Privacy policy
Last updated: 28 September 2023
Introduction
This personal data policy applies to Danske Shoppingcentre P/S and Frederiksberg Centret I/S in its entirety (hereinafter collectively referred to as Danske Shoppingcentre). In this context, Danske Shoppingcentre P/S is understood as Danske Shoppingcentre and all the shopping centres in our portfolio, including Frederiksberg Centret. Danske Shoppingcentre P/S is the data controller for all centres, which means that the individual centres are not independent data controllers. For a list of Danske Shoppingcentre P/S shopping centres, click here.
Danske Shoppingcentre processes certain personal data about its members. Danske Shoppingcentre takes the protection of this personal data seriously. Sharing personal data with a company is a matter of trust, and Danske Shoppingcentre believes that this personal data policy will create trust that Danske Shoppingcentre will process personal data responsibly.
The Danske Shoppingcentre personal data policy applicable at any given time will always be publicly available at danskeshoppingcentre.dk and on the individual shopping centres’ websites.
Data controller
Enquiries regarding Danske Shoppingcentre’s processing of personal data can be directed to:
Danske Shoppingcentre P/S
CVR number: 37070726
Address:
Cityringen 24
DK-2630 Taastrup
Denmark
E-mail: gdpr@danskeshoppingcentre.dk
The type of personal data that Danske Shoppingcentre processes, the purpose of the processing, the legal basis and the retention period:
1. Members of PLUS+ loyalty programme
1.1.1 What personal data is processed?
Danske Shoppingcentre processes certain ordinary personal data when a person becomes a member of Danske Shoppingcentre’s PLUS+ loyalty programme (profile data):
Profile information may include, but is not limited to, the following: name, address, date of birth, gender, marital status, mobile number, email address, affiliation centre, number of people in the household, age of children and vehicle registration plate as given by the member.
In addition, Danske Shoppingcentre assigns all members a membership number, registers the date of registration for the points scheme and collects the member’s consent for marketing via email, mobile and social media (e.g. Facebook and Instagram).
1.1.2 Purpose
The data is processed for the purpose of establishing and maintaining an up-to-date loyalty concept/programme and ensuring targeted and personalised content for customers.
Personal data is also processed as part of the membership programme for the purpose of segmenting members and targeting offers and marketing. The information is also used to give members the opportunity to participate in competitions and relevant events at the centre.
E-mail addresses are used to send activation links, login codes, service messages and surveys and to send marketing material from Danske Shoppingcentre about products and services from Danske Shoppingcentre.
1.1.3 Legal basis
The legal basis for the processing is the EU General Data Protection Regulation Art. 6(1)(b) (contractual relationship) and 6(1)(a) (consent) with regard to marketing and participation in competitions. Consent can be withdrawn at any time, but we reserve the right to retain data for statistical purposes where personal data is anonymised so that it can no longer be attributed to you.
1.1.4 Retention period
Danske Shoppingcentre stores the information until all transactions between Danske Shoppingcentre and the member are completed. In general, personal data is deleted no later than three years after the termination of membership. However, information subject to bookkeeping requirements is retained for five years after the end of the relevant financial year.
1.2.1 Which personal data is processed?
Danske Shoppingcentre processes the member’s profile information (see section 1.1.1 above), the member’s enquiry history and transactions in their points account (number of points).
When the member uses the app, clicks on links in emails or visits “My PLUS+” on Danske Shoppingcentre’s websites while logged in, Danske Shoppingcentre also processes information about the member’s earned and used points at Danske Shoppingcentre and the partners/tenants affiliated with Danske Shoppingcentre’s loyalty concept/programme. This applies whether the member earns and uses points in physical centres or through digital activities/participation.
Danske Shoppingcentre also processes information about where, when and how the app is used, as well as when emails are opened and what the member has clicked on.
The member can opt in or out of the opportunity to use certain functions in Danske Shoppingcentre’s app through the settings in their phone and on the website under “My PLUS+”, in which case, Danske Shoppingcentre processes the personal data associated with this, see section 1.1.1.
Finally, Danske Shoppingcentre processes, to the extent possible, information about the member receiving and opening Danske Shoppingcentre’s emails and their use of Danske Shoppingcentre’s digital platforms, e.g. use of Danske Shoppingcentre’s websites, apps and social media (Facebook and Instagram). Read more about this in Section 3. Members on Danske Shoppingcentre’s websites, apps and emails (databases).
1.2.2 Purpose
Information about the member’s registered earned and used points is used alongside the member’s profile information to calculate the member’s points balance and other member benefits.
When logged in as a member on the individual centre’s website or app, the member’s profile information, as well as information about the member’s individual earned and used points and the member’s digital online behaviour is used to place the member in a group with a given interest/purchase profile in order to grant the member access to relevant news, services and general offers from partners. The purpose is also to ensure correct segmentation of the member in order to give the member access to personalised discounts, selected specifically for that member and based on products and services that the member is interested in or that may be particularly relevant to the member.
Danske Shoppingcentre also uses the information about the member’s processing of e-mails sent from PLUS+ and about the member’s digital behaviour to obtain general statistical knowledge about the member’s opening rates on e-mails sent and use of the digital platforms.
Finally, Danske Shoppingcentre uses information about members’ interests and digital behaviour to maintain and develop Danske Shoppingcentre’s centres, offers, digital platforms and services.
1.2.3 Legal basis
The legal basis for the processing is the EU General Data Protection Regulation Art. 6(1)(b) (contractual relationship) and 6(1)(a) (consent) with regard to marketing and participation in competitions. The consent may be withdrawn at any time.
The legal basis for the processing for statistical purposes is Article 6(1)(f) of the EU General Data Protection Regulation (balancing of interests) and Danske Shoppingcenter’s legitimate interest in optimising its physical centres, shop and brand mix, offers and digital platforms and services.
1.2.4 Retention period
Danske Shoppingcentre stores the information until all transactions between Danske Shoppingcentre and the member are completed. In general, personal data is deleted no later than three years after the termination of membership. However, information subject to bookkeeping requirements is retained for five years after the end of the relevant financial year.
2. Members’ visits to Danske Shoppingcentre’s physical centres
2.1 Which personal data is processed?
Danske Shoppingcentre processes customers’ contact information in connection with earning and using points in the physical centres. If a customer interacts with a centre’s PLUS+ app, a visit to that centre will be registered. The customer’s vehicle registration plate is registered when entering the underground car park. If the customer has given consent, we can register this entrance as a physical check-in at the centre or remind the customer to check in via a push notification in the app.
2.2 Purpose
The processing of a customer’s contact information is done for the purpose of registering the customer’s visit to the centres as well as the earning and use of points in the physical centres.
2.3 Legal basis
The legal basis for the processing is the EU General Data Protection Regulation Art. 6(1)(b) (contractual relationship).
2.4 Retention period
Personal information about a customer in Danske Shoppingcentre’s physical centres is stored for as long as the customer wishes to be a member of the loyalty programme. However, information subject to bookkeeping requirements is retained for five years after the end of the relevant financial year.
3. Members on Danske Shoppingcentre’s websites, apps and emails (databases)
3.1 Which personal data is processed?
Danske Shoppingcentre processes online customers’ contact information, earning history, comments to Danske Shoppingcentre (both directly and through online portals outside of Danske Shoppingcentre) about their earning experiences with Danske Shoppingcentre and loyalty programme information in connection with online point earning.
Finally, Danske Shoppingcentre processes, to the extent possible, online customers’ opening behaviour when receiving emails from Danske Shoppingcentre and its individual centres, as well as other digital behaviour relating to Danske Shoppingcentre.
3.2 Purpose
The processing is for the purpose of confirming the earning/use of points, informing about member benefits and how points can be used.
The processing is also for the purpose of providing online customers with relevant offers digitally or via email, based on products and services in which the online customer has shown an interest.
Danske Shoppingcentre also uses the information about the individual online customer’s processing of e-mails sent from Danske Shoppingcentre and other digital behaviour related to Danske Shoppingcentre to obtain general statistical knowledge about online customers’ opening rates on e-mails sent and use of the digital platforms.
Finally, Danske Shoppingcentre uses the information about the individual online customer’s earning/use of points to obtain general statistical knowledge about online customer behaviour for the purpose of developing and improving Danske Shoppingcentre’s physical centres, shop and brand mix and offers.
3.3 Legal basis
The legal basis for the processing is the EU General Data Protection Regulation Art. 6(1)(b) (contractual relationship) and 6(1)(a) (consent) with regard to marketing.
The legal basis for the processing for statistical purposes is the EU General Data Protection Regulation article 6(1)(f) (balancing of interests) and Danske Shoppingcentre’s legitimate interest in optimising its physical centres, shop and brand mix, offers and digital platforms and services.
3.4 Retention period
Danske Shoppingcentre stores the information until all transactions between Danske Shoppingcentre and the member are completed. In general, personal data is deleted no later than three years after the termination of membership. However, information subject to bookkeeping requirements is retained for five years after the end of the relevant financial year.
Personal data collected on the basis of cookies is deleted in accordance with Danske Shoppingcentre’s cookie policy..
4. Danske Shoppingcentre’s apps
4.1 Which personal data is processed?
As stated in point 3. “Members on Danske Shoppingcentre’s websites, apps and emails (databases)”, Danske Shoppingcentre processes certain personal data about members when they are logged in to Danske Shoppingcentre, e.g. in apps and on “My PLUS+” on their websites.
When a member uses Danske Shoppingcentre’s apps, Danske Shoppingcentre will also process the following personal data, provided that the person has consented to this via settings in their mobile device (i.e. smartphone or tablet – hereinafter for the sake of understanding referred to as “phone”):
- If the member has allowed Danske Shoppingcentre’s app to send notifications to their phone through the settings in their phone
- If the member has allowed Danske Shoppingcentre’s app to access the phone’s location through the settings in their phone, this will be registered
- If the member has allowed Danske Shoppingcentre’s app to use the phone’s camera through the settings in their phone, this will be registered
4.2 Purpose
The purpose of processing the information concerning access to send messages to the phone is to be able to send messages to the member’s phone about relevant offers from Danske Shoppingcentre, including from our centres.
Information about the location of the phone is processed alongside information concerning access to send messages to the phone for the purpose of being able to send messages about relevant offers from Danske Shoppingcentre in the vicinity of the phone, as well as to collect information about where in the centre the member has been. This information can be used in connection with earning points in the loyalty programme and for targeted marketing for members.
The processing of information concerning access to the phone’s camera is processed alongside information about the phone’s location for the purpose of ensuring that the member can use the app function Scan QR code in the relevant centre when the member, for example, wants to earn points on arrival at the centre.
4.3 Legal basis
The legal basis for the processing is the EU General Data Protection Regulation art. 6(1)(b) (contractual relationship) and 6(1)(a) (consent), with regard to marketing, participation in competitions and processing of location data (as described above in Section 4.1), as long as consent is given for the processing of these. The consent may be withdrawn at any time.
4.4 Retention period
Danske Shoppingcentre stores the information as long as the Danske Shoppingcentre app is installed on the member’s phone.
5. People who sign up for SMS marketing
5.1 Which personal data is processed?
Danske Shoppingcentre processes contact information (the name and phone number) of people who sign up for SMS marketing centrally from Danske Shoppingcentre (or locally from the individual shopping centre).
5.2 Purpose
The purpose of the processing is for Danske Shoppingcentre to send SMS marketing related to the selected topic to the persons who have signed up.
5.3 Legal basis
The legal basis for the processing is the EU General Data Protection Regulation Art. 6(1)(a) (consent) with regard to marketing and participation in competitions. The consent may be withdrawn at any time.
5.4 Retention period
Contact information provided for the purpose of receiving SMS marketing will be deleted no later than three years after the consent to receive SMS marketing has been withdrawn.
6.1 Which personal data is processed?
Danske Shoppingcentre processes competition entrants’ contact information in connection with participation in the competition.
6.2 Purpose
The processing is for the purpose of contacting the winner of the competition. In some cases, the information is also processed in order to send marketing to the competition entrant.
6.3 Legal basis
The legal basis for the processing is the EU General Data Protection Regulation Art. 6(1)(b) (contractual relationship) and 6(1)(a) (consent) with regard to marketing and participation in competitions. The consent may be withdrawn at any time.
6.4 Retention period
Contact details provided by competition entrants who have not won will be deleted once the competition has ended and the winner has received their prize. The winner’s contact details are stored for three years from the date of receipt of the prize.
However, bookkeeping information in relation to distributing the winner’s prize is stored for five years after the end of the financial year in which the prize is distributed. Contact information provided for marketing purposes will be deleted no later than three years after consent to receive marketing has been withdrawn.
7. The data subject’s rights under section 3 of the EU General Data Protection Regulation
Danske Shoppingcentre processes personal data for the purposes described in the individual sections above. In relation to each of these processing operations, the data subject has the right to:
- Request access to the personal data Danske Shoppingcentre processes about the data subject
- Receive information about themselves in a structured, commonly used and machine-readable format (data portability)
- Request rectification or erasure of personal data that Danske Shoppingcentre processes about the data subject
- Object to Danske Shoppingcentre’s processing of personal data
- Complain to the Danish Data Protection Agency about Danske Shopping Centre’s processing of personal data
Contact the Danish Data Protection Agency
E-mail: dt@datatilsynet.dk or tel: +45 3319 3200
NB: Please note that it is not always possible to comply with an erasure request, as Danske Shoppingcentre may have a legitimate interest in retaining the personal data in question or may be required to retain the personal data in question.
Where Danske Shoppingcentre has received consent as the legal basis for the processing of personal data, it will always be possible for the person who has given consent to withdraw it, without this affecting the lawfulness of the processing up to the time of withdrawal.
If you wish to exercise your rights, please contact: gdpr@danskeshoppingcentre.dk
8. Disclosure of personal data
Danske Shoppingcentre does not disclose personal data unless it is a legal requirement or it is necessary to fulfil an agreement that Danske Shoppingcentre has entered into with the individual member.
The agreement may regulate a specific member benefit that the member has opted for as a supplement to Danske Shoppingcentre’s general membership terms, or it may be an agreement that the individual customer has entered into with Danske Shoppingcentre for a specific service. In such cases, the disclosure will be stated in the terms and conditions when the member or customer enters into the specific agreement.
9. Data processors and third country transfers
Danske Shoppingcentre uses external partners and suppliers for the operation, development and hosting of e.g. communication and marketing solutions, preparation of market analyses and IT systems for handling business data.
These partners and suppliers may be data processors for Danske Shoppingcentre and process personal data under instructions from Danske Shoppingcentre. Danske Shoppingcentre has, where relevant, entered into written data processing agreements with these data processors.
Data processors are subject to confidentiality and may not use the personal data for purposes other than those specified in the data processing agreement.
Danske Shoppingcentre continuously monitors the data processors to ensure that they fulfil their obligations under the data processing agreement.
Danske Shoppingcentre does not generally transfer personal data to countries outside the EU/EEA. If, exceptionally, it is necessary to transfer data to third countries, this is done using an appropriate transfer basis; in most cases the European Commission’s Standard Contractual Clauses.
10.1 Children and young people
Danske Shoppingcentre processes personal data about children and young people aged 15–17 years who are members of Danske Shoppingcentre. The data processing also applies to their personal data. It is possible to earn and use points on Danske Shoppingcentre’s digital platforms from the age of 15.
Danske Shoppingcentre processes customers’ personal data on the digital platforms using cookies for necessary, statistical, functional and marketing purposes, including to optimise the user experience on Danske Shoppingcentre’s digital platforms.
Cookies are small text files containing letters and numbers that are stored on your computer. Cookies make it possible to collect information about which pages and functions the user uses and visits. You can read more about which cookies we use, the purpose of the collection and how you can delete or reject them in our cookie policy here.