Privacy-notice-shopping-centres

This privacy notice (“Notice”) was last updated on 1 December 2023.

1. Introduction

This Notice describes the types of personal data (“Data”) collected in our centres (“Centres”). It explains:

It should be read in conjunction with our other privacy notices:

- Safeguarding and Security Privacy Notice, which explains how we collect and use Data in our shopping centres for security and safeguarding purpose; and

- https://www.westfield.com/en-gb/privacy-notice, which explains how we collect and use Data on our websites and in the context of the provision of our newsletter and our ‘Loyalty Program’ (including the access to your ‘Loyalty Account’ within the website and app).

Data Controllers

The controllers of the Data we collect from you are:

Westfield Europe Limited (“Westfield”) (incorporated in England and Wales with registered number 03912122 and registered office at 4th Floor, 1 Ariel Way, London, W12 7SL) (registered with the Data Commissioner’s Office with registration number Z5539526); and
Unibail Management S.A.S.,7 place du Chancelier Adenauer, 75016 Paris, France, registered with the Registry of Commerce and Companies of Paris under number 414878389

(each a “Controller” and together referred to as the “Controllers”).

Data Privacy Team

Westfield’s Data Privacy Team can be contacted by email at dpo@urw.com or via post at Westfield Europe Limited, 1 Ariel Way, London, W12 7SL.

2. HOW DO WE COLLECT AND USE YOUR DATA?

Online Services

Data you give to us: When you subscribe to or book any of the following services online, you will be requested to provide the following Data to us, which will be used for the purposes set out below:

Shopmobility (including Kiddy Car, wheelchair and scooter rental): First name, surname, email address and contact number, for the purposes of processing your booking and providing you with the service;
E-newsletter: First name and email address, for the purposes of obtaining your consent to subscribe to electronic marketing communications;
Personal Styling, Fashion Lounge and meeting room bookings: First name, surname, email address and contact number, for the purposes of processing your booking and providing you with the service.

The lawful basis for the processing of this Data is to provide you with the service that you have requested.

Creating a Smart Parking account: If you create a Smart Parking account we will collect your first name, surname, email address, vehicle registration numbers and payment card details. The lawful basis for the processing of this Data is to provide you with the service that you have requested.

Marketing and competitions: When you create an account, enter a competition or register for an event you may be asked if Westfield can also use your Data for marketing purposes. The lawful basis for these marketing communications is your consent. If you do provide consent, you can subsequently unsubscribe from these communications by: following the unsubscribe link on the email; from your online Westfield account if you have one; or by emailing us at dpo@urw.com.

Data we collect automatically from your device: We may collect Data when you use our online services. For example, Data about your use of our online services, including the time and duration of your visit, the referring URL, your Internet Protocol (IP) address, the type of device you use and its operating system, advertising identifiers, and other device identifiers. The lawful basis for the processing of this Data is for the legitimate interests of Westfield.

Cookies and similar technologies: Westfield and its partners use cookies and similar technologies when you use our online services. For more Data on our use of cookies, including how to manage your cookie preferences, see our Cookie Policy.

Advertising. Westfield uses the Data you provide us to help us tailor and show advertisements to you. We may partner with third parties to help us display relevant advertising and to manage our advertising across multiple channels. Our third-party partners may use cookies and non-cookie based technologies in order to help us show you advertising based upon your browsing activities and interests.

If you apply for a job with us: If you apply for a job at Westfield through our recruitment website you will be provided with a detailed privacy notice for recruitment and selection as part of the application process.

3. Collection of Data in our Centres

Concierge Services: If you use our Concierge services and other facilities in our Centres, we will collect the Data necessary to provide you with the products or services you have requested. The lawful basis for the collection of this data is for the performance of a contract that we are entering into with you at your request.

Management of our Centres: In the course of running our centres, we may collect Data on incidents and accidents that occur, as well as using CCTV and other security measures for your and our protection. Click here to view our centre Safeguarding and Security Privacy Notice for further Data on how we use your personal data for these purposes, your rights, and how long we retain the Data. This notices also includes Data on exclusion orders. We also use licence plate recognition systems in our car parks for operational purposes (such as monitoring car park usage) and to provide services that help you to find your car.

Westfield Wi-Fi: If you use the Wi-Fi networks in our centres, we will collect Data from you in order to log you on to the network, including your name and email address. We may also collect Data relating to the duration of visits and the identity of the device that connects to the Wi-Fi. The lawful basis for the processing of the Data is that it is necessary for entering into a contract for the provision of a service you have requested. Any research/analysis conducted on Wi-Fi usage would be for the legitimate interests of Westfield.

Location and Wi Fi analytics: We may, with your consent, use Wi-Fi and other technology to help us analyse how visitors travel through our centres, and to provide useful Data such as the proportion of repeat visitors to our centres. This technology works by collecting a unique identifier, called a MAC Address, from your mobile device. This is collected by the Wi-Fi signal that your device transmits. The MAC address is ‘hashed’ (a process that obscures the original MAC address) shortly after collection. We do not combine this Data with any other Data that may identify you.

Other uses of your Data

In addition to the purposes already described, Westfield uses Data collected to perform essential business operations, for example: to understand usage patterns (such as foot traffic) within our centres; to develop, provide, improve and personalise Westfield products and services; and, to provide customer service/support. We may undertake additional research, analysis, and surveys, both online and in our centres. The lawful basis for this use of Data is for the legitimate business interests of Westfield.

4. HOW DO WE SHARE YOUR DATA?

Service Providers. We may share your personal data with the following third parties for further processing:

our corporate affiliates, including our joint venture partners, in order to deliver the Services and develop and test new services and features;
in the provision of our Smart Parking and finding your car Services;
to process payments made;
in the management of email marketing;
to provide Wi-Fi in our centres;
to provide CCTV and security services within our centres; and/or
with contractors, consultants and professional advisors.

A list of third parties to which we transfer your Data for this sort of processing is here:

BrainTree
247 Tottenham Court Road
Floor 1
London, UK W1T 7QX

Hub PARKING TECHNOLOGY

(a business unit of the FAAC Group a trading style of FAAC (UK) Limited)

10 Hatch Industrial Park, Greywell Road

Mapledurwell

Basingstoke RG24 7NG

Networks Merchants Limited

4^th Floor All Saints’ Street

Bristol BS1 2LZ

Salesforce.com EMEA Limited
Floor 26 Salesforce Tower
110 Bishopsgate
London UK EC2N 4AY

Spreedly
116 West Main Street
Durham, NC 27701-3232
United States

Onetrust
London (Co-Headquarters)
Cannon Green, 27 Bush Lane
London EC4R 0AA

CMX Engage (Cisco Systems)
9-11 New Square
Bedfont Lakes
Feltham
Middlesex
TW14 8HA

Managed by Westfield, LLC

Hosting - Google – Big Query / Data Flow / GA
Gordon House, Barrow Street
Dublin, D04 E5W5, Dublin

Hosting - Amazon – AWS
Burlington Plaza, Burlington Rd
Dublin 4, Ireland

Hosting – Monitoring/Logging New Relic, Sumologic
Aviation House
125 Kingsway
London, WC2B 6NH

New Relic
Strand Bridge House, 138-142 The Strand
London, England WC2R 1HL

Disclosure for Legal Reasons. We may disclose Data when we believe, in good faith, that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with the law, including valid legal requests from the Police, or other government agencies.

Change of Ownership. If Westfield is involved in a merger, acquisition, dissolution, or sale of all or a portion of its assets, we reserve the right to transfer your Data. You will be notified via email or by notification on our website of any change in ownership.

5. USE OF CHILDREN'S DATA

Westfield does not knowingly collect Data from children under the age of 16, but it may be collected from parents/guardians with their consent. Examples include the Kids Club services within our centres, and competitions that involve children’s participation.

If you have reason to believe that a child under the age of 16 has provided personal Data to Westfield, please contact us at dpo@urw.com and we will delete that Data from our databases.

6. HOW LONG DO WE KEEP YOUR DATA?

Westfield retains the Data we collect only for as long as necessary to provide the products and services you have requested, or for other essential purposes such as complying with legal obligations, resolving disputes, and enforcing our agreements. We retain certain categories of data for the following periods:

E-newsletter Data: for so long as you actively engage with our e-newsletter, after which we only retain the Data for 1 year. If you request to unsubscribe or withdraw your consent to be contacted, you may receive communications whilst our systems update. We will delete your Data within three months unless we hold it for other purposes, for example if you are registered for other services.
Smart Parking Data and purchases: 7 years
General CCTV footage: 30 days
CCTV footage of personal injury: 4 years for adults; 4 years after 16th birthday for minors
CCTV footage of property damage: 7 years
Personal injury records (other than CCTV): 10 years for adults; 21 years for minors
Property damage records (other than CCTV): 6 years

We provide further Data in specific privacy notices on:

specific retention periods for recruitment, employees and workers (available to a candidate when they apply for a role); and
our uses of personal data for safeguarding and security purposes, available here.

7. HOW DO WE KEEP YOUR DATA SECURE?

The security of your Data is important to us. While we follow generally accepted security standards to safeguard the Data submitted to us, it is not possible to guarantee the security or integrity of Data on the internet. Therefore, we encourage you to take precautions to protect your Data, including protecting your passwords, using secure networks to access the internet, and logging out of online services when you are away from your device.

8. WHEN DO WE TRANSFER YOUR DATA OVERSEAS?

We may transfer Data overseas in the following situations:

To other members of the URW Group where we share computing systems: These transfers are made lawful through an agreement between our group companies and model contractual clauses approved by the European Commission.
Where we use suppliers who are either based outside of the United Kingdom or who may store personal data on servers outside of the United Kingdom: Where these transfers are outside of the European Economic Area or where a country is not deemed to have an equivalent level of data protection law to the United Kingdom we use model contractual clauses approved by the European Commission.

9. YOUR RIGHTS IN RELATION TO YOUR DATA

Westfield adheres to all applicable data protection laws. In particular:

You have the right to request a copy of the Data we hold on you, plus Data on how we use your Data;
You have the right object to the use of your Data; however, this right is limited and will depend upon the lawful basis by which we are using your Data;
If Westfield’s processing of Data is based on your consent, you have the right to withdraw consent for future processing at any time;
You may request the deletion of your Data, unless we are legally entitled or obliged to retain the Data (for example, where we have a legal obligation to do so);
You may have the right to object to the processing of your Data; and,
You have the right to lodge a complaint with your Data Protection Authority. In the U.K, this is the Data Commissioner’s Office (ICO). You may contact the ICO by phone (+44 (0)3031231113), email (casework@ico.org.uk) or by post (Customer Contact, Data Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF).

LINKS TO OTHER WEBSITES

Westfield’s products and services may contain links or references to other websites or companies not operated or controlled by Westfield. The policies and procedures described here do not apply to those third parties. Links or advertisements do not imply that Westfield endorses or has reviewed such third parties or their privacy practices. Visit those third parties’ websites or contact them directly for Data on their privacy notices.

CHANGES TO THIS PRIVACY POLICY

We may update this Notice to reflect changes to our Data practices and where updates are required by law. We encourage you to periodically review this page for the latest Data on our privacy practices. Your continued use of Westfield products or services after any changes or revisions to this Notice shall indicate your agreement with the revised terms.

HOW TO CONTACT US

If you have questions or complaints regarding our privacy practices or this Notice, or would like to exercise your privacy rights please contact our Data Privacy Team:

Via email (dpo@urw.com) or by post to: Data Privacy Team, Unibail-Rodamco-Westfield, 1 Ariel Way, London, W12 7SL.