Green Park cares about the privacy of visitors to its website and the Green Park complex and conducts its business in accordance with legal regulations on personal data protection, particularly the General Data Protection Regulation, which has been in effect here since April 11, 2025.
This statement aims to inform you about how and why we process your personal data in the context of using our website or visiting our services and retail park, on what basis we process such collected data, how we handle it, and what rights you can exercise in this regard.
WHO IS GREEN PARK?
REST SPV d.o.o., Ulica Charlesa Darwina 6/F, 10000 Zagreb (“Green Park”), as the owner of the website greenpark.hr and the managing company of Green Park Varaždin, is the data controller and is responsible for processing your personal data.
Green Park acts as an independent data controller in relation to web analytics and cookies, as well as for prize games and contests (unless a specific game or contest states otherwise).
In any case, and in accordance with the agreement with other joint controllers, Green Park serves as the contact point for any questions regarding the processing of your personal data:
REST SPV d.o.o.
Ulica Charlesa Darwina 6/F, 10000 Zagreb
OIB: 42428929902
HOW, WHEN, AND WHY DO WE PROCESS YOUR DATA?
Who are our data subjects?
In our operations, we especially process personal data of the following data subjects:
- Business partners (if they are sole traders, owners of family farms, or holders of other independent activities), or their contact persons (in the case of companies and other legal entities);
- Recipients of our newsletters;
- Participants in prize games and contests (including those who register themselves and, if applicable, persons they nominate);
- Visitors to Green Park, users of services and parking spaces within the complex;
- Visitors to our website.
Personal Data We Process
For the purposes of our activities, we process the following categories of personal data:
- Basic personal information (such as full name, address, ID number, personal identification number (OIB), signature);
- Contact details (such as phone number, email address, job position, social media username);
- Content of your messages (compliments, complaints, suggestions, opinions, etc.);
- Video recordings (footage of individuals that allow identification and vehicle license plates);
- IP address and your preferences.
How Do We Collect Your Personal Data?
We collect the personal data we process in one of the following ways:
- When you submit a request (e.g. application for leasing space or for advertising and promotion, application to participate in a prize game/contest);
- When you give consent for direct marketing (newsletter);
- When you send complaints, compliments, or other messages;
- When you are present in areas under video surveillance;
Purposes for Which We Collect Data and Legal Grounds for Collection
In the context of using the website and visiting the Green Park complex, the purposes and legal grounds for processing personal data vary depending on the specific activity. Generally speaking, we process personal data in order to fulfill your requests, enter into and perform contracts, and for our own marketing purposes and to pursue our legitimate interests in improving business operations and ensuring security.
For more details on the processing of personal data, the applicable purposes, and legal grounds for each specific activity, please refer to the activity of your interest:
- Applications for leasing space or for advertising and promotion
- Sending compliments, complaints, suggestions, and opinions (“visitor messages”)
- Direct marketing (newsletter)
- Cookies and similar technologies
- Video surveillance
- Prize games and contests
- Event photography
Applications for Leasing Space or for Advertising and Promotion
To support the continuous development of our business, we allow potential tenants and business partners (for advertising and promotional purposes) to contact us through dedicated forms on our website. We process the data solely for the purpose of handling your request, so that we can get back to you and, depending on the circumstances, initiate negotiations for concluding a lease or business cooperation agreement.
The full name, company or trade name, and email address provided in the web forms are necessary for us to identify who is submitting the inquiry and how to contact them regarding the request. In the leasing form, we additionally ask you to briefly indicate whether you’re interested in a short-term or long-term lease, so we can consider your inquiry accordingly. You also have the option to include details of your request directly in the form, as well as a phone number to facilitate further communication.
If we receive the inquiry directly from a potential tenant/business partner (e.g., a sole trader), the legal basis for processing the data is their request for steps prior to entering into a contract. If the inquiry is submitted by a person other than the prospective tenant/business partner (e.g., someone authorized to represent a company), the legal basis is our legitimate interest in initiating business communication with potential tenants/business partners (for potential contract negotiations).
The data is entered into a dedicated database of potential tenants/business partners, which we maintain based on our legitimate interest.
Sending Compliments, Complaints, Suggestions, and Opinions (“Visitor Messages”)
We value your opinion and therefore enable you to send us compliments, complaints, suggestions, opinions, and other messages (hereinafter referred to as “visitor messages”) via email or by postal mail.
In order to respond to your messages and ensure they are addressed and acted upon, we need to process their content, which includes personal data. Depending on how the message is sent (by regular mail or email), the data we process includes your full name, email address or home address, and in any case, the content of your message.
The processing of personal data related to your messages is based on our legitimate interest, which lies in assisting our visitors, thereby enhancing Green Park’s reputation and improving our operations.
Direct Marketing (Newsletter)
Direct marketing is a form of information and advertising through which we communicate directly with our visitors via email. The newsletters we send include announcements about discounts, events, and updates from Green Park.
To deliver the newsletter, we collect and process only your email address, based on your expressed consent. Email addresses are stored separately in a dedicated newsletter database.
You may withdraw your consent at any time, free of charge, either by clicking the ‘unsubscribe’ link found at the bottom of every newsletter or by sending a request to the email address: info@greenpark.hr.
We use the Mailchimp platform, i.e. services provided by The Rocket Science Group, LLC from the USA (Atlanta, Georgia 30308, USA), to deliver newsletters, manage recipient lists, and keep records of objections (i.e., unsubscribes). This company acts as a data processor and, when processing newsletter recipients’ email addresses, acts on our instructions and takes all necessary data protection measures in accordance with its participation in the Privacy Shield framework.
You can find more information about the “Privacy Shield” program on the website of the Croatian Personal Data Protection Agency. As part of using the MailChimp platform, we also collaborate with the marketing agency Traffika d.o.o. from Varaždin, whose authorized personnel may have access to the email address database. They act strictly according to our instructions and are not permitted to use the data from the database in any way.
Cookies and similar technologies
We use cookies and similar technologies (hereinafter collectively referred to as “cookies”) on our website primarily to enable certain technical functionalities (e.g., cookies that determine whether you have given consent to cookies, your language preference settings, etc.) and to improve our services (e.g., cookies that allow us to analyze traffic to specific content). The use of cookies does not necessarily involve the processing of personal data.
When personal data is processed via cookies (e.g., your IP address and preferences while browsing our website), we do so based on a lawful legitimate interest (for cookies necessary for the functioning of the website and provision of services) or based on your consent (for analytical cookies).
For analytical purposes, we use the cloud-based Google Analytics service provided by Google Inc. (“Google”), and data is transferred to and stored on servers in the USA. As a participant in the Privacy Shield framework, Google takes all necessary measures to protect the data. You can find more information about the “Privacy Shield” program on the website of the Croatian Personal Data Protection Agency.
There are also several external services (e.g., Facebook, Google) that store certain cookies on the devices of visitors to our website (so-called third-party cookies). These cookies enable additional features for visitors, such as access to social media, sharing articles on social networks, using navigation maps (Google Maps), and similar functionalities. These cookies are not set by our website and are controlled by the respective external services.
Video Surveillance
Our video surveillance system covers the shared interior areas and facilities within the complex (excluding individual stores), parts of the parking area and roadways, as well as the food court area. The purpose of this surveillance is to ensure your safety while at Green Park and to protect property — yours, ours, and that of other businesses operating within the complex.
The processing of data (footage of individuals enabling identification and vehicle license plates) is carried out based on the legitimate interest outlined in the Law on the Implementation of the General Data Protection Regulation. Video recordings are used exclusively for the purpose of ensuring safety and investigating potential unlawful behavior (i.e., for follow-up actions in the event of recorded incidents), all in accordance with legal regulations.
The video surveillance system is protected against unauthorized access. Access to the recordings is granted only to authorized persons, namely members of the management of REST SPV d.o.o., the maintenance technician, and the complex manager. All authorized representatives of external partners act strictly according to our instructions and under contractual agreements. In accordance with the law, competent government authorities may also access the footage in the course of carrying out duties within their legally defined powers.
As for your rights, we refer you to the section titled Your Rights and How to Exercise Them toward the end of this document. Please note that, in order to exercise certain rights, you may need to provide specific information (e.g., time and location of the recording) to help identify the footage related to you. Also, the exercise of some rights may be restricted (e.g., to protect the rights of other individuals recorded in the footage). In any case, you are entitled to receive further information regarding the processing of your data and all related circumstances.
Prize Games and Contests
As part of our business activities, we frequently organize various prize games and contests to promote Green Park, our shops, services, and products. In doing so, we collect and process personal data, which may vary depending on the specific prize game or contest. This data may include personal information such as social media usernames, comments or photographs (that enable individual identification), full name, contact details (email address and/or phone number), address, age, and similar.
This data is necessary for the administration of the prize game or contest and for awarding prizes. We process it based on your request to participate — in order to fulfill our obligations arising from the prize game or contest.
When awarding prizes, we may process additional personal data — typically, we request to see an ID card and record the ID number and the recipient’s signature on the prize confirmation form. We collect such data based on our legitimate interest in ensuring we can prove fulfillment of our obligations to the winner, as well as to defend and exercise legal claims.
Details regarding the processing of personal data for a specific prize game or contest are always provided in the privacy notice that accompanies each individual event.
Event Photography
As part of our business activities, we frequently organize various events to promote Green Park, its stores, services, and products. Some of these events are photographed, and the photos may be used for publication on social media or in PR articles in the media.
Purpose and Legal Basis:
The capturing, storage, and public sharing of photographs on Green Park’s social media platforms (Facebook, Instagram) and in PR publications in various print and online media serve the purpose of promoting Green Park and its events, as well as similar future events, and more broadly, the promotion of the activities, products, and services of the shops and the Green Park complex.
- Subsequent public sharing of photos on Green Park’s social media and in media PR publications is aimed at building Green Park’s public image and advertising future similar events.
- Sharing photos with business partners/tenants serves the purpose of reporting and proving the fulfillment of obligations.
- When delivering and publishing photographs, we take special care to ensure they are mainly wide or group shots, without focusing on specific individuals.
The legal basis for such data processing is our legitimate interest in: promoting and advertising Green Park, improving our own marketing, and fulfilling obligations to our business partners — all in the interest of improving our operations.
Who Are the Recipients of Personal Data?
Within the limits permitted by law and depending on the specific processing activity, we share or grant access to your data to the following partners: Cloud-based software service providers and business partners mentioned in this statement under the relevant processing purposes.
In some cases, recipients of personal data may be located outside the EU. As explained in more detail in the section “Purposes for Which We Collect Data and Legal Grounds for Collection,” in all instances of data transfer to such countries, an adequate level of personal data protection is ensured in accordance with regulations (e.g., through the recipient’s participation in the “Privacy Shield” program in the case of recipients from the USA, or by concluding standard contractual clauses with the recipient).
You may also request additional information at any time about the transfer of personal data outside the EU and the protective measures applied, using our provided contact information.
How Long Do We Keep Your Data?
We retain your data only for as long as there is a purpose for its storage and processing.
- Accounting documents (e.g., invoices and prize/gift voucher receipts): 11 years (in accordance with accounting regulations);
- Data obtained based on consent (e.g., email address for the newsletter): only as long as the consent remains valid;
- Database of potential tenants/business partners: up to 12 months;
- Visitor messages (compliments, complaints, suggestions, etc.): for as long as needed to consider and respond to your message, depending on its content and our capabilities (approximately 2 weeks). Consumer complaint records are kept for 1 year from the date of receipt (in accordance with consumer protection laws);
- Data processed in connection with potential damage claims: retained in accordance with legal limitation periods (up to 5 years);
- Prize games and contests: until complaint resolution is no longer needed (depending on the time frame defined by the contest rules), or exceptionally longer in the case of inspections or pending legal action, in line with limitation periods (maximum of 4–5 years);
- Video surveillance footage: typically retained for up to 15 days from the date of recording. If an incident is captured and reported, footage may be kept longer if necessary for legal proceedings;
- Legal proceedings: if legal proceedings arise, personal data necessary for such proceedings is retained until the case is lawfully concluded. Finalized damage claims are retained for 10 years after the decision or settlement becomes legally binding (in accordance with statutory limitation periods);
- If certain data used for fulfilling a contract is subject to tax obligations, the retention period is extended to 10 years in line with tax regulations, and the processing of such data is limited during that time.
If the same data is used for multiple purposes, we retain it until the expiration of the longest applicable retention period. However, we cease using it for purposes whose (shorter) retention periods have expired.
After the data retention period expires, your data that is no longer needed is either irreversibly anonymized (and anonymized data may be retained) or securely deleted/destroyed.
Your Rights and How to Exercise Them
All our data subjects are entitled to the rights guaranteed by personal data protection regulations. You have the following rights:
- Right to withdraw consent (when processing is based on consent)
- Right of access
- Right to erasure (“right to be forgotten”)
- Right to rectification
- Right to object
- Right to restrict processing
- Right to data portability
- Right to lodge a complaint with the competent authority
Any inquiries or requests you submit will be handled without undue delay and in accordance with legal obligations, and we will inform you of the actions taken.
Right to Withdraw Consent
Newsletter subscribers have the right to withdraw their consent at any time, completely free of charge:
- by clicking the ‘unsubscribe’ link found at the bottom of each newsletter, or
- by sending a request to: info@greenpark.hr
Right of Access
You have the right to obtain confirmation from us as to whether we are processing your personal data (including a copy of such data), and to access information about the processing (e.g. purposes, categories of personal data, recipients, retention periods). In cases where your data is transferred outside the EU, you have the right to information about appropriate safeguards.
Right to Erasure (“Right to Be Forgotten”)
You have the right to request the erasure of your personal data without undue delay if there is no lawful reason for continued processing (e.g. if the data is no longer necessary for the purposes it was collected for). If a lawful reason for retention still exists, we will inform you of this in our response.
Right to Rectification
You have the right to have inaccurate personal data corrected without undue delay. Taking into account the purposes of processing, you also have the right to complete incomplete data, including by providing a supplementary statement.
Right to Object
If processing is based on our legitimate interests, you have the right to object at any time to such processing to the extent it relates to your personal data. In such cases, we will no longer process the data for that purpose unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or if the data is needed for the establishment, exercise, or defense of legal claims.
Right to Restrict Processing
You have the right to request restriction of the processing of your personal data if:
- you contest its accuracy;
- the processing is unlawful and you oppose erasure;
- you need the data for legal claims, and we no longer need it for processing;
- you have objected to processing and are awaiting verification.
Right to Data Portability
You have the right to receive your personal data, which you provided to us, in a structured, commonly used, and machine-readable format, and to transmit it to another service provider. Where technically feasible, you have the right to have the data transmitted directly from us to another controller.
CONTACT FOR EXERCISING RIGHTS:
You may exercise the above rights by contacting us at: info@greenpark.hr
COMPLAINT TO THE COMPETENT AUTHORITY
You may also exercise your rights by lodging a complaint with the supervisory authority regarding the processing of your personal data.
In the Republic of Croatia, this is the Croatian Personal Data Protection Agency, Martićeva ulica 14, 10 000 Zagreb. Additional contact information is available on their website: azop.hr
Amendments and Updates
Given our ongoing commitment to protecting your data, we may make changes to this statement over time in order to align it with actual practices and legal requirements. In the event of significant changes, we will take appropriate measures to inform you in a timely and suitable manner about all such amendments and updates.
