Shopping centre: Overview of processing activities

1. Shopping centre customer clubs

Name, address, postal code, phone number, email address, gender and date of birth

We process this information in order to manage your membership and personalise marketing if you consent to this.

We collect the information directly from you when you join the customer club.

GDPR Article 6 (1) b:

necessary to fulfil a membership agreement with you

Deleted immediately after the membership has ended.

We register your most recent activity to avoid storing information about inactive members. After two years of inactivity, we will contact you and if you do not respond, your membership will be deleted.

If you are a member of several shopping centres, each membership must be deleted separately.

2. My Shopping (mobile app)

Phone number, access to location, favourite shop, types of coupons you have used

The app can be used without you having to grant access or log in.

We process data when you consent to log in as a member of the app with your phone number. This information was already collected about you at the time of registration (see point 2)

In order to get the full benefit of the app, we will also ask for access to your location to show you which of our centres are nearby, as well as to show which coupons are available at that centre.

GDPR Article 6 (1) a:

you have consented to the processing of personal data

The accesses/consent you have granted to the app can be revoked in the settings.

Data provided in connection with the membership may be deleted as described above in point 1.

3. Newsletters and personalised marketing

Name, address, postal code, phone number, email address, gender, date of birth, number of children and their year of birth

To be able to communicate with you about member benefits and general offers.

We communicate with you in the following ways:

- Text message

- Email

- Push notification

GDPR Article 6 (1) a:

you have consented to receive communications about benefits and offers

As a member of the customer club, you can withdraw your consent via 'My Page' or in the My Shopping app or directly via the source from which you received the communication from us.

Please note that if you have memberships at several shopping centres, consent must be managed for each individual membership.

4. Profiling

Behavioural data, types of coupons used

GDPR Article 6 (1) a:

you have consented to profiling.

Profiling is only carried out if you have consented to this.

You can revoke your consent for profiling via 'My Page'. If you have the My Shopping app, this can also be done there.

Please note that if you have memberships at several shopping centres, consent must be managed for each individual membership.

5. Personal Shopper (Ski, Sandvika and Storo Storsenter)

Name, phone number, email address, clothing sizes, shoe size and purchase history

GDPR Article 6 (1) b:

necessary to fulfil an agreement with you.

If you are no longer an active customer, i.e. you have not visited within 36 months, your personal data and visit and purchase history will be deleted.

You can request the deletion of your personal data at any time before the 36 months have passed.

6. Thon Wi-Fi

IP address, MAC address, location and phone number

To provide you with free Wi-Fi.

On connection, an authentication web page will appear to connect to Wi-Fi. You will be asked to enter your phone number in order to receive a text message with a code, which is used to verify that it is you on the login page. We then use your location to redirect you to the website for the shopping centre you are visiting.

GDPR Article 6 (1) b:

necessary to fulfil an agreement with you

7. Camera surveillance

Photograph/video of you

The Thon Group uses CCTV to deter, prevent and investigate crimes and accidents, to secure the property of the Thon Group and its guests/visitors and to maintain safety for employees, guests and visitors. 

All locations with camera surveillance are marked with signs. Read more about camera surveillance at TG here.

GDPR Article 6 (1) f:

our legitimate interest and the CCTV Regulation