Privacy policy

SIA IREF RETAIL 3 PRIVACY POLICY

Controller: SIA IREF RETAIL 3, unified registration No. 50203606931, site: Shopping Centre Olimpia

Personal data is any information allowing to identify a particular person – for example, your name, personal identity number or location data. This Privacy Policy aims to explain in detail as to how SIA IREF Retail 3 (hereinafter referred to as the Company) processes, protects and manages your personal data providing both data processing principles, purposes, scope, and duration, as well as your rights in relation to data processing performed by us.

Our goal is to provide you with a comprehensive and understandable on how and why your personal data are being used, so that you would feel safe when sharing your personal details with us. Therefore, to ensure data safety, we have introduced several safeguards guaranteeing processing of your personal data in line with the effective data protection laws, our internal guidelines and regulations. Personal data protection is taken care of by the responsible person in our Company tasked with ensuring compliance with all established regulations and requirements.

We are taking all possible measures to ensure protection and confidentiality of your data at every stage of processing. This Policy will provide you with insight as to what kind of data on you we might collect, how we use them, as well as communicate your rights and ways to contact us.

We monitor data protection and privacy matters on a regular basis, therefore, this Privacy Policy may be amended or supplemented at any time. The effective version of Privacy Policy shall be published on this website. Any version of the Privacy Policy published on website shall replace any and all previous versions of the Privacy Policy and shall enter into force immediately after publishing thereof.

In processing personal data, the Company shall comply with the requirements of the General Data Protection Regulation No. 2016/679 and the Personal Data Processing Law, as well as other effective Latvian laws.

1. What are the purposes of our processing of your personal data?

The Company shall process your personal data for particular purposes and in accordance with the applicable laws and regulations. Under this Policy, personal data shall be used in the following events and for the following purposes:

Customer service and relationship management – to ensure service quality and efficient communication.
Marketing activities – for example, campaigns, offers or information on updates provided that you have consented to receipt of such information.
Compliance with our legal obligations – collection and transfer of information in order to comply with the regulatory acts or obligations with state or local government institutions.
Contractual performance – your data may be used to perform our obligations under the contract entered into by you and the Company.

2. How do we process personal data?

The Company shall process your personal data only in the events where there is legal basis:

Your consent – applies to a freely given consent, for example, to marketing activities.
Legitimate interests – when data required for protection of the legitimate interests of our Company, for example, for monitoring purposes.
Contractual performance – for performance of particular provisions of a contract.
Compliance with the law – when the law requires storing data, for example, for financial or accountancy purposes.

3. Transfer of personal data to third parties

To ensure efficient operation and services, your personal data may be transferred to the following third parties:

Processors – cooperation partners providing us with the necessary services (for example, IT, marketing, accountancy services):

Third parties shall receive only the required volume of data.
Third parties shall process data in accordance with our instructions and shall not use them for any other purposes without our consent.

Public institutions – courts and state or local government institutions when it’s required for compliance with legal requirements or protection of our legitimate interests.

Personal data shall be processed solely in the territory of EU/EEA and shall not be transferred outside this area.

4. Personal data storage terms

The Company shall store your personal date only for as long as a data processing purpose or other legal basis exists. The storage term shall be determined by:

Statutory terms – data shall be stored, for example, in compliance with financial accounting requirements.
Validity of the contract – as long as contractual relationships between you and the Company exist.
Withdrawal of consent – if the basis for processing is consent, data shall be deleted upon withdrawal of this consent, unless another legal basis exists.

When the processing purpose ceases to exist, the data shall be irreversibly deleted or anonymized.

5. Your rights in relation to personal data

You have certain rights in relation to your personal data that we shall take into account and whose exercise we shall support:

Access to data – you have the right to know what data about you are being processed and to receive a copy of such data.
Correction of data – if data are inaccurate or outdated, you may request to correct your data.
Withdrawal of consent – if the data are processed based on your consent, you may withdraw this consent at any time.
Objections and processing limitations – you may object to data processing or request to limit the processing.
Deletion of data – you may request deletion of your data when they are no longer required or your consent has been withdrawn.
Data portability – you have the right to receive your data electronically or transfer them to another service provider.
Submitting a complaint – if you believe your rights have been violated, you may file a complaint with the Company or with the Data State Inspectorate.

6. Processing or personal data for marketing purposes

In order to ensure effective marketing activities, the Company shall process your personal data, for example, in order to send information, organize contests and lotteries, or provide customer communication in connection with these activities. This document explains in detail what personal data shall be processed, the purposes of their processing, the legal basis, and the data storage periods.

Personal data processors

In order to ensure the successful conduct of marketing activities, your personal data may be transferred to other companies acting as personal data processors. These companies have been carefully selected to ensure safe and appropriate data processing respecting confidentiality.

Your personal data may be transferred to the following categories of processors:

Event organizing agencies – arranging lotteries, contests, and other public activities.
Photographers and cameramen – documenting our marketing activities in the form of photos or video materials.
Public relations and digital services providers – servicing social media accounts and ensuring online communication.
Social media and marketing platform administrators – processing data relating to promoting activities online.
Postal and courier service providers – ensuring communication, especially in cases when the winners need to be notified in person.
Institutions (law enforcement, supervision, tax administration etc.) – in the events when there is a statutory requirement to transfer personal data.
Financial, legal, and other consultants – in situations when ensuring our activities requires professional assistance.

Types of personal data, legal basis, and purpose

Processing of personal data under the marketing activities of the shopping centre shall only be carried out with a determined legal basis and for a certain purpose. Based on your consent or legitimate interests, we ensure a safe and accurate processing of your data.

Legal basis and purpose of processing of your data:

Marketing activity	Personal data	Legal basis	Purpose of processing
Creating photos and video material	Looks, visual data from public events	Legitimate interests	Promoting Olimpia and publicity in social networks, homepage, etc.
Subscribing to newsletters	Name, e-mail	Your consent	Notifying you on shopping centre news and special offers from the stores
Lotteries and contests	Full name, personal identity number	Your consent	Including you in the list of lottery and contest participants, presenting awards
Lotteries and contests	Full name, personal identity number	Legitimate interests, statutory obligations	Identification of participants, filing tax returns with the relevant authorities
Communication with the winners	Contact information (phone, e-mail)	Your consent, legitimate interests	Communication with participants in the event of receiving awards

Photos and videos from public events

In public events and activities organized in the shopping centre, event participants may be photographed or filmed. These visual materials may be published on Olimpia’s social networks, website, advertising materials or printed publications to promote our offers. When participating in the activities hosted by us, visitors should be aware that they and their children (if they participate) may appear in these materials.

Personal data storage terms

Personal data storage terms shall be set to ensure that data shall be stored only for as long as it is necessary for the implementation of a particular marketing activity or for the period prescribed by law.

Marketing activity	Type of data storage	Storage term (for deletion/destruction)
Events and activities	Electronic data	3 years after the event
Subscribing to newsletters	Electronic data	Until withdrawal of the consent
Lotteries and contests	Electronic and paper data	3 years after the completion of lottery or contest

7. Processing or personal data for security purposes

Video surveillance with recording is continuously carried out in the common areas of Olimpia, around the perimeter of the building and on the territory. The main purpose of video surveillance is to ensure the safeguarding of property and the protection of the vital interests of persons, including the protection of life and health. Video surveillance data can also be used to obtain evidence for insurance or other legal purposes.

Data Controller and Processors

The data controller of personal data obtained during video surveillance is:

SIA IREF Retail 3, Reg. No. 50203606931, which manages the Olimpia shopping center.
Contact information:

Legal address: Elizabetes iela 13-1, Rīga, LV-1010

Email: [email protected]

Data may also be transferred to other personal data processors who provide certain services related to security and insurance needs. These processors are carefully selected and comply with reliability and confidentiality requirements.

Categories of data processors:

Physical security service providers – provision of physical security of the territory of the shopping centre and responding to security violations.
Security and safety system maintenance service providers – ensuring CCTV systems are working properly and are regularly tested.
Insurance service providers – obtaining the necessary evidence related to insurance cases.
Institutions – law enforcement institutions (pre-trial investigation institutions, state security institutions, courts, etc.) to which data may be transferred in accordance with the procedure prescribed by law.
Other approved personal data processors – providing support in data processing processes in compliance with the established confidentiality and security provisions.

The company will not transfer your personal data outside the European Union.

Types of Personal Data, Legal Basis for Processing, and Purposes

Within the framework of video surveillance, data is processed for all persons present in the shopping center and within the camera's field of view, including children (persons under 18 years of age). This data is used solely for security purposes and to achieve legally established objectives.

Personal data is any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be directly or indirectly identified, particularly by reference to an identifier. Video surveillance recordings contain personal data. The video surveillance system operates 24 hours a day, 7 days a week, in motion-sensitive mode. Within the framework of video surveillance, the following personal data is processed:

Personal image,
Place of recording,
Time of recording.

Purpose: The company conducts video surveillance to prevent or detect criminal offenses related to property protection and the prevention of unlawful activities, to safeguard the legitimate interests of the data controller, and to ensure the safety and health protection of individuals.

Legal Basis: The legitimate interests of the data controller (i.e., property protection and prevention of unlawful activities) (Article 6(1)(f) of the General Data Protection Regulation), as well as the vital interests of data subjects, including the protection of health and life (Article 6(1)(d) of the General Data Protection Regulation).

When processing personal data, the following is ensured:

Security – the safety of all persons present in the shopping center.
Prevention and detection of crime – enables the identification and detection of criminal offenses and other legal violations.
Evidence collection – provides evidence for insurance purposes and legal proceedings, if necessary.

Identification and Registration of Employees and Visitors

Olimpia ensures the identification and registration of employees, visitors, and service providers upon their arrival. Personal data is processed electronically or on paper to provide transparency regarding individuals present at Olimpia at a given time.

Within the registration of employees, visitors, and service providers, the following personal data is processed:

First and last name
Personal identification number
Name of the represented company
Phone number
Email address
Date, time, and location of visit

Public Availability of Video Surveillance Data

Video surveillance data is not published and is stored securely to prevent any unauthorized access or disclosure. Access to video surveillance recordings is strictly controlled and available only to persons whose duties are related to the protection of legitimate interests. These materials can be viewed only by Olimpia administration staff and security service providers.

Personal Data Retention Periods

Data storage and deletion occur according to the following periods:

Video Surveillance:

Standard data retention – recordings are stored for up to 30 days after recording.
Data retention for investigation purposes – if an investigation is underway or a request is received from a law enforcement agency, the data is stored until the investigation is completed or until the data is transferred to the authority.

Employee, Visitor, and Service Provider Data:

Standard data retention – processed electronically or on paper until the purpose is achieved.
Data retention for investigation or law enforcement requests – until the case is resolved.

Contact Information and Complaints

If you have questions regarding the processing of personal data or the exercise of your rights, please contact us using the following:

Email: [email protected]
Address: Elizabetes iela 13-1, Riga, LV-1010, Latvia.

The Privacy Policy was approved and came into effect on November 10, 2023.

Changes to the Privacy Policy were approved and came into effect on Novembr 27, 2024.

Changes to the Privacy Policy were approved and came into effect on September 30, 2025.