Privacy-policy | Carrousel du Louvre

Safeguarding, Security and Access management Privacy Notice

Last update : June 2019

This notice explains how the data controller [referred to in this notice as the Data Controller (as defined below), we, us or our] collects and uses personal data in our shopping centre Le Carrousel du Louvre, hereinafter referred to as the “Shopping Centre” for security, safeguarding, access management purposes. Safeguarding refers to the management of accidents and incidents occurring in the Shopping Centre. Security relates to the prevention and detection of alleged or actual criminal activity.

This notice covers the following:

1/ Contact details of the Data Controller

2/ How do we collect your personal data?

3/ What is the scope of this privacy policy?

4/ Information about the processing of your personal data

5/ What happens if you do not provide personal data that we request?

6/ How do we share your personal data

7/ How do we keep your personal data secure

8/ Do we transfer your personal data overseas ?

9/ Your rights in relation to your personal data

10/ Automated decision making / profiling

11/ Update of this Privacy Notice

1/ Contact details of the Data Controller

The local data controller :

Espace Expansion

Simplified joint stock company with a capital of 464 910€

Having its registered office at 7 place du Chancelier Adenauer 75016 Paris

Registered within the Paris Register under number 323 998 690

The local data controller will process your personal data in the context set out below.

The group data controller :

Unibail Management

Simplified joint stock company with a capital of 20 000 000€

Having its registered office at 7 place du Chancelier Adenauer 75016 Paris

Registered within the Paris Register under number 414 878 389

The group data controller will process your personal data in order to assist the local data controller and to ensure a general governance at group level.

The local data controller and the group data controller are acting as joint data controllers and will hereinafter be referred to together as “Data Controller”.

2/ How do we collect your personal data?

We collect personal data about you through the following means :

through any system operated for the security, safety and access management (CCTV, licence plate recognition in Parking, access right system)
directly from you (or from your relatives in case of serious injuries) ; and/or
through any applications that can be available to any person working within the Shopping Centre

3/ What is the scope of this privacy policy?

This privacy policy deals with personal data we are processing in the framework of the management of security , safety and access management in and around the Shopping Centre, through :

CCTV System
Record of injuries and/or accidents
Record of incident and/or criminal activities
Access right management system

If you are a member of our loyalty program, the processing of your personal data collected in relation with the Loyalty Program will be made in compliance with the Loyalty Program privacy policy that you can find on the Shopping Centre’s website.

4/ Information about the processing of your personal data

You will find in the table below all information in relation with :

Why we are processing your personal data (Purpose)
Which personal data are involved (Personal data involved)
On which legal basis we are processing your personal data (Legal basis)
How long we are storing your personal data (Retention period)

Specific purpose

Personal data involved

Legal basis

Retention period*

Management of accident and injury occurring in the Shopping Centre.

Including management of any pursuant legal claim.

Personal contact details, date of birth, information about the injury and/or accident information about health and medical information,

Legitimate interest to keep track of accident occurring in the Shopping Centre and to prepare for and defend legal claim.

10 years maximum from their collection

Management of access in the Shopping Centre in order :

to prevent any unauthorized access and to prevent criminal or potential criminal activity including prevention against damages to property, shoplifting, prevention against terror attack as well as drug trafficking;

Personal contact details, entry pass, license plate number,

CCTV recording (image and voice)

Legitimate interest in preventing and detecting unlawful acts. and crimes .

Your personal data will remain stored for the duration of 3 (three) years after the last exit of the Shopping Centre..

Retention of CCTV footage is 30 days (in any case, up to a maximum of 30 days).

Maintain security within our shopping centre and keep the public safe and notably

· comply with health and safety obligations (including fire protection and prevention against foreseeable natural and technological risk).

· prevent and detect criminal or potential criminal activity including prevention against damages to property, shoplifting, prevention against terror attack as well as drug trafficking ;

Personal contact details, license plate number, information about the criminal or alleged criminal activity

CCTV footage (image and voice)

Specific for employees of CCTV operator service provider : connexion logs on the IT tool used to manage the CCTV.

Specific for any person working within the shopping centre : name – surname – phone number and e-mail address (personal and professional)

legitimate interest in preventing and detecting unlawful acts and crimes. .

Ten years maximum from collection

Retention of CCTV footage is 30 days (in any case, up to a maximum of 30 days).

One year

One year from last digital contact

Management of Parking subscription contract

Name/surname/ registration plate number / bank details / ID card

Execution of a contract

Duration of the contractual relationship.

Management of demand(s) made in application of rights related to personal data

Including any pursuant legal claim.

Personal contact details, all information contained in the request

Legal obligation to answer data subjects requests

five years from closing of the request.

*We may need to retain your personal data beyond these stated retention periods, for example where a law enforcement body or regulatory body are investigating a crime or incident, or in preparation for or in the defence of legal claims.

5/ What happens if you do not provide personal data that we request?

Where we are legally obliged to collect personal data the provision of this information will be mandatory.

Failure to provide personal data which you later rely upon in preparing or making a legal claim could result in your claim being dismissed and/or unsuccessful.

6/ How do we share your personal data ?

We may share personal data in the following ways:

with other companies of the Unibail-Rodamco-Westfield Group as part of the handling of a security, legal or insurance matter, based on our legitimate interest to handle those matters efficiently and with the support of the relevant departments of such companies.
where we use service providers who process personal data on our behalf in order to provide services to us. You will find the list of our services providers in Appendix 1 below.
Please note that for any employees working within the shopping centre : your personal data may be processed within any applications (such as Connect) available to them in accordance with their privacy policies.
with law enforcement agencies and government agencies for the prevention and detection of crime;
with the emergency services in the case of accident or illness;
with our lawyers and courts when enforcing claims and/or defending our position; and
with our insurers for claims relating to accident/injury or damage to personal property.

7/ How do we keep your personal data secure?

We take the security of all the personal data we hold very seriously. We are committed to protecting your personal data and implement appropriate technical security measures to protect it.

8/ When do we transfer your personal data overseas?

Your personal data are not transferred outside the European Union.

if your personal data is to be transferred to countries outside the European Economic Area in countries that may not offer an equivalent level of protection for personal data to the laws in the European Union, we will ensure that appropriate safeguards are put in place to protect your personal data, notably by signing the Standard Contractual Clauses of the European Commission.

9/ Your rights in relation to your personal data

Pursuant to all applicable laws, you have the right to ask for access, rectification, deletion, objection, limitation or portability of your Personal data as described below:

to access your personal data personal data
to ask for rectification or deletion of your personal data; to object or demand the limitation of the processing of your personal data;
to receive, upon request, all your personal data in a structured and standard format or to ask for the transmission of such information to other controller;
to give instructions regarding the further processing of your personal data after your death.

9.1 Exercise of your Rights

If you wish to exercise these rights and/or obtain all relevant information, please contact us at the following address: carrousel-du-louvre@majestic-events.fr.

To ensure an effective exercise of your rights, please note that you can send your request at the above mentioned address for your questions and demands in relation with processing to both data controllers (local data controller and group data controller).

You can also exercise these rights directly at the Welcome/info desk of the Shopping Centre.

In order to avoid to infringe third party rights, we reserve the right, in case of reasonable doubt, to proceed to prior verification of your identity.

Please be aware that for CCTV recording, the access right, if applicable, will consist in a viewing of the CCTV footage.

9.2 Complaints

We would request that you first provide us with an opportunity to address any complaints about how we use your personal data, you have the right to make a complaint to the CNIL 3 place de Fontenoy 75007 Paris.

10/ Automated decision making / profiling

There is currently no automated decision making process or profiling made with your personal data.

11 / Update of this Privacy Notice

We may revise or update this Privacy Notice from time to time. Any change to this Privacy Notice will become effective upon online publication on this website.

Appendix 1 – List of service providers

Welcome desk

Company name	Headquarter	Company registration	Country where the personal data are processed and stored
Majestic	32 rue de Ponthieu, 75008 Paris	443 168 463	France

Maintenance – Safety – Security

Company name

Headquarter

Company registration

Country where the personal data are processed and stored

Vinci

Cegelec Missenard

67 avenue de Fontainebleau, 94270 Le Kremlin Bicêtre

RCS Créteil 537 934 002

France

Securitas France SARL

253 quai de la bataille de Stalingrad, 92130 Issy les Moulineaux

RCS 304 497 852

France

Parkings

Company name

Headquarter

Company registration

Country where the personal data are processed and stored

Société INDIGO Infra France

Tour Voltaire

1 Place des Degrés - TSA 43214, 92919 La Défense CEDEX

304 646 078 RCS Nanterre

France