Version of 28 May 2024

1 – Carmila and the protection of personal data 

2 – Carmila responsible for processing

3 – Data subjects

4 – Purposes and legal basis of Carmila’s processing

5 – Personal data processed by Carmila

6 – Retention periods

7 – Data recipients

8 – Data transfers outside the European Union  

9 – Rights of the data subject

10 – Security of personal data

11 – Cookies

12 – Updates 

13 – Carmila contact


GDPR CARMILA is committed to the respect and protection of personal data, in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”) and Law No 78-17 of 6 January 1978 on computers, files and freedoms as amended (the “Data Protection Act”) and any guidelines and recommendations of the competent bodies and authorities (together the “Regulations”).

This Privacy Policy (“the Policy”) sets out CARMILA’s commitments and how CARMILA processes users’ personal data in the context of their visit and interaction on the website (the “Website”) and more generally how CARMILA processes personal data in the context of its activities with professionals.

To learn more about how CARMILA handles your personal data regarding cookies and other tracers, we invite you to the section 11 on cookies.


CARMILA, a public limited company, registered with the RCS of Nanterre under number 381 844 471, whose head office is located at 25 rue d’Astorg, 75008 Paris, represented by its President-in-Office.


As part of its activities on its Website, CARMILA collects and processes personal data relating to any user of the Website who uses its functionalities, as well as any professionals in the context of their exchanges and activities with CARMILA, which comprises in particular Carmila prospects, franchisees, managers or managers of shops, directors of branches, dealers and tenants, journalists, managers of premises, elected representatives, providers, shareholders as well as users of or visitors to the Website (the “Data subjects” or “you”).


This data is collected and processed by CARMILA for the following purposes and on the following legal bases.

Purpose Examples of using your personal data Legal bases
Subscribe to the Smart Shopping and Management newsletter to send you newsletters; to send you promotional offers. Your consent
Linking franchisors/companies with CARMILA's business partners (prospects, tenants and dealers) and transmitting your personal data to these partners to provide CARMILA's business partners with your contact information; to allow CARMILA's business partners to sign contracts with franchisors/companies. Our legitimate interest
Integration of your personal data in CARMILA's CRM tool and transmission to the CARMILA sales representatives to allow CARMILA sales representatives to contact you directly at various events (trade shows, events, new projects); to draw up the files for signing contracts and preparing the compulsory documents; to sign lease contracts or agreements of temporary occupation; commercial exploration. Our legitimate interest
Journalist databases to allow the sending of press releases or communication to a list of journalists. Our legitimate interest
Business Prospecting to allow the sending of invitations, press releases, newsletters to Carmila's business partners. Our legitimate interest
Shopping Centre Management to allow CARMILA to contact you to manage the shopping centres; to enable CARMILA to perform the functions of community manager (management of social networks, contest games, newsletters, information) for shopping centres. Our legitimate interest
Subscription to the shareholder space to allow registration for events (AG); to allow registration for Webinars; to enable financial information on Carmila to be sent. Execution of the contract with shareholders
Recruitment (job opportunities on the Website) to process your application and select candidates; to organise interviews; to assess candidates. Pre-contractual measures
Website Improvement and Your User Experience to evaluate and improve the Website; to facilitate your navigation on the Website; to guarantee the security of the Website. Our legitimate interest in improving the Website, as well as your user experience
Management of pre-litigation or litigation to sanction any violation of the Website's Terms and Conditions or any other identified violation; to manage any disputes or disputes. Our legitimate interest in defending our rights and interests
Compliance with legal and regulatory bonds to comply with legal and regulatory bonds (e.g. accounting); to respond to your requests for exercise of rights. CARMILA's legal and regulatory bonds
Manage requests according to your profile to allow you to send us your information requests (commercial leases, specialty leasing, ephemeral shops, events, franchise & development, retail services); to process your requests and complaints; to contact you if necessary. Execution of the xxxUGC and our legitimate interest
Good functioning and security of the website enable anomaly detection and security of your data and of our information systems from which your data is processed. Our legitimate interest in protecting our website and your data


CARMILA collects your personal data for the above purposes directly from you.

The personal data collected by CARMILA are as follows:

  • surname and first name;

  • email address;

  • telephone number;

  • company or name of employer and position within that company;

  • any information you may provide as part of the forms on the Website or as part of the emails you send us via our email addresses;

  • Banking ID (RIB) and identity documents where these are necessary for the establishment of a contract.

CARMILA also processes personal data that it does not collect directly from you, namely:

  • contact details of Carmila’s prospects (surname, first name, e-mail, mobile phone number, postal address, company name or employer and position within that company) that we may receive from our commercial partners,

  • technical information about your browsing activity on the Website (including data collected using cookies, login logs, IP address, date and time of login);

  • information on the processing of technical data, in particular via cookies placed on the Website, is provided in Section 11.


We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including to meet any legal or accounting requirements.

In determining the appropriate retention period for personal data, we take into account the quantity, nature and sensitivity of the personal data, the potential risk of harm resulting from the unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and the possibility of achieving those purposes by other means, as well as the applicable legal requirements.

For personal data relating to Data Subjects, our retention periods are as follows:

  • Contact forms: three (3) years from the date of application;

  • Subscribe to the newsletter: as long as the Data Subject does not unregister;

  • Lead data: three (3) years from the last contact;

  • Data integrated into CRM tool: five (5) years after the end of the professional relationship between you and CARMILA.

After the time limits have been set, the data shall either be deleted or kept after anonymisation, in particular for statistical purposes. They may be retained in case of pre-litigation and litigation. It is recalled that deletion or anonymisation are irreversible operations and that CARMILA is no longer able to restore them.


CARMILA shares the personal data it processes with a limited number of people:

  • authorised CARMILA employees, by virtue of their position, and subject to a bond of confidentiality;

  • its providers as “subcontractors” within the meaning of the Regulation solely for the purposes of the services provided. These include providers in charge of hosting, operating and maintaining the Carmila Website or information system, providers and agencies in charge of commercial campaigns or sending invitations or newsletters.

  • CARMILA’s business partners with whom CARMILA has concluded the necessary data protection agreements.

The third parties with whom we share your personal data are therefore limited (by law and by contract) in their ability to use your personal data for the specific purposes we have identified. We will always do our best to ensure that third parties with whom we share your personal data are subject to privacy and security bonds in accordance with this Policy and the Regulations. We only allow them to process your personal data for specific purposes and in accordance with our instructions.

Except as expressly stated above, we will never share, sell or rent your personal data to any third party without notice and/or consent. If you have given us your consent to use your information in a particular way, but subsequently change your mind, you should contact us and we will stop doing so.

In any case, CARMILA may share your personal data with independent administrative or judicial authorities or any other organisation if permitted by law.


CARMILA may have to transfer the personal data processed to its providers ‘subcontractors’ within the meaning of the Regulation, which may be located outside the European Union.

In this situation, in the absence of a decision on suitability, and after having carried out an assessment of the level of protection of your rights in the territory of the third State where the recipient of your personal data is established, CARMILA undertakes to take all necessary measures to ensure the protection of your personal data on the basis of appropriate safeguards (in particular standard contractual clauses of the European Commission).


According to the Regulation, each Data Subject has different rights. These rights are not absolute and each of these rights is subject to certain conditions in accordance with the GDPR and more generally the Regulation. In particular, the Data subjects shall have:

  • Right of access

You may request access to your personal data that we collect and process.

If you make a request for access, we will provide you with a copy of your personal data in our possession as well as all the information legally required.

  • Right of opposition

You may object at any time, for reasons relating to your particular situation, to the processing of your personal data where this is based on our legitimate interest, unless our legitimate interest overrides your own interests and your rights and freedoms, or the processing is necessary for the establishment, exercising or defence of legal rights.

You may also, at any time, object to the processing of your personal data by us when this processing is carried out for commercial marketing purposes by electronic or postal means, including when the processing concerned constitutes profiling.

  • Right of rectification

You may at any time ask us to rectify any personal data about you that is inaccurate or incomplete.

  • Right of erasure

You may request the erasure of your personal data under the conditions laid down by the Personal Data Regulation, unless these must be kept to enable us to comply with legal bonds, or to enable us to exercise or defend our rights or, where they are necessary for the performance of the contract binding us.

  • Right to restriction of processing

You may request the restriction of the processing of your personal data under the conditions laid down by the Regulation.

  • Right to portability

You have the right to the portability of personal data which you have provided to us and which we process by automated means, when the processing which we implement is based on your consent or on the performance of a contract or pre-contractual measures, provided that the exercising of this right does not infringe the rights and freedoms of third parties.

  • Right to set guidelines for the fate of your data after your death

You have the option to set general or specific guidelines regarding how you intend to exercise your rights under the applicable regulations after your death.

Any Data Subject may exercise his/her rights at any time by sending an email or writing to the postal address with the contact details mentioned below (Contact).

In the interests of confidentiality and protection of personal data, CARMILA will ask the Data Subject to prove his/her identity in order to respond to his/her request.

All requests will be processed in a timely manner and in accordance with the Regulations. In some cases, personal data can only be deleted after a certain period of time imposed by the regulations in force and the statute of limitations. In this case, CARMILA will keep this data until the total erasure date.

The Data Subject is informed that he/she cannot object to the collection and processing of personal data which is processed under legal bonds which would affect CARMILA. The Data Subject is also informed that in the event of refusal to provide his/her personal data or exercising of his/her right of deletion or opposition, all or part of the services offered may be made inaccessible to him/her.

In the event of a dispute concerning the use of his/her personal data, the Data Subject has the right to lodge a complaint with the National Commission of Information Technology and Freedoms (CNIL).


CARMILA ensures that personal data are processed in complete security and confidentiality, including when certain operations are carried out by subcontractors. To this end, appropriate technical and organisational measures are in place to prevent the loss, misuse, alteration and deletion of your personal data. These measures shall be adapted according to the level of sensitivity of the data processed and according to the level of risk presented by the processing or its implementation. We have procedures in place to deal with any suspected breach of data security and we will notify you and any competent supervisory authority of any suspected breach where we are legally required to do so.

Unfortunately, the security of data transmissions over the Internet or data storage systems cannot be guaranteed to 100%. If you have reason to believe that your interaction with us via the shopping centre websites is no longer secure (for example, if you believe that the security of an account you have with us has been compromised), please inform us immediately by contacting us at the contact details below.

11 - Cookies

  • What are cookies?

“Cookies” are small text files, often with unique identifiers, that are sent by web servers to web browsers, and can then be returned to the server each time the browser requests a page from the server.

Cookies are very useful and allow a website to recognise you, to connect when you visit a particular page, to provide a secure connection to a website and to improve your user experience by improving your browsing comfort and/or by adapting the content of a page to your interests.

  • How are cookies used?

Where prior consent is required for their use, the period of validity of consent for the placing of cookies is 6 months. At the end of this period, we will ask for your consent again.

Cookies that we place as operators of our Website are called “internal cookies”. The cookies that third parties have entrusted to us on our Website and/or our application are called “third party cookies”. Third-party cookies enable third-party features or functionality to be provided on or through a website (for example, advertising, interactive and analytical content). The people who create these third party cookies may collect some of your personal information, recognise your computer both when visiting the website in question and when visiting other websites.

The lifetime of an audience measurement cookie that does not require consent is 13 months. In addition, the information collected through these cookies is stored by us for a maximum of 25 months, in accordance with the applicable regulations.

The types of cookies that are used on our Website are:

             Technical cookies:

These cookies will allow you to move around our Website and use its features more efficiently. These cookies also allow our Website to remember your previous action during the same browsing session.

             Functional cookies:

These cookies allow our Website to remember the choices you make when you visit our Website in order to provide you with enhanced and more personalised features.

             Analytical cookies:

These cookies are used by us or third-party service providers to analyse the use and performance of our Website. In particular, we use Google Analytics cookies to obtain web analysis data. Google Analytics collects information about your interaction with our Website, including information about the pages you visit and how long you visit our Website.

                   Google Analytics

                   Google Analytics is a web analytics service offered by Google that tracks and reports traffic on websites. Google uses the collected data to track                     and control the use of our service. This data is shared with other Google services. Google can use the collected data to contextualise and                                   customise ads from its own ad network.

                   You can opt out of making your activity on the service available to Google Analytics by installing the Google Analytics opt-out browser add-on.                       This add-on prevents Google Analytics JavaScript (ga.js, analytics.js, and dc.js) from sharing information with Google Analytics about visit activity.

                   For more information on Google’s privacy practices, please visit the Google Privacy Policy web page:

              Statistical cookies:

These cookies allow us to establish statistics and volumes of visits and use of the various elements of our site and our application (sections and contents visited, itinerary, visit time), which allows us to improve the interest and ergonomics of our services.

              Advertising cookies:

These cookies are used to present advertisements to you or to send you, when you browse the Internet outside our sites and applications, information adapted to your interests in connection with your use of the site and the application. They are used to limit the number of times you see an ad and to help measure the effectiveness of an ad campaign. These cookies depend mainly on advertising agencies and we do not always control their use.

  • How to block the use of cookies

There are two ways to refuse the use of cookies.

During your first visit to our Website, your consent to the use of your data by cookies will be requested via an information banner which will be displayed visibly at the bottom of the page.

By using the “Allow all cookies” and “Continue without accepting” buttons, you will be able to accept or refuse globally so that we can place cookies on your computer or device (cookies related to targeted advertising operations, certain audience measurement cookies, social media cookies generated in particular by their sharing buttons when they collect personal data). However, a third “Cookie Settings” button on this banner will allow you to get the details of the categories of cookies used and thus choose whether or not to consent by purpose.

However, if you wish to refuse the use of any type of cookies on a website, you can do so by changing your browser settings to block the use of cookies. Please note that if you block the use of cookies by this browser setting, you may not be able to use or view all or part of the website concerned, including our Website.

Each web browser offers different ways to set up cookie management. In general, these are described in the Help menu of each browser.


Click on the menu button and select “Preference Options”.

Select the “Privacy and Security” panel.

Set the “Retention Rules” menu to “Use custom settings for history”.

Clear the “Accept cookies” checkbox.

Changes you make will be saved automatically.

               Internet Explorer:

Click on the “Tools” button, then on “Internet Options”.

Click the “Privacy” tab, then under “Settings”, move the slider up to block all cookies or down to allow all cookies, then click OK.

               Google Chrome:

Select the Chrome menu icon.

Select “Settings”.

At the bottom of the page, select “Show advanced settings”.

In the “Privacy” section, select “Content Settings”.

Select “Prohibit all sites from storing data”.

Select OK.


Click on “Settings” > “Safari” > “Privacy” > “Cookies and website data”.

Then select “always block”.

Please note that if you block the use of cookies by this browser setting, you may not be able to use or view all or part of the website, including our Website.

In addition, if you wish to block the use of analytical cookies and/or advertising and retargeting cookies, both provided by our third-party service providers, please access the following URL to suspend the use of these cookies.

Google Analytics: opt-out for cookies

Description of cookies and their purpose:

Google Analytics _ga;

Google Analytics _gid. These cookies are used to distinguish users. [];

Google Analytics _gat. These cookies are used to reduce the number of requests. However, if Google Analytics is deployed via Google’s tag manager, these cookies will be named: _dc_gtm_<property-id>. [].

Google Analytics is a web analytics service provided by Google LLC (“Google”). Generally, the information generated by the cookie about your use of the Website is transmitted to a Google server in the United States and stored there.

Google will use this information on our behalf in order to analyse your use of the Website, compile reports on the activity of the Website and provide us with additional services related to the use of the Website and the use of the Internet in general. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.

You may refuse the use of the data created by these cookies in connection with the use of our Website (in particular your IP address) and the processing of this data by Google, by downloading and installing the plug-in available on your browser under the following link:


CARMILA may amend this Policy from time to time to reflect changes in our practices. When we amend this Policy, we also change the update date indicated at the top of the first page of this Policy.

The current version of this Policy is always available online on the shopping centres’ websites and on request by email or post to the contact details below (Contact).


If you have any questions regarding this Policy or the processing of personal data implemented by CARMILA, please contact the DPO at the following address:



25 rue d’Astorg

75008 Paris

Or by Email: [email protected].

Présentation des résultats annuels 2020

La présentation des résultats annuels 2020 de Carmila se tiendra à huis clos jeudi 18 février 2021 à 14h30. Elle sera diffusée en direct sur le site internet de Carmila.

Vous pouvez dès à présent vous inscrire à cette diffusion en cliquant ici.

Présentation des résultats annuels 2020

La présentation des résultats annuels 2020 de Carmila se tiendra à huis clos jeudi 18 février 2021 à 14h30. Elle sera diffusée en direct sur le site internet de Carmila.

Vous pouvez dès à présent vous inscrire à cette diffusion en cliquant ici.