KINEPOLIS BUSINESS POLICY RELATING TO THE PROTECTION OF PERSONAL DATA

1. To whom does this Privacy Policy apply?

This Personal Data Protection Policy applies to all products and services offered by Kinepolis Group to its customers and prospects. This Privacy Policy provides you with the necessary information about the type of personal data we process, how we use it, your rights in this regard and how you can exercise them.

The processing of personal data is only applied if the professional client is a natural person. If the professional client is a legal person, the policy regarding respect for the protection of personal data only applies to the personal data of natural persons that Kinepolis processes in the context of its relations with the professional client (such as contact persons and agents).

2. Who is responsible for the “processing” of personal data?

The personal data that you communicate to us, expressly or automatically, are collected and processed by or on behalf of Kinepolis Group SA, whose head office is established at 1020 Brussels (BELGIUM), 20, Boulevard du Centenaire, registered at the Banque-Carrefour des Entreprises under the VAT number BE 0415.928.179, registered with the Brussels RPM 622 315, with a correspondence address at 9000 Ghent (BELGIUM), Moutstraat 132-146, and its subsidiaries, hereinafter jointly referred to as “Kinepolis” .

Kinepolis Group shares this data with its subsidiaries (other legal entities, such as individual Kinepolis cinemas or a group of several Kinepolis cinemas, hereinafter jointly referred to as “Kinepolis”) in order to offer you the best possible service.

Kinepolis is the so-called “controller” of personal data which is collected through the website, mobile applications and other channels.

3. What data does Kinepolis process about me? How does Kinepolis receive this data?

Personal data is data that directly or indirectly identifies a natural person. Even if the processing takes place in the context of B2B relationships, it does not effectively imply that you, as a contact person or as a website visitor, lose your rights as a natural person.

As part of its service provision, Kinepolis collects and processes the following categories of personal data:

Identifying data and contact details, such as name, email address, language preference, gender;
Payment data in connection with the execution of contracts concluded with our customers;
Data relating to products and services ordered;
Information following contacts with you in the context of our service provision;
Photos and video recordings of events, at which attendees may be recognizable.

In principle, the data will not be collected from third parties, but are requested from you, as on the occasion of a request for information, when purchasing a product or service, when participating to a survey or a competition, during registration and during the management of your customer account.

In addition, certain publicly available information may be used to contact you.

In addition, we work with companies that can provide us with contact details where we make sure they are authorized to do so, taking into account the purpose for which Kinepolis will process personal data.

Finally, some data is collected automatically by “cookies” and other systems that collect information. This includes, for example, your IP address, browser type and language, length of your visit, browsing behaviour and pages you have visited. You can find more information about cookies in our Cookie Policy.

4. Why does Kinepolis process this data?

Kinepolis collects, stores and processes personal data with a view to:

provide you with the products (such as gifts) and services (such as events) that you have ordered and then inform you, based on our legitimate interests, about our products and services; where appropriate we can also provide you with tailor-made information using a profile that Kinepolis has obtained on the basis of your interests and in addition inform you of the products and services that are offered by Kinepolis business partners (for the latter, only after obtaining your agreement);
ensure the follow-up of our services provided and be able to respond to your observations and / or questions concerning our services and ensure customer administration and dispute management and in general meet our legal obligations, particularly in accounting and tax matters;
to inform you, as an interested potential customer (such as via our Kinepolis Business newsletters) about products and services, including actions and promotions, that Kinepolis offers or that are offered by Kinepolis business partners (through the ‘obtaining your consent);
provide you, as an interested potential customer with tailor-made information about Kinepolis products and services by means of a profile that Kinepolis has obtained according to your interests;
analyze customer satisfaction;
for (general) market research, statistical purposes and analysis of the operation and use of the website and mobile applications;
to put you in touch with suppliers to provide additional services, e.g. catering or audio-visual material for an event;
for handling and following up your requests for implementation of your privacy rights and other privacy-related queries;
for managing VIP passes;
photographs and video recordings of events are used as a reminder for attendees, to give an atmospheric image to those who could not attend the event and to promote Kinepolis’ activities.

Processing for the purposes mentioned in (i) and (ii) above is necessary for the conclusion or performance of our agreement with you.

Processing for the purposes mentioned in (i), (iii), (iv), (v), (vi), (vii), (ix) and (x) above is necessary for our legitimate interests to improve and promote our products and services, as well as to ensure a personalised experience for our customers.

Processing for the purpose mentioned in (viii) above is necessary to comply with the legal obligations incumbent on Kinepolis.

To the extent required by law, as under points (iii), (iv) and (x) certain processing operations will require your consent.

Kinepolis may use your personal data to contact you directly, by post, by telephone or electronically, in particular by email, SMS or social networks. In case this communication is send for commercial purposes, you will always have the possibility to “unsubscribe” at any time.

5. How long does Kinepolis keep my personal data?

Kinepolis keeps your personal data only for the period necessary for the purposes described. In principle, your personal data is deleted five years after your last active interaction with Kinepolis. Thus, we also avoid the retention of irrelevant information. Since the action for contractual liability is only prescribed after 10 years, we will archive certain personal data during this period, and only for this purpose. If other legal obligations impose a longer-term conservation (in particular, in terms of conservation of invoices), we will obviously respect this regulation.

6. Does Kinepolis pass my personal data on to other organizations?

For the achievement of the purposes referred to in Article 4, Kinepolis may use “subcontractors”. They act exclusively on our behalf and may only process your personal data according to our instructions and within the framework of this Privacy Policy.

For example, we will use vendors for marketing, communications, logistics and IT services, to personalize and optimize our services, process credit card transactions and collections, and limit losses. fraud during transactions by credit card or any other means of payment, to organize contests, to deliver the products purchased, to co-organize our events, to provide our customer services, to collect debts, etc.

These providers may be given access to your personal data or other information when providing such services. We only authorize these companies to process your personal data to the extent that this is necessary for the provision of their services. We also ensure that these subcontractors ensure an adequate level of security in terms of data protection.

In addition to the involvement of such “subcontractors” for the services described, we share the personal data that you have expressly communicated to us, such as your name, email address and other non-automated data, with other parties. only if we have received your express consent to do so, unless a legal provision, a request from a public body or a court decision requires us to do so.

In addition, we may transmit your personal data to companies within Kinepolis Group and share them with them which, depending on the case, will be considered as processors or as joint controllers.

7. Are personal data transmitted to countries which do not guarantee similar personal data protection?

Kinepolis collects your data in its databases and aims to protect this data in accordance with the market against any modification, loss or illegal use.

When we process your personal data outside the EU, we ensure, through contractual or other measures (such as the standard contractual clauses of the European Commission), that these data benefit from an adequate level of protection comparable to the level of protection applied within the EU.

8. What right can I exercise regarding my personal data?

When your data has been collected and processed, you have the right to consult this personal data, to demand their rectification if they prove to be incorrect and, with a reason, to request the deletion of the personal data. However, it should be taken into account that we cannot always delete all the personal data requested, in particular when their processing is necessary for the establishment, exercise or justification of legal action.

In addition, you also have the right to request that processing be “restricted” (in cases where immediate deletion would put you at a disadvantage, then personal data will only be made inaccessible).

If you wish, it is also possible to transfer the personal data that you have actively provided to another service provider. This is the “right to data portability”.

Whenever the processing is based on a legitimate interest of Kinepolis, you have the right to object to this processing. If your request is justified, Kinepolis will stop processing your personal data, unless the processing of personal data is linked to the establishment, exercise or justification of legal action (e.g. ., filing an application with a court).

Where processing is based on your consent, you have the right to withdraw that consent at any time, without prejudice to the lawfulness of processing based on consent prior to such withdrawal.

Finally, you always have the right to object, without having to give a reason, to the use of your personal data for direct marketing purposes.

9. How can I concretely exercise these rights?

You can exercise these rights by sending an email to privacyB2B@kinepolis.lu.

Kinepolis has the right to request additional information to confirm your identity. We do this in order to protect your personal data, among other things to ensure that no third party can see your personal data.

10. Can Kinepolis make changes to this Privacy Policy?

This Personal Data Protection Policy may be amended from time to time, in particular with a view to adapting it to a change in the provision of services or in legal and regulatory requirements. You will always find the most recent version on the website.

11. Who can I contact in case of a lack of clarity or possible complaints?

You can contact us by sending an email to dpo[at]kinepolis[dot]com for your questions or general observations relating to your personal data which do not concern the exercise of your rights as mentioned above in points 8 and 9.

For complaints relating to the processing of your personal data by Kinepolis, you can also contact the National Commission for Data Protection 1, avenue du Rock’n’Roll, L-4361 Esch-sur-Alzette, Tel. +352 2610 60 1, e-mail: info@cnpd.lu, Website: https://cnpd.public.lu/fr.html