Privacy Notice

Introduction
McArthurGlen develops and manages designer outlet centres ("Centres") across the UK, Europe and Canada. We provide services at these Centres and process your personal data for the reasons set out in this Website, App and Centre Visitor Privacy Notice ("Privacy Notice"), including to facilitate and enhance your experience at these centres and on our website and apps.

In this notice, where we refer to "McArthurGlen", "we", "us" or "our", this means the McArthurGlen Group Company or Group Companies responsible for processing your personal data.

McArthurGlen UK Limited is the primary controller of personal data for the McArthurGlen Group, but there will be circumstances where McArthurGlen UK Limited and the relevant McArthurGlen Group Company or Companies act as joint controllers. "Joint controllers" jointly determine how and why we process your personal data. For example, in some instances, McArthurGlen UK Limited, along with a Group Company or Group Companies, may act as joint controllers of your personal data which we share between us in order to evaluate and improve our services.

When visiting our Centres, the controller for some personal data collected (e.g. in relation to outlet centre security and CCTV collection) is the relevant Group Company (as defined below) in that country as identified through signage/notices at that Centre.
Please click on the sections below for more information.

Purpose and overview of this Privacy Notice
McArthurGlen takes the privacy of your personal data seriously. We understand that by providing your personal data – whether through use of our website, mobile apps, including the McArthurGlen Club app ("apps"), or other digital services, visiting our Centres (including in relation to data collected through CCTV) or logging into our WiFi – you are entrusting us with your information.

We have developed this Privacy Notice to give you full transparency about the information we collect from you online, why we collect it and how we use it. This Privacy Notice also explains what personal information we collect and record at our Centres - on our in-Centre computers and devices and in certain cases offline- and what we do with that information. We also need to ensure that you understand the rights you have over your personal data, including your rights of access to that data and how you can correct it and erase it. These rights are described below.

Annexed to this Privacy Notice is additional information that relates specifically to the personal information we collect and record when you use WiFi provided by us (“WiFi Annex”).

Please note that there is additional information in the jurisdiction-specific information section at the end of this Privacy Notice. If you use our services when located in one of the jurisdictions named in that section, then any information in the section relating to your jurisdiction takes precedence over any conflicting information in the other parts of this Privacy Notice. If you are in the European Economic Area ("EEA"), the GDPR applies to the processing of your personal data. If you are in the UK, the UK GDPR applies to your personal data.

Definitions and Interpretation
In this Privacy Notice:

"Centre" has the meaning given in paragraph 1 of the Introduction above;

"Centre Owner" means an owner of one of Centres which we manage ;

"controller" is a legal term and refers to the company that makes decisions about how and why your personal data is processed and is therefore responsible for ensuring that the processing is done in accordance with relevant data protection laws;

“Group Company” means McArthurGlen UK Limited, McArthurGlen UK Limited's parent company or any direct or indirect subsidiaries of the parent company (and 'Group Companies' is interpreted accordingly). Our Group Companies include the subsidiary management companies operating in each of our locations. A list of these Group Companies, their locations and contact details can be found at the end of this Privacy Notice. We may change this list from time to time;

"McArthurGlen", "we", "us" or "our" has the meaning given in paragraph 2 of the Introduction above.

"personal data" (also referred to in this Privacy Notice as "personal information") means any information that relates to you from which you can be directly or indirectly identified;

"process" means any activity relating to personal data, including collection, use, sharing, storage and transmission; and

"special categories of personal data" are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, the processing of genetic data, biometric data for the purpose of uniquely identifying you, data concerning health or data concerning your sex life or sexual orientation.

References to “you" or “your” in this Privacy Notice are references to individuals whose personal data is processed by us, including anyone who uses our website, apps or other digital services, visits our Centres, signs up for our services or uses the WiFi provided by us.

The information we collect
We collect, receive, store and process the following information about you:

information that you provide via the website or our apps, including information you provide when you register with or use the website or apps (e.g. name, address, telephone numbers, email address, preferred centre, interests and date of birth), join our Privilege Club (our exclusive club where you can sign up to keep up-to-date with our latest news, events and offers) or the replacement for Privilege Club, known as McArthurGlen Club, purchase or use a gift card, book parking, enter into competitions or complete surveys, participate in a contest or promotion, or join or post comments on our social media sites;
information that you provide to us for the purpose of subscribing to direct marketing;
information about your computer or mobile device and about your visits to, and use of, our website or our apps, such as Internet Protocol (IP) addresses, geolocation, date and time that you visited the website or apps, the type of Internet browser and computer operating system, referral source, length of visit, page views and website or app navigation paths;
information relating to any purchases you make via our website or apps (e.g. gift cards) or any other transactions that you enter into through our website or apps (including your name, address, telephone number, email address, card details and transaction history);
information processed for anti-money laundering and sanctions compliance purposes;
due diligence information including copies of identification documents;
(in limited circumstances) information obtained through public sources such as government lists of sanctioned entities / persons;
(in limited circumstances) information related to your health (e.g. if you become unwell or have an accident at one of our Centres);
(in limited circumstances) information related to criminal convictions or offences (e.g. if there is any theft or other criminal activity at one of our Centres);
information that you provide to us for the purpose of Click and Reserve via our website;
information contained in, or relating to, any communications that you send to us or send through our website or apps (including the communication content and metadata associated with the communication);
information we obtain from private social media companies (see also 'Social Media' below), including from outside the UK or EEA, about your interests and preferences;
information as set out in our Cookies Notice;
information collected through transactions or interactions offline or on our in-Centre computers or devices
information about which brands you have visited if you use one of our apps to scan a QR code in-store or you are logged into McArthurGlen Club when you do so;
information collected by our systems during your visits to our Centres, such as CCTV footage, photo, video and/or audio recordings, body-worn video camera footage and/or automatic number plate recognition (ANPR) data;
information about which emails from us you open;
information about your postal code when you register with us (e.g. for McArthurGlen Club) so that we know how far you travel to our Centres and your likelihood of visiting a particular Centre; and
information described in the WiFi Annex.

If it is mandatory for you to provide personal information, we will make this clear at the time and will also explain what will happen if you do not provide the information.

We may collect, use and share aggregated, anonymised data such as statistical data for the purpose of assessing and improving our business and services. Such data may be derived from your personal data but does not reveal your identity. For example, we may anonymise and aggregate your usage data to calculate the percentage of users accessing a specific website feature.

Use of your information
We use your personal information for the purposes set out in the table below. In this table any reference to “our legitimate interests” will be replaced with “reasonable and legitimate purposes as permitted by law” in respect of Canada only.

Please also see the section below "Legal bases for processing your information" for an explanation of the lawful bases relied upon to process your personal data, as well as the section entitled "Special categories of personal data" for information about the additional lawful bases for our use of such data.

Purpose	Lawful basis
To administer our website and apps, business and Centres	Our legitimate interests (in efficiently operating our website, apps, business, and Centres).
To enable your use of the products and services available on our website and apps or otherwise made available offline or on our in-Centre computers and devices	Our legitimate interests (in promoting our business)
To provide our gift card programmes	Performance of a contract
To administer our gift card programmes	Our legitimate interests (in promoting our business and the business of our tenants)
To provide our Privilege Club or the replacement for Privilege Club, known as McArthurGlen Club	Performance of a contract
To administer our Privilege Club or the replacement for Privilege Club, known as McArthurGlen Club, including to personalise and improve the service you receive through these programmes (e.g. birthday offers, promotions at your local Centre)	Our legitimate interests (in promoting our business and the business of our tenants)
To manage and run advertisement campaigns, competitions or offers by email, phone, SMS or post	Consent or our legitimate interests (in promoting our business)
To confirm orders and fulfil orders placed on our website or apps	Performance of a contract
To respond to your questions or requests for additional information and communicate with you about the website or apps and the Centres	Our legitimate interests in managing and promoting our business and providing services to our customers
To provide you with information that you have specifically requested or that we have asked if you would like to receive	Our legitimate interests in managing and promoting our business and providing services to our customers
To respond to your questions or provide you with information that you have specifically requested or that we have asked if you would like to receive or take steps at your request in relation to a contract with you or prior to entering into a contract	Performance of a contract
To take payments for use of our car parks	Performance of a contract
To operate and manage our car parks	Our legitimate interests in efficiently operating our car parks
For internal research and analysis so that we can see how our website, apps and the Centres’ products and services are being used, understand how we can improve our website or apps and the Centres’ products and services and decide our marketing strategies	Our legitimate interests in optimising our business and the services we provide
To deal with enquiries and complaints made by you or on your behalf relating to us, our services, website or apps and the Centres	Our legitimate interests in promoting and managing our business, solving problems and providing good customer service
To keep our website, apps and systems secure and prevent fraud	Our legitimate interests in reducing cybersecurity risks
To keep our website, apps and systems secure and prevent fraud as required by law	Compliance with a legal obligation
Where relevant, to meet legal, regulatory and compliance requirements	Compliance with a legal obligation
Where relevant, for the establishment, exercise or defence of legal claims	Our legitimate interests in managing our legal rights and obligations or compliance with a legal obligation
iIn order to carry out tasks or achieve objectives in relation to the management of our business in our legitimate commercial interests	Our legitimate interests in running our business
To monitor and analyse the use of any account to prevent, investigate and/or report security incidents or crime	Our legitimate interests in reducing cybersecurity risks
To monitor and analyse the use of any account to prevent, investigate and/or report security incidents or crime where required by law	Compliance with a legal obligation
To verify compliance with the terms and conditions governing the use of our website, apps and in-Centre computers and devices	Our legitimate interests in managing our business and our legal rights and obligations
To protect the rights, property, security or safety of us (including our employees and contractors), our customers, Centre Owners or others and to protect the security of our Centres and including the prevention and detection of crime	Our legitimate interests in reducing damage and risks to our employees and third parties within in our sphere of influence, public interest or compliance with a legal obligation
To deal with accidents or injuries to visitors to our Centres	Our legitimate interests in managing such incidents and reducing damage and risks
To understand your interests and preferences we may combine information we collect about you through transactions or interactions offline or on our in-Centre terminals or our email and SMS communications with the customer profile we hold about you so we can tailor the content, offers and promotions we surface on our website or apps to better match your interests and preferences and provide you with a better customer experience – see also our Cookies Notice. If we do not carry out such data processing, you will still see ads and other content, but they will not be tailored to your specific interests and preferences	Our legitimate interests in promoting our business and the business of our tenants and in managing our business
To understand and identify the features of our customer base for insight purposes (including from social media sources) and in order to better target our advertising, also referred to as "profiling" (e.g. reaching out to a similar demographic on social media)	Consent or our legitimate interests
to enforce or apply our terms and conditions or other agreements	Performance of a contract or our legitimate interests
to protect the rights, property, or safety of McArthurGlen, our customers or others	Our legitimate interests
To send customer satisfaction surveys to you	Consent or our legitimate interests
For the purposes described in the WiFi Annex.	Please see table in the WiFi Annex for relevant lawful bases

See the following provisions of GDPR/UK GDPR (as applicable) for reference to lawful bases:

Legitimate interests	Art 6(1)(f)
Contract	Art 6(1)(b)
Legal obligation	Art 6(1)(c)
Consent	Art 6(1)(a)

We will also inform you from time to time of other products and/or services we offer which we consider may be of interest to you by email, phone, SMS or post, where permitted by applicable law (which may require that we obtain your consent).

As well as unsubscribing within communications, you may email us at any time at dataprotection@mcarthurglen.com to indicate that you do not want to receive direct marketing communications from us. We will make commercially reasonable efforts to implement your unsubscribe / opt-out requests promptly, but you may still receive communications from us that were already underway before we process your request and update our systems.

Social Media

We also use personal information we obtain from social media sites online including Facebook, Instagram, X, YouTube and TripAdvisor for our (and our businesses’) research and analytics purpose. Where appropriate, and in line with their own policies, we may match information from these sites to better understand and improve our customers' experience. This includes posts or other information made public or made available to us where you use hashtags or tags relating to us, our business, the Centre Owners, the Centres and our industry. Information from these sites may include information which has been held outside the UK and European Union.

Legal bases for processing your information
We are required by data protection law to have a lawful basis or reason for processing your personal data, which we explain in this section.

We process your personal information with your consent when you agree that we may place certain types of cookies, when you agree to receiving certain direct marketing or on other occasions where we ask you for consent. Where we process personal information based on consent, you can withdraw your consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal).

We process your personal information when we are required to do so by law, including in response to requests by government or law enforcement authorities conducting an investigation or court orders.

We process your personal information when it is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. This applies in any case where we provide or deliver products and services to you pursuant to a contract, such as when you have signed up for Privilege Club or its replacement, known as McArthurGlen Club, or when you purchase a gift card, process your registration on the website or enter into a competition. If you do not provide the personal information that we need in order to provide or deliver the service, we will not be able to provide or deliver services to you.

We also process your personal information when it is necessary for the purposes of a legitimate interest pursued by us or a third party (when these interests are not overridden by your data protection rights). These legitimate interests include the administration and running of our business, marketing our products and services to our customers, servicing our existing customers, protecting our business and assets and improving our services to current and potential customers. Further details of our legitimate interests are included in the table above.

Special categories of personal data and criminal data
We are required to have an additional lawful basis when we process special categories of personal data and comply with requirements as set out in data protection law when we process criminal conviction or offence data. We do not collect special categories of personal data or criminal conviction or offence data about you, other than in limited circumstances described below:

On occasion, we may collect data relating to injuries or illnesses occurring in our Centres or other premises. We may also process health data where it is necessary for reasons of substantial public interest (Art 9(2)(g) GDPR/UK GDPR) and to establish, exercise or defend legal claims (Art 9(2)(f) UK GDPR/GDPR). We may also request your explicit consent to process such data (Art 9(2)(a) GDPR/UK GDPR). Very rarely, we may process such data where it is necessary to protect your life (Art 9(2)(c) GDPR/UK GDPR).

It is also possible that we will on occasion process special categories of personal data about you, where you expressly provide it or when this is inferred from data you provide to us, e.g. where you include it in the personalised message you write when purchasing a gift card. Please avoid providing us with any special categories of personal information, such as that related to health, race, ethnicity or religion, other than when it is strictly required or requested by us in accordance with this Privacy Notice.

We will process criminal conviction or offence data in limited circumstances, such as for the prevention or detection of unlawful acts or for the purposes of legal claims (Art 10 GDPR/UK GDPR in conjunction with the conditions set out in local law). The processing of criminal data will be carried out in compliance with the applicable UK, European and/or local legislation on public security and terrorism prevention.

Information sharing
We disclose or transfer personal information to other parties as follows:

to our Group Companies (including subsidiary management companies), Centre Owners, investors and joint venture partners;
to third party service providers that perform functions on our behalf in relation to the Site and apps or our Centres and for the purposes set out in this Policy (for example, website hosting, social media analysis providers (e.g. Google), marketing email service providers, data analysts and website developers);
our lawyers, accountants and other professional advisers;
our insurers, claims and loss adjusters and auditors;
other insurance companies to support their legitimate interests, or those of their clients;
to brand partners (stores) in order to fulfil Click and Reserve orders;
media agencies and their advertising partners in order to run targeted marketing campaigns as described above;
to regulators, law enforcement agencies and government authorities, and to other third parties when compelled to do so by government and law enforcement authorities or otherwise as required by law, including but not limited to in response to court orders and subpoenas;
We also disclose user information when we have reason to believe that someone is causing injury to or interference with our rights or property, other users of our website or apps, or other third parties and to detect, prevent and respond to such activity. We may therefore share CCTV, body-worn camera footage, photo, video and/or audio recordings and/or automatic number plate recognition (ANPR) data with law enforcement agencies, government or local authorities, tenants, our other Centres and local crime reduction partnerships and initiatives. Additionally, we cooperate with law enforcement inquiries and other third parties to enforce laws, intellectual property rights and other rights;
to sellers or buyers as part of a sale or merger of our business or assets;
to an applicable Centre Owner, a Group Company or to buyers as part of a sale or merger of a Centre Owner or Centre. In addition, if McArthurGlen UK Limited or one of our Group Companies ceases the role as a manager of a Centre, we will need to transfer your personal data to the Centre Owner or the replacement manager to ensure the continuity of our products and services; and
as described in the WiFi Annex.

In addition, subject to your consent where required by law, we share your personal information with carefully selected third parties so that they can send you information about special promotions and offers.

To enhance your shopping experience, our website and apps may include links to other websites. Those websites will have their own privacy policies that you may wish to review. We have no control over, or responsibility for, the data processing carried out by these linked websites.

We also share information about visitors to this website or apps in an anonymous or aggregate form with third parties including advertisers, business partners and sponsors, to understand customer trends and patterns and manage and improve our business relationships.

Transferring your information
We transfer personal information to countries outside the UK and EEA to our Group Companies and to third parties, including to countries which have different data protection standards to those which apply in the UK and EEA.

Where service providers process your personal information in countries deemed adequate by (as applicable) the European Commission or the UK, we rely on the European Commission's or the UK's adequacy decision to protect your personal information.

For transfers to Group Companies and service providers outside the EEA or UK where there is no adequacy decision in place, we use EU Standard Contractual Clauses, UK Standard Contractual Clauses (as applicable) or rely on (data protection authority approved) corporate rules that are in place to protect your personal information. You have a right to ask us for a copy of the Standard Contractual Clauses or a copy of the other safeguards used by contacting us as set out below.