1.  INTRODUCTION

This Privacy Notice for Promenaden – Oslo Fashion District ("Privacy Notice") has been prepared by Promenaden Management AS ("Promenaden") to ensure that you receive the information we are required to provide to you and which is necessary for you to exercise your rights under the General Data Protection Regulation (Regulation (EU) 2016/679) and Norwegian data protection legislation (together "Data Protection Legislation").

This Privacy Notice describes how Promenaden processes personal data about you, the purpose of our processing activities, and the legal basis for our processing activities. This Privacy Notice also describes your rights in connection with our processing of your personal data under applicable Data Protection Legislation.

2.  GENERALLY ABOUT PERSONAL DATA

Personal data means any information relating to an identified or identifiable natural person (a "data subject"). Your name, phone number, address and e-mail address are examples of information which generally is regarded as personal data.

3.  PROMENADEN'S RESPONSIBILITY AS A CONTROLLER

Promenaden is responsible for our processing of your personal data, including on Promenaden's website promenaden.no. As a "controller", Promenaden is furthermore responsible for complying with the Data Protection Legislation when we process your personal data.

However, please note that Promenaden – Oslo Fashion District consists of several stores, which process personal data independently of us, and which therefore will process personal data as a sole controller. We recommend that you contact these stores directly, if you have any questions regarding their processing of your personal data.

4.  OUR PROCESSING OF PERSONAL DATA

The following list includes information about the personal data which we process, and the purposes which the personal data is processed for:

• Newsletter. If you sign up to our newsletter, we will collect and process your name, e-mail address, and information on whether you have received and opened information provided by us. The foregoing personal data is processed for marketing purposes, i.e. for the purpose of providing newsletters with information on new products, brands and stores, and for the purpose of inviting you to exclusive events by way of email. We will optimize the information we send to you by using the foregoing personal data to analyze aspects concerning your preferences, habits and interests. You can terminate your newsletter subscription at any time by following the "unsubscribe"-information included in every e-mail which we send to you or by contacting us at the contact details below.
  
  
• Promenaden – Oslo Fashion District on Facebook and Instagram. Promenaden has its own Facebook and Instagram pages which you may visit. Your use of Facebook and Instagram will in principle be governed by the terms & conditions and privacy notices of these platforms.

We may, depending on the circumstances, also process other categories of personal data, and/or the above listed personal data for other purposes. This may for example be the case if you contact us with questions or comments. You may at any time request confirmation and/or information regarding the personal data which we process about you, by contacting us at the contact information set out below.

5.  WHAT IS OUR LEGAL BASIS FOR PROCESSING PERSONAL DATA?

We will rely on the following legal basis for our processing of the above described personal data:

• Newsletters. We will only process your personal data in relation to our provision of newsletters (as further described in Section 4 of this Privacy Notice), if you have consented to the processing of your personal data.

6.  DO WE TRANSFER OR DISCLOSE DATA TO THIRD PARTIES?

We use external service providers to assist with IT services and other administrative services. These service providers will act as data processors on behalf of Promenaden. We have entered into data processing agreements with our data processors which inter alia obligates the data processor to implement technical and organizational measures to ensure an appropriate level of security, confidentiality and integrity, as well as to only process the relevant personal data in accordance to Data Protection Legislation.

We will not disclose your personal data to any other third parties than the third parties described above, unless required to do so under applicable law or as required under a court order.

7.  DATA RETENTION

We will delete or anonymize personal data when they are no longer necessary in relation to the purposes for which they were collected or otherwise processed, or as otherwise required under the Data Protection Legislation. We will furthermore delete or anonymize personal data in accordance with the following criteria:

• Newsletters. We will delete or anonymize personal data collected and processed in connection with your newsletter subscription if you withdraw your consent, and where there is no other legal ground for the processing.

8.  YOUR DATA PROTECTION RIGHTS

Under Data Protection legislation, you have certain rights we need to make you aware of. The rights available to you inter alia depend on our reason for processing your personal data. You have the following rights in connection with our processing of your personal data:

• Access: You may contact us if you want to obtain confirmation with respect to whether or not we are processing your personal data, as well as access to and further information regarding our processing of your personal data.
  
  
• Rectification: You may request us to rectify and/or complete inaccurate or incomplete personal data.
  
  
• Erasure: You may request that we erase your personal data. We will respect and comply with your request unless we inter alia are prohibited from deleting your personal data under mandatory retention requirements, or the personal data is necessary for the establishment, exercise or defense of legal claims.
  
  
• Restriction of processing: You may also request the restriction of our processing of your personal data in accordance with Data Protection Legislation. If the processing has been restricted, such personal data will, with the exception of storage, only be processed with your consent or for the exercise or defense of legal claims or for the protection of the rights of another person or for reasons of important public interest.
  
  
• Right to object: You are entitled to object to certain processing activities, including for example processing of your personal data for marketing purposes. You are furthermore, on grounds relating to your particular situation (for example, a specific need for protection of your identity), entitled to object to processing of personal data based on legitimate interests, which we will comply with, unless there exist compelling legitimate grounds for our processing which override your interest, or if our processing is necessary for the establishment, exercise or defense of legal claims.
  
  
• Data Portability: If we process your personal data based on consent or based on our performance of a contract, and the processing is carried out by automated means, you may request us to transfer the personal data to you or another controller, in a structured, commonly used and machine-readable format.

Please contact us at the below listed contact information if you wish to make a request. Please also note that we may request the provision of additional information, if such information is necessary to confirm your identity.

9.  SECURITY

As a controller, Promenaden is responsible for the security and confidentiality of the personal data we process. We are furthermore responsible for implementing appropriate technical and organizational measures to ensure an appropriate level of security for processing.

We are for security reasons not entitled to disclose detailed information on the security measures which we have implemented. However, all of our employees are bound by a duty of confidentiality with respect to the personal data which we process. We have furthermore implemented measures, policies and routines to ensure the security of our processing.

10.  THE NORWEGIAN DATA PROTECTION AUTHORITY AND OTHER SUPERVISORY AUTHORITIES

The Norwegian Data Protection Authority has inter alia been established to supervise Norwegian companies' processing of personal data. You may contact us at any time if you have any information or complaints regarding our processing of your personal data. You may also file a complaint to the Norwegian Data Protection Authority, or a data protection authority in the EU/EEA Member State of your habitual residence, place of work, or the place of the alleged data protection infringement.

You can obtain the contact details of the Norwegian Data Protection Authority on the following website: www.datatilsynet.no. You may also find more information on your rights and the Data Protection Legislation on this website.

11.  CHANGES

We may, from time to time, revise this Privacy Notice for example due to changes in our processing activities, applicable Data Protection Legislation or other legislation which may affect our processing of personal data. An updated version of this Privacy Notice will be published on our website if any revisions to the Privacy Notice is made. We will furthermore notify you by e-mail if we make any material changes to this Privacy Notice.

12.  CONTACT INFORMATION

If you have any questions about this Privacy Notice, including how we process personal data, or would like to submit a request to exercise your rights, please contact us at:

Promenaden Management AS
Nedre Slottsgate 8, NO-0157 Oslo Norge
vb@promenadenmanagement.no