article 1968 of the Civil Code) unless such data are required to defend a legal claim or exercise a right, in which case they will be kept until the conclusion thereof.

Authority: The authority for the data processing is based on the legitimate interest of the Data Controller in responding to and dealing with any complaints made by Shopping Centre users.

With regard to any claims that involve personal injury or property damage, authority for the data processing is based on compliance with a legal obligation (Article 1902 of the Civil Code) and the Insurance Contract Act 50/1980.

Recipients: The data collected through complaints and suggestions will not be disclosed to third parties except in the cases expressly provided for in current legislation.

The data collected through claims will be disclosed to the insurance companies and brokers required to process the claim, as well as any other cases in which there is a legal obligation to do so.

Methods of data collection: The personal data that we process have been collected from the data subject.

The data categories processed are as follows:

– Identifying information
– Contact details
– Information relating to the complaint or claim
– Personal injury suffered (only in claims relating to personal injury)

In the case of claims that include personal damage, data relating to people’s health may be processed, e.g. injury reports.

F. Children’s play area service

Purpose: The personal data collected through this service will be processed in order to provide and manage the children’s play area service.

Retention: The data will be retained for a maximum period of one year unless such data are required to defend a legal claim or exercise a right, in which case they will be kept until the conclusion thereof.

Authority: The authority for the data processing is based on the implementation of the agreement for the provision of the children’s play area services requested by the data subject.

Recipients: No personal data will be disclosed to third parties unless there is a legal obligation to do so.

Methods of data collection: The personal data that we process have been collected from the data subject and/or the father, mother, guardian or carer of the minor.

The data categories processed are as follows:

– Identifying information of the father, mother, guardian or carer of the minor
– Identifying information of the minor

No sensitive data are processed.

G. Events, competitions, offers and promotions

Purpose: The personal data collected through the forms to participate in events, competitions or promotions will be processed in order to manage the data subject’s participation therein.

Furthermore, if you give us your consent, we will use the data provided to send you information by post and/or email on the activities, offers and promotions of the Shopping Centre or the businesses operating in it.

Retention: The personal data used to send information will be retained until the deletion thereof is requested by the data subject. All other information will be retained for a maximum period of five years.

Authority: The authority for the data processing is based on the consent of the data subject given during the data collection process.

Recipients: No personal data will be disclosed to third parties unless there is a legal obligation to do so.

Methods of data collection: The personal data that we process have been collected from the data subject.

The data categories processed are as follows:

– Identifying information and contact details

No sensitive data are processed.

H. Mobile app

Purpose: We will process the personal data of users of our mobile app in order to provide you with information on the latest news, offers, promotions, events and competitions of the Shopping Centre or the business operating in it.

If you allow our app to access your location, the data that we collect will be processed in order to inform you of the offers, promotions, latest news, events and promotions of our Shopping Centre.

The data collected through our app will be used to create a commercial profile based on such information. This profile will be used to inform the data subject of the offers, promotions and latest news in line with their tastes and interests.

Retention: The personal data of the data subject will be retained until the deletion thereof is requested by the latter.

Authority: The authority for the data processing is based on the consent of the data subject given during the app installation process.

Recipients: No personal data will be disclosed to third parties unless there is a legal obligation to do so.

Methods of data collection:

The personal data that we process have been collected from the data subject.

The data categories processed are as follows:

– Identifying information
– Geo-positioning data

No sensitive data are processed.

I. Video surveillance

Purpose: The personal data collected by our video surveillance system will be processed in order to maintain the security of the facilities, property and personnel of the Shopping Centre.

Retention: The personal data of the data subject will be retained for a maximum period of 30 days, unless such data are required to defend a legal claim or exercise a right, in which case they will be kept until the conclusion thereof.

Authority: The authority for the data processing is based on the legitimate interest of the data controller (protection of the facilities, property and personnel of the Shopping Centre.

Recipients: If any criminal offences should be committed, the images obtained will be passed on to the state security forces. Apart from such cases, no personal data will be disclosed to third parties unless there is a legal obligation to do so.

Methods of data collection:

The personal data processed have been obtained from the data subject through the video surveillance system.

The data categories processed are as follows:

– Images

No sensitive data are processed.

J. Employee identification card

Purpose: Management of the Shopping Centre and access control.

Retention: The personal data will be retained for a maximum period of one year, unless such data are required to defend a legal claim or exercise a right, in which case they will be kept until the conclusion thereof.

Authority: Legitimate interest.

Recipients: It is not anticipated that any personal data will be disclosed except in cases where there is a legal obligation to do so.

K. Subscribers to emailing list

Purpose:

– To send information of interest to you on the activities, offers and promotions of the Shopping Centre or the business operating in it.

– Creation of a commercial profile in order to send you information in line with your tastes and interests on the activities, promotions and latest news of the Shopping Centre.

Retention: The personal data of the data subject will be retained until the deletion thereof is requested by the latter.

Authority: Consent of the data subject.

Recipients: It is not anticipated that any personal data will be disclosed except in cases where there is a legal obligation to do so.

Methods of data collection: The personal data that we process have been collected from the data subject.

The data categories processed are as follows:

– Identifying information
– Contact details

No sensitive data are processed.

L. Subscribers to the emailing list who subscribed prior to 25 May 2018

Purpose:

– To send information of interest to you on the activities, offers and promotions of the Shopping Centre or the business operating in it.

– Creation of a commercial profile in order to send you information in line with your tastes and interests on the activities, promotions and latest news of the Shopping Centre.

Retention: The personal data of the data subject will be retained until the deletion thereof is requested by the latter.

Authority: Legitimate interest of the data controller.

Recipients: It is not anticipated that any personal data will be disclosed except in cases where there is a legal obligation to do so.

Methods of data collection: The personal data that we process have been collected from the data subject.

The data categories processed are as follows:

– Identifying information
– Contact details

No sensitive data are processed.

M. Users of the Wi-Fi service

Purpose: The personal data collected through the Wi-Fi service connection forms will be processed in order to provide you with access and connection to the free complimentary Wi-Fi service that the Shopping Centre provides to its customers. Furthermore, if you give us your consent, we will use your data to send information of interest to you on the activities, offers and promotion of the Shopping Centre or the businesses operating in it.

Retention: The personal data relating to users connected to the Wi-Fi service will be retained for a maximum period of one year. The personal data of the data subject relating to the sending of information by email on the activities and information of the Shopping Centre will be retained until the deletion thereof is requested by the data subject.

Authority: The authority for the data processing is based on the implementation of the agreement for the provision of Wi-Fi services to customers of the Shopping Centre.

Recipients: No personal data will be disclosed to third parties unless there is a legal obligation to do so.

Methods of data collection: The personal data that we process have been collected from the data subject.

The data categories processed are as follows:

– Identifying information

– Identifying information of the terminal or computer from which the connection is made.

No sensitive data are processed.

N. Social networks

Purpose: As the Vialia Malaga Shopping Centre has accounts or profiles on various social networks, you are advised that the data collected through this activity will be processed on the social network itself in order to interact and stay in contact with followers, as well as providing them with information.
If any activities involving any other processing of the data of the data subjects should be scheduled on such social networks, information will be provided on the privacy policy applicable to such data processing.

Retention: The personal data collected from followers will be retained for as long as the data subject remains interested in the content generated by our accounts or social networks and remains a follower thereof.

Authority: The authority for the data processing is based on the unequivocal consent of the user.

Recipients: No personal data will be disclosed to third parties unless there is a legal obligation to do so.

Methods of data collection: The personal data that we process have been collected from the data subject.

The data categories processed are as follows:

– Identifying information

No sensitive data are processed.

O. Employees of the businesses in the shopping centre

Purpose: Management of the shopping centre and contact with the employees of the businesses operating in it.

Retention: The data will be retained for as long as the data subject works in the businesses operating in the shopping centre.

Authority: Legitimate interest of the data controller.

Recipients: It is not anticipated that any personal data will be disclosed except in cases where there is a legal obligation to do so.

Methods of data collection: The personal data that we process have been collected from the data subject or the person legally responsible for the place where the employee works.

The data categories processed are as follows:

– Identifying information

– Contact details

No sensitive data are processed.

3. Rights of the data subject

– You have the right to obtain confirmation of whether or not we are processing personal data concerning you.

– Data subjects have the right to access their personal data, as well as to request rectification of any inaccurate data or, where appropriate, request the deletion of such data when, among other reasons, the data are no longer required for the purposes for which they were collected.

– Under certain circumstances, the data subjects may request the restriction of processing of their data, in which case we will only keep the data in order to exercise or defend legal claims.

– Under certain circumstances and on grounds relating to their particular situation, the data subjects may object to the processing of their data. In these cases, their data will not be processed unless there are legitimate reasons to do so, or in order to exercise or defend potential legal claims.

– Under certain circumstances, you will have the right to receive the personal data concerning you in a commonly-used, structured and machine-readable format.

You may exercise your rights using the methods of contact indicated in this policy (email address or in person at the Shopping Centre). You can also obtain more information on your rights and have access to the forms needed to exercise them at the following website: http://www.agpd.es/portalwebAGPD/CanalDelCiudadano/derechos/index-ides-idphp.php

Furthermore, please note that you have the right to make a claim to the Spanish Data Protection Agency if a request for the exercise of any right has not been properly dealt with or if, for any other reason, you believe that your personal data are not being processed correctly. To do this, please visit the following website: https://sedeagpd.gob.es/sede-electronica-web/vistas/formSpam/spamDenuncia.jsf;jsessionid=3FC268F548C59FFD4F289FCC645855EA

4. Cookies

What are Cookies?

A cookie is a file which is downloaded onto your computer when you visit certain websites. Among other things, cookies enable a website to store and retrieve information on users’ browsing habits or their device, manage users’ access to restricted areas of the website, etc.

What types of cookies does this website use?

– Analysis cookies: these cookies enable the monitoring and analysis of users’ behaviour on our website. The information collected is used to measure users’ activity on the website and create user browsing profiles in order to improve the website, as well as the products and services offered.

– Personalisation cookies: these cookies enable us to adapt browsing on our website to users’ preferences (e.g. language, browser used, etc.)

– Technical cookies: these types of cookies allow users to browse a website, platform or app and use the different options or services on it, such as monitoring traffic and data communication, identifying the session, visiting restricted access areas, remembering the items of an order, carrying out the order purchase process, completing a request to register for or take part in an event, using security elements while browsing, storing content to broadcast video or audio, or sharing content on social media.

– Advertising cookies: these cookies allow the efficient management of any advertising spaces included on the website, based on criteria such as the content published or the frequency with which adverts are displayed.

– Behavioural advertising cookies: these cookies allow the efficient management of any advertising spaces included on the website, based on information on users’ behaviour obtained through continuous observation of their browsing habits. This enables a specific profile to be developed in order to display advertising accordingly.

– First-party cookies: these cookies are sent to your computer or terminal from our website.

– Third-party cookies: these cookies are sent to your computer or terminal from a domain or website which is not managed by us, but by another organisation that processes the data obtained through the cookies.

– Session cookies: these are types of cookies designed to obtain and store data when you access our website.

– Persistent cookies: these are types of cookies in which the data are stored on the terminal and may be accessed and processed for a certain period of time; this may vary from a few minutes to several years.

Who uses the cookies?

The cookies on this website are used by the person legally responsible for this website and by the following services and service providers:

–       Google Analytics: A website analytics service that uses analysis cookies. The privacy policy of this service can be viewed at the following address. https://www.google.com/analytics/learn/privacy.html?hl=es

–       Instagram: A social network that uses analytical and technical cookies to share content on its social network. The cookies policy of this service can be viewed at the following address. https://help.instagram.com/155833707900388

–       Twitter: A social network that uses analytical and technical cookies to share content on its social network. The cookies policy of this service can be viewed at the following address. https://twitter.com/privacy/

–       Facebook: A social network that uses analytical and technical cookies to share content on its social network. The cookies policy of this service can be viewed at the following address. https://www.facebook.com/help/cookies/

How can I disable or delete cookies?

You can allow, block or delete the cookies installed on your computer by changing the settings of your installed browser. The links below provide additional information on the cookie settings of the different browsers.

– Internet Explorer: http://windows.microsoft.com/es-es/windows7/how-to-manage-cookies-in-internet-explorer-9

– Google Chrome: http://support.google.com/chrome/bin/answer.py?hl=es&answer=95647

– Firefox: http://support.mozilla.org/es/kb/habilitar-y-deshabilitar-cookies-que-los-sitios-we

– Safari: http://support.apple.com/kb/ph5042.

5. Version

This privacy policy is dated 01/05/2018. Any amendment to its terms and conditions will be published on this website.