Privacy policy

LINSTOW PRIVACY POLICY

Effective as of 25 May 2018

The goal of this Privacy Policy is to provide you with information on what personal data are processed by:

  • Linstow Group owned companies:  Linstow Center Management SIA, Dāvanu karte SIA, Linstow SIA, Tampere Invest SIA and
  • Linstow Group operated companies: Delta Property SIA, Tirdzniecības centrs Mols SIA, Tirdzniecības centrs Dole SIA,

(hereinafter –Companies), the principles, purpose and extent of processing, protection, processing time limits, procedures for deletion, as well as rights available to you in relation to personal data processing performed by us.

This Privacy Policy applies both to personal data that we obtain directly from you and also to personal data that we obtain from third parties.

We are entitled to use personal data for the purposes described in this Privacy Policy, as well as other purposes about which we have informed you at the time of obtaining of personal data.

WHO HAS THE RIGHT TO PROCESS YOUR PERSONAL DATA AND WHO CAN YOUR PERSONAL DATA BE TRANSFERRED TO?

Your personal data can be processed by a Company indicated in the respective section of the Privacy Policy which describes specific services provided by us or operations performed by us.

In addition, in specific cases we are entitled to authorize a third party to process your personal data. Please, note that we will transfer your personal data to third parties only if:

  • we have signed an agreement with the recipient of your personal data and ensured compliance with the security requirements of personal data transfer and receipt,
  • we have a statutory obligation to transfer your personal data to the recipient concerned.

We can transfer your personal data to the following categories of recipients:

1)  processors of personal data who provide certain services to us, which are detailed in the following sections of the Privacy Policy:

a)    the processor receives from us only such amount of personal data that is necessary to perform a particular task or provide a particular service;

b)    the processor processes your personal data only according to our instructions, does not use it for other purposes, and does not transfer your personal data to other parties without our prior consent;

2)  other processors of personal data, including state and municipal institutions and courts, to allow us to perform legal requirements applicable to us and to defend our legal interests.

Personal data are processed only in the territory of the EU/EEA and are not transferred outside of the EU/EEA.

More detailed description of controllers and processors in respect of our specific services or operations can be found in the following sections of the Privacy Policy.

WHAT DO WE DO TO PROTECT YOUR PERSONAL DATA?

We take care to ensure that your personal data are always safe and that they are processed according to the applicable legal requirements and principles.

To ensure that personal data can be accessed only by duly authorised persons and to prevent unauthorised disclosure or use of personal data, we use various security technologies and procedures.

IN WHAT CASES AND FOR WHAT PURPOSES ARE WE ALLOWED TO PROCESS YOUR PERSONAL DATA?

We process your personal data only when we have legal grounds to do so – your consent, our legitimate interests or if the personal data are necessary for signing or performing an agreement, or for performing our statutory obligations.

If processing of your personal data is based on our legitimate interests, we assess its potential effect on your rights and freedoms and we ensure that our legitimate interests to process your personal data do not negatively influence your rights and freedoms.

More detailed description of the legal grounds and purposes of processing of your personal data is given in the following sections of the Privacy Policy.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We process your personal data only as long as we have legal grounds to do so or as long as other conditions applicable to us are in effect. For example, the duration of storage of your personal data can be influenced by the following conditions:

  • procedures defined in law laying down how we can exercise our legitimate interests (for example, submit objections or bring an action in court);
  • existence of a legal obligation to store personal data for a certain period;
  • as long as your consent to the particular personal data processing is valid, unless there are other legal grounds for processing your personal data.

When the aforementioned conditions for processing your personal data cease to exist, your personal data are irreversibly deleted/destroyed and/or anonymized.                      

More detailed description of the storage periods of your personal data in respect of our specific services or operations is given in the following sections of the Privacy Policy.

WHAT ARE YOUR RIGHTS?

To ensure proper processing of personal data, you have several rights that you can exercise in respect of your personal data. To exercise your rights, please, contact us using the communication channels indicated further in this Privacy Policy.

Access to your personal data

You are entitled to request information about your personal data that we process.

Right to correct your personal data

If you consider that your personal data processed by us are inaccurate, incomplete or irrelevant, you have the right to request that your personal data be updated or corrected.

Right to withdraw your consent

If we process your personal data based on your consent, you have the right to withdraw your consent at any time.

If you wish to withdraw your consent in respect of receiving electronic information about our news, you can perform the actions indicated in the received e-mail message or you can also contact us.

Right to object to or restrict personal data processing

If we process your personal data based on our legitimate interests, you have the right to object to such processing of personal data.

If we receive your objections to our processing of personal data based on our legitimate interests, we will stop or restrict such processing of your personal data, unless we can justify processing of your personal data with our legitimate interests or our right to defend our legal claims.

If you consider that your personal data that we process are inaccurate or that the personal data processing carried out by us is unlawful, you can request us to restrict such processing of personal data.

Please, note that in the event if processing of your personal data is restricted, there is a possibility that we cannot ensure all operations available to you, inter alia, you may not be able to receive all of the benefits we offer.

Right to demand deletion of your personal data

If you consider that we no longer need your personal data for the purposes which they were obtained for or if you have withdrawn your consent, as well as in other circumstances, you may request deletion of your personal data.

Please, note that we will be able to delete your personal data only in cases when we do not have a binding obligation to retain your personal data for certain statutory purposes, or if we do not have other legal grounds to process your personal data.

Right to request transmission of your personal data

You have the right to receive your personal data provided by you and processed based on consent or on a contract, in written form or in a commonly used electronic format. If technically feasible, based on your request, we can transfer your personal data directly to another service provider.

Right to submit complaints about personal data processing carried out by us

If you consider that personal data processing carried out by us violates your rights, you can at any time submit a complaint to us. We will immediately consider your complaint and reply within the time limits specified in law.

You also have the right to submit your complaint to the Data State Inspectorate:

  • by sending your complaint to the following e-mail address: info@dvi.gov.lv
  • or in person at the Data State Inspectorate, 11/13 Blaumaņa Street, Riga.

CONTACT DETAILS

If you have any questions about the data processing performed by us or you wish to exercise your rights, please, contact us in the following ways:

  • with regard to electronic products and services:
    • in person at the information desks of the shopping centres managed by us – ORIGO, GALERIJA CENTRS, ALFA, MOLS, DOLE,
    • by e-mail: dpo@linstow.lv,
    • by mail: 16 Audēju Street, Riga, LV-1050,
    • Participants of the Galactico Privilege Program can use their web profile in the www.galactico.lv self-service portal, by entering their password.
    • with regard to other operations performed by us:
      • by e-mail: dpo@linstow.lv,
      • by mail: 16 Audēju Street, Riga, LV-1050.

VALIDITY AND AVAILABILITY OF THE PRIVACY POLICY

This Privacy Policy is available to you:

- at the information desks of the shopping centres managed by us – ORIGO, GALERIJA CENTRS, ALFA, MOLS, DOLE,

- and on our websites – www.galactico.lv, www.origo.lv, www.galerijacentrs.lv, www.alfaparks.lv, www.mols.lv, www.dole.lv, www.linstow.lv, www.summerstage.lv, www.kolosale.lv

We regularly control our operations in the field of personal data processing, to ensure our personal data processing obligations. Therefore we have the right to unilaterally change this Privacy Policy at any time.

 

PERSONAL DATA PROCESSING FOR PROVISION OF ELECTRONIC PRODUCTS

We process your personal data to provide various electronic products and services – Galactico Privilege Card, Galactico VISA Card, Galactico Gift Card and Galactico Online Store.

Personal data controllers and processors

Your personal data are processed within our electronic product groups by the following companies that are considered to be controllers of your personal data:

#

Electronic product group

Controllers and their contact details

1.

Galactico Privilege Cards and

Galactico VISA Cards

  • Linstow Center Management SIA, reg. no. 50003702891; 
  • Linstow SIA, reg. no.: 50003315411 (Origo);
  • Tampere Invest SIA, reg. no.: 40003311422 (Galerija Centrs);
  • Delta Property SIA, reg. no.: 50003390091 (Alfa);
  • Tirdzniecības centrs Mols SIA, reg. no: 40003539034 (Mols);
  • Tirdzniecības centrs Dole SIA, reg. no: 40003434873 (Dole).

Contact details of all of the aforementioned controllers:

-         Registered office: 16 Audēju Street, Riga, LV-1050, Latvia,

-         e-mail: dpo@linstow.lv.

2.

Galactico Gift Cards

Dāvanu karte SIA, reg. no.: 40003812282.

Controller’s contact details:

-         Registered office: 16 Audēju Street, Riga, LV-1050, Latvia,

-         e-mail: dpo@linstow.lv.

3.

Galactico Online Store

Dāvanu karte SIA, reg. no.: 40003812282.

Controller’s contact details:

-         Registered office: 16 Audēju Street, Riga, LV-1050, Latvia,

-         e-mail: dpo@linstow.lv.

We can transfer your personal data also to other companies – processors of personal data, to ensure provision of various services (provision of the services of Galactico information desks, delivery of orders made in Galactico online store, sending of news in text messages or e-mail etc.).

We use only trusted partners – processors of personal data, and through these partners various services are provided, such as issuing of electronic products, sending of marketing offers (through text messages, e-mail, mail) etc.

Your personal data can be transferred to the following categories of data processors:

-                 Customer service companies that provide security services and information desk services (for example, Grifs AG);

-                 Postal service providers (for example, Latvijas Pasts);

-                 Providers of mobile and e-mail marketing services (for example, Sales.lv); 

-                 Institutions (for example, law enforcement authorities, tax administration, supervisory authorities and institutions dealing with out-of-court dispute resolution);   

-                 Auditors, financial and legal consultants;

-                 Other personal data processors approved by us.

Types of personal data, legal grounds and purpose of processing

We always process your personal data only if we have legal grounds to do so, and solely for the defined purpose.

The following legal grounds exist for the needs of our electronic services:

  • Your consent – when you have clearly expressed your consent in writing or confirmed such consent by your actions (for example, to receive information about the Galactico Privilege Program). In such cases we process only those personal data to the processing of which you have clearly consented;
  • Our legitimate interests – we are interested in providing to you a range of services and experiences that is as wide and personalized as possible. In some cases we also have the right to defend our interests, for instance, if you have submitted a complaint concerning our services or their quality. In such cases we process only those personal data that are directly necessary for ensuring our legitimate interests;
  • Our statutory obligation (legal obligation) – in some cases certain obligations are imposed on us by law, for example, we have to identify buyers, send reports to tax administrations etc. In such cases we process only those personal data that are directly necessary for performing these statutory obligations;
  • Entering into or performing of an agreement – if you plan to buy a product from us, you enter into an agreement with us. We need some of your personal data to be able to make an agreement with you. Likewise, we need your personal data to perform obligations under an agreement, for example, to deliver a product you have purchased to an address.

Below you can see the legal grounds and purposes of processing of your personal data:

Galactico Gift Card

Personal data

Legal grounds

Purpose of processing

Name, Surname

Legitimate interests

Identification: when ordering a service; when making large purchases of electronic gift cards; for your complaints.

For ensuring internal control.

Personal identity number

Legal obligation

Identification: when making large purchases of electronic gift cards, for making cash withdrawals and transfers.

Data about identity document

Legal obligation

Identification: when making large purchases of electronic gift cards, in some cases when making purchases using bank cards.

Contact details (phone, e-mail or mail address)

Legitimate interests

For communication: to provide an ordered service, to reply to an application/complaint.

Bank details

Legitimate interests

For making a transfer if a customer has ordered a service.

Galactico Privilege Program

Personal data

Legal grounds

Purpose of processing

Name, Surname

Legitimate interests

Identification: to correctly register a person in the program and to print the person’s name on the loyalty card.

Personal identity number

Legitimate interests

Identification: to ensure correct provision and receipt of rewards and privileges according to your status in the program, data transfer and matching in the event of lost or renewed cards, and to ensure your identification in the system.

Date of birth if a person has no Latvian identity number or if the person has the new type of Latvian identity number

Legitimate interests

Identification: to control access to lotteries, offers for specific product groups, to identify the need for a legal representative.

Sex

Legitimate interests

For statistical purposes.

City/municipality

Legitimate interests

For statistical purposes.

E-mail

Legitimate interests

To give you access to personal data, our opportunity to provide to you important non-commercial information. To allow you to have authorised communication with us.

Your consent

To send special offers from selected shopping centres, cooperation partners, information about lotteries, if you have chosen this.

Mobile phone

Your consent

To send special offers from selected shopping centres, information about lotteries, if you have chosen this.

Mail address

Your consent

To send special offers from selected shopping centres, information about lotteries, if you have chosen this.

Language of communication

Your consent

To send special offers in the language chosen by you, if you have expressed the wish to receive offers.

Your wish to receive information about products/services/events for children aged up to 7, for children over 7, for pets

Your consent

To send offers about topics you have selected.

This information is collected with the aim of improving the variety of services and shops available to our customers.

Means of transport used

Your consent

Interests/hobbies

Your consent

Participation in lotteries

Your consent

To send special offers about certain topics, if you have chosen this. To automatically include you as a participant in lotteries.

Information of registered purchases

Legitimate interests

For statistical purposes.

To provide to you the benefits of the program.

Submitted purchase documents

Legitimate interests

To register a purchase for your account. To check the validity of the registered purchase.

Received rewards (orders concerning the issue of rewards)

Legitimate interests

To perform financial accounting of rewards.

Galactico Online Store

Personal data

Legal grounds

Purpose of processing

Buyer’s name and surname

Signing of an agreement

Identification. Invoicing.

Contact details (e-mail, phone)

Performance of the agreement

Communication. To inform about order status, adjust elements of an order.

E-mail can be used to create a registered user.

E-mail

Your consent

To send offers from Galactico online store.

Recipient’s name and surname

Performance of the agreement

Identification. If the recipient is a person other than the buyer, and the buyer has instructed to deliver the order to that person.

Delivery address

Performance of the agreement

Ensuring delivery of an order if you have chosen a delivery service.

Order data

Legitimate interests

For statistical purposes and defending our legitimate interests (e.g., as evidence).

 

Automated decision-making, including profiling

To provide you with personalised services and ensure full participation in Galactico programs, we use automated decision-making, including profiling, for example:

-                 to give to you the earned loyalty points according to the amount of transactions made in our shopping centres;

-                 to analyse your transactions, to send you tailored marketing offers and ensure free replacement of your card;

-                 to send to you birthday greetings and a special privilege offer in our shopping centres etc.

You can at any time refuse from being included in the automated decision-making process (including profiling) in respect of marketing activities, if you refuse to receive news and offers in the Galactico Privilege Program participant’s questionnaire form or in you web profile www.galactico.lv.

If you do not want us to make automated decisions concerning you in connection with awarding loyalty points, then unfortunately you cannot be a participant of the Galactico Privilege Program.

Time limits for personal data processing

To provide electronic products, we process your personal data within the following time limits:

Our product

Type of submission and storage of personal data

Time limit (for deletion / destruction)

Galactico Privilege Program

Electronic data

6 months after you no longer participate in Galactico Privilege Program

Paper questionnaire forms

30 months after applying for a card / updating of data

Applications

3 years after submission of personal data

Galactico Gift Card

 

Applications

3 years after submission of personal data

Galactico Online Store

Electronic data and order documents

5 years after submission

 

PERSONAL DATA PROCESSING FOR THE PURPOSES OF MARKETING OF SHOPPING CENTRES

We process your personal data to perform various marketing activities of our shopping centres, to administrate your participation and presentation of rewards in lotteries and competitions organised by us.

Personal data controllers and processors

Your personal data are processed within the framework of our marketing activities by the following companies that are considered to be controllers of your personal data:

#

Our marketing activities

Controllers and their contact details

1.

Marketing activities

Participation in lotteries

Participation in competitions

  • Linstow Center Management SIA, reg. no. 50003702891; 
  • Linstow SIA, reg. no.: 50003315411 (Origo);
  • Tampere Invest SIA, reg. no.: 40003311422 (Galerija Centrs);
  • Delta Property SIA, reg. no.: 50003390091 (Alfa);
  • Tirdzniecības centrs Mols SIA, reg. no: 40003539034 (Mols);
  • Tirdzniecības centrs Dole SIA, reg. no: 40003434873 (Dole).

Contact details of all of the aforementioned controllers:

-         Registered office: 16 Audēju Street, Riga, LV-1050, Latvia,

-         e-mail: dpo@linstow.lv.

We can transfer your personal data also to other companies – processors of personal data, to ensure provision of various services (organisation of our marketing activities, filming, sending of invitations etc.).

We use only trusted partners – processors of personal data, and through these partners various services are provided that are necessary for successful organisation and implementation of our activities.

Your personal data can be transferred to the following categories of data processors:

-                 Event management agencies;

-                 Photographers and photographers agencies;

-                 Public relations and digital service agencies;

-                 Postal service providers;

-                 Providers of mobile and e-mail marketing services; 

-                 Institutions (for example, law enforcement authorities, tax administration, supervisory authorities and institutions dealing with out-of-court dispute resolution);   

-                 Auditors, financial and legal consultants;

-                 Other personal data processors approved by us.

Types of personal data, legal grounds and purpose of processing

We always process your personal data only if we have legal grounds to do so, and solely for the defined purpose.

The following legal grounds exist for the needs of our marketing activities:

  • Our legitimate interests – we are interested in providing to you a range of services and experiences that is as wide and personalized as possible. In some cases we also have the right to defend our interests, for instance, if you have submitted a complaint concerning our activities. In such cases we process only those personal data that are directly necessary for ensuring our legitimate interests;
  • Our statutory obligation (legal obligation) – in some cases certain obligations are imposed on us by law, for example, we have to identify a person, send reports to tax administrations etc. In such cases we process only those personal data that are directly necessary for performing these statutory obligations.

The marketing activities organised by us are public events that can be photographed and/or filmed. You must be aware that you can be seen if you participate in such events. If you come to our marketing activity with a child (i.e., a person younger than 18 years), you must be aware that your child too can be photographed and/or filmed during our marketing activities.

We have the right to use the personal data of you and your children for various purposes, including, without limitation, for publishing, display and distribution in social networks, websites, commercials, in television, printed media and other publicity materials.

Our lotteries and/or competitions are public events. We have the right to use your personal data of you for various purposes, including, without limitation, for publishing, display and distribution in social networks and websites.

Please, note that your personal identity number, phone number or e-mail address will not be published within the framework of our lotteries and/or competitions.

Below you can see the legal grounds and purposes of processing of your personal data:

Our marketing activities

Personal data

Legal grounds

Purpose of processing

Personal data included in photographs or video materials – your appearance, your child’s appearance etc.

Legitimate interests

Promotion of our shopping centres and products offered by them.

Lotteries and/or competition s organised by us

Personal data

Legal grounds

Purpose of processing

Name, Surname

Legitimate interests

Identification. To allow us to identify you as a participant in a lottery or competition.

Legal obligation

Identification. To allow us to identify you as a participant in a lottery or competition.

To enable us to perform our obligations towards tax administrations and institutions that supervise lotteries.

Personal identity number

Legitimate interests

Identification. To allow us to identify you as a participant in a lottery or competition.

Legal obligation

Identification. To allow us to identify you as a participant in a lottery or competition.

To enable us to perform our obligations towards tax administrations and institutions that supervise lotteries.

Contact details (phone, e-mail)

Legitimate interests

To allow us to contact you for receiving a reward.

 

Time limits for personal data processing

To ensure our marketing activities, we process your personal data within the following time limits:

Our activity

Type of submission and storage of personal data

Time limit (for deletion / destruction)

Marketing activity

Electronic data

3 years after the event

Paper format

3 years after the event

Lotteries and competitions

Electronic data

3 years after the lottery or competition

Paper format

8 years after the lottery or competition

 

PERSONAL DATA PROCESSING FOR THE PURPOSES OF SECURITY OF SHOPPING CENTRES

We carry out continuous video surveillance with recording inside common-use rooms of shopping centres, around the building perimeter and in the territory.

We process your personal data to prevent or uncover offences related to protection of property and vital personal interests, including life and health, as well as to collect evidence for insurance purposes.

Personal data controllers and processors

Your personal data are processed as part of video surveillance performed by us by the following companies that are considered to be controllers of your personal data:

#

Our operations

Controllers (joint controllers) and their contact details

1.

Video surveillance in shopping centres

ORIGO

  • Linstow SIA, reg. no.: 50003315411
  • Linstow Center Management SIA, reg. no.: 50003702891 

GALERIJA CENTRS

  • Tampere Invest SIA, reg. no.: 40003311422
  • Linstow Center Management SIA, reg. no. 50003702891

ALFA

  • Delta Property SIA, reg. no.: 50003390091
  • Linstow Center Management SIA, reg. no.: 50003702891

MOLS

  • Tirdzniecības centrs Mols SIA, reg. no.: 40003539034
  • Linstow Center Management SIA, reg. no.: 50003702891

DOLE

  • Tirdzniecības centrs Dole SIA, reg. no.: 40003434873
  • Linstow Center Management SIA, reg. no.: 50003702891

 

Contact details of all of the aforementioned controllers:

-         Registered office: 16 Audēju Street, Riga, LV-1050, Latvia

-         e-mail: dpo@linstow.lv

 

We can transfer your personal data also to other companies – processors of personal data, to prevent or uncover offences, as well as to collect evidence for insurance purposes.

We use only trusted partners – processors of personal data, to provide these services.

Your personal data can be transferred to the following categories of data processors:

-                 Providers of physical security (guard) service;

-                 Providers of security system maintenance services;

-                 Providers of insurance services;

-                 Institutions (for example, pre-trial investigation institutions, subjects of operational activity, national security authorities, prosecutor’s offices, courts and other law enforcement authorities, tax administration, supervisory authorities and institutions dealing with out-of-court dispute resolution); 

-                 Other personal data processors approved by us.

Types of personal data, legal grounds and purpose of processing

We always process your personal data only if we have legal grounds to do so, and solely for the defined purpose.

The following legal grounds exist for the needs of our video surveillance:

  • our legitimate interests – we are interested to prevent and uncover offences related to our, your or our partners’ property, as well as vital interests, including life and health, of all persons present in a shopping centre. We also need to collect evidence for insurance purposes for insured events. In some cases we also have the right to defend our interests, for instance, if you have submitted a complaint concerning our activities. In such cases we process only those personal data that are directly necessary for ensuring our legitimate interests.

Within the framework of video surveillance performed by us, all persons inside a shopping centre and within the range of visibility of surveillance cameras are surveiled, and this also includes children (i.e., persons younger than 18 years).

Our video surveillance data are not published. We are entitled to use the personal data of you and your children only to prevent or uncover offences related to protection of property and vital personal interests, including life and health, as well as to collect evidence for insurance purposes.

Below you can see the legal grounds and purposes of processing of your personal data:

Video surveillance carried out by us

Personal data

Legal grounds

Purpose of processing

A person’s image

Place of recording of a person’s image

Time of recording of a person’s image

Legitimate interests

To prevent or uncover offences related to protection of property and vital personal interests, including life and health, as well as to collect evidence for insurance purposes.

 

Time limits for personal data processing

As part of video surveillance performed by us, we process your personal data within the following time limits:

Our activity

Type of submission and storage of personal data

Time limit (for deletion / destruction)

Video surveillance

Electronic data

Not longer than 30 days after making of a recording

Electronic data, if an investigation is performed or if a request for information is received from law enforcement authorities

Until the investigation is completed or until information is provided to the law enforcement authority