Privacy policy

Version of 28 May 2024

1 – Carmila and the protection of personal data

2 – Carmila responsible for processing

3 – Data subjects

4 – Purposes and legal basis of Carmila’s processing

5 – Personal data processed by Carmila

6 – Retention periods

7 – Data recipients

8 – Data transfers outside the European Union

9 – Rights of the data subject

10 – Security of personal data

11 – Cookies

12 – Updates

13 – Carmila contact

1 - CARMILA AND THE PROTECTION OF PERSONAL DATA

GDPR CARMILA is committed to the respect and protection of personal data, in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”) and Law No 78-17 of 6 January 1978 on computers, files and freedoms as amended (the “Data Protection Act”) and any guidelines and recommendations of the competent bodies and authorities (together the “Regulations”).

This Privacy Policy (“the Policy”) sets out CARMILA’s commitments and how CARMILA processes users’ personal data in the context of their visit and interaction on the website www.carmila.com (the “Website”) and more generally how CARMILA processes personal data in the context of its activities with professionals.

To learn more about how CARMILA handles your personal data regarding cookies and other tracers, we invite you to the section 11 on cookies.

2 - CARMILA RESPONSIBLE FOR PROCESSING

CARMILA, a public limited company, registered with the RCS of Nanterre under number 381 844 471, whose head office is located at 25 rue d’Astorg, 75008 Paris, represented by its President-in-Office.

3 - DATA SUBJECTS

As part of its activities on its Website, CARMILA collects and processes personal data relating to any user of the Website who uses its functionalities, as well as any professionals in the context of their exchanges and activities with CARMILA, which comprises in particular Carmila prospects, franchisees, managers or managers of shops, directors of branches, dealers and tenants, journalists, managers of premises, elected representatives, providers, shareholders as well as users of or visitors to the Website (the “Data subjects” or “you”).

4 - PURPOSES AND LEGAL BASIS OF CARMILA'S PROCESSING

This data is collected and processed by CARMILA for the following purposes and on the following legal bases.

5 - PERSONAL DATA PROCESSED BY CARMILA

CARMILA collects your personal data for the above purposes directly from you.

The personal data collected by CARMILA are as follows:

• surname and first name;
• email address;
• telephone number;
• company or name of employer and position within that company;
• any information you may provide as part of the forms on the Website or as part of the emails you send us via our email addresses;
• Banking ID (RIB) and identity documents where these are necessary for the establishment of a contract.

CARMILA also processes personal data that it does not collect directly from you, namely:

• contact details of Carmila’s prospects (surname, first name, e-mail, mobile phone number, postal address, company name or employer and position within that company) that we may receive from our commercial partners,
• technical information about your browsing activity on the Website (including data collected using cookies, login logs, IP address, date and time of login);
• information on the processing of technical data, in particular via cookies placed on the Website, is provided in Section 11.

6 - RETENTION PERIODS

We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including to meet any legal or accounting requirements.

In determining the appropriate retention period for personal data, we take into account the quantity, nature and sensitivity of the personal data, the potential risk of harm resulting from the unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and the possibility of achieving those purposes by other means, as well as the applicable legal requirements.

For personal data relating to Data Subjects, our retention periods are as follows:

• Contact forms: three (3) years from the date of application;
• Subscribe to the newsletter: as long as the Data Subject does not unregister;
• Lead data: three (3) years from the last contact;
• Data integrated into CRM tool: five (5) years after the end of the professional relationship between you and CARMILA.

After the time limits have been set, the data shall either be deleted or kept after anonymisation, in particular for statistical purposes. They may be retained in case of pre-litigation and litigation. It is recalled that deletion or anonymisation are irreversible operations and that CARMILA is no longer able to restore them.

7 - DATA RECIPIENTS

CARMILA shares the personal data it processes with a limited number of people:

• authorised CARMILA employees, by virtue of their position, and subject to a bond of confidentiality;
• its providers as “subcontractors” within the meaning of the Regulation solely for the purposes of the services provided. These include providers in charge of hosting, operating and maintaining the Carmila Website or information system, providers and agencies in charge of commercial campaigns or sending invitations or newsletters.
• CARMILA’s business partners with whom CARMILA has concluded the necessary data protection agreements.

The third parties with whom we share your personal data are therefore limited (by law and by contract) in their ability to use your personal data for the specific purposes we have identified. We will always do our best to ensure that third parties with whom we share your personal data are subject to privacy and security bonds in accordance with this Policy and the Regulations. We only allow them to process your personal data for specific purposes and in accordance with our instructions.

Except as expressly stated above, we will never share, sell or rent your personal data to any third party without notice and/or consent. If you have given us your consent to use your information in a particular way, but subsequently change your mind, you should contact us and we will stop doing so.

In any case, CARMILA may share your personal data with independent administrative or judicial authorities or any other organisation if permitted by law.

8 - DATA TRANSFERS OUTSIDE THE EUROPEAN UNION

CARMILA may have to transfer the personal data processed to its providers ‘subcontractors’ within the meaning of the Regulation, which may be located outside the European Union.

In this situation, in the absence of a decision on suitability, and after having carried out an assessment of the level of protection of your rights in the territory of the third State where the recipient of your personal data is established, CARMILA undertakes to take all necessary measures to ensure the protection of your personal data on the basis of appropriate safeguards (in particular standard contractual clauses of the European Commission).

9 - RIGHTS OF THE DATA SUBJECT

According to the Regulation, each Data Subject has different rights. These rights are not absolute and each of these rights is subject to certain conditions in accordance with the GDPR and more generally the Regulation. In particular, the Data subjects shall have:

• Right of access

You may request access to your personal data that we collect and process.

If you make a request for access, we will provide you with a copy of your personal data in our possession as well as all the information legally required.

• Right of opposition

You may object at any time, for reasons relating to your particular situation, to the processing of your personal data where this is based on our legitimate interest, unless our legitimate interest overrides your own interests and your rights and freedoms, or the processing is necessary for the establishment, exercising or defence of legal rights.

You may also, at any time, object to the processing of your personal data by us when this processing is carried out for commercial marketing purposes by electronic or postal means, including when the processing concerned constitutes profiling.

• Right of rectification

You may at any time ask us to rectify any personal data about you that is inaccurate or incomplete.

• Right of erasure

You may request the erasure of your personal data under the conditions laid down by the Personal Data Regulation, unless these must be kept to enable us to comply with legal bonds, or to enable us to exercise or defend our rights or, where they are necessary for the performance of the contract binding us.

• Right to restriction of processing

You may request the restriction of the processing of your personal data under the conditions laid down by the Regulation.

• Right to portability

You have the right to the portability of personal data which you have provided to us and which we process by automated means, when the processing which we implement is based on your consent or on the performance of a contract or pre-contractual measures, provided that the exercising of this right does not infringe the rights and freedoms of third parties.

• Right to set guidelines for the fate of your data after your death

You have the option to set general or specific guidelines regarding how you intend to exercise your rights under the applicable regulations after your death.

Any Data Subject may exercise his/her rights at any time by sending an email or writing to the postal address with the contact details mentioned below (Contact).

In the interests of confidentiality and protection of personal data, CARMILA will ask the Data Subject to prove his/her identity in order to respond to his/her request.

All requests will be processed in a timely manner and in accordance with the Regulations. In some cases, personal data can only be deleted after a certain period of time imposed by the regulations in force and the statute of limitations. In this case, CARMILA will keep this data until the total erasure date.

The Data Subject is informed that he/she cannot object to the collection and processing of personal data which is processed under legal bonds which would affect CARMILA. The Data Subject is also informed that in the event of refusal to provide his/her personal data or exercising of his/her right of deletion or opposition, all or part of the services offered may be made inaccessible to him/her.

In the event of a dispute concerning the use of his/her personal data, the Data Subject has the right to lodge a complaint with the National Commission of Information Technology and Freedoms (CNIL).

10 - SECURITY OF PERSONAL DATA

CARMILA ensures that personal data are processed in complete security and confidentiality, including when certain operations are carried out by subcontractors. To this end, appropriate technical and organisational measures are in place to prevent the loss, misuse, alteration and deletion of your personal data. These measures shall be adapted according to the level of sensitivity of the data processed and according to the level of risk presented by the processing or its implementation. We have procedures in place to deal with any suspected breach of data security and we will notify you and any competent supervisory authority of any suspected breach where we are legally required to do so.

Unfortunately, the security of data transmissions over the Internet or data storage systems cannot be guaranteed to 100%. If you have reason to believe that your interaction with us via the shopping centre websites is no longer secure (for example, if you believe that the security of an account you have with us has been compromised), please inform us immediately by contacting us at the contact details below.

11 - Cookies

What are cookies?

“Cookies” are small text files, often with unique identifiers, that are sent by web servers to web browsers, and can then be returned to the server each time the browser requests a page from the server.

Cookies are very useful and allow a website to recognise you, to connect when you visit a particular page, to provide a secure connection to a website and to improve your user experience by improving your browsing comfort and/or by adapting the content of a page to your interests.

How are cookies used?

Where prior consent is required for their use, the period of validity of consent for the placing of cookies is 6 months. At the end of this period, we will ask for your consent again.

Cookies that we place as operators of our Website are called “internal cookies”. The cookies that third parties have entrusted to us on our Website and/or our application are called “third party cookies”. Third-party cookies enable third-party features or functionality to be provided on or through a website (for example, advertising, interactive and analytical content). The people who create these third party cookies may collect some of your personal information, recognise your computer both when visiting the website in question and when visiting other websites.

The lifetime of an audience measurement cookie that does not require consent is 13 months. In addition, the information collected through these cookies is stored by us for a maximum of 25 months, in accordance with the applicable regulations.

The types of cookies that are used on our Website are:

Technical cookies:

These cookies will allow you to move around our Website and use its features more efficiently. These cookies also allow our Website to remember your previous action during the same browsing session.

Functional cookies:

These cookies allow our Website to remember the choices you make when you visit our Website in order to provide you with enhanced and more personalised features.

Analytical cookies:

These cookies are used by us or third-party service providers to analyse the use and performance of our Website. In particular, we use Google Analytics cookies to obtain web analysis data. Google Analytics collects information about your interaction with our Website, including information about the pages you visit and how long you visit our Website.

Matomo: Matomo is a web analytics solution that tracks and reports website traffic while respecting user privacy. Unlike other services, data collected via Matomo is not shared with third parties, and we use it exclusively to improve the user experience on our site. This data is not used for advertising or tracking purposes outside of our own platform.

You also have the option to refuse the tracking of your activity by Matomo in the cookie banner or by enabling the do-not-track option in your browser. This feature prevents Matomo from collecting information about your visits to our site.

For more information on Matomo’s privacy practices, you can visit their dedicated data protection page: https://matomo.org/privacy-policy/.

Statistical cookies:

These cookies allow us to establish statistics and volumes of visits and use of the various elements of our site and our application (sections and contents visited, itinerary, visit time), which allows us to improve the interest and ergonomics of our services.

Advertising cookies:

These cookies are used to present advertisements to you or to send you, when you browse the Internet outside our sites and applications, information adapted to your interests in connection with your use of the site and the application. They are used to limit the number of times you see an ad and to help measure the effectiveness of an ad campaign. These cookies depend mainly on advertising agencies and we do not always control their use.

How to block the use of cookies

There are two ways to refuse the use of cookies.

During your first visit to our Website, your consent to the use of your data by cookies will be requested via an information banner which will be displayed visibly at the bottom of the page.

By using the “OK!” and “No, thanks” buttons, you will be able to accept or refuse globally so that we can place cookies on your computer or device (cookies related to targeted advertising operations, certain audience measurement cookies, social media cookies generated in particular by their sharing buttons when they collect personal data). However, a third “I want to choose” button on this banner will allow you to get the details of the categories of cookies used and thus choose whether or not to consent by purpose.

However, if you wish to refuse the use of any type of cookies on a website, you can do so by changing your browser settings to block the use of cookies. Please note that if you block the use of cookies by this browser setting, you may not be able to use or view all or part of the website concerned, including our Website.

Each web browser offers different ways to set up cookie management. In general, these are described in the Help menu of each browser.

Firefox: https://support.mozilla.org/fr/kb/cookies-informations-sites-enregistrent

Click on the menu button and select “Preference Options”.

Select the “Privacy and Security” panel.

Set the “Retention Rules” menu to “Use custom settings for history”.

Clear the “Accept cookies” checkbox.

Changes you make will be saved automatically.

Internet Explorer: https://support.microsoft.com/en-us/products/windows?os=windows-7

Click on the “Tools” button, then on “Internet Options”.

Click the “Privacy” tab, then under “Settings”, move the slider up to block all cookies or down to allow all cookies, then click OK.

Google Chrome: https://support.google.com/chrome/answer/95647?hl=fr

Select the Chrome menu icon.

Select “Settings”.

At the bottom of the page, select “Show advanced settings”.

In the “Privacy” section, select “Content Settings”.

Select “Prohibit all sites from storing data”.

Select OK.

Safari: https://www.apple.com/legal/privacy/fr-ww/cookies/

Click on “Settings” > “Safari” > “Privacy” > “Cookies and website data”.

Then select “always block”.

Please note that if you block the use of cookies by this browser setting, you may not be able to use or view all or part of the website, including our Website.

In addition, if you wish to block the use of analytical cookies and/or advertising and retargeting cookies, both provided by our third-party service providers, please access the following URL to suspend the use of these cookies.

Google Analytics: opt-out for cookies

Description of cookies and their purpose:

Google Analytics _ga;

Google Analytics _gid. These cookies are used to distinguish users. https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage;

Google Analytics _gat. These cookies are used to reduce the number of requests. However, if Google Analytics is deployed via Google’s tag manager, these cookies will be named: _dc_gtm_<property-id>. https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage.

Google Analytics is a web analytics service provided by Google LLC (“Google”). Generally, the information generated by the cookie about your use of the Website is transmitted to a Google server in the United States and stored there.

Google will use this information on our behalf in order to analyse your use of the Website, compile reports on the activity of the Website and provide us with additional services related to the use of the Website and the use of the Internet in general. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.

You may refuse the use of the data created by these cookies in connection with the use of our Website (in particular your IP address) and the processing of this data by Google, by downloading and installing the plug-in available on your browser under the following link: https://tools.google.com/dlpage/gaoptout?hl=en-GB

12 - UPDATES

CARMILA may amend this Policy from time to time to reflect changes in our practices. When we amend this Policy, we also change the update date indicated at the top of the first page of this Policy.

The current version of this Policy is always available online on the shopping centres’ websites and on request by email or post to the contact details below (Contact).

13 - CARMILA CONTACT

If you have any questions regarding this Policy or the processing of personal data implemented by CARMILA, please contact the DPO at the following address:

CARMILA

DPO

25 rue d’Astorg

75008 Paris

Or by Email: infos-donnees@carmila.com.