1. Who does this Privacy Policy apply to?
This Privacy Policy applies to all products and services offered by Kinepolis Group to its business customers and prospective business customers.
This Privacy Policy informs you about which personal data we process, how we use it, what your privacy rights are and how you can exercise them.
However, the processing of personal data relating to business customers only applies if the business customer is a natural person, or — where the business customer is a legal entity — this Privacy Policy only applies to the personal data of natural persons processed by Kinepolis in the context of its relationship with that business customer (such as contact persons and representatives).
2. Who is responsible for the processing of personal data?
The personal data that you expressly or automatically provide to us is collected and processed by or on behalf of the public limited company (“naamloze vennootschap”) Kinepolis Group, with registered office at B-1020 Brussels (BELGIUM), Eeuwfeestlaan 20, VAT BE 0415.928.179, Brussels Register of Legal Entities (RPR) 622 315, and correspondence address at B-9000 Ghent (BELGIUM), Moutstraat 132-146, including its affiliated companies, hereinafter jointly referred to as “Kinepolis”.
The Kinepolis Group shares this data with its affiliated companies (other legal entities such as individual Kinepolis cinemas or groups of Kinepolis cinemas, hereinafter also referred to as “Kinepolis”) in order to provide you with the best possible service.
Kinepolis is the so-called “data controller” of the personal data collected through the website, mobile applications and other channels.
3. What personal data does Kinepolis process? How does Kinepolis obtain this data?
Personal data is any information that allows a natural person to be identified directly or indirectly. Although processing takes place in a business-to-business (B2B) context, this naturally does not mean that you, as a contact person or website visitor, lose your rights as a natural person.
As part of its services, Kinepolis collects and processes the following categories of personal data:
In principle, this data is not collected from third parties but is requested directly from you, for example when requesting information, purchasing a product or service, participating in a survey or competition, or registering and managing your customer account.
In addition, certain publicly available information may be used in order to contact you.
We also collaborate with companies that may provide us with contact details, ensuring that such companies are acting lawfully and taking into account the purposes for which Kinepolis processes personal data.
Finally, certain data is collected automatically through “cookies” and other information-gathering systems, such as IP address, browser type and language, duration of your visit to the website, browsing behaviour and visited web pages. Further information regarding cookies can be found in our Cookie Policy.
4. Why does Kinepolis process this data?
Kinepolis collects, records and processes personal data:
(i) to provide you with the products (such as gifts) and services (such as events) you have requested, and subsequently, based on our legitimate interests, to keep you informed about those products and services; additionally, we may provide tailored information using a profile created by Kinepolis based on your interests, as well as inform you about products and services offered by Kinepolis business partners (the latter only where your consent has been obtained);
(ii) to follow up on provided services, respond to your comments and/or questions regarding our services, and manage customer administration and business processes, as well as to comply with legal obligations, including accounting and tax obligations;
(iii) to inform you, as an interested prospective customer (including through our Kinepolis Business newsletters), about products and services, including promotional activities and offers provided by Kinepolis or its business partners (where consent has been obtained);
(iv) to provide interested prospective customers with tailored information about Kinepolis products and services using a profile created by Kinepolis based on their interests;
(v) to conduct customer satisfaction surveys;
(vi) to perform general market research, statistical purposes and studies regarding the functioning and use of the website and mobile applications;
(vii) to connect you with suppliers providing additional services, such as catering or audiovisual equipment for events;
(viii) to manage and follow up on requests relating to the exercise of your privacy rights and other privacy-related enquiries;
(ix) to manage VIP passes;
(x) to use photographs and video recordings from events as memories for attendees, to provide atmosphere impressions to those unable to attend, and to promote Kinepolis activities.
The processing of data for the purposes described under points (i) and (ii) is necessary for the execution of our agreement with you.
The processing of data for the purposes described under points (i), (iii), (iv), (v), (vi), (vii), (ix) and (x) is necessary for our legitimate interests in improving and promoting our products and services and ensuring a personalised customer experience.
Processing for the purpose described under point (viii) is necessary to comply with legal obligations applicable to Kinepolis.
Where legally required, such as for the purposes mentioned under points (iii), (iv) and (x), certain processing activities will be based on your consent.
Kinepolis may use your personal data to contact you directly by post, telephone or electronically, such as via e-mail, SMS or social media. If such communication is promotional in nature, you will always have the opportunity to unsubscribe at any time.
5. How long does Kinepolis store my personal data?
Kinepolis only stores your personal data for as long as necessary for the purposes described above. As a general rule, your personal data will be deleted five years after your last active interaction with Kinepolis. This also helps us avoid retaining irrelevant information.
Considering that contractual liability claims may only expire after ten years, certain personal information may be archived for that period solely for this purpose.
Where other legal obligations require longer retention periods (such as obligations relating to invoice retention), Kinepolis will of course comply with such legislation.
6. Does Kinepolis share my personal data with other organisations?
For the purposes described in Article 4, Kinepolis may engage so-called “processors”. These parties act exclusively on our behalf and may only process your personal data in accordance with our instructions and within the framework of this Privacy Policy.
For example, we use suppliers providing marketing, communication, logistics and IT services, services aimed at personalising and optimising our services, processing credit card transactions and collections, fraud prevention, organising competitions, delivering purchased products, organising events, providing customer service and debt collection services.
As part of providing such services, these suppliers may have access to your personal data or other information. We only authorise these companies to process personal data insofar as necessary to provide their services. We also ensure that these processors provide an appropriate level of security regarding data protection.
Apart from engaging these processors, we only share personal data expressly provided by you — such as your name, e-mail address and other non-automatically collected data — with third parties where we have obtained your explicit consent, unless disclosure is required by law, by request of a public authority or by judicial decision.
In addition, we may transfer and share your personal data with companies within the Kinepolis Group, which may act either as processors or joint controllers depending on the circumstances.
7. Are personal data transferred to countries that do not provide a similar level of protection?
Kinepolis stores your data in its databases and takes appropriate market-standard measures to protect it against modification, loss or misuse.
Where your personal data is processed outside the European Union, we ensure through contractual or other measures (such as the European Commission’s standard contractual clauses) that such data benefits from an adequate level of protection comparable to that within the EU.
8. What rights can I exercise regarding my personal data?
Once your data has been collected and processed, you have the right to:
Please note that we may not always be able to delete all requested data, for example where processing is necessary for the establishment, exercise or defence of legal claims.
You also have the right to request restriction of processing (for example, where immediate deletion could be detrimental to you, your data may instead become inaccessible).
If you wish to transfer your active personal data to another service provider, this is also possible. This is referred to as the “right to data portability”.
Whenever processing is based on Kinepolis’ legitimate interests, you have the right to object to such processing. If your request is justified, Kinepolis will cease processing your personal data unless, for example, the processing is linked to legal proceedings or claims.
Where processing is based on your consent, you always have the right to withdraw such consent without affecting the lawfulness of processing carried out prior to the withdrawal.
Finally, you always have the right, without providing any reason, to object to the use of your personal data for direct marketing purposes.
9. How can I exercise these rights in practice?
You may exercise these rights by sending an e-mail to privacidadB2B@kinepolis.es.
Kinepolis may request additional information to confirm your identity. We do this in order to protect your personal data and ensure that third parties cannot gain access to it.
10. Can Kinepolis change this Privacy Policy?
This Privacy Policy may be amended from time to time, for example to adapt it to changes in services or legal and regulatory requirements. The most recent version will always be available on the website.
11. Who can I contact in case of questions or complaints?
For general questions or comments regarding your personal data that are unrelated to the exercise of your rights under sections 8 and 9 above, you may contact us by e-mail at dpo[at]kinepolis[dot]com.
If you have any concerns or complaints, you may also contact the Spanish Data Protection Authority at any time:
Spanish Data Protection Authority
C/Jorge Juan, 6, 28001 Madrid
Tel. +34 91399 6200
E-mail: internacional[at]agpd[dot]es
Website: Spanish Data Protection Authority
