Notification concerning the processing of personal data within the premises of the shopping center



Nepi Real Estate Project One doo with its registered office in Milutina Milankovića No 9đ, 11070 New Belgrade, Serbia, registered with the Trade Register under no. 21165719 sole registration code 109345294. Promenada Novi Sad hereinafter referred to as “Operator“, processes, as Operator, the personal data of the data subjects who carry out their activity in or visit the location of the shopping center, under the following conditions:

Purposes of processing

  • – fulfilling the obligations incumbent on the owner of the building, according to the law, to ensure the security and safety of his own spaces, purpose for which he opted for video monitoring of public spaces, through the CCTV video surveillance system installed inside the mall, in the common areas, of the access roads, as well as of the parking areas.
  • – facilitating access to the parking area
  • – solving the requests for data received from the competent authorities and institutions
  • – archiving, resolving disputes, investigations or any other petitions / complaints to which our company is a party, as well as performing risk controls on procedures and processes, as well as conducting audits or investigations at the company level
  • – granting access to the free WiFi network
  • – participation in marketing campaigns carried out in the shopping center and handing over the prizes won within them (e.g.: signing handover-receipt reports, etc.)
  • – management of notifications / complaints submitted within the shopping center (e.g.: forms for complaints / notifications)
  • – managing requests regarding lost objects, submitted inside the shopping center (e.g. lost property forms).

The types of personal data processed

  • – in the context of using the CCTV video surveillance system: the image of the data subjects
  • – in the context of using the parking areas: type and registration number of the vehicle for which the parking space is granted, the image of the data subjects
  • – in the context of using the free WiFi network: the MAC of the device
  • – in the context of participating in the shopping center’s campaigns, the types of data collected will be made public in the Regulations for organizing and conducting the event, published on the official website.

The categories of data subjects whose personal data are processed

  • – visitors and customers of the shopping center
  • – the staff of the shopping center’s tenants
  • – the staff of the suppliers / partners / collaborators of the Operator and / or the tenants of the shopping center.

Basis of processing

In view of the above, we process the personal data of the data subjects who carry out their activity in or visit the location, either based on the request of the data subjects, or based on the fact that it is a legal requirement, or taking into account our legitimate interest, as the case may be.

Storage period

The personal data processed are kept for the period of time necessary to comply with the legal obligations imposed on us by the regulations specific to our field of activity.

Regarding the video recordings, they are kept, as a rule, for a period of 30 (thirty) days, unless the extension of their processing period is required by law or justified by legal procedures.

The MAC of the device is stored only during the period when it uses our WiFi network.

In the context of participating in the mall’s campaigns, the deadlines for keeping the personal data collected will be made public in the Regulations for organizing and conducting the event, published on the mall’s website.

Third party access

In order to ensure the CCTV video surveillance and the access control system in the parking spaces, the owner collaborates with specialized companies and authorized according to the law to carry out guarding and security activities.

Also, personal data processed in the context of the Contract, may be made available to the competent authorities and institutions, according to law or processed within the NEPI Rockcastle Group for purposes of consolidated management of group activities, for audit purposes and in any other situation where the law requires or permits such processing.

Regarding the participation in campaigns and events, as well as the management of notifications, complaints and / or requests regarding lost objects addressed to the staff of the Info Desk offices within the shopping centers, the operator usually collaborates with specialized service companies.

What are your rights with respect to the processing of your personal data?

a) Right of access – you may request confirmation if your personal data are processed or not by Promenada Novi Sad, and if so, you may request access thereto, as well as certain information about this. Upon request, Promenada Novi Sad will also issue a copy of the processed personal data. The request for additional copies will be charged based on the actual costs incurred by Promenada Novi Sad,

b) Right to rectification – you can get your inaccurate personal data rectified and also supplement incomplete data, including by providing additional information.

c) Right to delete data (“the right to be forgotten”) – in situations expressly regulated by law, you can obtain from Promenada Novi Sad the deletion of the data. Thus, you can request deletion of personal data if:

  • – the data are no longer necessary for the purposes for which they were collected or otherwise processed;
  • – you withdraw your consent on the basis of which processing takes place;
  • – you oppose to the processing under the right of opposition;
  • – processing your personal data is illegal;
  • – data must be deleted for compliance with a legal obligation incumbent on Promenada Novi Sad.

d) Right to restrict processing – you may request the restriction of processing of personal data in certain situations governed by law, as follows:

  • – you contest the accuracy of your data, for the time Promenada Novi Sad checks the accuracy of the concerned data;
  • – processing is illegal and you oppose to the deletion of data;
  • – you need these data to establish, exercise or defend some rights in court, and Promenada Novi Sad no longer needs this data;
  • – you opposed the processing of personal data for the period in which we check if our legitimate interests prevail over the interests of your rights and freedoms.
  • – In these situations, except for storage, the data will not be processed anymore.

e) Right to object to the processing of personal data – you can object at any time, for reasons related to your particular situation, to processing (including profiling) based on the legitimate interest of Promenada Novi Sad or, where appropriate, on the exercise by Promenada Novi Sad of a task which is in the public interest or results from the exercise of a public authority with which he would have invested Promenada Novi Sad.

f) Right to data portability – you can receive your personal data in a structured, readable format, and you can request that the data be passed to another operator. This right applies only to personal data provided directly by you to Promenada Novi Sad, and only if the processing of personal data is done by automated means and is legally based on either the execution of a contract or the consent of that person,

g) Right to complain – you can complain about how Promenada Novi Sad processes your personal data. The complaint will be filed with the Commissioner, for Information of Public Interest and the Protection of Personal Data (“Commissioner”),

h) Right to withdraw your consent – you may at any time withdraw your consent to the processing of personal data by Promenada Novi Sad in cases where processing is based on consent. Withdrawal of the consent will only have effect for the future, and processing prior to the withdrawal remains valid.

i) Additional rights related to automated decisions used in the delivery of Promenada Novi Sad services – if Promenada Novi Sad makes automated decisions about personal data and these decisions affect you significantly, you can (a) obtain human intervention with respect to said intervention, (b) express your point of views on such processing, (c) obtain explanations of the decision made and (d) contest that decision.

These rights (except the right to contact Commissioner, which you can exercise under the conditions established by this authority – in this regard you can see the official website may be exercised, either individually or by aggregation sending a letter/message in the following ways:

a) By post, at: Bulevar Milutina Milankovića 9đ, Belgrade, Republic of Serbia (in atenția NEPI Rockcastle);

b) By email, at the email address:;

In addition, a Data Protection Officer (“DPO”) has been appointed at the Group level, who can be contacted if there are any concerns about the protection of personal data and the exercise of data protection rights. The OPD may be contacted by submitting a written, dated and signed application to the following mailing address: Bulevar Milutina Milankovića 9đ, Belgrade, Republic of Serbia (in atenția NEPI Rockcastle) or to the following email address