This privacy notice applies to all personal information we collect or process about you. Personal information is information or a combination of pieces of information that could reasonably allow you to be identified.
This privacy notice is with immediate effect. It may vary from time to time, so please check it regularly.
The personal information we use
We will collect personal information about you from a variety of sources, including information we collect from you directly (e.g., when you contact us) and information we collect about you from other sources, described below.
You will be informed at each information collection point what information is required and what information is optional.
Note that we may be required by law to share certain personal information about you, or as a consequence of any contractual relationship we have with you. Failure to provide this information may prevent or delay the fulfillment of our obligations. We will inform you at the time your information is collected whether certain data is compulsory and the consequences of the failure to provide such data.
Information we collect directly from you
- When you visit our websites, the web server collects some basic information such as your browser type, MAC or IP address, internet service provider’s domain name, which pages you accessed on the site, and when.
- As you navigate through a website, certain information can be passively collected (that is, gathered without your actively providing the information) using various technologies and means, such as Internet Protocol addresses, cookies, Internet tags, and navigational data collection.
This site may use Internet Protocol (IP) addresses. An IP Address is a number assigned to your computer by your Internet service provider so you can access the Internet and is generally considered to be non-personally identifiable information, because in most cases an IP address is dynamic (changing each time you connect to the Internet), rather than static (unique to a particular user’s computer). We use your IP address to diagnose problems with our server, report aggregate information, determine the fastest route for your computer to use in connecting to our site, and administer and improve the site.
- Where you fill out a feedback form, complete a “contact us” form, enter a competition or complete an application form we collect personal information such as your email address, name, contact number, postcode and date of birth. Not all fields are mandatory, and provision of the information is optional. Where you enter a competition or promotion, we may share your details with the retailers at the property to which the competition relates. This will be made clear to you at the time you sign up for the competition or promotion in individual terms and conditions.
- You may be asked to complete a survey or questionnaire either directly at our centres or via email, SMS or post and in doing so, we may ask for details such as your age, gender, and postcode. The information captured is for research purposes, and so we can understand the type of visitors coming to our centre to help improve our offer.
- We occasionally stream videos on social media, such as Facebook and Instagram live, and take and display photography on our website and social media of members of the public using and enjoying our centre. Photography and video will be used by third parties to promote Shopping City, Runcorn and the experiences and activities available within the centre. We inform members of the public of the possibility or photography, and video through the signs placed around the centre or building.
- We operate CCTV at our centre for public safety, crime prevention and prosecution, insurance, property management. In some circumstances, we may share this footage with third parties for public safety, crime prevention, and prosecution.
- Where we own a building, we capture personal data within the system which controls access to our buildings. This comprises personal data of people who work in a building and those who visit or occupy it. This may include name, occupation, employer and contact details. In relation to access control and visitor data where the data relates to us, we consider ourselves to be the data controller. Where the personal data relates to our tenants’ staff, contractors or visitors, our tenants may also be data controllers depending on the circumstances.
- Where we do not own a building but we provide property management services for the building owner and/or we provide access control system services for the building owner we capture personal data within the access control system. This comprises personal data of people who work in a building and those who visit or occupy it and includes name; occupation; employer and contact details. The data controller in these situations will be the building owner or the tenants of the building owner, and we are a data processor.
- Where we own a building or we provide property management services for a building owner we collect data on accidents to comply with health and safety legislation.
- Where you are a commercial tenant, you provide us with personal data such as financial and business information, contact details and bank account details. This is so that we can assess your suitability to be a tenant, allow you to pay the sums due under your lease and manage our buildings.
- Where you work for a tenant within the centre we may be provided with your contact details by your employer or yourself. This information will be used to liaise regarding estate management matters including key holders for emergencies. Your personal information (upon your agreement) will be used to communicate marketing and commercialisation opportunities and to liaise about estate management matters. Tenant employee information will be stored on locked databases within the Shopping City management suite. Where we provide property management services for a third party, we can be provided with personal data on tenants and their employees where this is necessary for us to carry out these services. We are not the data controller in these circumstances and are a data processor for the third party landlord.
Information we collect from other sources:
- We use social media such as Facebook, Twitter, and Instagram either ourselves or through third-party advertising agencies.
How we use your personal information and the basis on which we use it
We use your personal information to:
- provide and personalise our services;
- deal with your enquiries and requests;
- comply with legal obligations to which we are subject and cooperate with regulators and law enforcement bodies;
- contact you with marketing and offers relating to products and services offered by our tenants and us (unless you have opted out of marketing, or the law otherwise prevents us from doing so);
- contact you for research purposes, where you have consented to us doing so, to understand what you think of our sites and how we can improve them;
- we contract with third parties which in certain circumstances will be controllers of your personal data and responsible for managing it properly and in other circumstances will be processors who deal with your personal data in accordance with our instructions. Whether a third party supplier (who is not us) is a processor or controller of your personal data depends on the facts and where we appoint a third-party processor of your personal data we will put a framework around what we expect them to do with it and how they manage it.
We must have a legal basis to process your personal information. In most cases the legal basis will be one of the following:
- to fulfill our contractual obligations to you, for example, to fulfill the terms of a competition or promotion that you have entered or to provide you with the information you have requested;
- to comply with our legal obligations to you, for example, health and safety obligations while you are on our premises, or to a third party (e.g., the police)
- to meet our legitimate interests, for example, to understand how you use our services and our centre and to enable us to derive knowledge from that which in turn enables us to develop new services and further tailor our centre to appeal to a wide variety of persons. When we process personal information to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.
We may obtain your consent to collect and use certain types of personal information when we are required to do so by law (for example, when we process sensitive personal information after a Health & Safety incident within our centre). If we ask for your consent to process your personal information, you may withdraw your consent at any time by contacting us using the details at the end of this privacy notice.
Your rights over your personal information
You have certain rights regarding your personal information, subject to local law. These include the following rights to:
- access your personal information
- rectify the information we hold about you
- erase your personal information
- restrict our use of your personal information
- object to our use of your personal information
- receive your personal information in a usable electronic format and transmit it to a third party (right to data portability)
- register a complaint with your local data protection authority.
If you would like to discuss or exercise such rights, please contact us at the details below.
We encourage you to contact us to update or correct your information if it changes or if the personal information we hold about you is inaccurate.
We will contact you if we need additional information from you to honour your requests.
We may share your personal information with third parties under the following circumstances:
- Law enforcement agency, court, regulator, government authority, insurer or another third party. We may share your personal information with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party or to put in place insurance for our centres and other buildings.
- We may share non-personally identifiable information with third parties such as data profiling agencies, partner companies, customers, tenants, and suppliers, for example, to show trends of our centre and online profiles including website, app and social media channels.
Information Security and Storage
We implement technical and organisational measures to ensure a level of security appropriate to the risk to the personal information we process. These measures are aimed at ensuring the on-going integrity and confidentiality of personal information. We evaluate these measures on a regular basis to ensure the security of the processing.
We will keep your personal information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will make the necessary steps to ensure your details are removed from our systems or suppressed on request. An unsubscribe from marketing communications will result in your personal data being transferred to a suppression list for twelve months then deleted unless you choose to opt-in again via any of the methods detailed above. A right to be forgotten request will mean the deletion of all personal information held about you from our marketing database or relevant.
If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the data.
Links to Other Web Sites
Changes to the Policy
You may request a copy of this privacy notice from us at any time. We may modify or update this privacy notice from time to time.