This Personal Data Protection Policy applies to all products and services offered by Kinepolis Group to its customers and prospects. This Policy informs you about the personal data we process, how it is used, your rights in this regard, and how you can exercise those rights.
Personal data is only processed if the business customer is a natural person. If the business customer is a legal entity, the personal data protection policy only applies to the personal data of natural persons that Kinepolis processes in the context of its relationship with the business customer (such as contact persons and representatives).
1. To whom does this Personal Data Protection Policy apply?
This Personal Data Protection Policy applies to all products and services offered by Kinepolis Group to its customers and prospects. This Policy informs you about the personal data we process, how it is used, your rights in this regard, and how you can exercise those rights.
Personal data is only processed if the business customer is a natural person. If the business customer is a legal entity, the personal data protection policy only applies to the personal data of natural persons that Kinepolis processes in the context of its relationship with the business customer (such as contact persons and representatives).
2. Who is responsible for the “processing” of personal data?
The personal data that you provide to us, either expressly or automatically, is collected and processed by or on behalf of Kinepolis Group SA, whose registered office is located at 1020 Brussels (Belgium), 20, Boulevard du Centenaire, registered with the Banque Carrefour des Entreprises under VAT number BE 0415.928.179, registered with the RPM Brussels under number 622 315, with a correspondence address at 9000 Ghent (BELGIUM), Moutstraat 132-146, and its subsidiaries, hereinafter jointly referred to as “Kinepolis”.
Kinepolis Group shares this data with its subsidiaries (other legal entities, such as individual Kinepolis cinemas or a group of several Kinepolis cinemas, hereinafter jointly referred to as “Kinepolis”) in order to provide you with the best possible service.
Kinepolis is the “data controller” of the personal data collected via the website, mobile applications, and other channels.
3. What data does Kinepolis process about me? How does Kinepolis receive this data?
Personal data is data that can be used to directly or indirectly identify a natural person. Even if the processing takes place in a B2B context, this does not mean that you, as a contact person or website visitor, lose your rights as a natural person.
In the context of its service provision, Kinepolis collects and processes the following categories of personal data:
Identification and contact details, such as name, email address, language preference, gender;
Payment data in the context of the performance of contracts concluded with our customers;
Data relating to the products and services ordered;
Information following contacts with you in connection with our provision of services;
Photo and video recordings of events, in which participants may be recognizable.
In principle, data will not be collected from third parties, but will be requested from you, for example when you request information, purchase a product or service, participate in a survey or competition, register, or during the management of your customer account.
In addition, certain publicly available information may be used to contact you.
Furthermore, we collaborate with companies that can provide us with contact details, ensuring that they are authorized to do so, taking into account the purpose for which Kinepolis will process the personal data.
Finally, certain data is collected automatically by “cookies” and other systems that collect information. This includes, for example, your IP address, browser type and language, the duration of your visit, your browsing behavior, and the pages you have visited. You can find more information about cookies in our Cookie Policy.
4. Why does Kinepolis process this data?
Kinepolis collects, records, and processes personal data for the following purposes:
(i) provide you with the products (such as gifts) and services (such as events) you have ordered and then inform you, based on our legitimate interests, about our products and services; where applicable, we may also provide you with tailored information using a profile that Kinepolis has obtained based on your interests and, in addition, inform you about products and services offered by Kinepolis' business partners (for the latter, only after obtaining your consent);
(ii) to follow up on the services we provide and to be able to respond to your comments and/or questions about our services, to manage customer administration and disputes, and in general to comply with our legal obligations, particularly in terms of accounting and tax matters;
(iii) to inform you, at your request, as a potentially interested customer (e.g. via our Kinepolis Business newsletters), about the products and services, including offers and promotions, that Kinepolis offers or that are offered by Kinepolis' business partners (subject to obtaining your consent);
(iv) to provide you, at your request, as a potential interested customer, with tailored information about Kinepolis products and services using a profile that Kinepolis has obtained based on your interests;
(v) to analyze customer satisfaction;
(vi) for (general) market research, statistical purposes, and analysis of the functioning and use of the website and mobile applications;
(vii) to put you in touch with additional service providers, such as caterers or audiovisual equipment for an event;
(viii) to process and follow up on your requests to exercise your privacy rights and other privacy-related matters;
(ix) to manage VIP Passes;
(x) photos and video recordings of events are used as a memento for participants, to give an impression of the atmosphere to those who cannot attend the event, and to promote Kinepolis' activities.
Processing for the purposes mentioned in points (i) and (ii) is necessary for the conclusion or performance of our agreement with you.
The processing for the purposes mentioned in points (i), (iii), (iv), (v), (vi), (vii), (ix), and (x) above is necessary for our legitimate interests in improving and promoting our products and services, as well as ensuring a personalized experience for our customers.
The processing for the purposes mentioned in points (viii) is necessary to comply with the legal obligations to which Kinepolis is subject.
Where required by law, certain processing operations, as mentioned in points (iii), (iv) and (x), require your consent.
Kinepolis may use your personal data to contact you directly by post, telephone, or electronic means, including email, SMS, or social media. If you do not wish to receive this commercial information, you can always “unsubscribe” at any time.
5. How long does Kinepolis keep my personal data?
Kinepolis only retains your personal data for as long as necessary for the purposes described. In principle, your personal data is deleted five years after your last active interaction with Kinepolis. This also allows us to avoid storing irrelevant information.
Since contractual liability claims are only time-barred after 10 years, we will archive certain personal data during this period, solely for this purpose.
If other legal obligations require longer storage (particularly with regard to the storage of invoices), we will of course comply with these regulations.
6. Does Kinepolis share my personal data with other organizations?
In order to achieve the purposes set out in Article 4, Kinepolis may use “subcontractors.” These subcontractors act exclusively on our behalf and may only process your personal data in accordance with our instructions and within the framework of this Personal Data Protection Policy.
For example, we use suppliers for marketing, communication, logistics, and IT services in order to personalize and optimize our services, process credit card transactions and collections, and limit fraud in credit card transactions or other means of payment, organize contests, deliver purchased products, co-organize our events, provide our customer services, collect debts, etc.
These providers may have access to your personal data or other information when providing such services. We only allow these companies to process your personal data to the extent necessary for the provision of their services. We also ensure that these subcontractors provide an adequate level of security in terms of data protection.
In addition to the involvement of such “subcontractors” for the services described, we share the personal data that you have expressly provided to us, such as your name, email address, and other non-automated data, with other parties only if we have received your explicit consent to do so, unless we are required to do so by law, by a request from a public authority, or by a court order.
In addition, we may transfer your personal data to companies within the Kinepolis Group and share it with them, which, depending on the case, will be considered as subcontractors or joint controllers.
7. Are personal data transferred to countries that do not guarantee a similar level of personal data protection?
Kinepolis collects your data in its databases and aims to protect this data in accordance with the market against any modification, loss, or illegal use.
When your personal data is processed outside the EU, we ensure that, through contractual or other measures (such as the European Commission's standard contractual clauses), this data benefits from an adequate level of protection comparable to the level of protection applied within the EU.
8. What rights do I have regarding my personal data?
Once your data has been collected and processed, you have the right to view this personal data, request that it be corrected if it is incorrect, and request that personal data be deleted. However, please note that we cannot always delete all personal data requested, particularly when its processing is necessary for the establishment, exercise, or defense of legal claims.
In addition, you also have the right to request that the processing be “restricted” (in cases where immediate deletion would be disadvantageous to you, the personal data will then only be made inaccessible).
If you wish, it is also possible to transfer the personal data you have actively provided to another service provider. This is known as the “right to data portability.”
Whenever the processing is based on a legitimate interest of Kinepolis, you have the right to object to such processing. If your request is justified, Kinepolis will cease processing your personal data, unless the processing of personal data is related to the institution, exercise, or justification of legal action (e.g., filing a claim with a court).
When the processing is based on your consent, you have the right to withdraw that consent at any time, without prejudice to the lawfulness of the processing based on consent prior to withdrawal.
Finally, you always have the right to object, without giving any reason, to the use of your personal data for direct marketing purposes.
9. How can I exercise these rights in practice?
You can exercise these rights by sending an email to mesdonneespersoB2B@kinepolis.fr
Kinepolis has the right to request additional information to confirm your identity. We do this to protect your personal data, to ensure, among other things, that no third party can access your personal data.
10. Can Kinepolis make changes to this Personal Data Protection Policy?
This Privacy Policy may be amended from time to time, in particular to adapt it to changes in the services provided or legal and regulatory requirements. You will always find the most recent version on the website.
11. Who can I contact if anything is unclear or if I have any complaints?
You can contact us by sending an email to dpo@kinepolis.com with any questions or general comments regarding your personal data that do not relate to the exercise of your rights as mentioned above in points 8 and 9.
For complaints regarding the processing of your personal data by Kinepolis, you can also contact the French data protection authority if you have any questions or complaints: Commission Nationale de l'Informatique et des Libertés – CNIL, 8 rue Vivienne, CS 30223, F-75002 Paris, Cedex 02, tel. +33 1 53 73 22 22, website: http://www.cnil.fr/.
July 2023 version