This Privacy Notice (“Privacy Notice” or “Notice”) was last updated on July 25, 2018.
This Notice describes the types of personal information (“Information”) collected on our websites and mobile applications (“Online Services”) in our centres. It explains: how that Information is used and shared; the lawful bases for our use of your Information; what rights you have in relation to it; and, how to contact us for further information.
WHAT IS PERSONAL DATA?
Personal information is information that allows us to identify you directly or indirectly and that tells us something about you. This could include information such as your name, email address, information we collect about you when you visit our website, sign-up for services online or in our centres, or when we collect information on accidents and injuries or for security and crime prevention.
HOW DO WE COLLECT AND USE YOUR INFORMATION?
Information you give to us: You may provide Information to us directly, by creating an account online or by joining services such as Smart Parking. The lawful basis for the collection of this Information will depend upon the service being subscribed to but could include being asked for your consent, or because it is necessary for entering into a contract for the provision of a service you have requested.
Marketing and competitions: When you create an account, enter a competition or register for an event you may be asked if Westfield can also use your Information for marketing purposes. The lawful basis for these marketing communications is your consent. If you do provide consent, you can subsequently unsubscribe from these communications by: following the unsubscribe link on the email; from your online Westfield account if you have one; or by emailing us.
Information we collect automatically from your device: We may collect Information when you use our Online Services. For example, information about your use of our Online Services, including the time and duration of your visit, the referring URL, your Internet Protocol (IP) address, the type of device you use and its operating system, advertising identifiers, and other device identifiers. The lawful basis for the processing of this Information is for the legitimate interests of Westfield.
If you apply for a job with us: If you apply for a job at Westfield through our recruitment website you will be provided with a detailed privacy notice for recruitment and selection as part of the application process.
In our centres
Concierge Services: If you use our Concierge services and other facilities in our centres, we will collect the Information necessary to provide you with the products or services you have requested. The lawful basis for the collection of this data is for the performance of a contract that we are entering into with you at your request.
Management of our centres: In the course of running our centres, we may collect Information on incidents and accidents that occur, as well as using CCTV and other security measures for your and our protection. Click here to view our centre safeguarding and security privacy notice for further information on how we use your personal data for these purposes, your rights, and how long we retain the information. This notices also includes information on exclusion orders. We also use licence plate recognition systems in our car parks for operational purposes (such as monitoring car park usage) and to provide services that help you to find your car.
Westfield Wi-Fi: If you use the Wi-Fi networks in our centres, we will collect Information from you in order to log you on to the network, including your name and email address. We may also collect Information relating to the duration of visits and the identity of the device that connects to the Wi-Fi. The lawful basis for the processing of the Information is that it is necessary for entering into a contract for the provision of a service you have requested. Any research/analysis conducted on Wi-Fi usage would be for the legitimate interests of Westfield.
Wi-Fi analytics: Our Wi-Fi technology collects a MAC address (a unique device identifier) and the type of device being used by centre visitors that log in and connect to our Wi-Fi. This provides us with useful information on how visitors use the public areas of our centres only. For visitors who have Wi-Fi enabled but are not connected to Westfield Wi-Fi, generalised location data is still accessible but is only analysed on an aggregated basis. The MAC address would generally be unobtainable in this instance. The lawful basis for the collection and use of Information for these limited purposes is for the legitimate interests of Westfield.
Other uses of your information
In addition to the purposes already described, Westfield uses Information collected to perform essential business operations, for example: to understand usage patterns (such as foot traffic) within our centres; to develop, provide, improve and personalise Westfield products and services; and, to provide customer service/support. We may undertake additional research, analysis, and surveys, both online and in our centres. The lawful basis for this use of Information is for the legitimate business interests of Westfield.
HOW DO WE SHARE YOUR INFORMATION?
Service Providers. We may share Information we collect about you with suppliers who provide services on our behalf to help with our business activities. For example:
- in the provision of our Smart Parking and finding your car Services;
- to process payments made;
- in the management of email marketing;
- to provide Wi-Fi in our centres;
- to provide CCTV and security services within our centres; and/or
- with contractors, consultants and professional advisors.
Disclosure for Legal Reasons. We may disclose Information when we believe, in good faith, that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with the law, including valid legal requests from the Police, or other government agencies.
Change of Ownership. If Westfield is involved in a merger, acquisition, dissolution, or sale of all or a portion of its assets, we reserve the right to transfer your Information. You will be notified via email or by notification on our website of any change in ownership.
USE OF CHILDREN'S INFORMATION
Westfield does not knowingly collect Information from children under the age of 16, but it may be collected from parents/guardians with their consent. Examples include the Kids Club services within our centres, and competitions that involve children’s participation.
Children under the age of 16 are not permitted to use Wi-Fi networks in Westfield centres.
If you have reason to believe that a child under the age of 16 has provided personal information to Westfield, please contact us and we will delete that Information from our databases.
HOW LONG DO WE KEEP YOUR INFORMATION?
Westfield retains the Information we collect for as long as necessary to provide the products and services you have requested, or for other essential purposes such as complying with legal obligations, resolving disputes, and enforcing our agreements.
We provide further information on specific retention periods in our privacy notices for recruitment and selection, employees and workers and on our uses of personal data for safeguarding and security purposes.
When you unsubscribe from our email newsletters you may receive communications whilst our systems update. We will delete your information within three months unless we hold it for other purposes, for example if you are registered for other services.
HOW DO WE KEEP YOUR INFORMATION SECURE?
The security of your Information is important to us. While we follow generally accepted security standards to safeguard the Information submitted to us, it is not possible to guarantee the security or integrity of Information on the internet. Therefore, we encourage you to take precautions to protect your Information, including protecting your passwords, using secure networks to access the internet, and logging out of online services when you are away from your device.
WHEN DO WE TRANSFER YOUR INFORMATION OVERSEAS?
We may transfer Information overseas in the following situations:
To other members of the Westfield Corporation Group where we share computing systems: These transfers are made lawful through an agreement between our group companies that use model contractual clauses approved by the European Commission.
Where we use suppliers who are either based outside of the United Kingdom or who may store personal data on servers outside of the United Kingdom: Where these transfers are outside of the European Economic Area or where a country is not deemed to have an equivalent level of data protection law to the United Kingdom we typically use model contractual clauses to legitimise these transfers.
YOUR RIGHTS IN RELATION TO YOUR INFORMATION
Where applicable, Westfield adheres to data protection laws in the European Economic Area.
- You have the right to request a copy of the Information we hold on you, plus information on how we use your Information;
- You have the right object to the use of your Information; however, this right is limited and will depend upon the lawful basis by which we are using your Information;
- If Westfield’s processing of Information is based on your consent, you have the right to withdraw consent for future processing at any time;
- You may request the deletion of your Information, unless we are legally entitled or obliged to retain the Information (for example, where we have a legal obligation to do so);
- You may have the right to object to the processing of your Information; and,
- You have the right to lodge a complaint with your Data Protection Authority. In the U.K, this is the Information Commissioner’s Office.
Westfield Europe Limited is the ‘data controller’ for the personal data we collect. It is registered with the Information Commissioner’s Office with registration number Z5539526.
We have appointed a Data Protection Officer who can be contacted using the information provided in the contact us section.
LINKS TO OTHER WEBSITES
Westfield’s products and services may contain links or references to other websites or companies not operated or controlled by Westfield. The policies and procedures described here do not apply to those third parties. Links or advertisements do not imply that Westfield endorses or has reviewed such third parties or their privacy practices. Visit those third parties’ websites or contact them directly for information on their privacy notices.
We may update this Notice to reflect changes to our information practices and where updates are required by law. If we make any material changes we will notify you by email (sent to the email address specified in your account) or by means of a notice on our website prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices. Your continued use of Westfield products or services after any changes or revisions to this Notice shall indicate your agreement with the revised terms.
HOW TO CONTACT US
If you have questions or complaints regarding our privacy practices or this Notice, or would like to exercise your privacy rights please contact our Data Protection Officer:
Via email or by post to: Data Protection Officer, Westfield U.K. 6th Floor MidCity Place, 71 High Holborn, London, WC1V 6EA, United Kingdom.