Q: HOW WE USE COOKIES

<div class="root-rte css-0"><style data-emotion="css 1ui6af">.css-1ui6af{margin-bottom:space-16;}</style><p class="chakra-text css-1ui6af" dir="inherit">We use cookies to enable our systems to recognise your device so that we can personalise and improve your customer experience whilst using our Site and provide you with relevant online advertising. Please see the section “<style data-emotion="css in3yi3">.css-in3yi3{font-weight:bold;}</style><b class="chakra-text css-in3yi3">Personal data we collect about you, how it is used and why, including the legal basis for our processing”</b> and our Cookie Policy available at (<style data-emotion="css h82jag">.css-h82jag{margin-bottom:3px;}</style><a class="chakra-link css-h82jag" url="https://oslofashionoutlet.no/cookie-policy" href="https://oslofashionoutlet.no/cookie-policy">https://oslofashionoutlet.no/cookie-policy</a>) to find out more.</p></div>

Q: HOW LONG WE KEEP YOUR PERSONAL DATA FOR

<div class="root-rte css-0"><style data-emotion="css 1ui6af">.css-1ui6af{margin-bottom:space-16;}</style><p class="chakra-text css-1ui6af" dir="inherit">We retain your personal data for no longer than is necessary for the purposes for which the information is collected (see the section “<style data-emotion="css in3yi3">.css-in3yi3{font-weight:bold;}</style><b class="chakra-text css-in3yi3">Personal data we collect about you, how it is used and why, including the legal basis for our processing”</b> for details of the relevant purposes). When determining the relevant retention periods, we will take into account factors including: • legal obligation(s) under applicable law to retain data for a certain period of time, for example, accounting obligations; • statute of limitations under applicable law; • (potential) disputes; and • guidelines issued by relevant national data protection regulators. Otherwise, we securely erase your information once this is no longer needed for the purposes for which the information is collected.</p></div>

Q: OUR POLICY ON CHILDREN’S PERSONAL DATA

<div class="root-rte css-0"><style data-emotion="css 1ui6af">.css-1ui6af{margin-bottom:space-16;}</style><p class="chakra-text css-1ui6af" dir="inherit">We do not knowingly collect the personal data of children under 16 years of age, without the prior consent or authorisation of the holder of parental responsibility over the child.</p></div>

Q: LINKS TO OTHER WEBSITES

<div class="root-rte css-0"><style data-emotion="css 1ui6af">.css-1ui6af{margin-bottom:space-16;}</style><p class="chakra-text css-1ui6af" dir="inherit">The Site may contain links to other websites operated by unrelated companies and persons (“<style data-emotion="css in3yi3">.css-in3yi3{font-weight:bold;}</style><b class="chakra-text css-in3yi3">Third Party Website</b>”). These links are provided for your information only. The inclusion on the Site of any link to a Third Party Website does not mean that we accept any responsibility for that Third Party Website, its content or use, or the use of any features, products and/or services made available through that Third Party Website. We have no control over Third Party Websites or any information or materials contained on them and have not investigated, monitored or checked any Third Party Websites for accuracy, completeness or conformance with applicable laws and regulations. We are not responsible for any damages or injuries caused as a result of your use of, or reliance on, Third Party Websites or any information or materials contained on them. You access and use Third Party Websites at your own risk.</p></div>

Q: CHANGES TO THE PRIVACY POLICY

<div class="root-rte css-0"><style data-emotion="css 1ui6af">.css-1ui6af{margin-bottom:space-16;}</style><p class="chakra-text css-1ui6af"> </p><p class="chakra-text css-1ui6af" dir="inherit">We reserve the right to make changes to this Privacy Policy at any time, so please check our Site regularly to keep informed of changes. If you are a member of the Fashion Club or have signed up to receive our newsletter, we will also notify you of the changes by email.</p></div>

Q: HOW YOU CAN CONTACT US

<div class="root-rte css-0"><style data-emotion="css 1ui6af">.css-1ui6af{margin-bottom:space-16;}</style><p class="chakra-text css-1ui6af" dir="inherit">If you have any questions about this Privacy Policy or you wish to exercise any of your rights in relation to your personal data, please contact us at <style data-emotion="css h82jag">.css-h82jag{margin-bottom:3px;}</style><a class="chakra-link css-h82jag" url="mailto:Privacy.Oslo@viaoutlets.com" href="mailto:Privacy.Oslo@viaoutlets.com">Privacy.Oslo@viaoutlets.com</a>. If you have any questions or wishes in connection with your personal data, you may also contact our data protection officer: <a class="chakra-link css-h82jag" url="mailto:DPO@viaoutlets.com" href="mailto:DPO@viaoutlets.com">DPO@viaoutlets.com</a></p></div>

Question 1

WHO WE ARE

Accepted Answer

The personal data that the Centre collects from you, or that you provide to the Centre, is controlled by one or both of the following companies within the VIA Outlets portfolio: • Oslo Fashion Outlet AS, a private company with limited liability under the laws of Norway, having its seat in Vestby Norway and its address at Vestbyveien 155, 1543 Vestby Norway with company registration number 990 690 006 (“Centre Propco”); and/or • VIA Outlets B.V., a private company with limited liability under the laws of the Netherlands, having its seat in Amsterdam the Netherlands and its address at WTC Building Schiphol, 4th floor Tower F, Schiphol Boulevard 153, 1118 BG Schiphol, the Netherlands, registered with the Chamber of Commerce of Amsterdam under number 76586537 (“VIA Outlets B.V.” ). The controller of your personal data depends on the reason for your interaction with us. Please see the section “Personal data we collect about you, how it is used and why, including the legal basis for our processing” to understand which of the companies listed above control the personal data that the Centre collects from you, or that you provide to the Centre, in connection with each type of interaction covered by this Privacy Policy. References in this Privacy Policy to “we” or “us” are to these companies. Each of the companies listed are committed to protecting your privacy and are (depending on the reason for your interaction with us, as explained above) joint data controllers of your personal data within the meaning of data protection laws applicable in the European Union (“EU”) and European Economic Area (“EEA”). As joint data controllers, we have arrangements between us to ensure that we handle your personal data correctly and in accordance with data protection laws applicable in the EEA, such as the General Data Protection Regulation (GDPR). These arrangements, which do not affect your rights under data protection law, reflect our respective roles and responsibilities in relation to you, and considers which entity is in the best position to fulfil each obligation to you. If you have any questions or requests in connection with your personal data, you can also contact VIA Outlet’s group data protection officer, please send an email to: DPO@viaoutlets.com.

Question 2

PERSONAL DATA WE COLLECT ABOUT YOU, HOW IT IS USED AND WHY 1/2

Accepted Answer

Below you will find an overview of the purposes for which we process personal data about you. It includes which personal data we use for that specific purpose, what the legal basis is for the data processing and how long we retain the personal data. (A) Fashion Club: Registration Types of personal data we collect: • We collect the information you provide to us when you register for our Fashion Club, via our website, app or at the Centre, and any further information you provide to update your registration details from time to time. This information includes your name (first and last name), email address, country of residence, postal address (including city of residence and postcode), language preferences, gender and date of birth. If you do not want to provide us with your personal data upon sign-up, we are unfortunately not able to let you participate in the Fashion Club. • Refer a friend – on occasion we may offer incentives to reward members of the Fashion Club for referring a friend. In order for us to facilitate this reward we need to create and store links between you and friend(s) you refer within our database. This link will only be created when the new member completes the registration process. Purpose of processing (how and why we use your personal data): • We process your personal data to administer your Fashion Club membership and to be able to provide you with access to the various benefits of the Fashion Club. These benefits include our newsletter, the ability to make savings at participating retailers’ stores by accruing credits on your purchases and access to special offers, promotions and discounts. We also process your personal data to ensure that the information we hold about you is kept up to date and accurate. - We rely on the use of personal data to build a clearer picture of our members both as a group and as individuals, including by analysing your shopping behavior (the date/time), the benefits of the Fashion Club which you choose to take up or participate in, and the different ways in which you choose to interact with us. This helps us to provide you with a seamless, relevant and consistent service and also to work out how we can improve the Fashion Club and the information technology systems (including security) that are used to operate it. Legal basis for processing: • We process your personal data after obtaining your consent to do so for the purpose of sending you marketing communications, which may include invitations to take part in special events, surveys and/or focus groups, about the benefits of the Fashion Club. Please see the section “Fashion Club: Marketing communications and automated decision-making (including profiling)” to find out more about your choices when it comes to marketing. • In addition, it is in our legitimate interests to collect and use the personal data referred to in the section above so that we can better understand our member base so that we can improve our services and marketing activities (which could also benefit you). • It is necessary for us to process your personal data in order to perform the contract between us and you in relation to your registration to the Fashion Club. Account deletion: • If you no longer wish to participate in Fashion Club, you can delete your account from the "Settings" section of the Fashion Club mobile application, and select "Delete My Account". Alternatively, you may request that we delete your data (and thereby your account) by submitting a request to Privacy.Oslo@viaoutlets.com. Data retention period: • As a Fashion Club member your data will be kept for as long as you are an active participant of the Fashion Club programme. We define an active Fashion Club member (an “Active Fashion Club Member”) as one that has transacted using their Fashion Club App / Card or Unique Code and/or has opened a Fashion Club email and/or visited our Centre (including our online store). If you are no longer deemed to be an Active Fashion Club Member for a rolling five-year period, then your personal data will be anonymized with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (transaction information and Centre visits or online purchases) for market research and analysis purposes. Prior to deletion, you will be informed that your account will be deleted. • If you request to delete your account, we will anonymize your information. Your personal data will be anonymized in the database with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (transaction information, Centre visits or online purchases and other analytical data) for market research and analysis purposes. Joint controllers of your personal data: • VIA Outlets B.V. • Centre Propco

(B) Fashion Club: Marketing communications and automated decision-making (including profiling) Types of personal data we collect: • As part of the Fashion Club, we also gather information about the purchases you make at the Centre, including the stores you shop in and transaction details. When you use our online platform, we also collect information on purchased items, frequency of purchasing and transaction details (including the date, time and value of the transaction). We gather this information when you scan or enter in your unique code membership email, Fashion Club membership card or Fashion Club app at a Centre store or online when making a purchase (we gather this information in order to offer you all the benefits of the Fashion Club). This helps us to build a profile of your preferred brands and products. Purpose of processing (how and why we use your personal data): • By interacting with our services, we are able to use the data you have provided to find out what products, brands and styles you are interested in and profiling helps us to build a profile of your preferred brands and products. With this profile, we are able to send you offers that are tailored to your specific preferences, based on your previous transaction activity. It also means that we don’t send the same offers to all members of our Fashion Club, so you may not be made the same offers as another Fashion Club member. • We gather information about the purchases you make at the Centre and your use of our online services and your visits to the Centre (location data) so that we can give you all the benefits of the Fashion Club and to provide you with useful information that corresponds to your needs and interests. When we have information about your purchases, we can tailor our benefits to your preferences, based on your purchasing activities and learn more about your favourite stores so that we can make sure you are sent the kinds of offers that you will be most interested in. We may also use your personal data to analyse the effectiveness of our marketing communications so that we can improve the relevance of the marketing communications we provide to you and other members over time. • We send you such offers by automated means. This means processing using, for example, software code or an algorithm, which does not require human intervention. Legal basis for processing: • We only send you personalized offers with your consent. • If you want to withdraw your consent and opt out of receiving personalized offers based on profiling and automatic decision-making, you can unsubscribe via the link provided in each newsletter. • If you don’t agree with an automated decision that our technology has made in relation to you, you can contact us and we will look into it for you (see the section “How you can contact us”). • If you opt-out of receiving personalized offers, we will not target and/or profile your data, but we will still collect your information as part of your membership of the Fashion Club and in order to provide our services as mentioned in the section “Fashion Club: Registration” above. Please also see the section “**Analytics, surveys and focus groups (market research) and Advertising” which sets out how we use your data for market research and analytic purposes. Data Retention Period • As a Fashion Club member your data will be kept for as long as you are an Active Fashion Club Member. If you are no longer deemed to be an Active Fashion Club Member for a rolling five-year period, then your personal data will be anonymized with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (transaction information and Centre visits or online purchases) for market research and analysis purposes. Prior to deletion, you will be informed that your account will be deleted. • If you request to delete your account, we will anonymize your information. Your personal data will be anonymized in the database with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (transaction information, Centre visits or online purchases and other analytical data) for market research and analysis purposes. Joint controllers of your personal data: • VIA Outlets B.V. • Centre Propco

(C) Fashion Club: Geo-fencing Types of personal data we collect: • We process location data of Fashion Club members using a geo-fencing service. Geo-fencing is a location-based service which establishes a virtual fence around, or within, our shopping centres. If you are a Fashion Club member (or use the Fashion Club app) and you have consented to location tracking within the Fashion Club app on your mobile device, our geo-fencing service will detect and record when you enter and leave that geo-fenced location within our centres and how long you stay in a specific area of the centre. • Geo-fencing cannot pinpoint your exact location or entry into a particular store. • No personal data is shared with the retail outlets or brands you visit. Purpose of processing (how and why we use your personal data): • The geo-location data is combined with data from your Fashion Club loyalty scheme card data if you use it in the Centre to collect rewards to determine the spend value and the brand/store. On the basis of this information, we determine which (future) rewards, discounts and/or vouchers to offer to you as a Fashion Club Member. • We can also determine when you visited the Centre without making any transaction or without using your loyalty scheme card in order to send you offers or information about the Centre and/or brands. • We may also use the geo-location data to send Fashion Club members who visited the Centre a survey after their visit. • We may send you the above through push notification during or after your visit to the Centre. For more information on our marketing communications, please read “Fashion Club: Marketing communications and automated decision-making (including profiling)” and “Push Notifications”. Legal basis for processing: • Geo-location data via a Fashion Club member’s mobile device is automatically collected by the device when you have consented to location tracking services on your device. As such, you remain in full control of location data collection. • You have the right to withdraw your consent at any time with effect for the future by consulting the settings on your device. Data retention period: • As a Fashion Club member your data will be kept for as long as you are an Active Fashion Club Member. • If you are not registered as a Fashion Club member, we do not store any geo-location of you. All data is stored locally on your device and is not accessible by us. If you enter a geo-fenced area, your device may automatically send you a push notification or in-app message (for more information, please read the section “Push Notification”). Controller of your personal data: • VIA Outlets B.V. • Centre Propco

(D) Fashion Club: Push Notification

Types of personal data we collect: • If you have downloaded the Fashion Club App, we use your personal data to send you push notifications on your mobile device to send you the latest offers and news tailored to your preference. • If you are a Fashion Club member we do so based on the geo-fencing data and your transactions and shopping behaviour (please read “Fashion Club: Geo-fencing” and “Fashion Club: Marketing communications and automated decision-making (including profiling)” for more information). • If you are not registered as a Fashion Club member but still use the Fashion Club App, you will only receive push notifications based on geo-fencing data, if you have consented to such location tracking, and analytical data about your use of the Fashion Club App (i.e. what you have clicked on). Legal basis for processing: • You will only receive push notifications if you have given us your consent. • At any time, you can manage your push notification preferences or deactivate these notifications at any time by turning off the notification settings in the App or in the device settings of your mobile device. Data retention period: • As a Fashion Club member your data will be kept for as long as you are an Active Fashion Club Member. If you are not registered as a Fashion Club member, we do not store any geo-location of you. All data is stored locally on your device and is not accessible by us. Controller of your personal data: • VIA Outlets B.V. • Centre Propco

(E) Newsletter (formally the VIP Programme) and including our trade newsletter, if you sign up to receive it by itself and not as part of either the Fashion Club) Types of personal data we collect: • We collect the information you provide to us when you sign up to receive our newsletter and any further information you provide to update your registration details from time to time. This information includes your name, email address, gender and date of birth. If you sign-up to receive our trade newsletter the information we collect also includes your company name and telephone number. Purpose of processing (how and why we use your personal data): • We process your personal data to: - provide you with our newsletter (including our trade newsletter if you have specifically signed up for this); - provide you with more relevant information based on the information you have provided to us on signing up to the newsletter (if you have consented to personalized offers); - provide you with information about events, special offers, promotions and other relevant matters concerning the Centre; - for research and analysis, including inviting you to take part in surveys or focus groups carried out by us or by third parties on our behalf: We carry out research and analysis to improve the newsletter. However, if you tell us that you do not want us to contact you about surveys or focus groups, we will respect this choice. This will not affect your subscription to the newsletter; and - administer our database of customers who have signed up to receive our newsletter: We use your personal data so that we can notify you about changes to our newsletter service. We also process your personal data to ensure that the information we hold about you is kept up to date and accurate. Legal basis for processing: • We process your personal data after obtaining your consent to do so for the purpose of sending you information about the latest news, special events, offers, promotions and other benefits at the Centre. Please see the section “Fashion Club: Marketing communications and automated decision-making (including profiling)” to find out more about your choices when it comes to marketing. You can unsubscribe from and withdraw consent to this service at any time by opting out via the link provided in each newsletter. Data retention period: • As a Newsletter member, your data will be kept for as long as you are actively opening and reviewing our email communications. If you are deemed to be an inactive member for a rolling three-and-a-half-year period, your personal data will be anonymized in the database with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (analytical data) for market research and analysis purposes. Prior to deletion, you will be informed that your account will be deleted. • If you request to delete your account, we will anonymize information. Your personal data will be anonymized with your name, email address and other identifiable data being removed from the database. We will keep anonymized data (analytical data) for market research and analysis purposes. Joint controllers of your personal data: • VIA Outlets B.V. • Centre Propco

(F) Competitions and contests Types of personal data we collect: • We collect the information you provide to us when you participate in a competition or contest that we run. This may differ depending on the type of competition or contest we are running but is likely to include your name (first and surname), email address, mobile number and postal address. Purpose of processing (how and why we use your personal data): • We need your personal data in order to operate the competition or contest that you have entered and inform you of its outcome. Legal basis for processing: • The processing of your personal data is necessary for the performance of the contract with you. In order to perform the competition or contest. Data retention period: • Your data is retained for the term of the competition and will then be deleted after the winner of a competition has been announced. The data of the competition winner (and any runner-up) may be held until such time that the competition prize has been collected, or used if the prize is a trip or event, following which, data will be deleted. • If you are a Fashion Club member, we will store your data as set out above in the section “Fashion Club: registration / Data retention period”. Controller of your personal data: • Fashion Club competitions: VIA Outlets B.V. • All local run competitions: Centre Propc

Question 3

PERSONAL DATA WE COLLECT ABOUT YOU, HOW IT IS USED AND WHY 2/2

Accepted Answer

(G) Analytics, surveys and focus groups (market research) and Advertising Types of personal data we collect: • We combine the personal data we collect about you through the different channels you use to interact with us (for example, browsing our Site, signing up for the newsletter or Fashion Club, using our online shopping platform and contacting us). In addition, we may combine the information we hold about you with information about you held by our selected partners and/or retail outlets where you have agreed that they can share your information with third parties. • We may also collect your personal data if you choose to participate in a survey or focus groups carried out by us or by a third party on our behalf. • Email analytics: We included email tracking and link tracking features in our emails by embedding a small transparent image pixel in the outgoing email. If the email is opened, we will have access to certain information, such as the name and surname of the recipient; the recipient’s email address; subject of the email; date and time in which the email was sent; confirmation that the recipient received the email; confirmation that the recipient has opened the email after it has been received; timestamp of each email opening; the history of the times (number, date and time) the recipient has opened the received email; IP address from which the email was opened; browser and operating system used by the recipient who opened the email; number of links included in the email; text and URL of such links; number of clicks made on each of them by the recipient; timestamp of each click on the link; IP address from which the link was clicked on and browser and operating system used by the person who has clicked on the link. Purpose of processing (how and why we use your personal data): • We carry out research and analysis to improve the Fashion Club and other services by evaluating your needs, experiences and wishes. We do so on an aggregated level. • By interacting with our services, we are able to use the data you have provided to find out what products, brands and styles you are interested in and profiling helps us to build a profile our guests’ preferred brands and products. • We gather information about the purchases you make at the Centre and your use of our online services so that we can analyse the effectiveness of our marketing communications so that we can improve the relevance of the communications we provide to you and other guests over time. • We also use your data, for the purpose or market research and data analysis, for the following reasons: - User segmentation – classification of various target and user groups and their shopping interests and usage habits (including findings on demographic interests and habits). - Execution of advertising to existing customers, including execution of direct marketing (newsletters). - Monitoring the success of advertising campaigns. - Usage analytics or services. Legal basis for processing: • It is in our legitimate interests to do this so that we can form a clearer picture about our customer base and as a result improve our services and marketing activities (which could also benefit you). • Email analytics: The processing of these personal data is necessary for the purposes of the legitimate interests pursued by us, in order to analyse the reach and effectiveness of the mails send by us. Data retention period: Data shall be retained depending on the origin according to period foreseen in other sections. If you would like more information or to request details, please contact us by sending your request to Privacy.Oslo@viaoutlets.com. Controller of your personal data: • VIA Outlets B.V. • Centre Propco

(H) Website use and access Types of personal data we collect: • We automatically generate and collect information about you when you visit our Site or use our Fashion Club application (App), for example through the use of cookies and similar technologies. Please refer to our Cookie Policy (https://oslofashionoutlet.no/cookie-policy) for more specific information. The information we collect about you includes: - Technical data, such as your internet protocol (IP) address (which is a unique number enabling us to recognize your device) and other identifiers, browser type, version and settings, including the time zone and language settings, global geographic location on a national or city level, browser plug-in types and versions, operating system and platform, and other technologies on the devices you use to access the Site. - Usage data, such as which pages you visit, whether you are a returning visitor, the period of time you spend on our Site, the activity on your account (should you have one), including storage usage and the number of log-ins, which data was displayed to you, which User Interface (UI) elements you interacted with, including buttons and links, as well as information about your social media profiles which we collect through social media plug-ins. Please refer to our Cookie Policy (https://oslofashionoutlet.no/cookie-policy) for more specific information of our cookies and similar technologies. Purpose of processing (how and why we use your personal data): • We process your personal data to better understand how you use our Site or App, in order to provide, maintain and improve it. This may for example enable us to correctly display content and to better secure our Site and App. • We process information about you to find out what your preferences are. This helps us to provide you with a personalized and optimized online experience, for example by remembering your settings, such as your preferred language, and by providing you with advertisements tailored to your interests. We are also able to understand the effectiveness of the advertising we serve to you. • We use tools and plug-ins of social media platforms on our Site. These enable you log in to your social media profile and share information about this Site with others. Furthermore, it enables us to obtain the information you have shared on your social media profiles. Please be advised that, although we use different social media platforms and are responsible for the content of this Site that is shared via such platforms, we are not responsible for the management of these platforms. For more information about how your data will be used by these social media platforms, we refer to the information already available on the website of the suppliers of these platforms. • With your consent, we use the so-called Meta Pixel on our Site to make sure that our advertisements on the Meta Apps (including Facebook and Instagram) match the potential interest of users. Accordingly, we use the Meta Pixel to display our ads to Meta users who have shown an interest in our Site or who have specific characteristics (e. g. interests in certain topics or products determined by the Site visited) that we submit to Meta (so-called “custom audiences”). - With the Meta Pixel, we can also track the effectiveness of our Meta ads for statistical and market research purposes by seeing whether users were redirected to our Site after clicking on one of our Meta ads. - Because the Meta Pixel is integrated into our Site, your browser automatically establishes a connection with the Meta server after you have agreed to the use of the Meta Pixel through our cookie banner. If you are registered with a Meta service, Meta can also assign the visit to your account. The processing of your personal data by Meta is governed by Meta’s Privacy Policy. Specific information and details about the Meta Pixel can also be found in the Meta Help Center. - We are jointly responsible with Meta (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) for the collection and transfer of personal data in this process. We have therefore entered into a corresponding agreement with Meta for our joint controllership, which you can find here. This arrangement defines the respective responsibilities for fulfilling our obligations under the GDPR. We have agreed with Meta that Meta shall act as the main contact point for the exercise of data subject rights with regard to the processing of personal data through the Meta Pixel. - You may withdraw your consent for the collection by the Meta Pixel and use of your personal data to display Meta ads at any time, by deactivating the Meta Pixel via the Cookie Settings here or for logged in users also here. Legal basis for processing: • We base the use of your personal data on our legitimate interest in offering and securing our Site and App and pursuing the other processing purposes listed above. • In some circumstances, we base the processing of your personal data on your (explicit) consent, such as when we personalize your experience. Although you have the right to refuse to give consent or withdraw it at any time, please be advised that, as a result, the service may not function properly. Data retention period: • Data will not be kept longer than necessary for the purpose for which it was collected. Therefore, the retention period of the data depends on the purpose pursued. If you would like more information or request details, please contact us by sending your request to Privacy.Oslo@viaoutlets.com • Please refer to our Cookie Policy (https://oslofashionoutlet.no/cookie-policy) for detailed information about the retention period of our cookies and similar technologies. Data controller of your personal data: • Centre Propco (I) VIP Day Pass Types of personal data we collect: • If you want to receive your VIP D ay Pass electronically, we will need to collect your name and email address in order to send you your online pass. We also ask you to confirm which country you are travelling from, and which travel company informed you of the VIP Day Pass. Purpose of processing (how and why we use your personal data): • We process your data (name and email address) in order to send you your electronic VIP Day Pass. In addition, we process information about the country you are travelling from and the travel agency you were informed about the VIP Day Pass by in order to review our guest tourism base and local partner performance. • We may also send you a survey after your visit to the Centre. Legal basis for processing: • The processing of your name and email address is necessary for the performance of a contract in order to provide you with your electronic VIP Day Pass. • It is in our legitimate interests to analyse information about the country you are travelling from and the travel agency you were informed about the VIP Day Pass • For research and analysis, including inviting you to take part in a survey carried out by us or by third parties on our behalf: We carry out research and analysis to improve the VIP Day Pass programme. Please also see the section “Analytics, surveys and focus groups (market research) and Advertising” which sets out how we use your data for market research and analytic purposes. Data retention period: • Maximum period of four months from the date the electronic VIP Day Pass is sent to you. Controller of your personal data: • VIA Outlets B.V. • Centre Propco

(J) Online Gift Card Types of personal data we collect: • If you want to purchase your Gift Card electronically on our Site, we will need to collect the name, phone number, company name (if applicable) and email address of the purchaser of the Gift Card (and the recipient if that is a different person) in order to send the online Gift Card. Payment and transactional information is controlled and processed directly by the third party online gift card provider. Purpose of processing (how and why we use your personal data): • We process the personal data (name, phone number, company name (if applicable) address and email address) in order to send you (or the recipient) the electronic Gift Card code. Any payment details will be uploaded directly via the third party online Gift Card provider’s web portal. Legal basis for processing: • The processing of the name, phone number, company details (if applicable), address and email address is necessary for the performance of a contract in order to provide you (or the recipient) with the Gift Card code electronically. Data retention period: • Maximum period of 18 months from the date the Gift Card code is sent (electronically or by post). Controller of your personal data: • Centre Propco (K) Entering an area of the Centre in which we operate security cameras (excluding in-store CCTV) Types of personal data we collect: • We operate security cameras at the Centre in limited areas where we have identified a need and where other solutions are ineffective to achieve the purposes described in the section below. This means that if you visit the Centre you may be captured on security camera. • There are prominent signs in the areas where the security cameras are operated. Purpose of processing (how and why we use your personal data): • Security cameras are used at the Centre for monitoring the security of the Centre, safeguarding the safety of visitors and staff at the Centre and preventing and detecting crime. For the avoidance of doubt, our operation of security cameras excludes in-store CCTV. For more information on in-store CCTV please consult the privacy policy of the relevant store. Legal basis for processing: • It is in our legitimate interests to collect and use the personal data referred to in the section above so that we can provide a safer, more secure environment for visitors and staff at the Centre, and to protect our property and that of VIA Outlets. • Please note that access to the security camera footage is restricted to authorised personnel of VIA Outlets, our insurance companies and our security service provider that need to have access in order to achieve the purposes described in the section above. In addition, access to the footage will be granted to law enforcement agencies in certain circumstances in order to prevent and detect crime. Data retention period: Seven days except if such data is necessary to process claims or rights exercise, in which case information shall be kept until its expiration. Controller of your personal data: • Centre Propco

(L) Using the car parking facilities at the Centre Types of personal data we collect: • We operate a vehicle number plate recognition system inside the car park at the Centre for statistic and marketing reasons. This means that if you use the car parking facilities at the Centre your vehicle number plate will be captured. • There are prominent signs in the areas where the vehicle number plate recognition system is operated. Purpose of processing (how and why we use your personal data): • A vehicle number plate recognition system is used inside the car park at the Centre for statistic and marketing reasons. • We aggregate information about the postal code in which your vehicle is registered to conduct statistical analysis of the geographical attraction of the Centre and build up a clearer picture about our customer base as a group. This helps us to work out how we can improve the Centre and better service visitors to the Centre. Legal basis for processing: • It is in our legitimate interests to collect and use the personal data referred to in the section above so that we can better understand our customer base as a group so that we can improve the Centre. • Please note that access to the vehicle number plate recognition system is restricted to a third party supplier named APCOA Parking Norway AS that need to have access in order to achieve the purposes described in the bullet points in the section above. • Authorised personnel of VIA Outlets have access to aggregated information about the origin of the visitor cars but not to the underlying vehicle number plates. Data retention period: images 3 months and license plate numbers 12 months. Controller of your personal data: • Centre Propco • APCOA Parking Norway AS

(M) Health and Safety Management Types of personal data: • If you have an incident at our Centre relating to health or safety, we may collect information about you so that we can support you and to follow up with our insurers if a claim is made. We may also collect information from you if you are a witness to an incident. The data you provide may include the following: - Contact details: first name and last name, email address and telephone number; - Details of any injuries resulting from an incident. Purpose of processing (how and why we use your personal data): • The processing of your personal data is necessary for health and safety reasons and incident management. Legal basis of processing: • The processing of these personal data is necessary for the purposes of the legitimate interests pursued by us and to process and insurance claims arising from an incident at the Centre. In addition, we may process this data on your request. Where we use cookies or other technologies that might store information on your device and that are not absolutely necessary for our service, we process your personal data after obtaining your consent. For more information, please see our Cookie Policy (https://oslofashionoutlet.no/cookie-policy). Data retention period: • Information will be deleted after claim has expired under law. Controller of your personal data: • Centre Propco

(N) Contact us Types of personal data we collect: • You may contact us in various ways, including via the contact form on the website, our social media channels, by e-mail, WhatsApp, text and by telephone. If you contact us, we may keep a record of that correspondence and any personal data that you provide, such as your name, telephone number and email address. Purpose of processing (how and why we use your personal data): • We use your personal data so that we can respond to your communications. Legal basis for processing: • It is in our legitimate interests to collect and use the personal data referred to in the section above so that we can serve our customers’ needs. • Where the contact is related to a contract we have with you, the legal basis for processing your personal data is based on contract. Data retention period: Your information will be deleted after a period of 6 months from the date that your query/needs have been met. Controller of your personal data: • Centre Propco

Question 4

WHO WE SHARE YOUR PERSONAL DATA WITH

Accepted Answer

For the purposes set out in the section “Personal data we collect about you, how it is used and why, including the legal basis for our processing”, we sometimes provide your personal data to other companies within the VIA Outlets portfolio and certain service providers who perform certain business operations on our behalf. This includes: • Management company to the Centre Propco that provides management, financial and other operational services; • Database platform service and hosting provider who assist us with: o storing and combining data; o processing transaction information of VIP Day Pass and Fashion Club members; o communicating with our Fashion Club members about the benefits of this loyalty programme; o communicating with customers who have signed up to receive our newsletter; and o communicating with entrants of competitions and contests we may run from time to time; • Customer Service Platform; • Retailers/brands at the Centre who may assist you with signing up to the Fashion Club in their store at the Centre; • Service providers who help us with our information technology systems (including security); • Cloud providers who host the information stored in our customer database; • Service providers who help us to operate the security cameras and vehicle number plate recognition system at the Centre; and • Insurers that deal with claims on our behalf. In addition, we may share your personal data with other organisations in the following circumstances: • if we are required by applicable law or a public authority to share information about you; • if we need to share information about you in order to establish, exercise, defend or protect the rights, property or safety of our business, our customers or others. This includes, in specific cases, exchanging information with other organisations for the purposes of fraud and theft protection; and • to successors in title or replacement operators of all or part of our respective businesses. Transfer of your personal data outside the European Economic Area and the UK In some cases, the personal data we collect from you may also be accessed or processed outside the EEA and the UK, including North Macedonia, USA and Canada. See this link for an overview of EEA countries. Such destinations may not have laws which protect your information to the same extent as in the EEA and the UK. We have obligations to ensure that your personal data is only accessed or processed from territories outside the EEA and the UK where the European Commission has decided that the territory in question ensures an adequate level of protection (known as a ‘white listed’ territory) or, in the absence of such decision, there are appropriate safeguards in place to protect your personal data. See this link for an overview of applicable adequacy decisions. For example, if your personal data is accessed or processed from a territory outside the EEA or the UK which is not white listed, the appropriate safeguards may be provided by standard data protection clauses adopted by the European Commission and Information Commissioner (FDPIC) (known as ‘model clauses’).

Please ask us if you would like more information about the safeguards that are used to protect your personal data when it is processed outside the EEA and the UK (see the section “How you can contact us”).

Question 5

HOW WE USE COOKIES

Accepted Answer

We use cookies to enable our systems to recognise your device so that we can personalise and improve your customer experience whilst using our Site and provide you with relevant online advertising. Please see the section “Personal data we collect about you, how it is used and why, including the legal basis for our processing” and our Cookie Policy available at (https://oslofashionoutlet.no/cookie-policy) to find out more.

Question 6

HOW LONG WE KEEP YOUR PERSONAL DATA FOR

Accepted Answer

We retain your personal data for no longer than is necessary for the purposes for which the information is collected (see the section “Personal data we collect about you, how it is used and why, including the legal basis for our processing” for details of the relevant purposes). When determining the relevant retention periods, we will take into account factors including: • legal obligation(s) under applicable law to retain data for a certain period of time, for example, accounting obligations; • statute of limitations under applicable law; • (potential) disputes; and • guidelines issued by relevant national data protection regulators. Otherwise, we securely erase your information once this is no longer needed for the purposes for which the information is collected.

Question 7

OUR POLICY ON CHILDREN’S PERSONAL DATA

Accepted Answer

We do not knowingly collect the personal data of children under 16 years of age, without the prior consent or authorisation of the holder of parental responsibility over the child.

Question 8

YOUR RIGHTS

Accepted Answer

By law, you have the following rights with regard to your personal data.

Right of access	You have the right to obtain access to your personal data (if we’re processing it) and certain other information (similar to that provided in this Privacy Policy). This is so you’re aware and can check that we’re using your personal data in accordance with data protection law.
Right to rectification	You are entitled to have your personal data corrected if it is inaccurate or incomplete.
Right to erasure	This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data. This is not a general right to erasure; there are exceptions. You have the right to have your personal data erased if the personal data is no longer necessary, you withdraw your previously given consent, you object to the use of your data, and there is no overriding legitimate interest to continue processing, personal data have been unlawfully processed or we have to do it to comply with a legal obligation.
Right to restrict processing	You have the right to restrict the processing of your personal data in certain circumstances. This means that you can limit the way that we use your data when you contest the accuracy of your personal data and we are verifying the accuracy of the data, the data has been unlawfully processed and you oppose erasure and request restriction instead, we no longer need the personal data but we need to keep it in order to establish, exercise or defend a legal claim, or you have objected the processing of your data and we are considering whether our legitimate grounds override yours.
Right to data portability	You have rights to obtain and reuse your personal data for your own purposes across different services. For example, if you decide to switch to a new provider, this enables you to move, copy or transfer your personal data between our IT systems and theirs safely and securely, without affecting its usability.
Right to object to processing	You have the right to object to processing of personal data which is based on our legitimate interests. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, you always have the right to object to processing of personal data for such marketing. In that case, we shall no longer process your personal data for such purposes.
Right to withdraw consent	Where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. The withdrawal does not affect the lawfulness of previous processing, but from the time you withdraw your consent we will not process any further personal data.
Right to lodge a complaint	In addition to the above-mentioned rights, you have the right to lodge a complaint about the way we handle or process your personal data with a supervisory authority, in particular in the EU Member State where you normally live, where you work or where an alleged infringement took place. This webpage gives you an overview of all supervisory authorities in the EU and their contact details. However, before you approach a supervisory authority, we encourage you to contact us with any issues you may have. We take your concerns very seriously, and would appreciate the chance to assist you personally. You may send your request to Privacy.Oslo@viaoutlets.com. We will respond to your request as soon as reasonably possible and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. We will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay. If we do not take action on your request, we shall inform you without delay and at the latest within one month of receipt of the request of the reasons for not taking action. In that case, you also have the right to lodge a complaint with the supervisory authority and to seek a judicial remedy.

Question 9

LINKS TO OTHER WEBSITES

Accepted Answer

The Site may contain links to other websites operated by unrelated companies and persons (“Third Party Website”). These links are provided for your information only. The inclusion on the Site of any link to a Third Party Website does not mean that we accept any responsibility for that Third Party Website, its content or use, or the use of any features, products and/or services made available through that Third Party Website. We have no control over Third Party Websites or any information or materials contained on them and have not investigated, monitored or checked any Third Party Websites for accuracy, completeness or conformance with applicable laws and regulations. We are not responsible for any damages or injuries caused as a result of your use of, or reliance on, Third Party Websites or any information or materials contained on them. You access and use Third Party Websites at your own risk.

Question 10

CHANGES TO THE PRIVACY POLICY

Accepted Answer

We reserve the right to make changes to this Privacy Policy at any time, so please check our Site regularly to keep informed of changes. If you are a member of the Fashion Club or have signed up to receive our newsletter, we will also notify you of the changes by email.

Question 11

HOW YOU CAN CONTACT US

Accepted Answer

If you have any questions about this Privacy Policy or you wish to exercise any of your rights in relation to your personal data, please contact us at Privacy.Oslo@viaoutlets.com. If you have any questions or wishes in connection with your personal data, you may also contact our data protection officer: DPO@viaoutlets.com

Question 12

Entering an area of the Centre in which we operate security cameras (excluding in-store CCTV)

Accepted Answer

Types of personal data we collect:

We operate security cameras at the Centre in limited areas where we have identified a need and where other solutions are ineffective to achieve the purposes described in the section below. This means that if you visit the Centre you may be captured on security camera.
There are prominent signs in the areas where the security cameras are operated.

Purpose of processing (how and why we use your personal data):

Security cameras are used at the Centre for monitoring the security of the Centre, safeguarding the safety of visitors and staff at the Centre and preventing and detecting crime. For the avoidance of doubt, our operation of security cameras excludes in-store CCTV. For more information on in-store CCTV please consult the privacy policy of the relevant store.

Legal basis for processing:

It is in our legitimate interests to collect and use the personal data referred to in the section above so that we can provide a safer, more secure environment for visitors and staff at the Centre, and to protect our property and that of VIA Outlets.
Please note that access to the security camera footage is restricted to authorised personnel of VIA Outlets, our insurance companies and our security service provider that need to have access in order to achieve the purposes described in the section above. In addition, access to the footage will be granted to law enforcement agencies in certain circumstances in order to prevent and detect crime.

Data retention period: Three days except if such data is necessary to process claims or rights exercise, in which case information shall be kept until its expiration.

Controller of your personal data:

Centre Propco

PRIVACY POLICY

Discover us

About us

Need help