Safeguarding and Security Privacy Notice



This notice explains how the data controller [referred to in this notice as the Data Controller (as defined below), we, us or our] collects and uses personal data in our shopping centre for security and safeguarding purposes. Security relates to the prevention and detection of alleged or actual criminal activity. Safeguarding refers to the collection of personal data on accidents and incidents within the shopping centre. This notice covers the following: 1/ Contact details of the Data Controller 2/ How do we collect your personal data 3/ What is the scope of this privacy policy? 4/ Details about the processing of your personal data 5/ What happens if you do not provide personal data that we request? 6/ How do we share your personal data 7/ How do we keep your personal data secure 8/ Do we transfer your personal data overseas? 9/ Your rights in relation to your personal data 10/ Automated decision making / profiling 11/ Update of this Privacy Notice


1/ Contact details of the Data Controller
The local data controller : CH Warszawa U spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw, ul. Złota 59, 00-120 Warsaw, holding NIP 1080005074 and REGON 141188098, entered into the Register of Entrepreneurs kept by the District Court for the capital city of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under number KRS 0000298581, with the share capital of PLN 18 655 000,00.
The local data controller will process your personal data in the context set out below. The group data controller : Unibail Management Simplified joint stock company with a capital of 20 000 000€ Having its registered office at 7 place du Chancelier Adenauer 75016 Paris Registered within the Paris Register under number 414 878 389 The group data controller will process your personal data in order to assist the local data controller and to ensure a general governance at group level in case of serious cases dealing security, legal or insurance matter. The local data controller and the group data controller are acting as joint data controllers and will hereinafter be referred to together as “Data Controller”.

2/ How do we collect your personal data
We collect personal data about you through the following means : - through any system operated for the security, safety and access management (notably CCTV, licence plate recognition in Parking, access right system) - directly from you (or from your relatives in case of serious injuries) ; and/or - through any applications that can be available to any person working within the shopping centre

3/ What is the scope of this privacy policy?
This privacy policy deals with personal data we are processing in the framework of the management of security and safety in and around our shopping centre, through : - CCTV System - Record of injuries and/or accidents - Record of incident and/or criminal activities - Access right management system - Parking assistance and parking subscription contract If you are a member of our loyalty program, the processing of your personal data will be made also in compliance with the Loyalty Program privacy policy that you can find on our website


4/ Details about the processing of your personal data
You will find in the table below all information in relation with : - Why we are processing your personal data (Purpose) - Which personal data are involved (Personal data involved) - On which legal basis we are processing your personal data (Legal basis) - How long we are storing your personal data (Retention period)

Specific purpose Personal data involved Legal basis Retention period*
Zarządzanie sprawami zaistniałych w centrum handlowym wypadków i urazów ciała.
Management of accident and injury occurring in the shopping centre. Including management of any pursuant legal claim.
Personal contact details, date of birth, information about the injury and/or accident information about health and medical information, CCTV recording (if applicable) Legitimate interest to keep track of accident occurring in the shopping centre and to prepare for and defend legal claim. 10 years maximum from collection
Management of access in the shopping centre in order:
to prevent any unauthorized access and to prevent criminal or potential criminal activity including prevention against damages to property, shoplifting, prevention against terror attack and drug trafficking.
Personal contact details, entry pass, license plate number, CCTV recording Legitimate interest in preventing and detecting unlawful acts. and crimes. Your personal data will remain stored for the duration of 3 (three) years after the last entrance/exit in the relevant parking. Retention of CCTV footage in any case, up to a maximum of 30 days.  
Maintain security within our shopping centre and keep the public safe and notably

- comply with health and safety obligations (including fire protection and prevention against foreseeable natural and technological risk).

- prevent and detect criminal or potential criminal activity including prevention against damages to property, shoplifting, prevention against terror attack and drug trafficking.
Personal contact details, license plate number, information about the criminal or alleged criminal activity CCTV footage (image and voice) Legitimate interest in preventing and detecting unlawful acts and crimes. 10 years maximum from collection.  

Retention of CCTV footage is in any case, up to a maximum of 30 days​.
Management of Parking assistance and parking subscription contract. Personal contact details, registration plate number, CCTV footage
Specific for persons concluding parking subscription contract: bank details, PESEL number.
Execution of a contract Duration of the contractual relationship.
Retention of CCTV footage is in any case, up to a maximum of 30 days.
Management of demand(s) made in application of rights mentioned in article 8

Including any pursuant legal claim.
Personal contact details, information on alleged or actual incident, CCTV footage, Automatic Number Plate Recognition footage/information Legal obligation pursuant to application of article Duration of the handling of the request and 6 additional years.



*We may need to retain your personal data beyond these stated retention periods, for example where the law requires us to do so (ex: Tax regulation), where a law enforcement body or regulatory body are investigating a crime or incident, or in preparation for or in the defence of legal claims.

5/ What happens if you do not provide personal data that we request?
Where we are legally obliged to collect personal data the provision of this information will be mandatory. Failure to provide personal data which you later rely upon in preparing or making a legal claim could result in your claim being dismissed and/or unsuccessful.

6/ How do we share your personal data?
We may share personal data in the following ways: - with Unibail-Rodamco Polska sp. z o.o. with its registered seat in Warsaw, having KRS number: 0000153593 (part of the Unibail-Rodamco-Westfield Group), a company providing services regarding management of Shopping Centre to Local Data Controller. - where we use service providers who process personal data on our behalf in order to provide services to us. You will find the list of our services providers in Appendix 1 below. Please note that for any employees working within the shopping centre: your personal data may be processed within any applications (such as Connect) available to them in accordance with their privacy policies. - with law enforcement agencies and government agencies for the prevention and detection of crime; - with the emergency services in the case of accident or illness; - with our lawyers and courts when enforcing claims and/or defending our position; and - with our insurers for claims relating to accident/injury or damage to personal property.

7/ How do we keep your personal data secure?
We take the security of all the personal data we hold very seriously. We are committed to protecting your personal data and implement appropriate technical security measures to protect it.

8/ When do we transfer your personal data overseas?
Your personal data is not transferred outside the European Economic Area. if the situation would change and your personal data will be transferred to countries outside the European Economic Area, such a transfer will be done in countries that offer an equivalent level of protection for personal data to the laws in the European Economic Area otherwise we will ensure that appropriate safeguards are put in place to protect your personal data, notably by signing the Standard Contractual Clauses of the European Commission. More information about such clauses can be found here : https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. In such case the present privacy policy will be updated.

9/ Your rights in relation to your personal data
Pursuant to all applicable laws, you have the right to ask for access, rectification, deletion, objection, limitation or portability of your Personal data as described below: - to access your personal data personal data - to ask for rectification or deletion of your personal data; to object or demand the limitation of the processing of your personal data; - to receive, upon request, all your personal data in a structured and standard format or to ask for the transmission of such information to other controller; -Exercise of your Rights If you wish to exercise these rights and/or obtain all relevant information, please contact us at the following address: recepcja.URSYNOW@urw.com. To ensure an effective exercise of your rights, please note that you can send your request at the above mentioned address for your questions and demands in relation with processing to both data controllers (local data controller and group data controller). You can also exercise these rights directly at the Welcome/info desk of our Shopping Centre. In order to avoid to infringe third party rights, we reserve the right, in case of reasonable doubt, to proceed to prior verification of your identity. -Complaints We would request that you first provide us with an opportunity to address any complaints you have about how we uses your personal data, however you have the right to make a complaint to the President of Personal Data Protection Office in Warsaw.

10/ Automated decision making / profiling
There is currently no automated decision making process or profiling made with your personal data.

11 / Update of this Privacy Notice
We may revise or update this Privacy Notice from time to time. Any change to this Privacy Notice will become effective upon online publication on this website.


The date this privacy notice was last revised was: 1 June 2019.