Privacy Policy
This privacy notice provides an overview of how we manage and protect the personal data we receive or obtain about you.
The data we collect about you and how we use it will depend on your relationship with us.
We occasionally update this privacy policy so you should return to this page and read it through again from time to time. We will notify you of any material changes where required by law to do so.
Last updated: 14 March 2024
Intu Eldon Square Limited (register number 05503289) is a controller of your personal data (referred to as “Eldon Square”, “we”, “us” or “our” in this notice). Eldon Square is registered with the Information Commissioner’s Office with registration number Z2215738 and processes data on behalf of their clients.
If you have any questions in relation to this policy, please email [email protected].
.
This privacy policy is divided into the following sections:
- What happens if this Notice is updated or your personal data changes?
- Who does this notice relate to?
- Collection and use of your personal data;
- How do we use your personal data for marketing and how can you opt out?
- Who do we share your data with, and for what purposes?
- Changing your preferences;
- The use of cookies;
- Security measures and possibility of international transfer;
- How long will data about you be kept;
- What rights and options do you have;
- Time limit to respond;
- Your right to make a complaint;
- Links and Third Party Advertising;
- Changes to Privacy Policy and queries;
What happens if this Notice is updated or your personal data changes?
This Notice was last updated on the date stated at the beginning of the Notice and any historic versions can be obtained by contacting us at [email protected]. We will publish any changes to this Notice on our website. It is important that the personal data we hold about you is accurate and up to date. Please keep us informed if your personal data changes during your relationship with us.
Clients and related parties
If you are an existing client of Eldon Square , are an officer or employee of one of our clients or are a third party related to a client (for example an occupier, a service provider or supplier) then please email us at [email protected] find out more information about how we use your data.
Others
If you do not fall into any of the above two categories the information set out below tells you who we are, what data we may collect, and what we may do with that data. This notice applies if you are a visitor to our website, a contact of ours or are involved in providing services to us.
Introduction
This Privacy Policy, and our Cookie Policy, sets out the basis upon which any personal data we collect from you, or that you provide to us, may be processed by Eldon Square.
Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.
Please read the following carefully to understand our practices regarding your personal data and how we will treat it.
You may withdraw your consent for a particular activity at any time providing it does not impact on any other lawful basis for processing your data such as contract or vital interest. This can be done by contacting [email protected].
Who does this notice relate to?
This notice gives you information about how we collect and use your personal data when:
- Job applicants, current and former employees, temporary and agency workers, contractors, apprentices, interns, people doing work experience, and apprentices;
- Shopping centre visitors;
- Website visitors;
- Competition entrants; and
- Supplier contacts.
Collection and use of your personal data
Your personal data may be collected by Eldon Square through our website, or meetings with and emails and telephone calls to us.
The types of personal data we collect about you are:
Contact data
- Information provided when you interact with us directly including when registering on the Site with us, using our in-store services, participating in promotions and competitions, completing customer surveys or completing lost property forms or photography consent forms – this may include your title, name, postal address, email address, telephone number(s), account details, username, login and information about your use of our centre;
Preferences & Profile data
- Information about your preferences, including brands and content you like, dislike, click on or share with others;
- Information provided when you interact with us directly (e.g. telephoning, writing or emailing us, buying gift cards or services from us, participating in promotions and competitions);
Demographic information;
- Data collected when you interact with us or otherwise make accessible via third parties, including:
o through brand partners and social media platforms, and
o through third party surveys and market research you participate in;
Other information which you give us when dealing with us or interacting with us in any way including via third parties.
Financial data
- Your credit and/or debit card number and expiry date may be collected if you make a purchase from us.
Image data
- CCTV footage, including Body-worn Video (BWV), featuring your image; BWV may also include audio recording;
- Vehicle registration number and details (via Automatic Number Plate Recognition (ANPR) systems where it is in operation at our service road entrances).
Technical / Usage data
- Information about your use of the Sites. Some of this information may be automatically collected, such as your Internet Protocol (IP) address, unique device identifier, browser type, browser language and access times;
Technical data from analytics providers;
- Details you provide when using our WiFi in our centre;
- Information about your location. We may automatically collect your location
information (if you have consented to this on your device).
Your personal data may be processed by (or on behalf of) Eldon Square for any of the following purposes:
- To manage our relationship with you
- To communicate with you, such as in the course of developing a commercial relationship between us and your employer. To send you marketing communications via email or post.
- To create and manage records of your involvement with us.
- To comply with our legal and regulatory obligations.
- To use data analytics to improve our website, products/services, marketing, customer relationships and experiences.
- For the Security and wellbeing of our staff and visitors and for the purposes of managing our properties.
- To administer and protect our business
- Process payments for purchases;
- To manage and administer any of our promotions and competitions which you enter.
- Provide reservation or booking services;
- Provide you with information, products, services or experiences that you request from us;
The legal basis for our use of data about you is one of the following:
- The performance of a contract to which you are a party;
- Compliance with a legal obligation to which we are subject; or
- A legitimate business interest that is not overridden by your interests, rights and freedoms which require protection. Where processing is required to protect the vital interests of an individual/s.
Where none of the above conditions apply, we will ask for your consent to process the data. You can withdraw your consent at any time by emailing [email protected]. or by clicking on the opt out link on any marketing communication sent to you.
We will only use your personal data for the purposes for which we collected it, unless we consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to obtain an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at [email protected].
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Purposes for which we use your data – summary
We have set out below, in a table format, a broad summary of the ways we use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
Note that we may process your personal data on more than one lawful ground if we are processing the same information for more than one specific purpose.
| Purpose/activity | Type of data | Lawful basis for processing including basis of legitimate interest |
| To manage our relationship with you which will include:
a) Notifying you about changes to our terms or privacy policy b) Asking you to leave a review or take a survey c) Responding to your request d) To create and manage records of your involvement with us |
Contact
Preferences & Profile |
a) Performance of a contract with you in relation to any updates to our terms. Necessary to comply with a legal obligation to inform you about how we use your personal data.
b) Necessary for our legitimate interests to keep our records updated and to study how customers use our products/services c) Necessary for our legitimate interests to provide customers with a good service |
| To administer and protect our business (including protecting our centre, visitors and staff) and our Sites (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data), this may include data collected from on-site visits to the centre and complying with legal and regulatory obligations | Contact
Preferences & Profile Technical / Usage Image |
a) Necessary for our legitimate interests, for running our business, provision of administration and IT services, network security, to prevent crime and fraud in our Centre and on our Sites, to prevent and manage Health & Safety issues in our Centre, and in the context of a business reorganisation or group restructuring exercise, and in the event that we need to commence and manage any legal proceedings.
b) Necessary to comply with a legal obligation. e.g. to comply with health and safety legislation. |
| To use data analytics to improve our website, products/services, marketing, customer relationships and experiences. | Technical / Usage | Necessary for our legitimate interests (to define types of customers for our products and services, to keep our Sites updated and relevant, to develop our business and to inform our marketing strategy) |
| To send you marketing communications via email or post, including suggestions and recommendations to you about services that may be of interest to you, and to provide you with updates about us and our centre (which may be personalised). | Contact
Preferences & Profile Technical / Usage |
a) Necessary for our legitimate interests (to develop our products/services and grow our business)
b) In certain circumstances, with your consent (see also Direct marketing – how to opt out) |
| To manage and administer any of our promotions and competitions which you enter. | Contact
Preferences & Profile |
a) Performance of a contract with you e.g. in order send you a prize which you have won from a competition you have entered into.
c) Necessary for our legitimate interests (to develop our products/services and grow our business) e.g. in order establish what products you are interested in so we can target marketing and promotional material which we feel may be most relevant to you. |
| To provide a service to you | Contact
Preferences & Profile Technical / Usage Financial |
a) Performance of a contract with you
b) Consent to push notifications, via your device settings |
How do we use your personal data for marketing and how can you opt out?
- We may use your Identity, Contact, Communications Data Technical and Usage data to form a view on what we think you may want or need, or what may be of interest. This is how we decide which products, services and offers may be relevant for you (we call this marketing). You will receive marketing communications from us if you have requested marketing communications by signing up to our newsletter via our website.
- You can ask us to stop sending you marketing communications at any time by following the opt-out links on any marketing communications sent to you or by contacting us at [email protected]..
Who do we share your data with, and for what purposes?
We will only share your data with anyone outside of Eldon Square where it is justifiable (under the GDPR) to do so.
Some of the third parties are based outside the UK so their processing of your personal data will involve a transfer of personal data outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is in place:
We may transfer your personal data to countries that have been granted an adequacy decision by the European Commission and/or an adequacy regulation by the UK Secretary of State (as applicable) confirming that the country in question provides an adequate level of protection for personal data; or
We may use specific contracts approved by the European Commission and/or the UK (as applicable) which ensure that personal data is adequately protected. When we rely on this measure, we will conduct risk assessments and take appropriate measures to ensure that the third-party can comply with the provisions of such contracts and we have confirmed that the country to which the personal data is transferred provides enforceable data subject rights and effective legal remedies for data subjects are available there; or a specific exception applies under applicable data protection law.
Please see below for details of the third parties we share your personal data with and where we send your personal data:
- Our Staff
- Service providers who provide IT and systems administration services and access to platforms we use for operational purposes to run our business;
- Tenants and potential tenants of premises within the centre may have access to personal data as part of research projects to provide an insight into customer behaviour and trends.
- Professional advisers including lawyers, auditors and insurers who provide consultancy, legal, insurance and accounting services to us;
- HM Revenue & Customs, regulators and other authorities based in the UK who require reporting of processing to ensure we are complying with legal and regulatory obligations
- Third parties who require access to the personal data we process for the purposes of the prevention or detection of crime or for the purposes of legal proceedings
- We require all third parties to respect the security of your personal data and to treat it in accordance with the law and the terms of the contract we have in place with them where they are our third-party service providers. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
- Please contact us at [email protected] if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or you would like more information about the third parties we share your personal data with.
Changing your preferences
We want to make sure that you are happy with the ways in which we hold and use your personal data. If at any time you wish to check, update or amend your personal data or preferences, please email us at [email protected].
The use of ‘Cookies’
Please see our for details of how to disable cookies in use on the Website.
Security measures and possibility of international transfer
We are professional about security and we follow appropriate technical and organisational measures in the storage and disclosure of personal data so as to prevent unauthorised disclosure, use, alteration or destruction. We will only share your data with anyone outside of Eldon Square where it is justifiable (under the GDPR) to do so.
We also have in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
How long will data about you be kept?
We store data for as long as is necessary in accordance with legal, regulatory, financial and best-practice business requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. Once our relationship with you ends, we will securely delete/destroy your data in line with our data retention policies.
Please contact us at [email protected]. if you would like to know more information about the specific retention periods for which we retain your personal data.
What rights and options do you have?
You may have the following rights in respect of data about you that we hold:
- Request us to give you access to it;
- Request us to rectify it, update it, or erase it;
- Request us to restrict our use of it, in certain circumstances;
- Object to our use of it, in certain circumstances;
- Withdraw your consent to our use of it;
- Data portability, in certain circumstances;
- Opt out from our using of it for direct marketing; and
- Lodge a complaint with the supervisory authority in your country (if there is one).
You are able to exercise these rights by contacting us using the details set out below.
Before we can process your request, we may need information from you to help us confirm your identity. This is a security measure to ensure that rights are being exercised by the correct person and to ensure that personal data is not disclosed to, erased by or altered by any person who has no right to do so.
For more information on the rights set out above and when they apply, please contact us at [email protected]. or see the guidance from the UK Information Commissioner on individuals’ rights/other relevant supervisory authorities.
Time limit to respond
We will aim to all respond to all legitimate requests within one month. If your request is particularly complex or you have made a number of requests it is likely to take us longer than a month to respond, we will notify you of that and keep you updated as to progress.
Your right to make a complaint
In addition to your legal rights set out above, you also have the right to make a complaint at any time to your local data protection authority, (see http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.html). Information Commissioner’s Office (ICO) is the UK supervisory authority for data protection issues (www.ico.org.uk). We are committed to protecting your personal data and would appreciate the opportunity to address any concerns or complaints you may have before you approach the ICO so that we can remedy them. Any concerns or complaints should be raised with the Data Protection Officer in the first instance.
Links and Third Party Advertising
Any links on the Website may take you to third party sites over which we have no control. When linking to another Website you should read the privacy policy stated on that Website. This Privacy Policy does not cover the use of your personal data on any third party Websites.
Changes to Privacy Policy and queries
If you have any queries about this Privacy Policy or any queries about the protection of personal data we hold about you, please do not hesitate to contact us at [email protected].
