Privacy Policy Statement

Date of last revision of this Privacy Policy Statement: 6.1.2025

This Privacy Policy Statement explains how the Data Controller (defined below) collects and processes your personal data in the context of providing our newsletter and our Loyalty Program (including access to your Loyalty Account via the Website and App), collectively referred to as the "Services."

Please note that specific privacy policies may additionally apply to you depending on the services provided at the Shopping Center you visit and the related processing of your personal data. Such practices will be duly communicated to you if relevant (for example, regarding the management of CCTV systems, WiFi, or customer feedback).

This Privacy Policy Statement includes the following information:

1/ Contact Details of the Data Controller

2/ How We Collect Your Personal Data

3/ Details on the Processing of Your Personal Data

4/ How We Share Your Personal Data

5/ How We Ensure the Security of Your Personal Data

6/ Your Rights in Relation to Your Personal Data

7/ Data Transfer in the Event of a Change of Ownership

8/ Managing Cookies and Tracking Technologies

9/ Updates to this Privacy Policy Statement

Definitions

• App: the mobile application of the Shopping Center
• Loyalty Account: a personal account that must be created in accordance with the Terms [BS1] in order to use the benefits of the Loyalty Program
• Loyalty Card: a virtual card (available within your Loyalty Account in the App and/or on the Website) that displays your loyalty identification number and is required to obtain benefits from our offers or services
• Loyalty Program: our loyalty program available at the Shopping Center
• Shopping Center: AUPARK SHOPPING CENTER, Einsteinova 18, 851 01 Bratislava
• Website: the website available at www.aupark-bratislava.sk

1/ Contact Details of the Data Controller

1.1 – General Principles

The controller of your personal data, hereinafter referred to as the "Controller" or "we":

Aupark a. s., with its registered office at Einsteinova 18, 851 01 Bratislava, Slovak Republic, Company ID: 47 240 377, a company registered in the Commercial Register of the Bratislava III District Court, Section: Sro, File number: 5586/B

1.2 – Roles of the Data Controller

The Controller has entered into several data processing and service provision agreements to offer you the technical ability to register for the Loyalty Program or to download and use the Website and App.

In addition, the Controller negotiates special offers with third parties, which will be made available to members of the Loyalty Program.

The Controller will process your personal data depending on the circumstances and based on your choices:

A. If you register for the Loyalty Program, in order to send you communications and inform you about specific offers and promotions of the Shopping Center and to provide you with the requested offers and Service (subject to their availability and other specific conditions that may apply):

• manage your registration in the Loyalty Program;
• analyze your use of the Services within the Shopping Center as further described in section 3 below, in order to provide you with suitable offers and promotions that may be of interest to you;
• send you communications regarding the Loyalty Program.

B. If you subscribe to the newsletter, in order to be able to send you such a newsletter.

2/ How We Collect Your Personal Data

We collect personal data about you through the following means:

• directly from you; and/or
• from your use of the Services:

        a) When you use the Loyalty Card, if it is scanned during your visit, we obtain information related to the type of Service for which your Loyalty Card was used (for example: promotions, events, birthday gift), as well as your presence in our Shopping Center.

        b) When you use our App as a verified user, based on your consent, we collect information about your geographic location in order to provide you with relevant Services. Further details can be found in Article 3.

        c) When you use the Website and accept the use of non-essential cookies, we collect those cookies you have accepted. All cookie details can be found [[BS2]] and in Article 8 of this statement.

For more details on how we collect your personal data, see the table below.

3/ Details on the Processing of Your Personal Data

3.1 – The following table provides all relevant information regarding:

• Why we process your personal data (Purpose)
• Which personal data is involved (Affected Personal Data)
• On what legal basis we process your personal data (Legal Basis)
• How long we retain your personal data (Retention Period)

NEWSLETTER

Purpose

Affected Personal Data

Legal Basis

Retention Period

Providing our personalized newsletter

Directly from you:

Mandatory: email address, first name

Optional: title, surname, phone number, interests (e.g., sports, shopping, etc.)

Indirectly:

The fact that you opened or did not open our newsletter

Provided by third parties:

NOT APPLICABLE

Consent

Retention Period:

3 years from the last digital contact or use of services

LOYALTY PROGRAM

Purpose

Affected Personal Data

Legal Basis

Retention Period

Providing our personalized newsletter

Managing your registration in the Loyalty Program

Directly from you:

• Mandatory: first name, surname, email address
• Optional: title, phone number, date of birth, postal code, information regarding the fact that you work in or near the Shopping Center, and interests

Provided by third parties:

• NOT APPLICABLE

Retention Period:

3 years from the last digital contact or use of services

Managing offers and benefits of the Loyalty Program

Free access to services (in accordance with the terms and conditions, e.g., cloakroom, etc.)

Directly from you:

• Loyalty card number, barcode, first name, surname, and date of birth

Provided by third parties:

• NOT APPLICABLE

Legal Basis:

Performance of a contract (i.e., the terms of the Loyalty Program)

No storage of offers and benefits.

If the Loyalty Card is scanned (never for the use of toilets), we may retain the date of your visit and the type of services/offers used for 3 years from the last digital contact or use of services.

Managing participation in events organized by the Shopping Center

Please note that we may send you notifications to enable your participation in an event (e.g., if an event requires you to have a registration document for entry).

Directly from you:

Email address, first name, surname, phone number, and city.

Provided by third parties:

• NOT APPLICABLE

Legal Basis:

Legitimate interest of the data controller to manage events for members of the Loyalty Program and ensure event security.

6 months after the event.

Providing our services to facilitate your access to the Shopping Center parking lot.

Directly from you:

License plate number, personal data provided when creating the loyalty account.

Provided through the service:

• NOT APPLICABLE

Provided by third parties:

• NOT APPLICABLE

Legal Basis:

Performance of a contract (i.e., the terms of the Loyalty Program).

3 years from the last digital contact or use of services.

Participation in contests and challenges organized for members of the Loyalty Program

Directly from you:

Loyalty card number, first name, surname, date of birth, personal data that may be included in the contest itself (answers to questions)

Provided by third parties:

• NOT APPLICABLE

Legal Basis:

Performance of a contract (i.e., the rules of the respective contest)

Retention Period:

1 month after the delivery of prizes to the winner(s)

Management of non-commercial communication related to the Loyalty Program

Directly from you:

Loyalty card number, title, first name, surname, and email address

Phone number (optional)

Provided by third parties:

• NOT APPLICABLE

Legal Basis:

Performance of a contract (i.e., the terms of the Loyalty Program)

Retention Period:

3 years from the last digital contact or use of services

Management of commercial communication

By email and/or SMS, if you have provided us with your mobile phone number.

Directly from you:

Email address

Phone number (optional)

Provided by third parties:

• NOT APPLICABLE

Legal Basis:

Consent

Retention Period:

3 years from the last digital contact or use of services, or until consent is withdrawn, whichever occurs first.

Analysis of your information/usage of services

• To provide you with personalized offers and
• To improve our understanding of your expectations and needs and to develop new features and services.

Please note that, in this regard, we will combine the personal data listed in the respective column.

Directly from you: All information you may provide.

Acquired from your activity:

• Based on your consent, behavior on the Website (cookies)
• Participation in events organized by the Shopping Center
• Your use of Wi-Fi: date of visit to the Shopping Center
• Your use of the loyalty points collection
• When your loyalty card is scanned during service usage or participation in an event at the Shopping Center.

Legal Basis:

Legitimate interest of the data controllers to better understand the customer in order to provide appropriate services and/or offers.

Retention Period:

3 years from the last digital contact or use of services

Geolocation (only within the Shopping Center - when using the app as a verified user)

Details can be found in Section 3.2

Directly from you:

• NOT APPLICABLE

Provided during the use of the service:

• Location data within the Shopping Center

Provided by third parties:

• NOT APPLICABLE

Legal Basis:

• Consent (granted through the app)

Retention:

• We will not store your geographic location.

Obtaining feedback from you about our services

Directly from you:

• Responses to a questionnaire regarding the evaluation of the services we provide.

Legal Basis:

• Legitimate interest of the data controllers to better understand the customer, improve services, and provide appropriate services and/or offers.

Retention Period:

• 3 years from the last digital contact or use of services.

SOCIAL WALL

Specific Purpose

Personal Data Involved

• Directly from you:
• Photos, videos
• Provided by third parties:
• NOT APPLICABLE

Legal Basis

• Consent

Retention Period

• 1 year from the consent date.

WEB PUSH

Specific Purpose

Personal Data Involved

• Directly from you:
• Name, surname, email address, date of birth
• Provided by third parties:
• IP adress

Legal Basis

• Consent

Retention Period

• 12 months or until consent is withdrawn, whichever occurs first.

APPLIES TO ALL PROCESSING ACTIVITIES.

Specific Purpose

Personal Data Involved

• Directly from you:
• Name, surname, email address, loyalty card number, or possibly a copy of an ID card

Legal Basis

• Legal obligation
• Establishment, exercise, or defense of legal claims

Retention Period

• Calendar year of receipt plus 5 years
• If your ID card is requested, it will be deleted immediately after your identity is verified.
• Statutory period depending on the type of claim/dispute

If you wish to obtain further details about our legitimate interests, please contact us by sending a request via the contact details provided in section 7.6.

3.2 Geolocation in the Shopping Center

General Principle

With your consent granted in the App, we may collect and process information related to your location in our Shopping Center while you are verified in our App, for the purpose of providing location-related services.

Geolocation will only occur if you have activated additional services/specific functions in the settings of the downloaded App on your mobile device. These additional services can be deactivated at any time in the settings.

Please note that once consent is granted, your consent will be immediately effective for all subsequent connections in our App and for all further visits to our shopping center for up to 12 months from the first connection, unless you revoke your consent.

If you wish to participate in certain challenges, you may be asked to enable geolocation on your mobile device. In such cases, this request will be tied to the specific nature of the challenge you are participating in (for example, counting steps in our centers). In any case, enabling geolocation will not be automatic and will require your explicit consent.

How to Manage Location Settings on Your Mobile Device

To be located in the Shopping Center, you must enable the Bluetooth feature on your mobile device.

If you only want to check the map, activating the Bluetooth feature is not required.

Please note that we cannot locate you outside of our Shopping Center. Location tracking is only done using Bluetooth beacons installed in the common areas of the Shopping Center.

You can turn off the geolocation of your mobile device at any time through the settings of your mobile device.

4/ How do we share your personal data?

We may share your personal data with:

• Our processors acting on our behalf and following our instructions, as stated here;
• Any relevant authority or legal entity to respond to legal or regulatory requirements, court orders, subpoenas, or legal proceedings if necessary to comply with applicable laws;
• Any acquirer, if personal data is transferred as part of the sale or other transfer of all or part of our assets to another company;
• Our insurers, lawyers, other advisors, and courts in the collection of claims and/or the defense of our position;
• Partners who provide Services on our website and/or in our App that you have subscribed to. These services are governed by the terms of use of the respective partners, and your personal data is processed according to their privacy policies.

5/ How do we keep your personal data secure?

We take the security of all personal data we process very seriously and are committed to protecting your personal data. Therefore, we have implemented appropriate technical and organizational security measures, and we have chosen our service providers accordingly.

With each of our service providers who qualify as processors, we have entered into specific data processing agreements and have reviewed their general technical and organizational measures. Service providers are authorized to process your personal data as data processors only in accordance with the provisions of this privacy notice, solely on our behalf and according to our instructions. We cannot control all the risks associated with using the internet, and data security also depends on the vigilance of each of us and the proper use of these technologies. Therefore, we encourage you to remain highly cautious when using online services in relation to potential internal risks.

7/ Your rights regarding your personal data

7.1 Under applicable laws, you have various rights related to the processing of your personal data, depending on the relevant situation:

• Right of access to your personal data: You have the right to request confirmation that we are processing your personal data and, if so, to receive a copy of this data;
• Right to rectification of your personal data: If the personal data we process is inaccurate, you have the right to request correction of your personal data;
• Right to erasure of your personal data: You have the right to request the deletion of some or all of your personal data;
• Right to object to the processing of your personal data: You have the right to object to the processing of your personal data. This means that you can ask us to stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims. If we process your personal data for direct marketing purposes and you object to such use, we will stop processing your data for that purpose;
• Right to restriction of processing of your personal data: You have the right to request restriction of the processing of your personal data, especially if you dispute the accuracy, lawfulness, or necessity of processing your data. In such cases, and where applicable, we will then only process the personal data for the establishment, exercise, or defense of legal claims, to protect another natural or legal person, or for another limited reason required by applicable law;
• Right to data portability: You have the right to obtain a copy of your personal data that you have provided to us in an interoperable format, or, where appropriate and technically feasible, you may also request that such data be transferred directly to another data controller.

7.2 Withdrawal of consent(s)

If the legal basis for processing is your consent, as detailed in the table shown in Article 3.1 above (under the "Legal basis" column), you may withdraw the given consent(s) at any time without having to provide any reason.

If you do so, we will stop any further processing based on that consent.

Please note that withdrawing your consent does not affect the legality of any processing based on consent before its withdrawal.

7.3 Unsubscribing from marketing communications

If you do not wish to receive marketing communications, you can request to stop receiving them by:

> sending an email using the contact details provided in Section 7.6 below; or

> directly changing the settings in your loyalty account, if available; or

> clicking the unsubscribe link available in all our communications.

7.4 Shopping Centre Management

Communications sent by the Shopping Centre will be governed by your communication preferences (whether you wish to receive only Loyalty Programme information, commercial announcements, or no communication at all).

7.5 Deleting your loyalty account

If you want to delete your loyalty account, you can:

> delete it directly in the settings of your loyalty account, or

> send an email using the contact details provided in Section 7.6 below.

7.6 Exercising your rights

If you wish to exercise your rights or obtain all relevant information, please contact the Controller by mail using the contact details provided in Section 1, or contact the Controller at aupark@urw.com or by phone at +421 (02) 682 661 11.

In your request, please try to clearly state: (i) which personal data it concerns, and (ii) which of your rights you wish to exercise.

Some of your rights can also be exercised directly through your loyalty account.

To prevent the violation of third-party rights, we reserve the right, in case of reasonable doubt, to verify your identity beforehand and may ask you for:

• identification questions such as your loyalty card number or date of birth;
• an identity document if reasonable doubts persist after the first step outlined above.

We will respond to your request within 1 month of receiving it. This period may be extended by an additional two months if necessary, taking into account the complexity and number of your requests. In any case, we will inform you within one month of receiving your request if we decide to extend the response time, along with the reasons for such an extension.

7.7 Complaints

If you believe that the way we process your personal data violates applicable data protection laws, you have the right to lodge a complaint with the relevant data protection authority in the country of your usual residence, workplace, or the place of the alleged violation.

8/ Transfer in case of a change of ownership

If the Controller is involved in a merger, acquisition, liquidation, or sale of the entire Shopping Center or any part of it, or its operating or management company or owner, when you are registered as a member of the loyalty program or have subscribed to newsletters, we reserve the right to transfer your personal data. If such a change requires notification or consent according to applicable laws, you will be informed or given the opportunity to provide your consent.

9/ MANAGEMENT OF COOKIE FILES AND TRACKING TECHNOLOGIES

When you visit our Website or App, we or our partners may use cookies and similar technologies to collect information about your use of the service.

What are cookies and tracking technologies?

Depending on how you access the service, different tracking technologies are used.

On the Website, we use cookies and similar technologies (such as Pixel, web beacons, etc.). Cookies are small text files that are stored in your browser when you visit the Website. Cookies are widely used to ensure the proper functioning of websites, to recognize your device, and to remember information about your visit (e.g., preferred language, font size, other preferences, and activity information). Pixels (also known as web beacons) are code embedded in the service that sends information about the browser or device to the server. Pixels provide similar functionality to cookies but are not always browser-based. When you access a service containing a pixel, the pixel may allow us or a third party to insert or read cookies in your browser or collect other information about your browser or device.

In the App, we rely on technologies that are not browser-based, such as software development kits (SDKs). SDKs are pieces of code released by third parties that provide specific features. App technologies are used for similar purposes as cookies and pixels and may allow us or a third party to collect information from your browser or device.

(These tracking technologies are collectively referred to as "cookies and technologies" or "cookies").

Our use of cookies?

We may place different types of cookies for the following purposes:

• Strictly necessary

These cookies and technologies are essential for the functioning of the Website and cannot be turned off in our systems. They are usually set in response to your actions, such as setting your privacy preferences, logging in, or filling out forms. You can set your browser to block these cookies and technologies or alert you about them, but some parts of the Website may not work as a result.

• Performance

These cookies and technologies allow us to count visits and traffic sources so we can measure and improve the performance of the Website. They help us determine which pages are the most and least popular and understand how visitors move around the Website.

• Functional

These cookies and technologies enable the Website to provide enhanced features and personalization. We may set them ourselves or allow third-party service providers whose services we have added to our site. If you do not allow these cookies, some or all of these services may not work properly.

• Targeting cookies

These cookies and technologies may be set through the Website by our advertising partners. These companies may use them to create a profile of your interests and show you relevant ads on other sites. If you do not allow these cookies and technologies, you will see less targeted advertising.

• "Social media" cookies

These cookies and technologies are set by various social media services we have added to the Website. They are able to track your browser across other sites and create a profile of your interests. This may affect the content and messages you see on other websites you visit. If you do not allow these cookies, you may not be able to use or see these services.

Your choices regarding cookies and technologies

By using the Website, you consent to the use of the cookies listed above. Your choices will be retained for a maximum of 6 (six) months. You have several ways to manage your choices regarding cookies.

Our cookie and technology management tool

The cookie and technology management module available on the Website allows you to control the use of cookies by us and our partners. You can decide at any time whether to accept, reject, or set all of them according to your preferences by clicking the appropriate button in the cookie management module, except for cookies that are strictly necessary for the use of the Website, which you cannot deactivate.

Options provided by your browser software

In addition, most browsers allow you to manage cookie preferences on websites by changing your browser settings.

You can set your browser to:

• Automatically reject or accept all cookies.
• Reject or accept first-party cookies and/or third-party cookies.
• Receive a notification before any cookies are saved, so you can decide whether to accept them.

The "Help" function in your browser should provide you with information on how to do this.

Alternatively, you can follow the links below, which contain instructions on managing cookie settings in commonly used browsers:

· Chrome (https://support.google.com/chrome/answer/95647?hl=en)

· Internet Explorer (http://windows.microsoft.com/en-US/windows-vista/Block-or-allow-cookies)

· Mozilla Firefox (https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox)

· Safari (https://support.apple.com/fr-fr/guide/safari/sfri11471/mac)

Additionally, if you do not want Google Analytics to be used in your browser, you can:

· Install the Google Analytics browser add-on, available for download at https://tools.google.com/dlpage/gaoptout

· Use advertising settings

· Use mobile advertising settings

· Opt out through the consumer opt-out system of the Network Advertising Initiative, available at this link: http://optout.networkadvertising.org/#!/

Furthermore, you can use another online service that allows you to manage advertising cookies placed on your computer or mobile phone: http://www.youronlinechoices.com/

10/ Update to this Privacy Notice

We may occasionally revise or update this privacy notice. Any changes to this privacy notice will become effective once published online.

If such changes require your notice or consent under applicable laws regarding any processing mentioned in the updated version of the privacy notice, you will be informed or given the opportunity to consent to whether we may use your personal data in a different way.

[BS1] Terms and Conditions

[BS2] Information about Cookies