The purpose of this document is to provide users of the application with the information required by Art. 12 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) about the processing of personal data in connection with the operation of the application.

FREEPORT LEISURE (CZECH REPUBLIC) s.r.o., comp. reg. no.: 264 29 101, with its registered office at Hatě 196, 669 02 Chvalovice, registered in the Commercial Register maintained by the Regional Court in Prague, File No. C 47035 (“FREEPORT”), protects all processed personal data as strictly confidential and handles them in accordance with the applicable legal regulations in the field of personal data protection. The security of your personal data is a priority for FREEPORT.

Within the meaning of Article 4(7) of the GDPR, FREEPORT is the controller of your personal data, i.e. it determines the purposes and means of processing your personal data and collects, stores and uses (and otherwise processes) your personal data for the performance of its business activities (the individual purposes for which personal data are processed are defined in more detail below). The information on the processing of personal data applies to the processing of users of the FREEPORT loyalty app (“Data Subjects”).

1. PROCESSING PRINCIPLES

1.1 FREEPORT is the operator of a loyalty mobile app called the Freeport Loyalty App (the “App”), which is intended not only for visitors and customers of the FREEPORT FASHION OUTLET shopping centre, Hatě 196, 669 02 Chvalovice.

1.2 FREEPORT complies with the following principles when processing personal data:

• it processes personal data fairly and in a lawful and transparent manner;
• it processes personal data for specific, in this information explicitly stated and legitimate purposes and does not process them in a way that is incompatible with those purposes;
• it processes data to an adequate extent, i.e. data that are relevant and limited to what is necessary in relation to the purpose for which they are processed;
• it processes accurate and up-to-date personal data of data subjects; the controller has taken all reasonable measures to ensure that personal data that are inaccurate in relation to the purposes for which they are processed are erased or rectified without delay;
• it processes personal data for the period necessary for the purposes;
• it processes personal data in a way that ensures their proper security.

2. CATEGORIES, PURPOSE AND LEGAL BASIS

2.1 The overview table below describes the purposes, categories and legal bases for the processing of personal data of Data Subjects – users of the application:

Purpose	Categories of data	Legal basis
User registration	Identification data (name, surname, e-mail, password) The provision of data is necessary to create a registration	Art. 6(1)(b) of the GDPR (contract)
User login	Identification data (e-mail, password) The provision of data is necessary for logging in	Art. 6(1)(b) of the GDPR (contract)
Purchase	Identification and contact details (name, surname, e-mail, telephone) Billing information (street, house number, city, country + if applicable, company name, comp. reg. no., VAT Idno.) + other delivery address if applicable Transport and payment information Order information (goods) The provision of data is necessary for the sale of goods	Art. 6(1)(b) of the GDPR (contracts)
Legal obligations	Identification data (name, surname, e-mail, telephone) Billing information (street, house number, city, country + if applicable, company name, comp. reg. no., VAT no.) + other delivery address if applicable Transport and payment information Order information (goods) Data processing is a legal obligation	Art. 6(1)(c) of the GDPR (legal obligation)
Newsletter - sending offers	Contact details Name, surname, e-mail, telephone If the buyer has agreed, marketing newsletters are sent to the buyer	Art. 6(1)(a) of the GDPR (consent) in conjunction with Section 7(2) of Act No. 480/2004 Coll.
Application operation	Cookies Technical cookies are necessary for the operation of the application. Consent to other types of cookies is voluntary The cookie policy is available here.	Art. 6(1)(f) or (a) of the GDPR (legitimate interest and/or consent)
Dealing with an incentive or request or complaint	Identification and contact details (name and surname, address, address, if applicable address and company registration number, e-mail, telephone, order number and other data provided) In order to process the request (properly and timely), it is necessary to process personal data	Art. 6(1)(f) of the GDPR (legitimate interest)
Statistics	Anonymous data Data cannot be attributed to Data Subjects	Art. 5(1)(e) of the GDPR

3. RETENTION PERIOD

3.1 FREEPORT retains your personal data for the period necessary to ensure all rights and obligations arising from the relevant contractual relationship and for the period for which it is required to retain personal data under generally binding legal regulations. In other cases, the processing period is based on the purpose of the processing, which must be proportionate or is determined by data protection legislation or other regulatory provisions.

3.2 The overview table below describes the retention period of your personal data:

Purpose	Categories of data Purpose	Retention period
Registration	Identification and contact details (name, surname, e-mail, password)	During the period of use of the application, or until the removal of the application from the user’s device.
Purchase	Identification and contact details (name, surname, e-mail, telephone) Billing information (street, house number, city, country + if applicable, company name, comp. reg. no., VAT no.) + other delivery address if applicable Transport and payment information Order information (goods)	For a period of 10 years from the end of the tax year in which the performance took place.
Newsletter	Identification and contact details (name and surname, e-mail, telephone)	During the period of consent.
Application operation	Cookies	According to the expiration date of the cookies specified in [cookie banner overview table / cookie policy].
Handling the application	Identification and contact details (name and surname, address, registered office and comp. reg. no., if applicable,, e-mail, telephone, order number and other data provided)	For a period of 6 months to 3 years, depending on the request being processed.

4. RECIPIENTS OF PERSONAL DATA

4.1 At FREEPORT, your personal data is only disclosed to authorised employees or individual data processors contracted by FREEPORT or other data controllers. This includes, for example, processors or administrators involved in the implementation of services, payments, or providing marketing services, or sellers placing an offer of goods on the Website. However, only to the extent necessary for the performance of the individual purposes of processing and on the basis of the corresponding legal title for the processing of personal data. The current list of FREEPORT recipients of personal data is available on request by e-mail at info@freeport.cz.

4.2 In connection with the operation of the application, FREEPORT uses a processor of personal data, i.e. the company Able.cz s.r.o., comp. reg. no.: 242 78 815, with registered office at Tyršova 1251/3, 669 02 Znojmo.

4.3 FREEPORT is entitled, or required, to transfer certain personal data for example to law enforcement authorities or other public authorities in cases provided for by law and under applicable legal regulations.

4.4 FREEPORT does not transfer your personal data to a third country (a country outside the EU/EEA) or to an international organisation.

5. SAFETY

5.1 FREEPORT has implemented technical and organisational measures to secure personal data against unlawful processing, accidental loss, destruction and damage. It continuously updates these measures. The technical measures consist of deploying technologies to prevent unauthorised access to personal data by third parties. Data encryption is used for maximum protection. Given that the servers are located in a data centre operated by a third party, FREEPORT ensures that technical and organisational measures are also in place at this provider. FREEPORT only places all data on servers located in the European Union.

5.2 The processing of personal data may be carried out for FREEPORT by processors exclusively on the basis of a contract for the processing of personal data, i.e. with guarantees for the organisational and technical security of the data, specifying the purpose of the processing, and the processors may not use the personal data for other purposes.

5.3 The processors of personal data with whom FREEPORT cooperates, as well as its employees or other persons who are in a contractual relationship with FREEPORT and are entitled to access personal data, are required to maintain confidentiality of personal data and security measures, the disclosure of which would endanger the security of personal data of data subjects.

6. RIGHTS OF DATA SUBJECTS

6.1 In connection with the processing of personal data, Data Subjects are entitled to the following rights:

• Right to withdraw consent to the processing of personal data: if personal data is processed on the basis of consent, you can withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal. Consent to receive commercial communications can be revoked via the link provided in the footer of the e-mail message that is a commercial communication.
• Right of access to personal data: you have the right to obtain information about whether your personal data is being processed and, if so, the right to access your personal data.
• The right to rectification of inaccurate or incomplete personal data: if you believe that we are processing inaccurate or false, outdated or incomplete personal data, you have the right (and in certain cases the obligation) to request its rectification or completion. We will carry out the correction/completion without undue delay, taking into account technical possibilities.
• Right to erasure: if you request erasure, we will erase your personal data if (i) they are no longer necessary for the purposes for which they were collected or otherwise processed, (ii) the processing is unlawful, (iii) you have objected to the processing and there are no prevailing legitimate grounds for the processing, or (iv) the processing is not required by law.
• Right to restriction of processing: if you are not interested in erasure but only in temporary restriction of the processing of your personal data, you can request us to restrict the processing of your personal data.
• Right to data portability: if you want us to transfer your personal data that we process on the basis of consent or on the basis of a contract to a third party, you can exercise your right to data portability. If exercising this right could adversely affect the rights and freedoms of third parties, we will not be able to comply with this request.
• Right to object: you have the right to object to the processing of personal data that are processed for the purposes of protecting our legitimate interests or those of third parties. If we do not demonstrate that there is a compelling legitimate reason for the processing that prevails over your interests or rights and freedoms, we will terminate the processing without undue delay on the basis of the objection.
• The right to contact the Office for Personal Data Protection (www.uoou.cz).

6.2 When processing your personal data or browsing the Website, there is no automated decision- making or profiling pursuant to Art. 22 of the GDPR.

6.3 In the event of repeated or manifestly unjustified requests to exercise the above rights, in accordance with Art. 12(5)(a) of the GDPR, we are entitled to charge a reasonable fee for the exercise of the right or to refuse to exercise the right. We will inform you in advance of such a step.

6.4 To exercise your rights, please contact us by letter to FREEPORT’s registered office or by e-mail to info@freeport.cz. FREEPORT reserves the right to reasonably verify the identity of the applicant for the rights in question.

7. UPDATE

7.1 The information on the processing of personal data may be updated, in particular if the scope, purpose or legal basis of the processing changes. The valid and updated Personal Data Processing Policy is always available on the Website.

7.2 The information on the processing of personal data became valid in 13.7.2021

7.3 Last update 15.7.2023