The Mall Firenze

This privacy notice is provided by Design Management S.r.l. (hereinafter, the “Company” or the “Data Controller”) in its quality of data controller, pursuant to the Regulation (EU) no. 2016/679 (hereinafter, the “GDPR”) as well as Legislative Decree no. 196 of 2003 and subsequent amendments and integrations (hereinafter, the “Code” and, together with the GDPR, the “Privacy Law”) and also considering any other applicable rules and the provisions, guidelines and opinions of the Italian Data Protection Authority (hereinafter, the “Garante”), the Working Party referred to in article 29 of the Directive 95/46/EC, the European Data Protection Board referred to in article 63 et seq. of the GDPR and any other competent authority (hereinafter, the “Privacy Authorities”).

This document completes the information provided in a simplified version by the warning signs placed in the video-surveilled areas.

• Categories of personal data processed

The personal data that the Company collects and processes through the use of the video-surveillance system (hereinafter, the “Personal Data” or simply the “Data”) are the images of clients, visitors, employees and any other person (hereinafter, the “Data Subjects”) captured in real time or recorded by cameras placed at The Mall Luxury Outlet in Leccio – Reggello (FI), via Europa, 8 (hereinafter, the “Premises”). The capture and recording of voices, sounds and any other noise are not collected and processed.

• Purposes of the processing

The images recorded by the video-surveillance systems are processed, in compliance with the Privacy Law, in order to prevent and protect the safety and security of the Data Subjects who access the Premises, as well as the Company’s property and assets in relation to any crime committed within the Premises, such as, thefts, robberies and acts of vandalism.

• Legal basis for the processing

The processing of the Personal Data is carried out on the basis of the legitimate interest of the Company, pursuant to art. 6(1)(f) of the GDPR, where the interest consists in safeguarding the safety and security of the Data Subjects and Company’s assets, in compliance with the provisions issued by the Privacy Authorities over time.

• How Data are processed

The processing of the images of the Data Subjects is carried out while respecting the laws in force and with the use of instruments and means that ensure a suitable security and confidentiality of Data. Specifically, the images are automatically recorded by digital devices placed in the Premises and are processed both with the aid of computerized, electronic and/or magnetic or otherwise automated capture and recording tools and on video support (real-time images).

• Data disclosure and recipients

Access to Personal Data for the purposes indicated above is allowed only to the designated and duly persons acting under the authority of the controller or of the processor, or to the external data processors authorized and appointed by the Company for the surveillance and/or maintenance of the video-surveillance systems placed in the Promises.

However, it is understood that other authorized persons could access to the images, such as law enforcement or judicial authority.

A complete list of the designated persons acting under the authority of the controller or of the processor and processors appointed in relation to the processing here described is available at the Company. Data Subjects can request to consult the list by sending an email to the following email address: privacy@themall.it.

• Transfer of Personal Data

Data related to video-surveillance are processed in the territory of the European Economic Area and will not be transferred outside of it.

• Data retention

The images are stored on IT, electronic or magnetic media for the period of time strictly necessary to carry out the purposes described below for seven days unless a longer retention period is required by law or provisions from competent authorities, or or for the establishment, exercise or defence of legal claims.

At the end of the retention period, Data are deleted by automatic overwriting.

• Data Subjects’ Rights

In the case Data Subjects deem to have been recorded by the video-surveillance system, they can at any time and free of charge exercise the rights that are recognized by the Privacy Law, namely:

1. to obtain confirmation as to whether or not data concerning them are being processed and to request access to them obtaining clarifications on Company purposes, categories of personal data involved, recipients to whom personal data may be disclosed, the applicable period for which the personal data will be stored, the existence of automated decision-making;
2. to obtain, where applicable, the erasure of their personal data and the restriction of processing;
3. to lodge, if the conditions are met, a complaint with the Garante;
4. to object, in whole or in part, for legitimate reasons, to the processing.

Request for the exercise of these rights may be submitted in writing to the Company at the following email address privacy@themall.it or by writing to the Data Protection Officer (“DPO”) at the following email address dpo@themall.it.

• Contacts of the Data Controller and the DPO

The Data Controller is Design Management S.r.l., with its registered office in Scandicci (FI), via Pisana, 336, and can be contacted at the following email address privacy@themall.it.

The DPO of the Company can be contacted at the following email address dpo@themall.it to receive more information on the processing of Data and to exercise the rights listed above.

1. Changes and updates

This Privacy Notice may be amended and/or supplemented at any time by the Company, also in case of changes in the Privacy Policy.

The updated Privacy Notice will be made available on the link www.themall.it/en/cctv-privacy-notice.

Last update: March 2021.

This privacy notice is provided by Design Management S.r.l. (hereinafter, the “Company” or the “Data Controller”) in its quality of data controller, pursuant to the Regulation (EU) no. 2016/679 (hereinafter, the “GDPR”) as well as Legislative Decree no. 196 of 2003 and subsequent amendments and integrations (hereinafter, the “Code” and, together with the GDPR, the “Privacy Law”) and also considering any other applicable rules and the provisions, guidelines and opinions of the Italian Data Protection Authority (hereinafter, the “Garante”), the Working Party referred to in article 29 of the Directive 95/46/EC, the European Data Protection Board referred to in article 63 et seq. of the GDPR and any other competent authority (hereinafter, the “Privacy Authorities”).

This document completes the information provided in a simplified version by the warning signs placed in the video-surveilled areas.

• Categories of personal data processed

The personal data that the Company collects and processes through the use of the video-surveillance system (hereinafter, the “Personal Data” or simply the “Data”) are the images of clients, visitors, employees and any other person (hereinafter, the “Data Subjects”) captured in real time or recorded by cameras placed at The Mall Luxury Outlet in Sanremo (IM) via Armea, 43 (hereinafter, the “Premises”). The capture and recording of voices, sounds and any other noise are not collected and processed.

• Purposes of the processing

The images recorded by the video-surveillance systems are processed, in compliance with the Privacy Law, in order to prevent and protect the safety and security of the Data Subjects who access the Premises, as well as the Company’s property and assets in relation to any crime committed within the Premises, such as, thefts, robberies and acts of vandalism.

• Legal basis for the processing

The processing of the Personal Data is carried out on the basis of the legitimate interest of the Company, pursuant to art. 6(1)(f) of the GDPR, where the interest consists in safeguarding the safety and security of the Data Subjects and Company’s assets, in compliance with the provisions issued by the Privacy Authorities over time.

• How Data are processed

The processing of the images of the Data Subjects is carried out while respecting the laws in force and with the use of instruments and means that ensure a suitable security and confidentiality of Data. Specifically, the images are automatically recorded by digital devices placed in the Premises and are processed both with the aid of computerized, electronic and/or magnetic or otherwise automated capture and recording tools and on video support (real-time images).

• Data disclosure and recipients

Access to Personal Data for the purposes indicated above is allowed only to the designated and duly persons acting under the authority of the controller or of the processor, or to the external data processors authorized and appointed by the Company for the surveillance and/or maintenance of the video-surveillance systems placed in the Promises.

However, it is understood that other authorized persons could access to the images, such as law enforcement or judicial authority.

A complete list of the designated persons acting under the authority of the controller or of the processor and processors appointed in relation to the processing here described is available at the Company. Data Subjects can request to consult the list by sending an email to the following email address: privacy@themall.it.

• Transfer of Personal Data

Data related to video-surveillance are processed in the territory of the European Economic Area and will not be transferred outside of it.

• Data retention

The images are stored on IT, electronic or magnetic media for the period of time strictly necessary to carry out the purposes described below for seven days unless a longer retention period is required by law or provisions from competent authorities, or or for the establishment, exercise or defence of legal claims.

At the end of the retention period, Data are deleted by automatic overwriting.

• Data Subjects’ Rights

In the case Data Subjects deem to have been recorded by the video-surveillance system, they can at any time and free of charge exercise the rights that are recognized by the Privacy Law, namely:

1. to obtain confirmation as to whether or not data concerning them are being processed and to request access to them obtaining clarifications on Company purposes, categories of personal data involved, recipients to whom personal data may be disclosed, the applicable period for which the personal data will be stored, the existence of automated decision-making;
2. to obtain, where applicable, the erasure of their personal data and the restriction of processing;
3. to lodge, if the conditions are met, a complaint with the Garante;
4. to object, in whole or in part, for legitimate reasons, to the processing.

Request for the exercise of these rights may be submitted in writing to the Company at the following email address privacy@themall.it or by writing to the Data Protection Officer (“DPO”) at the following email address dpo@themall.it.

• Contacts of the Data Controller and the DPO

The Data Controller is Design Management S.r.l., with its registered office in Scandicci (FI), via Pisana, 336, and can be contacted at the following email address privacy@themall.it.

The DPO of the Company can be contacted at the following email address dpo@themall.it to receive more information on the processing of Data and to exercise the rights listed above.

1. Changes and updates

This Privacy Notice may be amended and/or supplemented at any time by the Company, also in case of changes in the Privacy Policy.

The updated Privacy Notice will be made available on the link www.themall.it/en/cctv-privacy-notice.

Last update: March 2021.