Privacy Policy

February 2025

Batavia Stad Fashion Outlet (the “Centre”) is committed to protecting your privacy. This Privacy Policy explains how the Centre collects and uses personal data about you if you:

• join the Batavia Fashion Club;
• sign up to receive Fashion Club marketing communications;
• consent to geofencing location;
• consent to receiving push notifications;
• sign up to receive the newsletter for the Centre;
• participate in any competitions or contests that we run;
• participate in surveys and focus groups;
• access and use the website located https://bataviastad.nl/  (the “Site”);
• request a VIP Day Pass;
• requesting an online Gift Gard;
• use our online shopping platform;
• enter an area of the Centre in which we operate security cameras and monitor footfall via CCTV;
• use the car parking facilities at the Centre;
• suffer an injury or have an incident in the Centre;
• if you want to raise a concern or compliant; or
• contact us in relation to any of the above.

Please read this Privacy Policy carefully to find out about:

1. Who we are
2. Personal data we collect about you, how it is used and why, including the legal basis for our processing
3. Who we share your personal data with
4. How we use cookies
5. How long we keep your personal data for
6. Our policy on children’s personal data
7. Your rights
8. Links to other websites
9. Changes to this Privacy Policy
10. How you can contact us

Who we are

The personal data that the Centre collects from you, or that you provide to the Centre, is controlled by one or both of the following companies within the VIA Outlets portfolio:

• Batavia Stad Outlet Shopping B.V., business address: (8242 PN) Lelystad, the Netherlands, Bataviaplein 60, trade registry number: 32085223 (“Centre Propco”); and/or
• VIA Outlets B.V., a private company with limited liability under the laws of the Netherlands, having its seat in Amsterdam the Netherlands and its address at WTC Building Schiphol, 4th floor Tower F, Schiphol Boulevard 153, 1118 BG Schiphol, the Netherlands, registered with the Chamber of Commerce of Amsterdam under number 76586537 (“VIA Outlets B.V.”).

The controller of your personal data depends on the reason for your interaction with us. Please see the section “Personal data we collect about you, how it is used and why, including the legal basis for our processing” to understand which of the companies listed above control the personal data that the Centre collects from you, or that you provide to the Centre, in connection with each type of interaction covered by this Privacy Policy. 

References in this Privacy Policy to “we” or “us” are to these companies. 

Each of the companies listed are committed to protecting your privacy and are (depending on the reason for your interaction with us, as explained above) joint data controllers of your personal data within the meaning of data protection laws applicable in the European Union (“EU”) and European Economic Area (“EEA”). As joint data controllers, we have arrangements between us to ensure that we handle your personal data correctly and in accordance with data protection laws applicable in the EEA, such as the General Data Protection Regulation (GDPR). These arrangements, which do not affect your rights under data protection law, reflect our respective roles and responsibilities in relation to you, and considers which entity is in the best position to fulfil each obligation to you.

If you have any questions or requests in connection with your personal data, you can also contact VIA Outlet’s group data protection officer, please send an email to: DPO@viaoutlets.com.

1. Personal data we collect about you, how it is used and why

Below you will find an overview of the purposes for which we process personal data about you. It includes which personal data we use for that specific purpose, what the legal basis is for the data processing and how long we retain the personal data.

(A) Fashion Club: Registration

Types of personal data we collect:

• We collect the information you provide to us when you register for our Fashion Club, via our website, app or at the Centre, and any further information you provide to update your registration details from time to time. This information includes your name (first and last name), email address, country of residence, postal address (including city of residence and postcode), language preferences, gender and date of birth. If you do not want to provide us with your personal data upon sign-up, we are unfortunately not able to let you participate in the Fashion Club.
• Refer a friend – on occasion we may offer incentives to reward members of the Fashion Club for referring a friend. In order for us to facilitate this reward we need to create and store links between you and friend(s) you refer within our database. This link will only be created when the new member completes the registration process.

Purpose of processing (how and why we use your personal data):

• We process your personal data to administer your Fashion Club membership and to be able to provide you with access to the various benefits of the Fashion Club. These benefits include our newsletter, the ability to make savings at participating retailers’ stores by accruing credits on your purchases and access to special offers, promotions and discounts.  We also process your personal data to ensure that the information we hold about you is kept up to date and accurate.
• We rely on the use of personal data to build a clearer picture of our members both as a group and as individuals, including by analysing your shopping behavior (the date/time), the benefits of the Fashion Club which you choose to take up or participate in, and the different ways in which you choose to interact with us. This helps us to provide you with a seamless, relevant and consistent service and also to work out how we can improve the Fashion Club and the information technology systems (including security) that are used to operate it.

Legal basis for processing:

• We process your personal data after obtaining your consent to do so for the purpose of sending you marketing communications, which may include invitations to take part in special events, surveys and/or focus groups, about the benefits of the Fashion Club. Please see the section “Fashion Club: Marketing communications and automated decision-making (including profiling)” to find out more about your choices when it comes to marketing.
• In addition, it is in our legitimate interests to collect and use the personal data referred to in the section above so that we can better understand our member base so that we can improve our services and marketing activities (which could also benefit you).
• It is necessary for us to process your personal data in order to perform the contract between us and you in relation to your registration to the Fashion Club.

Account deletion: 

• If you no longer wish to participate in Fashion Club, you can delete your account from the "Settings" section of the Fashion Club mobile application, and select "Delete My Account". Alternatively, you may request that we delete your data (and thereby your account) by submitting a request to Privacy.Batavia@viaoutlets.com. 

Data retention period:

• As a Fashion Club member your data will be kept for as long as you are an active participant of the Fashion Club programme. We define an active Fashion Club member (an “Active Fashion Club Member”) as one that has transacted using their Fashion Club App / Card or Unique Code and/or has opened a Fashion Club email and/or visited our Centre (including our online store). If you are no longer deemed to be an Active Fashion Club Member for a rolling five-year period, then your personal data will be anonymized with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (transaction information and Centre visits or online purchases) for market research and analysis purposes. Prior to deletion, you will be informed that your account will be deleted.
• If you request to delete your account, we will anonymize your information. Your personal data will be anonymized in the database with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (transaction information, Centre visits or online purchases and other analytical data) for market research and analysis purposes.

Joint controllers of your personal data:

• VIA Outlets B.V.
• Centre Propco

(B) Fashion Club: Marketing communications and automated decision-making (including profiling) 

Types of personal data we collect:

• As part of the Fashion Club, we also gather information about the purchases you make at the Centre, including the stores you shop in and transaction details. When you use our online platform, we also collect information on purchased items, frequency of purchasing and transaction details (including the date, time and value of the transaction). We gather this information when you scan or enter in your unique code membership email, Fashion Club membership card or Fashion Club app at a Centre store or online when making a purchase (we gather this information in order to offer you all the benefits of the Fashion Club). This helps us to build a profile of your preferred brands and products.

Purpose of processing (how and why we use your personal data):

• By interacting with our services, we are able to use the data you have provided to find out what products, brands and styles you are interested in and profiling helps us to build a profile of your preferred brands and products. With this profile, we are able to send you offers that are tailored to your specific preferences, based on your previous transaction activity. It also means that we don’t send the same offers to all members of our Fashion Club, so you may not be made the same offers as another Fashion Club member.
• We gather information about the purchases you make at the Centre and your use of our online services and your visits to the Centre (location data) so that we can give you all the benefits of the Fashion Club and to provide you with useful information that corresponds to your needs and interests. When we have information about your purchases, we can tailor our benefits to your preferences, based on your purchasing activities and learn more about your favourite stores so that we can make sure you are sent the kinds of offers that you will be most interested in. We may also use your personal data to analyse the effectiveness of our marketing communications so that we can improve the relevance of the marketing communications we provide to you and other members over time.
• We send you such offers by automated means. This means processing using, for example, software code or an algorithm, which does not require human intervention.

Legal basis for processing:

• We only send you personalized offers with your consent.
• If you want to withdraw your consent and opt out of receiving personalized offers based on profiling and automatic decision-making, you can unsubscribe via the link provided in each newsletter.
• If you don’t agree with an automated decision that our technology has made in relation to you, you can contact us and we will look into it for you (see the section “How you can contact us”).
• If you opt-out of receiving personalized offers, we will not target and/or profile your data, but we will still collect your information as part of your membership of the Fashion Club and in order to provide our services as mentioned in the section “Fashion Club: Registration” above. Please also see the section “Analytics, surveys and focus groups (market research) and Advertising” which sets out how we use your data for market research and analytic purposes.

Data Retention Period

• As a Fashion Club member your data will be kept for as long as you are an Active Fashion Club Member. If you are no longer deemed to be an Active Fashion Club Member for a rolling five-year period, then your personal data will be anonymized with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (transaction information and Centre visits or online purchases) for market research and analysis purposes. Prior to deletion, you will be informed that your account will be deleted.
• If you request to delete your account, we will anonymize your information. Your personal data will be anonymized in the database with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (transaction information, Centre visits or online purchases and other analytical data) for market research and analysis purposes.

Joint controllers of your personal data:

• VIA Outlets B.V.
• Centre Propco

(C) Fashion Club: Geo-fencing

Types of personal data we collect:

• We process location data of Fashion Club members using a geo-fencing service. Geo-fencing is a location-based service which establishes a virtual fence around, or within, our shopping centres. If you are a Fashion Club member (or use the Fashion Club app) and you have consented to location tracking within the Fashion Club app on your mobile device, our geo-fencing service will detect and record when you enter and leave that geo-fenced location within our centres and how long you stay in a specific area of the centre.
• Geo-fencing cannot pinpoint your exact location or entry into a particular store.
• No personal data is shared with the retail outlets or brands you visit.

Purpose of processing (how and why we use your personal data):

• The geo-location data is combined with data from your Fashion Club loyalty scheme card data if you use it in the Centre to collect rewards to determine the spend value and the brand/store. On the basis of this information, we determine which (future) rewards, discounts and/or vouchers to offer to you as a Fashion Club Member.
• We can also determine when you visited the Centre without making any transaction or without using your loyalty scheme card in order to send you offers or information about the Centre and/or brands.
• We may also use the geo-location data to send Fashion Club members who visited the Centre a survey after their visit.
• We may send you the above through push notification during or after your visit to the Centre. For more information on our marketing communications, please read “Fashion Club: Marketing communications and automated decision-making (including profiling)” and “Push Notifications”.

Legal basis for processing:

• Geo-location data via a Fashion Club member’s mobile device is automatically collected by the device when you have consented to location tracking services on your device. As such, you remain in full control of location data collection.
• You have the right to withdraw your consent at any time with effect for the future by consulting the settings on your device.

Data retention period: 

• As a Fashion Club member your data will be kept for as long as you are an Active Fashion Club Member.
• If you are not registered as a Fashion Club member, we do not store any geo-location of you. All data is stored locally on your device and is not accessible by us. If you enter a geo-fenced area, your device may automatically send you a push notification or in-app message (for more information, please read the section “Push Notification”).

Controller of your personal data: 

• VIA Outlets B.V.
• Centre Propco

(D) Fashion Club: Push Notification

Types of personal data we collect:

• If you have downloaded the Fashion Club App, we use your personal data to send you push notifications on your mobile device to send you the latest offers and news tailored to your preference.
• If you are a Fashion Club member we do so based on the geo-fencing data and your transactions and shopping behaviour (please read “Fashion Club: Geo-fencing” and “Fashion Club: Marketing communications and automated decision-making (including profiling)” for more information).
• If you are not registered as a Fashion Club member but still use the Fashion Club App, you will only receive push notifications based on geo-fencing data, if you have consented to such location tracking, and analytical data about your use of the Fashion Club App (i.e. what you have clicked on).

Legal basis for processing:

• You will only receive push notifications if you have given us your consent.
• At any time, you can manage your push notification preferences or deactivate these notifications at any time by turning off the notification settings in the App or in the device settings of your mobile device.

Data retention period:

• As a Fashion Club member your data will be kept for as long as you are an Active Fashion Club Member. If you are not registered as a Fashion Club member, we do not store any geo-location of you. All data is stored locally on your device and is not accessible by us.

Controller of your personal data:

• VIA Outlets B.V.
• Centre Propco

(E) Newsletter (formally the VIP Programme) and including our trade newsletter, if you sign up to receive it by itself and not as part of either the Fashion Club)

Types of personal data we collect:

• We collect the information you provide to us when you sign up to receive our newsletter and any further information you provide to update your registration details from time to time. This information includes your name, email address, gender and date of birth. If you sign-up to receive our trade newsletter the information we collect also includes your company name and telephone number.

Purpose of processing (how and why we use your personal data):

• We process your personal data to:
• provide you with our newsletter (including our trade newsletter if you have specifically signed up for this);
• provide you with more relevant information based on the information you have provided to us on signing up to the newsletter (if you have consented to personalized offers);
• provide you with information about events, special offers, promotions and other relevant matters concerning the Centre;
• for research and analysis, including inviting you to take part in surveys or focus groups carried out by us or by third parties on our behalf: We carry out research and analysis to improve the newsletter. However, if you tell us that you do not want us to contact you about surveys or focus groups, we will respect this choice. This will not affect your subscription to the newsletter; and
  • administer our database of customers who have signed up to receive our newsletter:  We use your personal data so that we can notify you about changes to our newsletter service. We also process your personal data to ensure that the information we hold about you is kept up to date and accurate.

Legal basis for processing:

• We process your personal data after obtaining your consent to do so for the purpose of sending you information about the latest news, special events, offers, promotions and other benefits at the Centre. Please see the section “Fashion Club: Marketing communications and automated decision-making (including profiling)” to find out more about your choices when it comes to marketing. You can unsubscribe from and withdraw consent to this service at any time by opting out via the link provided in each newsletter.

Data retention period: 

• As a Newsletter member, your data will be kept for as long as you are actively opening and reviewing our email communications. If you are deemed to be an inactive member for a rolling three-and-a-half-year period, your personal data will be anonymized in the database with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (analytical data) for market research and analysis purposes. Prior to deletion, you will be informed that your account will be deleted.
• If you request to delete your account, we will anonymize information. Your personal data will be anonymized with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (analytical data) for market research and analysis purposes.

Joint controllers of your personal data:

• VIA Outlets B.V.
• Centre Propco

(F) Competitions and contests

Types of personal data we collect:

• We collect the information you provide to us when you participate in a competition or contest that we run. This may differ depending on the type of competition or contest we are running but is likely to include your name (first and surname), email address, mobile number and postal address.

Purpose of processing (how and why we use your personal data):

• We need your personal data in order to operate the competition or contest that you have entered and inform you of its outcome.

Legal basis for processing:

• The processing of your personal data is necessary for the performance of the contract with you. In order to perform the competition or contest.

Data retention period:

• Your data is retained for the term of the competition and will then be deleted after the winner of a competition has been announced. The data of the competition winner (and any runner-up) may be held until such time that the competition prize has been collected, or used if the prize is a trip or event, following which, data will be deleted.
• If you are a Fashion Club member, we will store your data as set out above in the section “Fashion Club: registration / Data retention period”.

Controller of your personal data:

• Fashion Club competitions: VIA Outlets B.V.
• All local run competitions: Centre Propco

(G) Analytics, surveys and focus groups (market research) and Advertising

Types of personal data we collect:

• We combine the personal data we collect about you through the different channels you use to interact with us (for example, browsing our Site, signing up for the newsletter or Fashion Club, using our online shopping platform and contacting us). In addition, we may combine the information we hold about you with information about you held by our selected partners and/or retail outlets where you have agreed that they can share your information with third parties.
• We may also collect your personal data if you choose to participate in a survey or focus groups carried out by us or by a third party on our behalf.
• Email analytics: We included email tracking and link tracking features in our emails by embedding a small transparent image pixel in the outgoing email.  If the email is opened, we will have access to certain information, such as  the name and surname of the recipient; the recipient’s email address; subject of the email; date and time in which the email was sent; confirmation that the recipient received the email; confirmation that the recipient has opened the email after it has been received; timestamp of each email opening; the history of the times (number, date and time) the recipient has opened the received email; IP address from which the email was opened; browser and operating system used by the recipient who opened the email; number of links included in the email; text and URL of such links; number of clicks made on each of them by the recipient; timestamp of each click on the link; IP address from which the link was clicked on and browser and operating system used by the person who has clicked on the link.

Purpose of processing (how and why we use your personal data):

• We carry out research and analysis to improve the Fashion Club and other services by evaluating your needs, experiences and wishes. We do so on an aggregated level.
• By interacting with our services, we are able to use the data you have provided to find out what products, brands and styles you are interested in and profiling helps us to build a profile our guests’ preferred brands and products.
• We gather information about the purchases you make at the Centre and your use of our online services so that we can analyse the effectiveness of our marketing communications so that we can improve the relevance of the communications we provide to you and other guests over time.
• We also use your data, for the purpose or market research and data analysis, for the following reasons:
  • User segmentation – classification of various target and user groups and their shopping interests and usage habits (including findings on demographic interests and habits).
  • Execution of advertising to existing customers, including execution of direct marketing (newsletters).
  • Monitoring the success of advertising campaigns.
  • Usage analytics or services.

Legal basis for processing:

• It is in our legitimate interests to do this so that we can form a clearer picture about our customer base and as a result improve our services and marketing activities (which could also benefit you).
• Email analytics: The processing of these personal data is necessary for the purposes of the legitimate interests pursued by us, in order to analyse the reach and effectiveness of the mails send by us.

Data retention period: Data shall be retained depending on the origin according to period foreseen in other sections. If you would like more information or to request details, please contact us by sending your request to Privacy.Batavia@viaoutlets.com.

Controller of your personal data:

• VIA Outlets B.V.
• Centre Propco

(H) Website use and access

Types of personal data we collect:

• We automatically generate and collect information about you when you visit our Site or use our Fashion Club application (App), for example through the use of cookies and similar technologies. Please refer to our Cookie Policyfor more specific information. The information we collect about you includes:
  • Technical data, such as your internet protocol (IP) address (which is a unique number enabling us to recognize your device) and other identifiers, browser type, version and settings, including the time zone and language settings, global geographic location on a national or city level, browser plug-in types and versions, operating system and platform, and other technologies on the devices you use to access the Site.
  • Usage data, such as which pages you visit, whether you are a returning visitor, the period of time you spend on our Site, the activity on your account (should you have one), including storage usage and the number of log-ins, which data was displayed to you, which User Interface (UI) elements you interacted with, including buttons and links, as well as information about your social media profiles which we collect through social media plug-ins. Please refer to our Cookie Policy for more specific information of our cookies and similar technologies.

Purpose of processing (how and why we use your personal data):

• We process your personal data to better understand how you use our Site or App, in order to provide, maintain and improve it. This may for example enable us to correctly display content and to better secure our Site and App.
• We process information about you to find out what your preferences are. This helps us to provide you with a personalized and optimized online experience, for example by remembering your settings, such as your preferred language, and by providing you with advertisements tailored to your interests. We are also able to understand the effectiveness of the advertising we serve to you.
• We use tools and plug-ins of social media platforms on our Site. These enable you log in to your social media profile and share information about this Site with others. Furthermore, it enables us to obtain the information you have shared on your social media profiles. Please be advised that, although we use different social media platforms and are responsible for the content of this Site that is shared via such platforms, we are not responsible for the management of these platforms. For more information about how your data will be used by these social media platforms, we refer to the information already available on the website of the suppliers of these platforms.
• With your consent, we use the so-called Meta Pixel on our Site to make sure that our advertisements on the Meta Apps (including Facebook and Instagram) match the potential interest of users. Accordingly, we use the Meta Pixel to display our ads to Meta users who have shown an interest in our Site or who have specific characteristics (e. g. interests in certain topics or products determined by the Site visited) that we submit to Meta (so-called “custom audiences”).
  • With the Meta Pixel, we can also track the effectiveness of our Meta ads for statistical and market research purposes by seeing whether users were redirected to our Site after clicking on one of our Meta ads.
  • Because the Meta Pixel is integrated into our Site, your browser automatically establishes a connection with the Meta server after you have agreed to the use of the Meta Pixel through our cookie banner. If you are registered with a Meta service, Meta can also assign the visit to your account. The processing of your personal data by Meta is governed by Meta’s Privacy Policy. Specific information and details about the Meta Pixel can also be found in the Meta Help Center.
  • We are jointly responsible with Meta (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) for the collection and transfer of personal data in this process. We have therefore entered into a corresponding agreement with Meta for our joint controllership, which you can find here. This arrangement defines the respective responsibilities for fulfilling our obligations under the GDPR. We have agreed with Meta that Meta shall act as the main contact point for the exercise of data subject rights with regard to the processing of personal data through the Meta Pixel.
  • You may withdraw your consent for the collection by the Meta Pixel and use of your personal data to display Meta ads at any time, by deactivating the Meta Pixel via the Cookie Settings.

Legal basis for processing:

• We base the use of your personal data on our legitimate interest in offering and securing our Site and App and pursuing the other processing purposes listed above.
• In some circumstances, we base the processing of your personal data on your (explicit) consent, such as when we personalize your experience. Although you have the right to refuse to give consent or withdraw it at any time, please be advised that, as a result, the service may not function properly.

Data retention period: 

• Data will not be kept longer than necessary for the purpose for which it was collected. Therefore, the retention period of the data depends on the purpose pursued. If you would like more information or request details, please contact us by sending your request to Privacy.Batavia@viaoutlets.com
• Please refer to our Cookie Policy for detailed information about the retention period of our cookies and similar technologies.

Data controller of your personal data:

• Centre Propco

(I) VIP Day Pass

Types of personal data we collect:

• If you want to receive your VIP Day Pass electronically, we will need to collect your name and email address in order to send you your online pass. We also ask you to confirm which country you are travelling from, and which travel company informed you of the VIP Day Pass.

Purpose of processing (how and why we use your personal data):

• We process your data (name and email address) in order to send you your electronic VIP Day Pass. In addition, we process information about the country you are travelling from and the travel agency you were informed about the VIP Day Pass by in order to review our guest tourism base and local partner performance.
• We may also send you a survey after your visit to the Centre.

Legal basis for processing:

• The processing of your name and email address is necessary for the performance of a contract in order to provide you with your electronic VIP Day Pass.
• It is in our legitimate interests to analyse information about the country you are travelling from and the travel agency you were informed about the VIP Day Pass
• For research and analysis, including inviting you to take part in a survey carried out by us or by third parties on our behalf: We carry out research and analysis to improve the VIP Day Pass programme. Please also see the section “Analytics, surveys and focus groups (market research) and Advertising” which sets out how we use your data for market research and analytic purposes.

Data retention period:

• Maximum period of four months from the date the electronic VIP Day Pass is sent to you.

Controller of your personal data:

• VIA Outlets B.V.
• Centre Propco

(J) Shopping online 

Types of personal data we collect:

• When you use our webshop and purchase a product from one of our brand stores, we collect your shopping data. Depending on the purchase. We process the data you provide when ordering a product, such as contact details, delivery and billing address, payment method and billing data and order information.

Purpose of processing (how and why we use your personal data):

• The processing of your personal data is necessary to fulfil obligations related to the purchase of a product, including processing of your payment, home delivery, return and refund management. Your personal data will be provided to the brand store you shop at for these same purposes.
• We also process your data for fraud prevention purposes to protect us, our brands and other users from misuse of data. By using the data you provide, we can check with external credit agencies and other services providers whether there has been any fraudulent activity based on your shopping and other behaviours. In addition, we may also carry out credit checks against you which serves to prevent payment defaults and other fraudulent activities.
• In the event of a payment default or where outstanding invoices are not settled, we may transfer your data required to commission a collection service provider for the purpose of collecting the debt.
• We also use your email address to send you a message requesting feedback on our online shop following your purchase.

Legal basis for processing:

• The processing of your personal data is necessary or the performance of the sale contract.
• It is in our legitimate interests to process your email address for the purpose of asking your feedback as referred to in the section above in order to gain a better understanding of people's experience with our service and to be able to improve our services based on such feedback provided to us.

Data retention period: Your information will be deleted after the latest of: (a) 24 months to cover any purchase warranty period, and (b) a period of years for tax purposes (or any other period required under law). The connection between your email address and the any feedback provided by you will be retained for a period of maximum 12 months.

Controller of your personal data:

• Centre Propco

(K) Entering an area of the Centre in which we operate security cameras (excluding in-store CCTV)

Types of personal data we collect:

• We operate security cameras at the Centre in limited areas where we have identified a need and where other solutions are ineffective to achieve the purposes described in the section below. This means that if you visit the Centre you may be captured on security camera.
• There are prominent signs in the areas where the security cameras are operated.

Purpose of processing (how and why we use your personal data):

• Security cameras are used at the Centre for monitoring the security of the Centre, safeguarding the safety of visitors and staff at the Centre and preventing and detecting crime. For the avoidance of doubt, our operation of security cameras excludes in-store CCTV. For more information on in-store CCTV please consult the privacy policy of the relevant store.

Legal basis for processing:

• It is in our legitimate interests to collect and use the personal data referred to in the section above so that we can provide a safer, more secure environment for visitors and staff at the Centre, and to protect our property and that of VIA Outlets.
• Please note that access to the security camera footage is restricted to authorised personnel of VIA Outlets, our insurance companies and our security service provider that need to have access in order to achieve the purposes described in the section above. In addition, access to the footage will be granted to law enforcement agencies in certain circumstances in order to prevent and detect crime.

Data retention period: Data shall be retained within a maximum period of 30 days days except if such data is necessary to process claims or rights exercise, in which case information shall be kept until its expiration.

Controller of your personal data:

• Centre Propco

(L) Footfall counter tracking via CCTV

Types of personal data we collect and how we use your personal data

• We use technology that tracks multiple features via our CCTVs placed at the entrance of our centre and in the centre and stores. This paragraph specifies what personal data about you are processed by us, for which purpose(s) and on which legal grounds we rely for the collection and processing of your personal data.
• Through the CCTVs we automatically analyse our guests in real time in order to get statistical insights into the reactions and behaviour of our shopping audience, by estimating the following features:
• age (estimation)
• gender
• dwell time
• clothing colour

Based on the estimated features above, we capture aggregated, statistical information about:

• the number of visits (entry and exit counts;
• visitor demographics (gender and age)
• visitor pathing for different floors
• occupancy of visitor in specified areas
• same-day unique/repeat guests
• average time spent in zone
• cross-conversion data.
• All data collected is stored and used anonymously for statistical and analytical purposes. No images are recorded or stored, therefore no uniquely identifiable data can be extracted. Images from the camera sensors undergo real-time conversion into statistical data within a short period of time. This also means that your image is translated into a hash value (a unique numerical value) when the video stream is processed, and only the hash value is stored for 24 hours for repeat visitor processing.  This means that the system is able to recognize the guests through the centre for a day. This is necessary to create and obtain a realistic picture of the number of visits to and walking routes in the Centre
• For the first two weeks that the AI system is functional, the video feed will be stored to conduct quality assurance and enhance the accuracy of the system. This is a one-time only procedure. Though facial images will be stored for a period of 3 days, the data processing will only take place for quality assurance and not for the purpose to identify or target you in any way whatsoever.
• The processing of your personal data for this short period of time is necessary for the purposes of the legitimate interests pursued by us, namely to create anonymous statistical and analytical data get insight in our shopping audience and to improve the shopping experience of our guests and once for quality assurance. For example, when we get insight on how our guests move through the centre and the average time spent at a certain location, we may improve the brand mix, position stores and facilities a certain way and provide entertainment at a specific location within the centre. With the anonymous statistical and aggregated data we cannot identify you or recreate any images of you. In addition, the data are not used to target you or any of our guests in any way whatsoever. If you wish to receive more information on the balancing test we performed in this context, please contact us.

Do we share your personal data with third parties?

• The technology described above is provided to us by Deep North. In addition, we use an external hosting provider for the storage and management of the data. The processing by these service providers is governed by a so called data processing agreement in which we have ensured that that the service provider shall only process the personal data on our instructions.
• Deep North’s employees and contractors located outside the European Economic Area (EEA), may need to access raw video footage for quality assurance purposes, in this case the United States and India. To comply with EU data protection laws around international data transfer, we only allow service providers outside the EEA to process your personal data in accordance with a contract entered into between VIA Outlets and the service provider, incorporating the European Commission’s Standard Contractual Clauses, which ensure that adequate data protection arrangements are in place (Article 46.1(c) GDPR). For more information on where and how the relevant document may be accessed or obtained , please contact us.

What are your rights?

• Under the GDPR, you have a number of rights with regard to your personal data and the processing thereof. Since the data processed by us, is stored and used anonymously and no images are recorded or stored, we will not be able to identify you should you invoke your rights under the GDPR. If the purposes for which a data controller processes personal data do not or do no longer require the identification of a data subject, the data controller is not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with the GDPR (Article 11 GDPR). In such cases, Articles 15 to 20 GDPR with regard to your rights do not apply.

Data retention period

• We shall retain personally identifiable information only as long as reasonably necessary to translate them into the anonymous, aggregated, statistical and analytical data. As mentioned above, no images are recorded or stored for longer than that. Therefore no uniquely identifiable data can be extracted afterwards. Images from the camera sensors undergo real-time conversion into statistical data within a short period of time. The video image is discarded within 10 minutes without any storage of your facial images and all hash values are deleted within 24 hours.

Controller 

• Centre Propco

(M) Using the car parking facilities at the Centre

Types of personal data we collect:

• We operate a vehicle number plate recognition system inside the car park at the Centre where we have identified a need and where other solutions are ineffective to achieve the purposes described in the section below. This means that if you use the car parking facilities at the Centre your vehicle number plate will be captured.
• There are prominent signs in the areas where the vehicle number plate recognition system is operated.

Purpose of processing (how and why we use your personal data):

• A vehicle number plate recognition system is used inside the car park at the Centre for preventing and detecting crime.
• In addition, we aggregate information about the country in which your vehicle is registered to conduct statistical analysis of the geographical attraction of the Centre and build up a clearer picture about our customer base as a group. This helps us to work out how we can improve the Centre and better service visitors to the Centre.

Legal basis for processing:

• It is in our legitimate interests to collect and use the personal data referred to in the section above so that we can provide a safer, more secure environment for visitors and staff; and better understand our customer base as a group so that we can improve the Centre.
• Please note that access to the vehicle number plate recognition system is restricted to authorised personnel of VIA Outlets and our security service provider that need to have access in order to achieve the purposes described in the bullet points in the section above. In addition, access to the system will be granted to law enforcement agencies in certain circumstances in order to prevent and detect crime.
• Other authorised personnel of VIA Outlets have access to aggregated information about the origin of the visitor cars but not to the underlying vehicle number plates.

Data retention period: Data shall be retained not longer than necessary ( (in case claims are processed or rights will be exercised the data shall be kept until its expiration).

Controller of your personal data:

• Centre Propco

(N) Health and Safety Management

Types of personal data:

• If you have an incident at our Centre relating to health or safety, we may collect information about you so that we can support you and to follow up with our insurers if a claim is made. We may also collect information from you if you are a witness to an incident. The data you provide may include the following:
  • Contact details: first name and last name, email address and telephone number;
  • Details of any injuries resulting from an incident.

Purpose of processing (how and why we use your personal data): 

• The processing of your personal data is necessary for health and safety reasons and incident management.

Legal basis of processing: 

• The processing of these personal data is necessary for the purposes of the legitimate interests pursued by us and to process and insurance claims arising from an incident at the Centre. In addition, we may process this data on your request. Where we use cookies or other technologies that might store information on your device and that are not absolutely necessary for our service, we process your personal data after obtaining your consent. For more information, please see our Cookie Policy.

Data retention period: 

• Information will be deleted after claim has expired under law.

Controller of your personal data: 

• Centre Propco

(O) Contact us

Types of personal data we collect:

• You may contact us in various ways, including via the contact form on the website, our social media channels, by e-mail, WhatsApp, text and by telephone. If you contact us, we may keep a record of that correspondence and any personal data that you provide, such as your name, telephone number and email address.

Purpose of processing (how and why we use your personal data):

• We use your personal data so that we can respond to your communications.
• We also use your email address to send you a message requesting feedback on our customer service following your interaction with us.

Legal basis for processing:

• It is in our legitimate interests to collect and use the personal data referred to in the section above so that we can serve our customers’ needs, in order to gain a better understanding of people's experience with our service and to be able to improve our services based on feedback provided to us.
• Where the contact is related to a contract we have with you, the legal basis for processing your personal data is based on contract.

Data retention period: Your information will be deleted after a period of 6 months from the date that your query/needs have been met. 

Controller of your personal data:

• Centre Propco

(P) External Complaints

Types of personal data:

• If you wish to report any suspected case of grievance, we may collect information about you (the reporter) so that we can support you with the follow up of your report and conduct the necessary investigation. The data we may collect about you includes the following:
  • Contact details: first name and last name, email address, telephone number and country;
  • Details of any suspected wrongdoing.

Purpose of processing (how and why we use your personal data):

• We use your personal data so that we can respond to your report and perform any necessary investigations according to relevant legislation.

Legal basis of processing:

• The processing of your personal data, and the personal data of any affected individuals is necessary for the purposes of legitimate interests pursued by us and to process any claim arising from a suspected wrongdoing at the Centre.

Data retention period:

• Relevant data shall be kept until the suspected wrongdoing reported is time-barred and in any case only for a period for as long as we are processing the grievance or required under applicable law or for any legal defence of a claim. Personal data clearly not relevant to the processing of a report shall not be collected or, if collected, shall be deleted as soon as possible.

Joint Controller of your personal data:

• Centre Propco
• VIA Outlets B.V.

(Q) Online Gift Card

Types of personal data:

• If you want to purchase your Gift Card electronically on our Site, we will collect the name, telephone number, email address and company name (if applicable) and address of the purchaser of the Gift Card (and the recipient if that is a different person) in order to send the online Gift Card.

Purpose of processing (how and why we use your personal data):

• We process the personal data in order to send you (or the recipient) the Gift Card. Any payment details will be uploaded.

Legal basis of processing:

• The processing of your/the recipient of the Gift Card’s name, phone number, company details (if applicable), address and email address is necessary for the performance of a contract in order to provide you (or the recipient) with the Gift Card.

Data retention period:

• Maximum period of five (5) years from the date the Gift Card is purchased.

Controller of your personal data:

• Centre Propco

1. Who we share your personal data with

For the purposes set out in the section “Personal data we collect about you, how it is used and why, including the legal basis for our processing”, we sometimes provide your personal data to other companies within the VIA Outlets portfolio and certain service providers who perform certain business operations on our behalf. This includes:

• Management company to the Centre Propco that provides management, financial and other operational services;
• Database platform service and hosting provider who assist us with:
  • storing and combining data;
  • processing transaction information of VIP Programme and Fashion Club members;
  • communicating with our VIP Programme and Fashion Club members about the benefits of these loyalty programmes;
  • communicating with customers who have signed up to receive our newsletter; and
  • communicating with entrants of competitions and contests we may run from time to time;
• Customer Service Platform;
• Retailers/brands at the Centre who may assist you with signing up to the Fashion Club in their store at the Centre;
• Service providers who help us with our information technology systems (including security);
• Cloud providers who host the information stored in our customer database;
• Service provider who process your data for reporting purposes (see External Complaints, above);
• Service provider who process your data for the provision of Gift Card services;
• Service providers who help us to operate the security cameras and vehicle number plate recognition system at the Centre; and
• Insurers that deal with claims on our behalf.

In addition, we may share your personal data with other organisations in the following circumstances:

• if we are required by applicable law or a public authority to share information about you;
• if we need to share information about you in order to establish, exercise, defend or protect the rights, property or safety of our business, our customers or others. This includes, in specific cases, exchanging information with other organisations for the purposes of fraud and theft protection; and
• to successors in title or replacement operators of all or part of our respective businesses.

Transfer of your personal data outside the European Economic Area and the UK

In some cases, the personal data we collect from you may also be accessed or processed outside the EEA and the UK, including North Macedonia, USA and Canada. See this link for an overview of EEA countries. Such destinations may not have laws which protect your information to the same extent as in the EEA and the UK. We have obligations to ensure that your personal data is only accessed or processed from territories outside the EEA and the UK where the European Commission has decided that the territory in question ensures an adequate level of protection (known as a ‘white listed’ territory) or, in the absence of such decision, there are appropriate safeguards in place to protect your personal data. See this link for an overview of applicable adequacy decisions. For example, if your personal data is accessed or processed from a territory outside the EEA or the UK which is not white listed, the appropriate safeguards may be provided by standard data protection clauses adopted by the European Commission and Information Commissioner (FDPIC) (known as ‘model clauses’). 

Please ask us if you would like more information about the safeguards that are used to protect your personal data when it is processed outside the EEA and the UK (see the section “How you can contact us”).

1. How we use cookies

We use cookies to enable our systems to recognise your device so that we can personalise and improve your customer experience whilst using our Site and provide you with relevant online advertising. Please see the section “Personal data we collect about you, how it is used and why, including the legal basis for our processing” and our Cookie Policy available at https://bataviastad.nl/en/cookie-policy to find out more.

1. How long we keep your personal data for

We retain your personal data for no longer than is necessary for the purposes for which the information is collected (see the section “Personal data we collect about you, how it is used and why, including the legal basis for our processing” for details of the relevant purposes). When determining the relevant retention periods, we will take into account factors including:

• legal obligation(s) under applicable law to retain data for a certain period of time, for example, accounting obligations;
• statute of limitations under applicable law;
• (potential) disputes; and
• guidelines issued by relevant national data protection regulators.

Otherwise, we securely erase your information once this is no longer needed for the purposes for which the information is collected.

1. Our policy on children’s personal data

We do not knowingly collect the personal data of children under 16 years of age, without the prior consent or authorisation of the holder of parental responsibility over the child.

1. Your rights

By law, you have the following rights with regard to your personal data.

You may send your request to Privacy.Batavia@viaoutlets.com. We will respond to your request as soon as reasonably possible and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. We will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay. 

If we do not take action on your request, we shall inform you without delay and at the latest within one month of receipt of the request of the reasons for not taking action. In that case, you also have the right to lodge a complaint with the supervisory authority and to seek a judicial remedy.

1. Links to other websites

The Site may contain links to other websites operated by unrelated companies and persons (“Third Party Website”). These links are provided for your information only. The inclusion on the Site of any link to a Third Party Website does not mean that we accept any responsibility for that Third Party Website, its content or use, or the use of any features, products and/or services made available through that Third Party Website. We have no control over Third Party Websites or any information or materials contained on them and have not investigated, monitored or checked any Third Party Websites for accuracy, completeness or conformance with applicable laws and regulations. We are not responsible for any damages or injuries caused as a result of your use of, or reliance on, Third Party Websites or any information or materials contained on them. You access and use Third Party Websites at your own risk.

1. Changes to the Privacy Policy

We reserve the right to make changes to this Privacy Policy at any time, so please check our Site regularly to keep informed of changes. If you are a member of the Fashion Club or have signed up to receive our newsletter, we will also notify you of the changes by email. 

1. How you can contact us

If you have any questions about this Privacy Policy or you wish to exercise any of your rights in relation to your personal data, please contact us at Privacy.Batavia@viaoutlets.com.

If you have any questions or wishes in connection with your personal data, you may also contact our data protection officer: DPO@viaoutlets.com