PRIVACYNOTICE FOR SHOPPERS
1. WHO ARE WE?
We are Standard Life Assurance Limited (we/us/our). We own The Water Gardens, Harlow,CM20 1AN (the Shopping Centre).
2. WHAT IS THIS NOTICE?
We want to reach out to our customers and hear what they’re saying –whether it’s by giving us feedback or comments, completing a survey, or takingpart in competitions we’re running – we’re thrilled you’re joining theconversation. You can also join our mailing lists to receive our newsletter orother communications, so that we can tell you about things you may beinterested in or benefit from deals and discounts we're offering.
When you interact with us, you may give us Personal Data about you. Personal Data means data which can beused to identify an individual. The individual who can be identified from thePersonal Data is known as the DataSubject.
In respect of any such Personal Data, for the purpose of applicabledata protection legislation (including but not limited to the General DataProtection Regulation (Regulation (EU) 2016/679) (the GDPR), we are acting as a Controller(which means we are the business responsible for making the decision to collectthe Personal Data in the first place, and deciding what to collect and how touse it). To help us to connect with ourcustomers and run some of our marketing activities, we use a marketing agency.Currently we use a company called Velocity Worldwide UK Limited (our Marketing Agent) to manage ourmarketing services for us. This means that they may handle the Personal Data asa Processor (they are acting on ourbehalf and authorised to use the Personal Data in accordance with ourinstructions). We also work with other companies that carry out certainactivities on our behalf, such as the wi-fi operator which helps us to provideour wi-fi service.
Your privacy is important to us, and we are committed to using yourPersonal Data in a fair and lawful way, and protecting your data rights.
This notice explains what we do with your Personal Data, includingwhat Personal Data we collect, how we collect it, how we use it, and how wecomply with our legal obligations to you. It provides information about yourdata rights, and information about how we use your Personal Data in the contextof our marketing activities (including via our Marketing Agent).
Please note that this notice applies to our use of the Personal Data ofShopping Centre customers. It also only applies to our activities – if you wantto know how other companies and organisations process Personal Data which youprovide to them, such as stores within the Shopping Centre, please read theirprivacy policies.
This notice may be updated from time to time, so please re-visit thispage if you want to stay up to date.
3. WHAT PERSONAL DATA DO WE COLLECT AND STORE?
We may collect and process the following data about you:
(i) INFORMATION WHICH YOU PROVIDE TO US WHEN YOU INTERACTWITH US: we may collect data directly from you, if, for example, you use our Shopping Centre services (such as wi-fiand our wi-fi operator asks you to provide information on our behalf formarketing purposes), take part in campaigns which we might run from time totime, complete a survey, or join our mailing lists. This may include:
· your name,address and phone number
· where you comefrom
· your gender
· online contactinformation
· payment details(if you decide to take advantage of any discounted goods or services offered aspart of our campaigns)
· any opinions orpreferences which you express (including your likes and dislikes)
· details aboutyour location
(ii) TRANSACTIONAL DATA: we might collect data about your transactions if you use a voucher, loyaltycard, discount code or take part in a promotion which we are running. This willhelp us to learn about:
· your shoppingpreferences, interests, hobbies and habits
· your health,well-being and lifestyle choices
(iii) TRAFFIC DATA:we might collect information about which websites you access or offers youclick on when you’re using our wi-fi services.
4. HOW DO WE USE THE DATA WE COLLECT ABOUT YOU AND WHAT’SOUR LEGAL BASIS FOR DOING SO?
We may use the data we collect about you in thefollowing ways:
(i) TO PROVIDE SERVICES: for example, if you have provided us with your details so that you canreceive particular services from us (such as taking part in a campaign,benefiting from a discount or taking part in a competition), we will use yourPersonal Data in order to make that happen. For certain campaigns andcompetitions, this may include transferring Personal Data related to you to athird party providing the prize or whose goods or services are being promoted.If a transfer of this nature is required, we will publish the name of the thirdparty recipient and let you know that the transfer is required before we do so.We will do this on the basis that suchuse of your Personal Data is required to provide you with the services you haverequested. This may be necessary for the performance of a contract that you areentering or have entered into with us, if you provide your consent, or if it isin our legitimate interests to do so. You may let us know at any time if you want to pull out of a competitionor stop receiving our services by contacting us using the contact details setout at the end of this policy and we will promptly comply with your request.
(ii) TO SEND YOU MARKETING COMMUNICATIONS: We might contact you by email, SMS, push notificationsin our app, social media, and potentially by other communication channels whichmay become available in the future, to provide you with information about competitions,deals, products and events. We will sendyou such communications where you have provided opt-in consent either to us orto a third party acting on our behalf, e.g. our wi-fi operator in the contextof our wi-fi service. You are entitled to withdraw your consent to allmarketing or marketing via particular channels at any time and we will promptlycomply with your request. You will be able to withdraw your consent bycontactingus using the contact details set out at the end of this policy or clicking theunsubscribe link in electronic marketing communications we send to you.
TO CREATE APROFILE ABOUT YOU TO INFORM OUR MARKETING DECISIONS: If you have opted in to receiving marketingcommunications from us, we might use an automated process to analyse yourpurchase habits and preferences to build a "profile" of you to get abetter idea of your interests, likes and dislikes. This helps us send you information which wethink might be of interest to you, about campaigns we’re running and otherevents or discounts we’re offering (including surveys and information aboutgoods and services which we think you’ll like and which seem to correspond withyour interests). We undertake profiling whereyou have provided opt-in consent to receiving marketing communications from us.You may ask us to stop using your Personal Data for profiling at any time by contactingus using the contact details set out at the end of this policy and we willpromptly comply.
(iii) INTERNAL BUSINESS REQUIREMENTS: we may use your Personal Data in accordance with ourinternal business requirements. For example, we may need to create back-upcopies of data to make sure we have adequate safeguards in place to preventloss of the data we hold; or we may need to use your data to help us establish,exercise or defend legal claims. Any copies of the data held will be heldsecurely and no further use shall be made of such data save as set out herein.We will carry out these activities where it is in our legitimate interests todo so. We believe that such use would be generally anticipated by Data Subjectsand is highly unlikely to cause any damage to or be considered by Data Subjectsto be invasive of their privacy.
(iv) STATISTICAL ANALYSIS: we may collect and use aggregate data, forinternal market research, statistical analysis and data mining purposes, and wemay transfer this data at will to third parties. This data will be anonymisedand you will not be identifiable from it (meaning it is no longer PersonalData).
5. WILL PERSONAL DATA ABOUT YOU BE DISCLOSED TO ANYONEELSE?
(i) We will not passPersonal Data about you to third parties for marketing purposes unless you haveexpressly consented to it.
(ii) We may discloseyour Personal Data to the following third parties for the following purposes:
· To enable our licensors, employees and thirdparties provide services to help us tocarry out our business. Any employeesand/or Processors (including our Marketing Agent) contracted by us will besubject to strict contractual requirements only to use your Personal Data inaccordance with our instructions.
· To any of our group companies where necessary for internal business purposes.
· If we sell any business or assets to another companyor if we merge with or are acquired by another company, or if we are inmeaningful discussions about such a possibility, we may share your PersonalData with the prospective new owners of the business or asset. We will never sell Personal Data as a sole asset.
(iii) We maydisclose aggregate data to third parties for analysis and market researchpurposes. Any data so disclosed will not contain Personal Data.
If any of these third parties are based outside of theEuropean Economic Area, we will only transfer data to such parties inaccordance with applicable data protection legislation (i.e. where there are appropriate safeguards inplace to protect your Personal Data).
6. WHAT SECURITY PROCEDURES DO WE HAVE IN PLACE?
(i) It is ourpolicy to ensure that all Personal Data held by us (or any Processors we use)is handled correctly and appropriately according to the nature of theinformation, the risk associated with mishandling the data, including thedamage that could be caused to an individual as a result of loss, corruptionand/or accidental disclosure of any such data, and in accordance with anyapplicable legal requirements.
(ii) We undertakeregular security and risk reviews and we monitor all of the controls that wehave in place to ensure the security, accuracy and integrity of the PersonalData we hold. We also endeavour to ensure that such data is only accessed byauthorised personnel for a legitimate purpose (in accordance with our privacynotice).
(iii) Wehave a set of formal procedures that must be adhered to within our organisationto ensure that security standards are maintained and that data privacy isrespected.
(iv) Our MarketingAgent, (which is responsible for protecting data we transfer to it formarketing purposes) is ISO27001 accredited by the BSI.
(v) There are some steps you can taketo help make sure that your data is protected. For example:
· if you are contacting us with a query or complaint,only ever give us your work details rather than your personal contact details;
· if you are sending any financial details orsensitive information, consider sending it in separate emails or encrypted,password protected documents; and
· make sure that you keep any passwords associatedwith any account that you hold with us secure.
7. WHERE DO WE STORE THE PERSONAL DATA WE COLLECT?
We only use servers in the EU (and the United Kingdom). Our currenthost servers are provided by AWS (Amazon Web Services).
8. FOR HOW LONG DO WE STORE PERSONAL DATA ABOUT YOU?
We will only retain and use Personal Data which we collect for as longas necessary for the purposes for which it was collected. If we haven't heardfrom you or had any meaningful interaction with you for over 2 years, we willcontact you and ask you if you would like to be removed from our database. Insome circumstances we may be required to keep your data for longer periods (forexample, to comply with our obligations under applicable laws).
9. WHAT RIGHTS DO YOU HAVE IN RESPECT OF ANY PERSONALDATA WE HOLD ABOUT YOU?
You have the following rights in respect of Personal Datawhich we hold about you:
(i) Right to be informed: the right to be informed about what Personal Data we collect andstore about you and how it’s used.
(ii) Right of access: the right to request a copy of the Personal Data we hold about you, aswell as confirmation of:
(i) thepurposes of the processing;
(ii) thecategories of Personal Data concerned;
(iii) therecipients to whom the Personal Data has/will be disclosed;
(iv) for howlong it will be stored; and
(v) if datawasn’t collected directly from the you, information about the source.
(iii) Right of rectification: the right to require us to correct any Personal Dataheld about youwhich is inaccurate or incomplete.
(iv) Right to be forgotten: in certain circumstances, the right to have any PersonalData held about youerased from our records.
(v) Right to restriction of processing: the right to request us to restrict the processingcarried out in respect of your Personal Data. You might want to do this, forinstance, if you think the data held by us is inaccurate and you would like torestrict processing until the data has been reviewed and updated if necessary.
(vi) Right of portability: the right to have your Personal Data transferred toanother organisation, to the extent it was provided in a structured, commonlyused and machine-readable format.
(vii) Right to object to direct marketing: the right to object where processing is carried outfor direct marketing purposes (including profiling in connection with thatpurpose).
(viii) Right to object to automated processing: the right not to be subject to a decision based solelyon automated processing (including profiling) which produces legal effects (orother similar significant effects) on you.
You may request to exercise any of these rights by contacting us usingthe contact details set out at the end of this policy. We may need to ask youfor further information and identification to help us to comply with thisrequest. We may also refuse your request where it is excessive, repetitive, orto comply with applicable laws.
10. WHO DO YOU COMPLAIN TO IF YOU’RE NOT HAPPY WITH HOW WEPROCESS YOUR PERSONAL DATA?
If you have any questions or concerns about how we areusing Personal Data about you or if you would otherwise like to contact ourData Protection Officer, please send an email to email@example.com.
If you wish to make a complaint about how we havehandled your Personal Data, you may lodge a complaint with the InformationCommissioner’s Office by following this link: https://ico.org.uk/concerns/.