Pursuant to the European Union General Data Protection Regulation (GDPR 2016/679), we hereby inform you about how your personal data is processed.

Who is the Data Controller

The Data Controller of personal data is the company Sicily Outlet Village S.R.L., subject to the management and coordination of Outlet JV Sarl, with registered office at Corso Matteotti no. 10 – Milan (MI), Tax Code and VAT no. 06227960967, in the person of its legal representative Mr Olivier de Nervaux de Mézières de Loy.

Who is the Data Protection Officer

The Data Controller has appointed a Data Protection Officer (DPO). You may contact the Data Protection Officer for matters relating to the processing of your data at the following address: dpo@siciliaoutletvillage.com

How we collect your Personal Data

We collect your Personal Data through the Video Surveillance system active within the perimeter of the Outlet Village and connected to the control room, capable of processing the Personal Data relating to the data subject’s images.

What data we collect and why we need it (category of personal data, purpose, legal basis of the processing, nature of the provision of data and retention period)

Video Surveillance

Category of data: images;

Purpose of the processing and nature of the data: the images are processed for the purposes of security and the protection of the Data Controller’s property. Should you not wish to be subject to processing, you may refrain from entering the perimeter marked by the warning signs;

Legal basis: The legal basis for the processing of such data is the Data Controller’s legitimate interest in the protection of property and security;

Retention period: The video surveillance system operates 24 hours a day, 7 days a week. The retention period of the recordings is 48 hours following the recording;

In addition, we may use the images for the following further purposes:

• To comply with obligations laid down by applicable national and supranational legislation (legal basis: necessity to fulfil legal obligations. Duration of the processing: the duration laid down by the legal obligation);
• Defence of the Data Controller’s rights in the course of judicial, administrative or out-of-court proceedings, and in disputes arising in relation to the security or the defence of the Data Controller’s assets (legal basis: legitimate interest in protecting its own rights. Duration of the processing: until the expiry of the limitation period for the right);

How we process the data (processing methods)

During the period in which your data are processed, we adopt appropriate security measures to prevent unauthorised access, disclosure, modification, or destruction of the data, and we will impose analogous security measures on third-party suppliers.

The processing is carried out using IT and/or electronic tools, with organisational and logical methods strictly related to the indicated purposes.

The data will not be subject to automated decision-making processes, including profiling.

The Data Controller does not link, cross-reference or compare the images collected with other personal data or with any identification codes.

To whom we disclose your data (transfer to third parties)

The disclosure of your personal data takes place to third parties and/or recipients whose activity is necessary for the performance of the services offered and, where applicable, to comply with specific legal obligations. The third parties and/or recipients will process your personal data as Data Processors, acting under the authority of the Data Controller, solely for the purposes provided for in this privacy policy.

• Security and surveillance companies in charge of the Outlet’s security;
• Companies providing technological services and technical support;
• Companies of the Group of which the Data Controller is part;
• Consultants and/or professionals (e.g. lawyers, notaries, auditors, consultants);

You may request the complete list of the parties acting as external Data Processors through the contact methods described in the “how you can contact us” section.

Personal data will be processed by the Data Controller’s staff expressly authorised to process the data and provided with appropriate operating instructions.

To which countries we transfer your data (transfer of personal data to a third country)

Your personal data are not subject to transfer to non-EU countries;

What are your rights? (Rights of the data subject)

As a data subject of the processing, you may exercise the following rights:

• Right of access: you have the right to obtain confirmation as to whether or not processing of your Data is taking place and, in addition, to receive all information relating to such processing. In order to identify the image of the possible recording, it is necessary to state in the relevant access request: the place, the date and the time slot, the clothing worn, any accessories used, the possible presence of companions, any activity carried out and further elements useful for your identification. The Data Controller will verify the actual existence of the images and will notify you accordingly.
• Right to rectification: you have the right to obtain the rectification of your data, but as these are recordings of real facts, it will not be possible to act upon requests for the rectification of images;
• Right to erasure: in certain circumstances, following the verification of images concerning you (right of access), where the data are not necessary to fulfil legal obligations or their retention is not necessary in relation to the purposes for which the data were collected or subsequently processed, it will be possible to delete the images, including by anonymising them;
• Right to restriction of processing: following the verification of images concerning you (right of access), upon the occurrence of specific conditions, you have the right to obtain the restriction of the processing relating to your data;
• Right to data portability: following the verification of images concerning you (right of access), you have the right to obtain, in a structured, commonly used and machine-readable format, your personal data, and you have the right to transmit them to another data controller without hindrance;
• Right to object: following the verification of images concerning you (right of access), you have the right to object to the processing of your Data;
• Right to lodge a complaint: you have the right to lodge a complaint with the supervisory Authority in the event that your data have been processed in breach of the GDPR;
• Right to withdraw consent: you have the right to withdraw your consent at any time for processing based on this legal basis. The withdrawal shall not affect the processing carried out prior to the withdrawal.

How you can exercise your rights

To exercise the aforementioned rights, you may use the contact methods described in the following section “how you can contact us”.

How you can contact us (contact details of the Data Controller and of the Data Protection Officer)

You may contact us by e-mail at the address: privacy@siciliaoutletvillage.com. Alternatively, you may contact us by registered letter, at the following address:

• Sicilia Outlet Village
• Autostrada A19 Palermo–Catania Uscita Dittaino
• 94011 Agira (EN)

The Data Controller undertakes to respond to your requests within 1 month, except in cases of particular complexity, in which case it may take up to 3 months. In any case, the Data Controller will explain the reason for the delay within one month of your request.

How we make changes to the Privacy Policy

We reserve the right to amend or simply update, in whole or in part, this Privacy Policy, including in the event of changes to the applicable legislation. We invite you to visit this section regularly in order to become aware of the most recent and updated version of the Privacy Policy.