Privacy Policy

PRIVACY NOTICE FOR INGKA CENTRES ACCOUNT

1. Which companies are data controllers of your data?

We know how important it is for you to understand how we use your data. This Privacy Notice sets out how and why we collect, store, process and share your personal data when you set up and use your Ingka Centres Account (the “Account”).

Your personal data is processed and protected by the European Ingka Centres companies listed in the table in section 10 below (jointly “we”, “us” or “Ingka Centres”). These companies are joint controllers of your personal data, which means that they jointly determine the purposes and means of processing your personal data for the purpose of the Account. The joint controllers have entered into an agreement to govern their shared responsibility for your personal data, and the agreed roles and responsibilities are described in this privacy notice. Your personal data will be shared between the joint controllers only as needed to provide you with the Account and related services.

There are also situations where your Local Joint Controller (as defined below) acts as a Sole Controller for the processing of your personal data. Information on said processing is also described below. This means that in some situations (as described below), only the Local Joint Controller is responsible for the processing of your personal data.

2. Your preferred meeting place and Local Joint Controller

When you choose Mar Shopping Algarve or Matosinhos as your preferred meeting place, your primary point of contact is Ingka Centres Portugal, S.A (the “Local Joint Controller”).

The registered address of the Local Joint Controller is: Centro Comercial "Mar Shopping", Avenida Dr. Óscar Lopes 4450-337 Leça da Palmeira, Portugal. .

If you have questions or concerns in relation to the processing of personal data or this Privacy Notice, please contact the data protection officer or privacy point of contact for the Local Joint Controller (for joint or sole controllership processing):

Address: Centro Comercial "Mar Shopping", Avenida Dr. Óscar Lopes 4450-337 Leça da Palmeira, Portugal

Email: [email protected]

If you have given a marketing consent, such consent is given to the Local Joint Controller who is responsible for all communication with you in relation to your Account and any connected services and offerings.

Your directly identifiable personal data is primarily processed by the Local Joint Controller and Ingka Centres Services AB. It is only shared on a need-to-know basis with the other Local Joint Controllers e.g. if you actively interact with (register or log-in) a meeting place operated by another Local Joint Controller.

3. Why do we collect and process your data?

3.1. Joint controllership

We collect and process your personal data to provide you with access to the Account and its functionalities and benefits. We may process your personal data to personalise your experience by tailoring content, offers, services, and communication based on your interactions, preferences, location, and use of our digital channels. This includes recommending events, services, or promotions that may be relevant to you based on your Account activity and past engagement with our meeting place(s). Additionally, collecting and processing your data allows us to provide you support where you need it, manage your requests for information and services and, where necessary, manage any complaints you may have with our service.

We may also analyse your data for statistical purposes and share your data with other companies within the Ingka Group and third parties who help us segment and understand our customers by providing additional information.

3.2. Ingka Centres Portugal as Sole Controller

Ingka Centres Portugal collects and processes your personal data to provide you with support on several fronts, capture images of our events, manage requests and findings and, eventually, manage any complaints you may have with our service. Ingka Centres Portugal also processes your personal data to provide you with gift cards, manage our campaigns and relationships with suppliers and service providers, in-store loans and orders, the use of your infrastructures or the provision of free wi-fi.

We may also process your personal data if you apply to a job with us or send an application, or to send you news about Mar Shopping.

This processing is focused on your direct interaction with the Mar Shopping centers in Portugal (Matosinhos and Algarve).

4. What personal data do we collect and process?

4.1. Joint controllership

We may collect the following types of personal data:

Information you provide directly to us: This may include your name, email address, phone number, and any other information you choose to provide when you create or use your Account, contact us, complete a form, subscribe to our newsletter, book a service or event, or participate in a survey or promotion.

Information we collect automatically: When you interact with your Account, we may automatically collect certain information, such as your IP address, browser software, operating system, and meeting place from which you have accessed your Account.

In the table below, we have set out a description of the ways we may use your personal data in the context of your Account, for what purpose, and which legal bases we rely on to do so.

4.2. Ingka Centres Portugal as Sole Controller:

All of the personal data processed for the purposes below only has Ingka Centres Portugal as a Controller. All of the personal data Ingka Centres Portugal processes for the purposes below are provided directly by you.

Please note that we also process your data using cookies, to make the browsing experience on our website as fluid as possible and remember your preferences so that data does not have to be entered repeatedly. These cookies also allow us to optimize the way our website woks and, with your consent, to deliver relevant advertisements.

You can control which cookies are used. You can read more about that in our Cookie Policy.

Applicable to both situations:

Please note that where your data is processed on the basis of consent, you may withdraw your consent at any time without any consequences to yourself as a data subject. You can unsubscribe to direct marketing at any time by clicking the “unsubscribe” link in each email or by changing the settings in your account.

Please note that, while you may object to or request us not to process your data, in certain cases this could make it impossible for us to provide you with an Account and related services.

Providing personal data is a contractual requirement and a requirement necessary for concluding a contract. Providing it is not always mandatory, however, failure to provide it may affect the ability to use the Account and the services associated with it.

5. How long do we keep your data?

We keep your personal data as long it is necessary to provide a service to you, for business and operational reasons, or based on legal obligations. The time we keep your personal data depends on the specific purpose for which it was collected:

5.1 Joint controllership

• Contract performance: We process your personal data for purposes related to the performance of a contract, including identity and access management, setting up your account, providing customer support, and delivering loyalty scheme functionality (such as managing your participation in and activity within the loyalty program). We retain this data for two (2) years after your last login to your Account.

• Marketing: We process your personal data based on your consent, such as your email address and phone number, to send you personalized marketing communications. We also process data used for marketing analysis and profiling, such as booking history, activities, services used, shopping preferences, and loyalty program activity, to tailor our marketing to your interests. We retain your personal data for up to 24 months from the date consent is given, unless you withdraw your consent earlier.

• Audit and security: We process your personal data for purposes related to pursuing our legitimate interests, including auditing and security purposes. This includes processing your full IP address (metadata) and browser software (metadata), as well as your phone number if you choose SMS OTP authentication. We retain this data for two and a half (2.5) years after your last login to your Account. This retention period is necessary to detect and prevent fraud, ensure the security and integrity of our platform, and comply with our security obligations.

• Complying with a legal obligation: We may retain certain personal data associated with your Account to comply with legal, tax, and accounting requirements, and to respond to lawful requests from authorities. This retention is separate from the data we keep for providing the Account service. Typically, such data is retained for up to 10 years after the end of the contractual or commercial relationship, unless a longer period is required by law (for example, in case of ongoing disputes or specific legal obligations).

When we no longer need your personal data for the intended purpose(s), the data will be deleted or anonymised so you can no longer be identified.

5.2. Ingka Centres Portugal as Sole Controller

• Management of customer complaints: For complaints presented in the Complaints Book, 3 years from the moment the complaint is presented.

• Video surveillance for the purpose of protecting people and property: 30 days.

• Data processing for tax purposes: 10 years from invoice issuance.

• Use of the Lego Kiddyland Platform: 1 year or until the data subject requests its deletion, if this is earlier.

• Provision of free Wi-Fi at MAR Shopping; Storing your MAC address for the same purpose: 1 year or until the data subject requests its deletion, if this is earlier. Use of the Wi-Fi service – 5 days;

• Sending newsletters about Mar Shopping: Until the consent provided by the data subject is revoked or the account is deleted due to deletion or inactivity.

Personal data being processed that do not have a specific deadline included herein will only be processed until the purpose with which the data were gathered ceases. Further retention will only apply if there is a need to comply with any legal obligation.

6. Who has access to your personal data?

Applicable to both sole and joint controllership situations

The Controller(s) may use third-party subcontractors to process your personal data, on our behalf, and in accordance with the instructions provided by us, in strict compliance with applicable legislation, as well as this notice.

Specifically, your personal data may be shared with the following categories of recipients:

• Companies within Ingka Group who provide intra-group services and provide operational support.

• Third-party service providers who perform services on our behalf for the purpose of inter alia identity and authentication service, email delivery and communication, providing the booking engine used to manage and create bookings, delivery partners and cloud hosting.

• Other joint controllers (set out in the table in section 10 below) than your Local Joint Controller or Ingka Centres Services AB, when you actively choose to interact with an Ingka Centres Meeting Place in that country (applicable to joint controllership only).

• Government bodies, law enforcement agencies, or other regulatory authorities, when required by law, court order, or for the fulfilment of legal obligations.

Any entity subcontracted in this context will not transmit your data to other entities without the Controller’s(s) prior written consent and without an applicable legal basis for such transmission. The Controller(s) undertakes to subcontract only entities that offer adequate guarantees of the implementation of technical and organizational measures to ensure the protection of your rights. All entities subcontracted by the Controller(s) will be bound by a written contract that regulates, among other, the subject matter and duration of the processing, the nature and purpose thereof, the categories of data subjects, and the rights and obligations of the parties.

In accordance with applicable legislation, the Controller(s) may transmit or communicate your personal data to other entities, when such transmission or communication is necessary for the execution of the contract concluded between us or when it is necessary to comply with a legal obligation to which the Controller(s) is subject.

The Controller(s) may periodically check whether third parties comply with their obligations and comply with measures for the protection of personal data.

7. International Data Transfers

Applicable to both situations

We may in some instances, transfer personal data to suppliers outside of the European Economic Area and/or the United Kingdom. These transfers are made lawful through appropriate safeguards such as standard contractual clauses approved by the European Commission (appropriately amended to reflect the United Kingdom’s status outside of the European Union).

If you would like further information, please contact us.

8. Your rights

Applicable to both joint and sole controllership situations

Under privacy laws, including the General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation and the Swiss Federal Act on Data Protection of 19 June 1992 (as applicable to each case), you have certain rights in relation the personal data that we hold about you. There will not usually be a charge for dealing with these requests. You may exercise these rights at any time by contacting us using the details set out in section 1.

The access, rights and controls might vary depending on your request, however, in general the following rights are available to you, unless we communicate or justify otherwise.

Access: You are entitled to gain confirmation from us about the data that we process about you, and, where that is the case, access to the personal data.

Rectification: You are entitled to ask us to update and amend your data that might be inaccurate, incomplete or outdated.

Erasure (“right to be forgotten”): You are entitled to request us to delete some data which no longer necessary is for its purpose.

Restriction: You are entitled to ask us to temporarily or permanently restrict/stop some of the processing of your data.

Object: You are entitled to at any time, object to the processing of your data, including direct marketing.

Data portability: You are entitled to receive a readable copy about your data and, if requested, have the data to be transferred to another service provider.

Not be subject to automated decision-making: You are entitled to not be subject to a decision based solely on automated processing, including profiling, which creates legal effects concerning you, or similarly significantly affects you.

Right to complain: You have the right to send a complaint about our use of your personal data to your local data protection authority. However, before doing so, we would of course love to hear from you and get the chance to address your concern.

Your local Data Protection Authority is Comissão Nacional de Proteção de Dados. For more information about them, please view their website at www.cnpd.pt.

Making a complaint to your local Data Protection Authority will not affect any other legal rights or remedies that might be available to you.

Please note that you may contact Ingka at any time by sending an email to [email protected], to be informed in complete clarity of the operations indicated and the rights mentioned and, if you wish, to obtain more information and exercise any of the rights mentioned above.

Withdrawal of consent: You have the right to withdraw your consent at any time.

9. How will I know if this Privacy Notice has changed?

As privacy regulations change and we develop our processes and services, we may make changes to this Privacy Notice. All future changes to our Privacy Notice will be updated online and accessed through the Account with the last date of update displayed as below. If we make material changes to the Privacy Notice we may also inform you by email.

We encourage you to review this page regularly for any changes in the Privacy Notice. Your continued use of your Account and our services after any implemented changes or revision to this Privacy Notice shall indicate your agreement with the revised terms.

10. The joint controllers

This Privacy Notice was last updated on [10.02.2026].