
Privacy Policy
PRIVACY NOTICE FOR INGKA CENTRES ACCOUNT
1. Which companies are data controllers of your data?
We know how important it is for you to understand how we use your data. This Privacy Notice sets out how and why we collect, store, process and share your personal data when you set up and use your Ingka Centres Account (the “Account”).
Your personal data is processed and protected by the European Ingka Centres companies listed in the table in section 10 below (jointly “we”, “us” or “Ingka Centres”). These companies are joint controllers of your personal data, which means that they jointly determine the purposes and means of processing your personal data for the purpose of the Account. The joint controllers have entered into an agreement to govern their shared responsibility for your personal data, and the agreed roles and responsibilities are described in this privacy notice. Your personal data will be shared between the joint controllers only as needed to provide you with the Account and related services.
There are also situations where your Local Joint Controller (as defined below) acts as a Sole Controller for the processing of your personal data. Information on said processing is also described below. This means that in some situations (as described below), only the Local Joint Controller is responsible for the processing of your personal data.
2. Your preferred meeting place and Local Joint Controller
When you choose Mar Shopping Algarve or Matosinhos as your preferred meeting place, your primary point of contact is Ingka Centres Portugal, S.A (the “Local Joint Controller”).
The registered address of the Local Joint Controller is: Centro Comercial "Mar Shopping", Avenida Dr. Óscar Lopes 4450-337 Leça da Palmeira, Portugal. .
If you have questions or concerns in relation to the processing of personal data or this Privacy Notice, please contact the data protection officer or privacy point of contact for the Local Joint Controller (for joint or sole controllership processing):
Address: Centro Comercial "Mar Shopping", Avenida Dr. Óscar Lopes 4450-337 Leça da Palmeira, Portugal
Email: [email protected]
If you have given a marketing consent, such consent is given to the Local Joint Controller who is responsible for all communication with you in relation to your Account and any connected services and offerings.
Your directly identifiable personal data is primarily processed by the Local Joint Controller and Ingka Centres Services AB. It is only shared on a need-to-know basis with the other Local Joint Controllers e.g. if you actively interact with (register or log-in) a meeting place operated by another Local Joint Controller.
3. Why do we collect and process your data?
3.1. Joint controllership
We collect and process your personal data to provide you with access to the Account and its functionalities and benefits. We may process your personal data to personalise your experience by tailoring content, offers, services, and communication based on your interactions, preferences, location, and use of our digital channels. This includes recommending events, services, or promotions that may be relevant to you based on your Account activity and past engagement with our meeting place(s). Additionally, collecting and processing your data allows us to provide you support where you need it, manage your requests for information and services and, where necessary, manage any complaints you may have with our service.
We may also analyse your data for statistical purposes and share your data with other companies within the Ingka Group and third parties who help us segment and understand our customers by providing additional information.
3.2. Ingka Centres Portugal as Sole Controller
Ingka Centres Portugal collects and processes your personal data to provide you with support on several fronts, capture images of our events, manage requests and findings and, eventually, manage any complaints you may have with our service. Ingka Centres Portugal also processes your personal data to provide you with gift cards, manage our campaigns and relationships with suppliers and service providers, in-store loans and orders, the use of your infrastructures or the provision of free wi-fi.
We may also process your personal data if you apply to a job with us or send an application, or to send you news about Mar Shopping.
This processing is focused on your direct interaction with the Mar Shopping centers in Portugal (Matosinhos and Algarve).
4. What personal data do we collect and process?
4.1. Joint controllership
We may collect the following types of personal data:
Information you provide directly to us: This may include your name, email address, phone number, and any other information you choose to provide when you create or use your Account, contact us, complete a form, subscribe to our newsletter, book a service or event, or participate in a survey or promotion.
Information we collect automatically: When you interact with your Account, we may automatically collect certain information, such as your IP address, browser software, operating system, and meeting place from which you have accessed your Account.
In the table below, we have set out a description of the ways we may use your personal data in the context of your Account, for what purpose, and which legal bases we rely on to do so.
Data Type | Purpose | Legal Basis |
|---|---|---|
First Name | • Identity and access management | Contract |
Last Name | • Identity and access management (optional) Required to set up account Provide support (optional) | Contract |
Email Address | • Identity and access management | Contract |
Email Address | • Personalised direct marketing (optional) | Consent |
Phone Number | • To use SMS as the OTP authentication method (optional) | Legitimate Interest |
Phone Number | • Personalised direct marketing (optional) | Consent |
Zip Code | • Personalised direct marketing (optional) | Consent |
Full IP Address (Metadata) | • Required for auditing and security purposes | Legitimate Interest |
Browser Software (Metadata) | • Required for auditing and security purposes | Legitimate Interest |
User ID | • Identity and access management Required to set up account Provide support | Contract |
Booking History | • Perform analysis to provide personalised direct marketing (optional) | Consent |
Activities | • Perform analysis to provide personalised direct marketing (optional) | Consent |
Services Used | • Perform analysis to provide personalised direct marketing (optional) | Consent |
Shopping Preferences | • Perform analysis to provide personalised direct marketing (optional) | Consent |
Loyalty Scheme Participation and Activity | • Provide loyalty scheme functionality | Contract |
Loyalty Scheme Participation and Activity | • Perform analysis to provide personalised direct marketing (optional) | Consent |
4.2. Ingka Centres Portugal as Sole Controller:
All of the personal data processed for the purposes below only has Ingka Centres Portugal as a Controller. All of the personal data Ingka Centres Portugal processes for the purposes below are provided directly by you.
Purpose | Legal Basis |
|---|---|
Management of customer complaints | Legitimate interest |
CCTV footage for the purpose of protection of people and assets | Legitimate interest |
Management of on-site accidents | Legitimate interest |
Lost and found | Legitimate interest |
Transfer of information to insurance companies after an accident has occurred | Legitimate interest |
Management of customer support services | Legitimate interest |
Data transfers to insurance companies or lawyers, exchange of emails with those involved. | Legitimate interest |
Social Media Management | Legitimate interest |
Image capture in actions and events: in certain events and actions and in the places where they occur, we collect your image, for marketing purposes and sharing on social networks and internal media. | Legitimate interest |
Providing gift cards to customers who purchase them | Contract |
Management of campaigns and offers; communication with campaign winners | Contract |
Management of the relationship with potential suppliers and suppliers, shopkeepers and other service providers | Contract |
Management of shopping mall's hobbies and targeted marketing actions; Awarding of Prizes to the winning data subjects | Contract; |
Store loan management | Contract |
Management of orders that have been placed on the Ingka platform | Contract |
Use of the Lego Kiddyland Platform in the Mar Shopping | Contract |
Provision of free-wifi at Mar Shopping; storing your MAC address for the same purpose. | Contract |
Sending newsletters about MAR Shopping | Consent |
Please note that we also process your data using cookies, to make the browsing experience on our website as fluid as possible and remember your preferences so that data does not have to be entered repeatedly. These cookies also allow us to optimize the way our website woks and, with your consent, to deliver relevant advertisements.
You can control which cookies are used. You can read more about that in our Cookie Policy.
Applicable to both situations:
Please note that where your data is processed on the basis of consent, you may withdraw your consent at any time without any consequences to yourself as a data subject. You can unsubscribe to direct marketing at any time by clicking the “unsubscribe” link in each email or by changing the settings in your account.
Please note that, while you may object to or request us not to process your data, in certain cases this could make it impossible for us to provide you with an Account and related services.
Providing personal data is a contractual requirement and a requirement necessary for concluding a contract. Providing it is not always mandatory, however, failure to provide it may affect the ability to use the Account and the services associated with it.
5. How long do we keep your data?
We keep your personal data as long it is necessary to provide a service to you, for business and operational reasons, or based on legal obligations. The time we keep your personal data depends on the specific purpose for which it was collected:
5.1 Joint controllership
Contract performance: We process your personal data for purposes related to the performance of a contract, including identity and access management, setting up your account, providing customer support, and delivering loyalty scheme functionality (such as managing your participation in and activity within the loyalty program). We retain this data for two (2) years after your last login to your Account.
Marketing: We process your personal data based on your consent, such as your email address and phone number, to send you personalized marketing communications. We also process data used for marketing analysis and profiling, such as booking history, activities, services used, shopping preferences, and loyalty program activity, to tailor our marketing to your interests. We retain your personal data for up to 24 months from the date consent is given, unless you withdraw your consent earlier.
Audit and security: We process your personal data for purposes related to pursuing our legitimate interests, including auditing and security purposes. This includes processing your full IP address (metadata) and browser software (metadata), as well as your phone number if you choose SMS OTP authentication. We retain this data for two and a half (2.5) years after your last login to your Account. This retention period is necessary to detect and prevent fraud, ensure the security and integrity of our platform, and comply with our security obligations.
Complying with a legal obligation: We may retain certain personal data associated with your Account to comply with legal, tax, and accounting requirements, and to respond to lawful requests from authorities. This retention is separate from the data we keep for providing the Account service. Typically, such data is retained for up to 10 years after the end of the contractual or commercial relationship, unless a longer period is required by law (for example, in case of ongoing disputes or specific legal obligations).
When we no longer need your personal data for the intended purpose(s), the data will be deleted or anonymised so you can no longer be identified.
5.2. Ingka Centres Portugal as Sole Controller
Management of customer complaints: For complaints presented in the Complaints Book, 3 years from the moment the complaint is presented.
Video surveillance for the purpose of protecting people and property: 30 days.
Data processing for tax purposes: 10 years from invoice issuance.
Use of the Lego Kiddyland Platform: 1 year or until the data subject requests its deletion, if this is earlier.
Provision of free Wi-Fi at MAR Shopping; Storing your MAC address for the same purpose: 1 year or until the data subject requests its deletion, if this is earlier. Use of the Wi-Fi service – 5 days;
Sending newsletters about Mar Shopping: Until the consent provided by the data subject is revoked or the account is deleted due to deletion or inactivity.
Personal data being processed that do not have a specific deadline included herein will only be processed until the purpose with which the data were gathered ceases. Further retention will only apply if there is a need to comply with any legal obligation.
6. Who has access to your personal data?
Applicable to both sole and joint controllership situations
The Controller(s) may use third-party subcontractors to process your personal data, on our behalf, and in accordance with the instructions provided by us, in strict compliance with applicable legislation, as well as this notice.
Specifically, your personal data may be shared with the following categories of recipients:
Companies within Ingka Group who provide intra-group services and provide operational support.
Third-party service providers who perform services on our behalf for the purpose of inter alia identity and authentication service, email delivery and communication, providing the booking engine used to manage and create bookings, delivery partners and cloud hosting.
Other joint controllers (set out in the table in section 10 below) than your Local Joint Controller or Ingka Centres Services AB, when you actively choose to interact with an Ingka Centres Meeting Place in that country (applicable to joint controllership only).
Government bodies, law enforcement agencies, or other regulatory authorities, when required by law, court order, or for the fulfilment of legal obligations.
Any entity subcontracted in this context will not transmit your data to other entities without the Controller’s(s) prior written consent and without an applicable legal basis for such transmission. The Controller(s) undertakes to subcontract only entities that offer adequate guarantees of the implementation of technical and organizational measures to ensure the protection of your rights. All entities subcontracted by the Controller(s) will be bound by a written contract that regulates, among other, the subject matter and duration of the processing, the nature and purpose thereof, the categories of data subjects, and the rights and obligations of the parties.
In accordance with applicable legislation, the Controller(s) may transmit or communicate your personal data to other entities, when such transmission or communication is necessary for the execution of the contract concluded between us or when it is necessary to comply with a legal obligation to which the Controller(s) is subject.
The Controller(s) may periodically check whether third parties comply with their obligations and comply with measures for the protection of personal data.
7. International Data Transfers
Applicable to both situations
We may in some instances, transfer personal data to suppliers outside of the European Economic Area and/or the United Kingdom. These transfers are made lawful through appropriate safeguards such as standard contractual clauses approved by the European Commission (appropriately amended to reflect the United Kingdom’s status outside of the European Union).
If you would like further information, please contact us.
8. Your rights
Applicable to both joint and sole controllership situations
Under privacy laws, including the General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation and the Swiss Federal Act on Data Protection of 19 June 1992 (as applicable to each case), you have certain rights in relation the personal data that we hold about you. There will not usually be a charge for dealing with these requests. You may exercise these rights at any time by contacting us using the details set out in section 1.
The access, rights and controls might vary depending on your request, however, in general the following rights are available to you, unless we communicate or justify otherwise.
Access: You are entitled to gain confirmation from us about the data that we process about you, and, where that is the case, access to the personal data.
Rectification: You are entitled to ask us to update and amend your data that might be inaccurate, incomplete or outdated.
Erasure (“right to be forgotten”): You are entitled to request us to delete some data which no longer necessary is for its purpose.
Restriction: You are entitled to ask us to temporarily or permanently restrict/stop some of the processing of your data.
Object: You are entitled to at any time, object to the processing of your data, including direct marketing.
Data portability: You are entitled to receive a readable copy about your data and, if requested, have the data to be transferred to another service provider.
Not be subject to automated decision-making: You are entitled to not be subject to a decision based solely on automated processing, including profiling, which creates legal effects concerning you, or similarly significantly affects you.
Right to complain: You have the right to send a complaint about our use of your personal data to your local data protection authority. However, before doing so, we would of course love to hear from you and get the chance to address your concern.
Your local Data Protection Authority is Comissão Nacional de Proteção de Dados. For more information about them, please view their website at www.cnpd.pt.
Making a complaint to your local Data Protection Authority will not affect any other legal rights or remedies that might be available to you.
Please note that you may contact Ingka at any time by sending an email to [email protected], to be informed in complete clarity of the operations indicated and the rights mentioned and, if you wish, to obtain more information and exercise any of the rights mentioned above.
Withdrawal of consent: You have the right to withdraw your consent at any time.
9. How will I know if this Privacy Notice has changed?
As privacy regulations change and we develop our processes and services, we may make changes to this Privacy Notice. All future changes to our Privacy Notice will be updated online and accessed through the Account with the last date of update displayed as below. If we make material changes to the Privacy Notice we may also inform you by email.
We encourage you to review this page regularly for any changes in the Privacy Notice. Your continued use of your Account and our services after any implemented changes or revision to this Privacy Notice shall indicate your agreement with the revised terms.
10. The joint controllers
Local de encontro | PaĂs | Nome da empresa | NĂşmero de IVA | Endereço |
|---|---|---|---|---|
Aleja Bielany | Poland | Ingka Centres Polska sp. z o.o. | KRS 725159 | Plac Szwedzki 3 05-090 Raszyn, Warsaw, Janki, Poland |
Ametzondo Shopping | France | Ingka Centres Bayonne SAS | 493 017 941 | 425 rue Henri Barbusse 78370 Plaisir, France |
Avion Shopping Umeå | Sweden | Ingka Centres Umeå AB | SE556864246501 | 205 28 Malmö Sweden |
Avion Shopping Park | Slovakia | Ingka Centres Slovensko s.r.o. | 35 849 363 | Ivanska cesta 16821 04 Bratislava Slovakia |
Avion Shopping Park Ostrava | Czech Republic | Centros Ingka Ostrava, s.r.o | 270 81 028 | Skandinávská 15a/144PSC 15500, Prague 5-ZlicĂn, Czech Republic |
Birsta City | Sweden | Ingka Centres Sverige AB | SE556074722101 | 205 28 Malmö Sweden |
Churchill Square | United Kingdom | Ingka Centros Deputado Reino Unido Brighton Limited | 14985147 | 100 Avebury BoulevardMK9 1FH Milton Keynes, UK |
ELNĂ’S Shopping | Italy | Centro Comercial Roncadelle S.r.l. | 08047330967 | Strada Provinciale 208 nÂş 320061 Carugate (Milano), Italia |
Erikslund Shopping Center | Sweden | Ingka Centres Västerås AB | SE556754582601 | 205 28 Malmö Sweden |
I-HUSET | Sweden | Ingka Centres Sverige AB | SE556074722101 | 205 28 Malmö Sweden |
Italie Deux | France | Ingka Centros FR MP Itália 2 SNC | 879 643 989 | 425 rue Henri Barbusse 78370 Plaisir, France |
Livat Hammersmith | United Kingdom | Ingka Centres Management UK Ltd | 12418686 | 100 Avebury Boulevard MK9 1FH Milton Keynes, UK |
Livli Kungens Kurva | Sweden | Centros Ingka Stockholm AB | SE556664384601 | 205 28 Malmö Sweden |
Luz Shopping | Spain | Ingka Centres Jerez S.L.U. | M-399225 | Avenida Matapiñonera nº 928703 San Sebastian de Los Reyes, Spain |
Mar Shopping Algarve | Portugal | Ingka Centres Portugal, S.A | 507161025 | Centro Comercial "Mar Shopping", Avenida Dr. Óscar Lopes 4450-337 Leça da Palmeira, Portugal |
Mar Shopping Matosinhos | Portugal | Ingka Centres Portugal, S.A | 507161025 | Centro Comercial "Mar Shopping", Avenida Dr. Óscar Lopes 4450-337 Leça da Palmeira, Portugal |
Matkus Shopping Centre | Finland | Centros Ingka Kuopio Oy | 2157374-8 | c/o Matkus Shopping Center Matkuksentie 60, 7080 Kuopio, Finland |
Pasing Arcaden | Germany | Ingka Centres Pasing GmbH | HRB 294655 | Wittelsbacher Platz 180333 Munich, Germany |
Port LĂłdĹş | Poland | Ingka Centres Polska sp. z o.o. | KRS 725159 | Plac Szwedzki 3 05-090 Raszyn, Warsaw, Janki, Poland |
Rio Shopping | Spain | Ingka Centres España S.L.U. | M-398502 | Avenida Matapiñonera nº 928703 San Sebastian de Los Reyes, Spain |
Shopping Park Kållered | Sweden | Ingka Centres Kållered Retail Park AB | SE559475131401 | 205 28 Malmö Sweden |
SKENDE Shopping | Poland | Ingka Centres Polska sp. z o.o. | KRS 725159 | Plac Szwedzki 3 05-090 Raszyn, Warsaw, Janki, Poland |
Tiare Shopping | Italy | Centro Comercial Villesse S.r.l. | 07523820962 | Località Maranuz 234070 Villesse (Gorizia), Itália |
Wola Park | Poland | Ingka Centres Polska sp. z o.o. | KRS 725159 | Plac Szwedzki 3 05-090 Raszyn, Warsaw, Janki, Poland |
Älmhults Handelsplats | Sweden | Ingka Centres Älmhult AB | SE556824309001 | 205 28 Malmö Sweden |
- | Sweden | Ingka Centres Services AB | SE559058471901 | 205 28 Malmö Sweden |
This Privacy Notice was last updated on [10.02.2026].