Privacy Policy

INTRODUCTION

Retail Marketing Limited (‘We’, ‘Our’, ‘Us’) strives to ensure that all personal data processed, stored and managed is undertaken with utmost respect and care. In view of this, We aim to outline how your personal data is handled in a clear and transparent manner.

We, Retail Marketing Limited, having its registered business address at TG Complex, Level 3, Triq il-Birrerija, Central Business District, Birkirkara CBD 3040, Malta is considered as the Data Controller. In this regard, We determine the purpose and means of processing your personal data relating to our services as stipulated in this notice.

Our team is committed to safeguarding Data Subjects (i.e., you or any other natural person) whose personal data is being collected, held, or processed in compliance with Regulation (EU) 2016/679, more commonly known as the General Data Protection Regulation (the ‘GDPR’). For any further information or clarifications, kindly contact us by sending an email to dataprotection@retailmarketing.mt.

COLLECTION OF PERSONAL DATA

We collect data relating to an identified or identifiable natural person, whether directly or indirectly (‘Personal Data’). In view of this, We may collect your personal data through the use of our website, Loyalty Club application, marketing promotional aspects or as may otherwise be stipulated in other privacy notices issued from time to time.

DATA COLLECTED THROUGH OUR WEBSITE

The information collected is mostly through our website in which you as a data subject choose to provide. In some instances, personal data may be requested from you to proceed with your online request. These instances may occur in cases of the submission of a vacancy, signing up for marketing newsletters and/or when submitting questions or comments through Our website.

Should you choose to provide Us with your personal data via email, such data will be processed in order to carry out the request or purpose requested therein and as indicated within this privacy notice.

The personal data collected may include:

• Name and Surname;
• Contact Details;
  • Email address,
  • Permanent address,
  • Telephone number;
• Personal identifiable data provided through responses to Our surveys and competitions;
• Information about the individual’s device (phone, tablet, laptop, desktop);
  • IP address; and Location as per IP address

By using our website, you may be providing data relating to the use of Our website and relevant access such as cookies, logs, marketing analytics, etc. For further information on our use of cookies, please refer to our Cookie Policy.

DATA COLLECTED THROUGH OUR LOYALTY CLUB

Alternatively, your personal data may also be collected through Our Loyalty Club application, in which you as a Data Subject, once again choose to provide.

As for Our Loyalty Club, the personal data collected may include:

• Name and Surname;
• Identification number;
  • ID card number; or
  • Passport number;
• Email;
• Town
• Mobile/telephone number;
• Date of birth;
• Gender

WHY WE COLLECT PERSONAL DATA?

In order for Retail Marketing Limited to collect personal data on you as a Data Subject, We ensure that all personal data is processed in accordance with the principles for processing. Therefore, We hereby declare that all processing is undertaken;

• in a lawful, fair and transparent manner,
• limited to what is necessary for the specific and legitimate purpose to which it was
  provided;
• held accurately and updated where incorrect data is identified;
• retained in line with the respective retention periods and not for longer than
  absolutely necessary; and
• in line with the implemented security measures required for the protection of
  unauthorized access or loss.

LEGAL BASIS FOR PROCESSING

Retail Marketing Limited ensures to outline its legal basis for processing in all instances requiring Data Subjects to provide their personal data. In this regard, processing is conducted on the basis of the following legal grounds:

• when a Data Subject has given consent to the processing of their personal data for one or more specific purposes;
• When We are required to process information for the performance of a contract (whether for employment purposes or in the provision of a service); and
• When We have legitimate interest to process that data, except in cases where the rights and freedoms of a data subject are considered above said interests.

In view of the above, We are hereby providing an indication of instances in which personal data is collected on the aforementioned legal basis;

1. Keep individuals up to date
   Information related to a Data Subject’s personal contact details (i.e., one’s name, surname, and contact information), are collected to ensure that all individuals are kept up to date on new products, services and brand communications via email, SMS, or post.

The above information is provided in cases where you, the Data Subject, have consented to receiving marketing material. Nevertheless, We value your privacy and allow Our users to opt-out of receiving any marketing materials at any point in time. Methods in which you may withdraw your consent from receiving such materials is made known to you upon choosing to subscribe and/or throughout communication (e.g., via an unsubscribe button).

Should you require further clarifications as to how you may refrain from receiving further marketing messages, please contact us on dataprotection@retailmarketing.mt.

1. Provide customer service and support
   Information/ personal data held on a Data Subject (inclusive of contact history) is collected for the purpose of providing customer service and technical support whenever necessary. Moreover, the processing of such personal data is essential in adhering to Our responsibilities in the performance of a contract.
2. Information related to the Data Subject’s Device (phone or laptop)
   The Data Subject’s personal information such as their IP address, device type, location data and use of website in the protection of Our website. The collection of such data assists Us in the prevention and detection of fraud against both the Data Subject or Retail Marketing Limited, whilst adhering to Our legal obligations in the protection of personal data.

A Data Subject may choose to refrain from accepting certain marketing cookies whilst using Our website. By doing so, the Data Subject may not be able to use Our website or all the services that We may offer on the site. Furthermore, this may hinder the possibility of receiving optimal customer experience.

Our team ensures that the Data Subject’s personal data is anonymized and aggregated, and its use is for functionality purposes including testing Our IT systems, research, data analysis, improvement on Our website and developing new products and services. In cases where such information is required to be shared with third parties in accordance with the above purposes, the Data Subject’s information is anonymized to ensure that the identification of an individual is not possible.

1. Response to surveys, competitions, and promotions
   Retail Marketing Limited carries out surveys, competitions, and promotions on an ongoing basis. As a result, an individual may choose to participate in these activities and consequently consent to the processing of their data. Therefore, Our team will be required to process the provided personal data in the performance of a contract in terms of Our surveys, competitions and promotions.

Alternatively, a Data Subject may choose to refrain from taking part in such activities. Therefore, it is important to note that those Data Subjects who choose not to provide such information will not be processed in any way.

1. Statistical analysis
   We have a legitimate interest to use the Data Subject’s personal data for other matters provided that proper care is taken in relation to their rights and interests of the individual as follows;

•  
  • to ensure that the Data Subject is informed on any modifications to Our website or the terms of Our Privacy Policy. In the case of individuals who have not subscribed to the marketing material, it is their responsibility to check for any updates to Our Privacy Policy;
  • for research and/or analysing Our Data Subject’s personal data, to better understand our clients and online audience, whilst also understanding who they are and how they interact with Our team;
  • in the provision of training of staff members; and to improve Our website and consistently maintain our security standards (i.e., statistical/testing/analytical purposes or troubleshooting).

COLLECTION OF DATA OF MINORS

Personal data of any individual under the age of 18, requires further protection. Therefore, at present, Retail Marketing Limited does not collect any information from a minor.

Nevertheless, We recognize that individuals who may have not yet attained eighteen (18) years may apply for vacancies with Us (e.g. summer vacancies), and thus choose to provide their personal data. In accordance with Subsidiary Legislation 452.92, Retail Marketing Limited may employ individuals who have attained the age of 16 years but less than 18
years of age (‘adolescents’).

Consequently, We refer to Article 8 of the GDPR in which the processing of personal data of a minor shall be lawful where the child is at least 16 years of age. Therefore, We have the right to process such data solely for the purpose of employing that Data Subject.

Should the public be aware or believe that we are holding any information collected with regards to a minor for reasons not outlined herein or within our privacy policy, kindly inform Us as soon as possible on dataprotection@retailmarketing.mt.

SHARING PERSONAL DATA

Retail Marketing Limited may be required to share your data with third parties (i.e., in this case the Data Processor will be the third party), to be used solely for the purposes for which We originally intended (as previously mentioned above). In view of this, measures are implemented by Us to ensure that the sharing of data is undertaken with utmost security and confidentiality. Wherever possible, We ensure to share data in an anonymised manner to avoid the possibility of direct or indirect identification.

In the case of professional service providers (i.e., marketing agencies, advertising partners and website hosts), help Us improve the content, functionality of Our website and/or business operations.

Nonetheless, We may be required to share Data Subject information in cases where we are required to do so by the relevant credit reference agencies, law enforcement and fraud prevention agencies. In such instances, Our team carefully and appropriately handle personal data in the attempt to prevent illegal activities such as fraud.

In most circumstances, We do not disclose your personal data without your prior consent. However, instances may arise in which We may have to;

• in case of a court order;
• to comply with legal requirements and when satisfying a legal request;
• for proper administration of justice;
• in the protection of a Data Subject’s vital interests;
• in order to fulfil a Data Subject’s rights request(s);
• in the safeguarding of integrity of the relevant website/s operated by Our team or by such related entities/subsidiaries; and
• in the event of a corporate sale/merger/reorganization/dissolution or similar event involving Our team and/or Our subsidiaries and other related entities.

Additionally, if We ever share data with entities that are located outside of the European Union (EU) or EEA (European Economic Area), We will be sure to do so in a manner that complies with the requirements established by the GDPR regulations.

Retail Marketing Limited shall not sell any of your personal data to a third party, i.e., your name, fixed address, email address or any other forms of personal data.

For further information on this subject, or any other queries, kindly contact us on dataprotection@retailmarketing.mt.

RETENTION OF DATA

Personal Data processed and managed by Retail Marketing Limited shall not be held for longer than necessary in accordance with the purpose to which it was obtained. Following lapse of the retention period, the data is then adequately erased in a secure and timely manner. In this regard, We ensure that such measures are applicable to both physical and electronic forms of data.

Nonetheless, instances may arise in which We may retain specific data for a longer period if it is necessary or required to:

• meet legal or regulatory requirements;
• resolve disputes;
• prevent fraud and abuse; or
• enforce Our terms and conditions.

Therefore, different categories of data may be kept for different periods of time in line with the respective legal obligations. An overview of the retention periods is provided below for ease of reference:

DATA SUBJECT’S RIGHTS AND FREEDOMS

The GDPR regulations stipulate your rights and freedoms as a Data Subjects in which any of the below may be exercised with Us:

• Right to be informed: Retail Marketing Limited are obliged to inform their customers how their data will be processed. We ensure this through this privacy policy;
• Right to access: Individuals may request to access the personal data held by Retail Marketing Limited. This can be done by contacting us on our website or by sending an email to dataprotection@retailmarketing.mt.

Furthermore, to process you request, We shall ask you to provide us with the necessary identification documents to confirm your identity. Our team shall try our best to process your request within one (1) month, whereas for more complex requests, this may take up to two (2) months. In case of the latter, we will inform you of the extended period and the rationale behind such an extension. Retail Marketing Limited will provide the Data Subject with their personal data either through an electronic format or hard copy.

If We deem the request to be unreasonable, We may choose not to proceed further with your request. In the case of the Data Subject disagreeing with this decision, they can file a complaint with the Information and Data Protection Commissioner (https://idpc.org.mt).

• Right to rectification: Individuals may ask to correct/modify any inaccurate or incomplete information. By doing so, Our team will be able to ensure that records are kept up to date.

If you notice any inaccurate information relating to your personal data, you are kindly requested to send an email on dataprotection@retailmarketing.mt or to contact Us directly through Our website.

• Right to erasure: Individuals may request to have their information deleted, cease processing or collection.

Nevertheless, instances may arise in which We are bound to retain personal data irrespective of the right to erasure in light with other legal obligations or to exercise or defence against legal claims.

Unless indicated otherwise, We will do our utmost to comply with your request in a timely manner whilst notifying any third parties with whom your data may have been shared, in order to ensure the full and appropriate exercise of your right.

• Right to restrict processing: Individuals have the right to block or limit the use of their personal data;
• Right to data portability: Individuals may request for their personal data to be moved/transferred to other service providers in an easy and secure manner.

Should you wish to exercise your right to data portability, we kindly ask you to contact us regarding this request indicating the information that you would like to transfer. We will then be able to provide you with a copy of your personal data in a structured, commonly used, and machine-readable form, (i.e., a CSV file format). It is important to note that We are not required to adopt processing systems that are compatible with another organization. Therefore, it may be that the recipient organization cannot automatically use the personal data we provide;

• Right to object: Individuals may object to data processing for specific reasons.

For instance, the Data Subject has the right to object at any time to processing of their personal data concerning them for direct marketing purposes or to carry out profiling through automated means. In doing so, their personal data will no longer be processed for such purposes unless We inform you of our inability to exercise your right on the basis of legitimate grounds overriding the interests, rights and freedoms of the Data Subject;

• Right in automated decision-making: Individuals are provided with protections in case of any harmful decisions made by automated systems. For instance, Data Subjects have the right to request human intervention if automated processing without human intervention is used to make decisions having legal or similar effects on them;
• Right to Lodge a Complaint: The Data Subject has the right to file a complaint with the Data Protection Commissioner if they consider that the processing of their personal data, infringes data protection legislation.

Where We do not intend to comply with such requests, due to a jurisdiction allowable at law, the reasons leading to such refusal shall be provided to the Data Subject.

INFORMATION SECURITY MEASURES

Retail Marketing Limited has a duty to ensure that all personal data is held securely. Where it is appropriate, our website uses HTTPS to help keep your personal data secure. However, no data transmission over the internet can be guaranteed to be totally secure.

The Data Subject may complete a registration process when they sign up to use parts of the website. This may include the creation of a username, password and/or other identification information. We advise you to always keep your personal data confidential and to never share your personal data with anyone.

We at Retail Marketing Limited ensure to keep all personal information that you disclose with us secure. However, no data transmission over the internet can be guaranteed to be totally secure.

Kindly bear in mind that no system can guarantee that unauthorized access or theft will not occur. However, as a means of mitigating such a possibility, We have implemented a number of security measures to further enhance the protection of your personal data. These include the following:

• use of secure servers;
• use of firewalls;
• use of encryption;
• physical access controls at our server room;
• information access controls; and
• use of back-up systems.

Links to Third-Party Websites

Our privacy policy does not cover third-party websites. Please review their privacy statements when visiting those websites.

Changes to Privacy Policy

Our privacy policy may be updated periodically as we enhance our website. We encourage you to review it regularly.

CONTACT US

Should you have any further questions about this Privacy Policy, or wish to make a complaint about how We have handled your personal information, kindly contact us through email correspondence:

EMAIL

Retail Marketing Limited has appointed a designated person responsible for privacy and data protection matters. Should you wish to contact this person, kindly send an email to dataprotection@retailmarketing.mt